lndconnect: add clnrest

modules/lndconnect.nix

@@ -32,6 +32,34 @@ let
       };
     };
 
+    services.clightning.plugins.clnrest.lnconnect = {
+      enable = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Add a `lnconnect-clnrest` binary to the system environment which prints
+          connection info for clightning clients.
+          See: https://github.com/LN-Zap/lndconnect
+
+          Usage:
+          ```bash
+            # Print QR code
+            lnconnect-clnrest
+
+            # Print URL
+            lnconnect-clnrest --url
+          ```
+        '';
+      };
+      onion = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Create an onion service for the clnrest server,
+          which is used by lnconnect.
+        '';
+      };
+    };
 
     services.clightning-rest.lndconnect = {
       enable = mkOption {
@@ -77,14 +105,18 @@ let
 
   inherit (config.services)
     lnd
+    clightning
     clightning-rest;
 
+  inherit (clightning.plugins) clnrest;
+
   mkLndconnect = {
     name,
     shebang ? "#!${pkgs.stdenv.shell} -e",
     isClightning ? false,
+    isClnrest ? false,
     port,
-    macaroonPath,
+    authSecretPath,
     enableOnion,
     onionService ? null,
     certPath ? null
@@ -99,7 +131,7 @@ let
         ${optionalString enableOnion "--host=$(cat ${config.nix-bitcoin.onionAddresses.dataDir}/${onionService})"} \
         --port=${toString port} \
         ${if enableOnion || certPath == null then "--nocert" else "--tlscertpath='${certPath}'"} \
-        --adminmacaroonpath='${macaroonPath}' \
+        --adminmacaroonpath='${authSecretPath}' \
         --configfile=/dev/null "$@"
     )
 
@@ -109,7 +141,7 @@ let
       #   Because `macaroon` is always the last URL fragment, the
       #   sed replacement below works correctly.
       ''
-        macaroonHex=$(${getExe pkgs.xxd} -p -u -c 99999 '${macaroonPath}')
+        macaroonHex=$(${getExe pkgs.xxd} -p -u -c 99999 '${authSecretPath}')
         url=$(
           echo "$url" | ${getExe pkgs.gnused} "
             s|^lndconnect|c-lightning-rest|
@@ -119,6 +151,18 @@ let
       ''
     }
 
+    ${optionalString isClnrest
+      # Change URL procotcol to clnrest
+      ''
+        url=$(
+          echo "$url" | ${getExe pkgs.gnused} "
+            s|^lndconnect|clnrest|
+            s|macaroon=.*|rune=$(cat '${authSecretPath}')|
+          ";
+        )
+      ''
+     }
+
     # If --url is in args
     if [[ " $* " =~ " --url " ]]; then
       echo "$url"
@@ -146,7 +190,7 @@ in {
               onionService = "${lnd.user}/lnd-rest";
               port = lnd.restPort;
               certPath = lnd.certPath;
-              macaroonPath = "${lnd.networkDir}/admin.macaroon";
+              authSecretPath = "${lnd.networkDir}/admin.macaroon";
             }
           )];
 
@@ -169,6 +213,39 @@ in {
         })
       ]))
 
