os/srv/monero.nix


1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78

{
  config,
  lib,
  pkgs,
  masterDomain,
  securityTemplates,
  ...
}:
let
  cfg = config.os.srv.monero;
in
{
  options.os.srv.monero = {
    wallet.enable = lib.mkEnableOption "enables the monero wallet";
    service.enable = lib.mkEnableOption "enables hosting a monero node";
  };

  config = lib.mkMerge [
    (lib.mkIf cfg.wallet.enable {
      environment.systemPackages = [ pkgs.monero-cli ];
    })
    (lib.mkIf cfg.service.enable {
      assertions = [
        {
          assertion = config.os.srv.nginx.enable;
          message = "Hosting a Monero node requires nginx for proxying";
        }
        {
          assertion = config.os.srv.sops.enable;
          message = "Required for password secure password storing";
        }
      ];

      sops.secrets."monero/rpc-password" = {
        owner = "monero";
        restartUnits = [ "monero.service" ];
      };

      services.monero = {
        enable = true;
        prune = true;
        limits = {
          upload = 1250;
          download = 12500;
          threads = 8;
        };
        banlist = builtins.fetchurl {
          url = "https://gui.xmr.pm/files/block.txt";
          hash = "0ik4d66js6wvrvciza0li6bsajj8dvxsqlf09hcz7hg610szdxcw";
        };
        rpc = {
          restricted = true;
          user = "admin";
          password = config.sops.secrets."monero/rpc-password".path;
        };
      };

      services.nginx.virtualHosts."xmr.${masterDomain}" = {
        enableACME = true;
        forceSSL = true;

        locations."/" = {
          proxyPass = "http://127.0.0.1:18081";
          extraConfig = ''
            proxy_read_timeout 600s;
            proxy_send_timeout 600s;
            client_max_body_size 50m;

            ${securityTemplates.restrictToInternal}
          '';
        };
      };

      # Left open for P2P syncing
      networking.firewall.allowedTCPPorts = [ 18080 ];
    })
  ];
}