lnd-rest-onion-service.nix: move to lndconnect-onion.nix, add clightning support

Option `services.lnd.restOnionService.package` has been removed.
There's not much use in overriding the [lndconnect pkg](https://github.com/LN-Zap/lndconnect).

modules/lnd-rest-onion-service.nix

@@ -1,54 +0,0 @@
-{ config, lib, pkgs, ... }:
-
-with lib;
-let
-  options.services.lnd.restOnionService = {
-    enable = mkOption {
-      default = false;
-      type = types.bool;
-      description = ''
-        Create an onion service for the lnd REST service.
-        Add a `lndconnect-rest-onion` binary (https://github.com/LN-Zap/lndconnect) to the system environment.
-        This binary generates QR codes or URIs for connecting applications to lnd via the REST onion service.
-      '';
-    };
-    package = mkOption {
-      type = types.package;
-      default = config.nix-bitcoin.pkgs.lndconnect;
-      defaultText = "config.nix-bitcoin.pkgs.lndconnect";
-      description = "The package providing lndconnect binaries.";
-    };
-  };
-
-  cfg = config.services.lnd.restOnionService;
-  nbLib = config.nix-bitcoin.lib;
-  runAsUser = config.nix-bitcoin.runAsUserCmd;
-
-  lnd = config.services.lnd;
-
-  bin = pkgs.writeScriptBin "lndconnect-rest-onion" ''
-    #!/usr/bin/env -S ${runAsUser} ${lnd.user} ${pkgs.bash}/bin/bash
-
-    exec ${cfg.package}/bin/lndconnect \
-     --host=$(cat ${config.nix-bitcoin.onionAddresses.dataDir}/lnd/lnd-rest) \
-     --port=${toString lnd.restPort} \
-     --lnddir=${lnd.dataDir} \
-     --tlscertpath=${lnd.certPath} "$@"
-  '';
-in {
-  inherit options;
-
-  config = mkIf cfg.enable {
-    services.tor = {
-      enable = true;
-      relay.onionServices.lnd-rest = nbLib.mkOnionService {
-        target.addr = nbLib.address lnd.restAddress;
-        target.port = lnd.restPort;
-        port = lnd.restPort;
-      };
-    };
-    nix-bitcoin.onionAddresses.access.lnd = [ "lnd-rest" ];
-
-    environment.systemPackages = [ bin ];
-  };
-}