+    (mkIf (clnrest.enable && clnrest.lnconnect.enable)
+      (mkMerge [
+        {
+          environment.systemPackages = [(
+            mkLndconnect {
+              name = "lnconnect-clnrest";
+              isClnrest = true;
+              enableOnion = clnrest.lnconnect.onion;
+              onionService = "${operatorName}/clnrest";
+              port = clnrest.port;
+              certPath = "${clightning.networkDir}/client.pem";
+              authSecretPath = "${clightning.networkDir}/admin-rune";
+            }
+          )];
+
+          services.clightning.plugins.clnrest.address = mkIf (!clnrest.lnconnect.onion) "0.0.0.0";
+        }
+
+        (mkIf clnrest.lnconnect.onion {
+          services.tor = {
+            enable = true;
+            relay.onionServices.clnrest = nbLib.mkOnionService {
+              target.addr = nbLib.address clnrest.address;
+              target.port = clnrest.port;
+              port = clnrest.port;
+            };
+          };
+          # This also allows nodeinfo to show the clnrest onion address
+          nix-bitcoin.onionAddresses.access.${operatorName} = [ "clnrest" ];
+        })
+      ])
+    )
+
     (mkIf (clightning-rest.enable && clightning-rest.lndconnect.enable)
       (mkMerge [
         {
@@ -180,7 +257,7 @@ in {
               onionService = "${operatorName}/clightning-rest";
               port = clightning-rest.port;
               certPath = "${clightning-rest.dataDir}/certs/certificate.pem";
-              macaroonPath = "${clightning-rest.dataDir}/certs/access.macaroon";
+              authSecretPath = "${clightning-rest.dataDir}/certs/access.macaroon";
             }
           )];
 

modules/presets/wireguard.nix

@@ -2,7 +2,8 @@
 
 # Create a WireGuard server with a single peer.
 # Private/public keys are created via the secrets system.
-# Add helper binaries `nix-bitcoin-wg-connect` and optionally `lndconnect-wg`, `lndconnect-clightning-wg`.
+# Add helper binaries `nix-bitcoin-wg-connect` and optionally `lndconnect-wg`,
+# `lnconnect-clnrest-wg`, `lndconnect-clightning-wg`.
 
 # See ../../docs/services.md ("Use Zeus (mobile lightning wallet) via WireGuard")
 # for usage instructions.
@@ -33,9 +34,12 @@ let
   inherit (config.networking.wireguard.interfaces) wg-nb;
   inherit (config.services)
     lnd
+    clightning
     clightning-rest;
+  inherit (clightning.plugins) clnrest;
 
   lndconnect = lnd.enable && lnd.lndconnect.enable;
+  lnconnect-clnrest = clnrest.enable && clnrest.lnconnect.enable;
   lndconnect-clightning = clightning-rest.enable && clightning-rest.lndconnect.enable;
 
   serverAddress = "${wgSubnet}.1";
@@ -150,6 +154,10 @@ in {
       (pkgs.writers.writeBashBin "lndconnect-wg" ''
         exec lndconnect --host "${serverAddress}" --nocert "$@"
       '')
+    ) ++ (optional lnconnect-clnrest
+      (pkgs.writers.writeBashBin "lnconnect-clnrest-wg" ''
+        exec lnconnect-clnrest --host "${serverAddress}" --nocert "$@"
+      '')
     ) ++ (optional lndconnect-clightning
       (pkgs.writers.writeBashBin "lndconnect-clightning-wg" ''
         exec lndconnect-clightning --host "${serverAddress}" --nocert "$@"
@@ -165,6 +173,9 @@ in {
         optionalString lndconnect ''
           iptables -w -A nixos-fw -p tcp -s ${wgSubnet}.0/24 --dport ${toString lnd.restPort} -j nixos-fw-accept
         ''
+        + optionalString lnconnect-clnrest ''
+          iptables -w -A nixos-fw -p tcp -s ${wgSubnet}.0/24 --dport ${toString clnrest.port} -j nixos-fw-accept
+        ''
         + optionalString lndconnect-clightning ''
           iptables -w -A nixos-fw -p tcp -s ${wgSubnet}.0/24 --dport ${toString clightning-rest.port} -j nixos-fw-accept
         ''
@@ -187,6 +198,11 @@ in {
       restAddress = "0.0.0.0";
       tor.enforce = false;
     };
+
+    services.clightning.plugins.clnrest.address = mkIf lnconnect-clnrest "0.0.0.0";
+    # clnrest runs inside `clightning.service`
+    services.clightning.tor.enforce = mkIf lnconnect-clnrest false;
+
     services.clightning-rest = mkIf lndconnect-clightning {
       # clightning-rest always listens on "0.0.0.0"
       tor.enforce = false;