jeirmeister/btc-pay-server
1
0
Fork 0
Code Issues Pull requests Projects Releases Packages Wiki Activity Actions

About to make change to fixing the postgres nbxplorer configuration, have to take a pause to this to get back to helm project.

Browse source
This commit is contained in:
jeirmeister 2025-07-22 00:50:22 -07:00
parent 11c5cd382e
commit f55936312f
6 changed files with 85 additions and 35 deletions
Download patch file Download diff file Expand all files Collapse all files

1
btc-ssh-key.pub Normal file
View file

@ -0,0 +1 @@
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAINOIWWGUGM+5GjypoSNe0nKMLnu+5/McFHQhY7HXtpbS btcpay-server key

61
flake.nix
View file

@ -1,20 +1,20 @@
{
description = "BTCPay Server NixOS module";
description = "BTCPayServer NixOS flake with dotfile-based pg_hba.conf and sops-nix secrets";
inputs = {
nixpkgs.url = "github:NixOS/nixpkgs/nixos-25.05";
nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
sops-nix.url = "github:Mic92/sops-nix";
};
outputs = { self, nixpkgs, nix-bitcoin, ... }: {
# Export a module for others to use
outputs = { self, nixpkgs, nix-bitcoin, sops-nix, ... }: {
nixosModules.btcpay-server = { config, lib, pkgs, ... }: {
imports = [ nix-bitcoin.nixosModules.default ];
imports = [ nix-bitcoin.nixosModules.default sops-nix.nixosModules.sops ];
options.services.btcpay-full = {
enable = lib.mkEnableOption "BTCPay Server with Bitcoin node";
};
# Disable debugfs mount in LXC containers
config = lib.mkIf config.services.btcpay-full.enable {
nix-bitcoin.generateSecrets = true;
nix-bitcoin.operator = {
@ -22,6 +22,25 @@
name = "btcpay";
};
# sops secret for Postgres password
sops.secrets.nbxplorer-pg-password = {
sopsFile = ./secrets.yaml;
owner = "postgres";
};
# Use tracked dotfile for Postgres auth rules
services.postgresql = {
enable = true;
package = pkgs.postgresql_14;
initialDatabases = [{ name = "nbxplorer"; }];
ensureUsers = [{
name = "nbxplorer";
passwordFile = config.sops.secrets.nbxplorer-pg-password.path;
ensureDBOwnership = true;
}];
authentication = builtins.readFile ./pg_hba.conf;
};
services.bitcoind = {
enable = true;
prune = 100000;
@ -29,44 +48,52 @@
rpc.port = 8332;
};
# Enable BTCPay Server with network binding
services.btcpayserver = {
enable = true;
# Configure BTCPay Server to listen on all interfaces
address = "0.0.0.0";
port = 23000;
environment = {
NBXPLORER_CHAINS__BTC__POSTGRES = "User ID=nbxplorer;Host=localhost;Port=5432;Database=nbxplorer;Password=${
builtins.readFile config.sops.secrets.nbxplorer-pg-password.path
}";
};
};
networking.firewall.allowedTCPPorts = [
config.services.btcpayserver.port
config.services.bitcoind.port
5432
];
# (SSH added below)
};
};
# System configuration for deployment - REMOVED duplicate nix-bitcoin import
nixosConfigurations.btcpay = nixpkgs.lib.nixosSystem {
system = "x86_64-linux";
modules = [
({ ... }: {
# Minimal system configuration for containers
({ config, ... }: {
boot.isContainer = true;
system.stateVersion = "25.05";
# Enable our BTCPay service
services.btcpay-full.enable = true;
# Basic SSH access
# SSH best practices: use a public key from secrets, fallback to password auth only if needed
sops.secrets.btcpay-ssh-pubkey = {
sopsFile = ./secrets.yaml;
owner = "root";
};
users.users.root.openssh.authorizedKeys.keys = [
(builtins.readFile config.sops.secrets.btcpay-ssh-pubkey.path)
];
services.openssh = {
enable = true;
settings = {
PermitRootLogin = "yes";
PasswordAuthentication = true;
PermitRootLogin = "prohibit-password"; # disables password logins
PasswordAuthentication = false;
};
};
})
# This module already imports nix-bitcoin.nixosModules.default
self.nixosModules.btcpay-server
];
};

26
justfile
View file

@ -1,20 +1,22 @@
# Variables
REMOTE_HOST := "root@10.1.1.163"
# Default command
default:
@echo "BTCPay Server deployment commands:"
@echo " just build - Build configuration"
@echo " just deploy - Deploy to remote server"
# Build the configuration
build:
NIX_CONFIG="experimental-features = nix-command flakes" nix build .#nixosConfigurations.btcpay.config.system.build.toplevel
nix build .#nixosConfigurations.btcpay.config.system.build.toplevel
# Deploy to remote server
deploy:
NIX_CONFIG="experimental-features = nix-command flakes" nixos-rebuild switch --flake .#btcpay --target-host {{REMOTE_HOST}} --option experimental-features "nix-command flakes"
nixos-rebuild switch --flake .#btcpay --target-host {{REMOTE_HOST}} --option experimental-features "nix-command flakes"
# Check services status
status:
ssh {{REMOTE_HOST}} "systemctl status bitcoind btcpayserver"
encrypt-secrets:
sops -e -i secrets.yaml
edit-secrets:
sops secrets.yaml
shell:
nix develop
psql:
psql -h localhost -U nbxplorer -d nbxplorer

4
pg_hba.conf Normal file
View file

@ -0,0 +1,4 @@
# TYPE DATABASE USER ADDRESS METHOD
local all all md5
host all all 127.0.0.1/32 md5
host all all ::1/128 md5

2
secrets.yaml Normal file
View file

@ -0,0 +1,2 @@
nbxplorer-pg-password: >-
f%Rn^g!o*d0U3UjXNN&1dG&H

16
shell.nix
View file

@ -2,6 +2,20 @@
pkgs.mkShell {
buildInputs = with pkgs; [
just
just # task runner
sops # secrets management
postgresql # includes psql client utility[6][9]
bitcoin # Bitcoin Core CLI tools (bitcoind, bitcoin-cli)
curl # For HTTP API testing
jq # For manipulating test output
# dotnet-sdk # IF you develop/plugins for NBXplorer, uncomment this
];
shellHook = ''
export SSH_CONFIG_FILE="$PWD/ssh-config-dev"
alias ssh="ssh -F $SSH_CONFIG_FILE"
alias scp="scp -F $SSH_CONFIG_FILE"
echo "Repo-local SSH config active: using $SSH_CONFIG_FILE for ssh/scp."
'';
}