142 lines
4.1 KiB
Nix
142 lines
4.1 KiB
Nix
{
|
|
description = "BTCPay server, NBXplorer, Bitcoin Core, etc. as a NixOS system/container image";
|
|
|
|
inputs = {
|
|
nix-bitcoin.url = "github:fort-nix/nix-bitcoin/release";
|
|
nixpkgs.follows = "nix-bitcoin/nixpkgs";
|
|
nixos-generators.url = "github:nix-community/nixos-generators";
|
|
flake-utils.url = "github:numtide/flake-utils";
|
|
};
|
|
|
|
outputs = {
|
|
self,
|
|
nixpkgs,
|
|
nix-bitcoin,
|
|
nixos-generators,
|
|
flake-utils,
|
|
...
|
|
}: let
|
|
system = "x86_64-linux";
|
|
pkgs = import nixpkgs {inherit system;};
|
|
in {
|
|
nixosConfigurations.btc-pay-server = nixpkgs.lib.nixosSystem {
|
|
inherit system;
|
|
modules = [
|
|
nix-bitcoin.nixosModules.default
|
|
({
|
|
config,
|
|
pkgs,
|
|
lib,
|
|
...
|
|
}: {
|
|
nixpkgs.overlays = [nix-bitcoin.overlays.default];
|
|
|
|
nix-bitcoin.generateSecrets = true;
|
|
|
|
# Enable core services
|
|
services.bitcoind = {
|
|
enable = true;
|
|
dataDir = "/var/lib/bitcoind";
|
|
address = "0.0.0.0";
|
|
port = 23002;
|
|
listen = true;
|
|
listenWhitelisted = true;
|
|
whitelistedPort = 8335;
|
|
rpc = {
|
|
address = "0.0.0.0";
|
|
port = 8332;
|
|
threads = 16;
|
|
allowip = ["10.1.1.0/24"];
|
|
};
|
|
regtest = false;
|
|
dataDirReadableByGroup = false;
|
|
disablewallet = null;
|
|
dbCache = 4000;
|
|
prune = 10000;
|
|
zmqpubrawblock = "tcp://0.0.0.0:28332";
|
|
zmqpubrawtx = "tcp://0.0.0.0:28333";
|
|
user = "bitcoind";
|
|
group = "bitcoind";
|
|
};
|
|
|
|
services.nbxplorer = {
|
|
enable = true;
|
|
address = "0.0.0.0";
|
|
port = 24444;
|
|
user = "nbxplorer";
|
|
group = "nbxplorer";
|
|
};
|
|
|
|
services.btcpayserver = {
|
|
enable = true;
|
|
address = "0.0.0.0";
|
|
port = 23000;
|
|
lbtc = true;
|
|
user = "btcpayserver";
|
|
group = "btcpayserver";
|
|
lightningBackend = "clightning";
|
|
};
|
|
|
|
# Relax seccomp and namespaces for BTCPayServer to avoid SIGSYS in LXC
|
|
systemd.services.btcpayserver.serviceConfig = {
|
|
SystemCallFilter = [];
|
|
PrivateMounts = false;
|
|
ProtectSystem = false;
|
|
};
|
|
|
|
# Container mode (required for your Proxmox LXC)
|
|
boot.isContainer = true;
|
|
|
|
# Firewall: Open necessary ports
|
|
networking.firewall.allowedTCPPorts = [
|
|
config.services.btcpayserver.port
|
|
config.services.bitcoind.port
|
|
config.services.nbxplorer.port
|
|
22
|
|
];
|
|
|
|
# SSH setup
|
|
services.openssh = {
|
|
enable = true;
|
|
settings = {
|
|
PermitRootLogin = "prohibit-password";
|
|
PasswordAuthentication = false;
|
|
};
|
|
};
|
|
users.users.root.openssh.authorizedKeys.keys = [
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPs/pdZLlCbv0vgtFA4hHGuWz1EeSn2kKhBJthlZ5lww devnix"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIDw6ilma4321EdQvguZKA7ijn9xF9QlfMfkES4bGCLTp jeirmeister@devnix-t470"
|
|
"ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIAaV7JtUWkWrjo5FfCcpTCCEY/OJ+T1mJOLbe4avg0XH sysadmin@skrybit.io"
|
|
];
|
|
|
|
# Suppress unnecessary units
|
|
systemd.suppressedSystemUnits = [
|
|
"dev-mqueue.mount"
|
|
"sys-kernel-debug.mount"
|
|
"sys-fs-fuse-connections.mount"
|
|
];
|
|
|
|
# State version
|
|
system.stateVersion = "25.05";
|
|
})
|
|
];
|
|
};
|
|
|
|
# Your devShell remains the same
|
|
devShells = flake-utils.lib.eachDefaultSystem (
|
|
system: let
|
|
pkgs = import nixpkgs {inherit system;};
|
|
in {
|
|
default = pkgs.mkShell {
|
|
buildInputs = [
|
|
nixos-generators.packages.${system}.nixos-generate
|
|
pkgs.just
|
|
];
|
|
shellHook = ''
|
|
echo "💚 Devshell ready: nixos-generate, just available."
|
|
'';
|
|
};
|
|
}
|
|
);
|
|
};
|
|
}
|