nixpkgs/nixos/modules/services/networking/namecoind.nix
lf- b37bbca521 nixos/modules: fix systemd start rate-limits
These were broken since 2016:
f0367da7d1
since StartLimitIntervalSec got moved into [Unit] from [Service].
StartLimitBurst has also been moved accordingly, so let's fix that one
too.

NixOS systems have been producing logs such as:
/nix/store/wf98r55aszi1bkmln1lvdbp7znsfr70i-unit-caddy.service/caddy.service:31:
Unknown key name 'StartLimitIntervalSec' in section 'Service', ignoring.

I have also removed some unnecessary duplication in units disabling
rate limiting since setting either interval or burst to zero disables it
(ad16158c10/src/basic/ratelimit.c (L16))
2020-10-31 01:35:56 -07:00

200 lines
5.0 KiB
Nix

{ config, lib, pkgs, ... }:
with lib;
let
cfg = config.services.namecoind;
dataDir = "/var/lib/namecoind";
useSSL = (cfg.rpc.certificate != null) && (cfg.rpc.key != null);
useRPC = (cfg.rpc.user != null) && (cfg.rpc.password != null);
listToConf = option: list:
concatMapStrings (value :"${option}=${value}\n") list;
configFile = pkgs.writeText "namecoin.conf" (''
server=1
daemon=0
txindex=1
txprevcache=1
walletpath=${cfg.wallet}
gen=${if cfg.generate then "1" else "0"}
${listToConf "addnode" cfg.extraNodes}
${listToConf "connect" cfg.trustedNodes}
'' + optionalString useRPC ''
rpcbind=${cfg.rpc.address}
rpcport=${toString cfg.rpc.port}
rpcuser=${cfg.rpc.user}
rpcpassword=${cfg.rpc.password}
${listToConf "rpcallowip" cfg.rpc.allowFrom}
'' + optionalString useSSL ''
rpcssl=1
rpcsslcertificatechainfile=${cfg.rpc.certificate}
rpcsslprivatekeyfile=${cfg.rpc.key}
rpcsslciphers=TLSv1.2+HIGH:TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH
'');
in
{
###### interface
options = {
services.namecoind = {
enable = mkEnableOption "namecoind, Namecoin client";
wallet = mkOption {
type = types.path;
default = "${dataDir}/wallet.dat";
description = ''
Wallet file. The ownership of the file has to be
namecoin:namecoin, and the permissions must be 0640.
'';
};
generate = mkOption {
type = types.bool;
default = false;
description = ''
Whether to generate (mine) Namecoins.
'';
};
extraNodes = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
List of additional peer IP addresses to connect to.
'';
};
trustedNodes = mkOption {
type = types.listOf types.str;
default = [ ];
description = ''
List of the only peer IP addresses to connect to. If specified
no other connection will be made.
'';
};
rpc.user = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
User name for RPC connections.
'';
};
rpc.password = mkOption {
type = types.nullOr types.str;
default = null;
description = ''
Password for RPC connections.
'';
};
rpc.address = mkOption {
type = types.str;
default = "0.0.0.0";
description = ''
IP address the RPC server will bind to.
'';
};
rpc.port = mkOption {
type = types.int;
default = 8332;
description = ''
Port the RPC server will bind to.
'';
};
rpc.certificate = mkOption {
type = types.nullOr types.path;
default = null;
example = "/var/lib/namecoind/server.cert";
description = ''
Certificate file for securing RPC connections.
'';
};
rpc.key = mkOption {
type = types.nullOr types.path;
default = null;
example = "/var/lib/namecoind/server.pem";
description = ''
Key file for securing RPC connections.
'';
};
rpc.allowFrom = mkOption {
type = types.listOf types.str;
default = [ "127.0.0.1" ];
description = ''
List of IP address ranges allowed to use the RPC API.
Wiledcards (*) can be user to specify a range.
'';
};
};
};
###### implementation
config = mkIf cfg.enable {
users.users.namecoin = {
uid = config.ids.uids.namecoin;
description = "Namecoin daemon user";
home = dataDir;
createHome = true;
};
users.groups.namecoin = {
gid = config.ids.gids.namecoin;
};
systemd.services.namecoind = {
description = "Namecoind daemon";
after = [ "network.target" ];
wantedBy = [ "multi-user.target" ];
startLimitIntervalSec = 120;
startLimitBurst = 5;
serviceConfig = {
User = "namecoin";
Group = "namecoin";
ExecStart = "${pkgs.namecoind}/bin/namecoind -conf=${configFile} -datadir=${dataDir} -printtoconsole";
ExecStop = "${pkgs.coreutils}/bin/kill -KILL $MAINPID";
ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
Nice = "10";
PrivateTmp = true;
TimeoutStopSec = "60s";
TimeoutStartSec = "2s";
Restart = "always";
};
preStart = optionalString (cfg.wallet != "${dataDir}/wallet.dat") ''
# check wallet file permissions
if [ "$(stat --printf '%u' ${cfg.wallet})" != "${toString config.ids.uids.namecoin}" \
-o "$(stat --printf '%g' ${cfg.wallet})" != "${toString config.ids.gids.namecoin}" \
-o "$(stat --printf '%a' ${cfg.wallet})" != "640" ]; then
echo "ERROR: bad ownership or rights on ${cfg.wallet}" >&2
exit 1
fi
'';
};
};
meta.maintainers = with lib.maintainers; [ rnhmjoj ];
}