315 lines
9.2 KiB
Nix
315 lines
9.2 KiB
Nix
# configuration building is commented out until better tested.
|
|
|
|
{ config, pkgs, ... }:
|
|
|
|
with pkgs.lib;
|
|
|
|
let
|
|
cfg = config.services.rippled;
|
|
|
|
rippledStateCfgFile = "/var/lib/rippled/rippled.cfg";
|
|
|
|
rippledCfg = ''
|
|
[node_db]
|
|
type=HyperLevelDB
|
|
path=/var/lib/rippled/db/hyperldb
|
|
|
|
[debug_logfile]
|
|
/var/log/rippled/debug.log
|
|
|
|
''
|
|
+ optionalString (cfg.peerIp != null) ''
|
|
[peer_ip]
|
|
${cfg.peerIp}
|
|
|
|
[peer_port]
|
|
${toString cfg.peerPort}
|
|
|
|
''
|
|
+ cfg.extraConfig;
|
|
|
|
rippledCfgFile = pkgs.writeText "rippled.cfg" rippledCfg;
|
|
|
|
in
|
|
|
|
{
|
|
|
|
###### interface
|
|
|
|
options = {
|
|
|
|
services.rippled = {
|
|
|
|
enable = mkOption {
|
|
default = false;
|
|
description = "Whether to enable rippled";
|
|
};
|
|
|
|
#
|
|
# Rippled has a simple configuration file layout that is easy to
|
|
# build with nix. Many of the options are defined here but are
|
|
# commented out until the code to append them to the config above
|
|
# is written and they are tested.
|
|
#
|
|
# If you find a yourself implementing more options, please submit a
|
|
# pull request.
|
|
#
|
|
|
|
/*
|
|
ips = mkOption {
|
|
default = [ "r.ripple.com 51235" ];
|
|
example = [ "192.168.0.1" "192.168.0.1 3939" "r.ripple.com 51235" ];
|
|
description = ''
|
|
List of hostnames or ips where the Ripple protocol is served.
|
|
For a starter list, you can either copy entries from:
|
|
https://ripple.com/ripple.txt or if you prefer you can let it
|
|
default to r.ripple.com 51235
|
|
|
|
A port may optionally be specified after adding a space to the
|
|
address. By convention, if known, IPs are listed in from most
|
|
to least trusted.
|
|
'';
|
|
};
|
|
|
|
ipsFixed = mkOption {
|
|
default = null;
|
|
example = [ "192.168.0.1" "192.168.0.1 3939" "r.ripple.com 51235" ];
|
|
description = ''
|
|
List of IP addresses or hostnames to which rippled should always
|
|
attempt to maintain peer connections with. This is useful for
|
|
manually forming private networks, for example to configure a
|
|
validation server that connects to the Ripple network through a
|
|
public-facing server, or for building a set of cluster peers.
|
|
|
|
A port may optionally be specified after adding a space to the address
|
|
'';
|
|
};
|
|
*/
|
|
|
|
peerIp = mkOption {
|
|
default = null;
|
|
example = "0.0.0.0";
|
|
description = ''
|
|
IP address or domain to bind to allow external connections from peers.
|
|
Defaults to not binding, which disallows external connections from peers.
|
|
'';
|
|
};
|
|
|
|
peerPort = mkOption {
|
|
default = 51235;
|
|
description = ''
|
|
If peerIp is supplied, corresponding port to bind to for peer connections.
|
|
'';
|
|
};
|
|
|
|
/*
|
|
peerPortProxy = mkOption {
|
|
type = types.int;
|
|
example = 51236;
|
|
description = ''
|
|
An optional, additional listening port number for peers. Incoming
|
|
connections on this port will be required to provide a PROXY Protocol
|
|
handshake, described in this document (external link):
|
|
|
|
http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt
|
|
|
|
The PROXY Protocol is a popular method used by elastic load balancing
|
|
service providers such as Amazon, to identify the true IP address and
|
|
port number of external incoming connections.
|
|
|
|
In addition to enabling this setting, it will also be required to
|
|
use your provider-specific control panel or administrative web page
|
|
to configure your server instance to receive PROXY Protocol handshakes,
|
|
and also to restrict access to your instance to the Elastic Load Balancer.