modules/lndconnect-onion.nix

@@ -0,0 +1,124 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  options = {
+    services.lnd.lndconnectOnion.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Create an onion service for the lnd REST server.
+        Add a `lndconnect-onion` binary to the system environment.
+        See: https://github.com/LN-Zap/lndconnect
+
+        Usage:
+        ```
+          # Print QR code
+          lndconnect-onion
+
+          # Print URL
+          lndconnect-onion --url
+        ```
+      '';
+    };
+
+    services.clightning-rest.lndconnectOnion.enable = mkOption {
+      type = types.bool;
+      default = false;
+      description = ''
+        Create an onion service for clightning-rest.
+        Add a `lndconnect-onion-clightning` binary to the system environment.
+        See: https://github.com/LN-Zap/lndconnect
+
+        Usage:
+        ```
+          # Print QR code
+          lndconnect-onion-clightning
+
+          # Print URL
+          lndconnect-onion-clightning --url
+        ```
+      '';
+    };
+  };
+
+  nbLib = config.nix-bitcoin.lib;
+  runAsUser = config.nix-bitcoin.runAsUserCmd;
+
+  inherit (config.services)
+    lnd
+    clightning
+    clightning-rest;
+
+  mkLndconnect = {
+    name,
+    shebang ? "#!${pkgs.stdenv.shell} -e",
+    onionService,
+    port,
+    certPath,
+    macaroonPath
+  }:
+  # TODO-EXTERNAL:
+  # lndconnect requires a --configfile argument, although it's unused
+  # https://github.com/LN-Zap/lndconnect/issues/25
+  pkgs.writeScriptBin name ''
+    ${shebang}
+    exec ${config.nix-bitcoin.pkgs.lndconnect}/bin/lndconnect \
+     --host=$(cat ${config.nix-bitcoin.onionAddresses.dataDir}/${onionService}) \
+     --port=${toString port} \
+     --tlscertpath='${certPath}' \
+     --adminmacaroonpath='${macaroonPath}' \
+     --configfile=/dev/null "$@"
+  '';
+in {
+  inherit options;
+
+  config = mkMerge [
+    (mkIf (lnd.enable && lnd.lndconnectOnion.enable) {
+      services.tor = {
+        enable = true;
+        relay.onionServices.lnd-rest = nbLib.mkOnionService {
+          target.addr = nbLib.address lnd.restAddress;
+          target.port = lnd.restPort;
+          port = lnd.restPort;
+        };
+      };
+      nix-bitcoin.onionAddresses.access.${lnd.user} = [ "lnd-rest" ];
+
+      environment.systemPackages = [(
+        mkLndconnect {
+          name = "lndconnect-onion";
+          # Run as lnd user because the macaroon and cert are not group-readable
+          shebang = "#!/usr/bin/env -S ${runAsUser} ${lnd.user} ${pkgs.bash}/bin/bash";
+          onionService = "${lnd.user}/lnd-rest";
+          port = lnd.restPort;
+          certPath = lnd.certPath;
+          macaroonPath = "${lnd.networkDir}/admin.macaroon";
+        }
+      )];
+    })
+
+    (mkIf (clightning-rest.enable && clightning-rest.lndconnectOnion.enable) {
+      services.tor = {
+        enable = true;
+        relay.onionServices.clightning-rest = nbLib.mkOnionService {
+          target.addr = nbLib.address clightning-rest.address;
+          target.port = clightning-rest.port;
+          port = clightning-rest.port;
+        };
+      };
+      # This also allows nodeinfo to show the clightning-rest onion address
+      nix-bitcoin.onionAddresses.access.operator = [ "clightning-rest" ];
+
+      environment.systemPackages = [(
+        mkLndconnect {
+          name = "lndconnect-onion-clightning";
+          onionService = "operator/clightning-rest";
+          port = clightning-rest.port;
+          certPath = "${clightning-rest.dataDir}/certs/certificate.pem";
+          macaroonPath = "${clightning-rest.dataDir}/certs/access.macaroon";
+        }
+      )];
+    })
+  ];
+}

modules/modules.nix

@@ -15,10 +15,10 @@
     ./clightning-rest.nix
     ./spark-wallet.nix
     ./lnd.nix
-    ./lnd-rest-onion-service.nix # Requires onion-addresses.nix
     ./lightning-loop.nix
     ./lightning-pool.nix
     ./charge-lnd.nix
+    ./lndconnect-onion.nix # Requires onion-addresses.nix
     ./rtl.nix
     ./electrs.nix
     ./liquid.nix

modules/obsolete-options.nix

@@ -33,6 +33,7 @@ in {
     (mkRenamedOptionModule [ "services" "liquidd" "rpcbind" ] [ "services" "liquidd" "rpc" "address" ])
     # 0.0.70
     (mkRenamedOptionModule [ "services" "rtl" "cl-rest" ] [ "services" "clightning-rest" ])
+    (mkRenamedOptionModule [ "services" "lnd" "restOnionService" "enable" ] [ "services" "lnd" "lndconnectOnion" "enable" ])
 
     (mkRenamedOptionModule [ "nix-bitcoin" "setup-secrets" ] [ "nix-bitcoin" "setupSecrets" ])
 

modules/versioning.nix

@@ -224,6 +224,13 @@ let
         The data dir migration happens automatically after deploying.
       '';
     }
+    {
+      version = "0.0.70";
+      condition = config.services.lnd.lndconnectOnion.enable;
+      message = ''
+        The `lndconnect-rest-onion` binary has been renamed to `lndconnect-onion`.
+      '';
+    }
   ];
 
   mkOnionServiceChange = service: {