|
|
'';
|
|
};
|
|
|
|
peerPrivate = mkOption {
|
|
default = null;
|
|
example = 0;
|
|
description = ''
|
|
0: Request peers to broadcast your address. Normal outbound peer connections [default]
|
|
1: Request peers not broadcast your address. Only connect to configured peers.
|
|
'';
|
|
};
|
|
|
|
peerSslCipherList = mkOption {
|
|
default = null;
|
|
example = "ALL:!LOW:!EXP:!MD5:@STRENGTH";
|
|
description = ''
|
|
A colon delimited string with the allowed SSL cipher modes for peer. The
|
|
choices for for ciphers are defined by the OpenSSL API function
|
|
SSL_CTX_set_cipher_list, documented here (external link):
|
|
|
|
http://pic.dhe.ibm.com/infocenter/tpfhelp/current/index.jsp?topic=%2Fcom.ibm.ztpf-ztpfdf.doc_put.cur%2Fgtpc2%2Fcpp_ssl_ctx_set_cipher_list.html
|
|
|
|
The default setting of "ALL:!LOW:!EXP:!MD5:@STRENGTH", which allows
|
|
non-authenticated peer connections (they are, however, secure).
|
|
'';
|
|
};
|
|
|
|
nodeSeed = mkOption {
|
|
default = null;
|
|
example = "RASH BUSH MILK LOOK BAD BRIM AVID GAFF BAIT ROT POD LOVE";
|
|
description = ''
|
|
This is used for clustering. To force a particular node seed or key, the
|
|
key can be set here. The format is the same as the validation_seed field.
|
|
To obtain a validation seed, use the rippled validation_create command.
|
|
'';
|
|
};
|
|
|
|
clusterNodes = mkOption {
|
|
default = null;
|
|
example = [ "n9KorY8QtTdRx7TVDpwnG9NvyxsDwHUKUEeDLY3AkiGncVaSXZi5" ];
|
|
description = ''
|
|
To extend full trust to other nodes, place their node public keys here.
|
|
Generally, you should only do this for nodes under common administration.
|
|
Node public keys start with an 'n'. To give a node a name for identification
|
|
place a space after the public key and then the name.
|
|
'';
|
|
};
|
|
|
|
sntpServers = mkOption {
|
|
default = null;
|
|
example = [ "time.nist.gov" "pool.ntp.org" ];
|
|
description = ''
|
|
IP address or domain of NTP servers to use for time synchronization.
|
|
'';
|
|
};
|
|
|
|
# TODO: websocket options
|
|
|
|
rpcAllowRemote = mkOption {
|
|
default = false;
|
|
description = ''
|
|
false: Allow RPC connections only from 127.0.0.1. [default]
|
|
true: Allow RPC connections from any IP.
|
|
'';
|
|
};
|
|
|
|
rpcAdminAllow = mkOption {
|
|
example = [ "10.0.0.4" ];
|
|
description = ''
|
|
List of IP addresses allowed to have admin access.
|
|
'';
|
|
};
|
|
|
|
rpcAdminUser = mkOption {
|
|
type = types.str;
|
|
description = ''
|
|
As a server, require this as the admin user to be specified. Also, require
|
|
rpc_admin_user and rpc_admin_password to be checked for RPC admin functions.
|
|
The request must specify these as the admin_user and admin_password in the
|
|
request object.
|
|
'';
|
|
};
|
|
|
|
rpcAdminPassword = mkOption {
|
|
type = types.str;
|
|
description = ''
|
|
As a server, require this as the admin pasword to be specified. Also,
|
|
require rpc_admin_user and rpc_admin_password to be checked for RPC admin
|
|
functions. The request must specify these as the admin_user and
|
|
admin_password in the request object.
|
|
'';
|
|
};
|
|
|
|
rpcIp = mkOption {
|
|
type = types.str;
|
|
description = ''
|
|
IP address or domain to bind to allow insecure RPC connections.
|
|
Defaults to not binding, which disallows RPC connections.
|
|
'';
|
|
};
|
|
|
|
rpcPort = mkOption {
|
|
type = types.int;
|
|
description = ''
|
|
If rpcIp is supplied, corresponding port to bind to for peer connections.
|
|
'';
|
|
};
|
|
|
|
rpcUser = mkOption {
|
|
type = types.str;
|
|
description = ''
|
|
Require a this user to specified and require rpcPassword to
|
|
be checked for RPC access via the rpcIp and rpcPort. The user and password
|
|
must be specified via HTTP's basic authentication method.
|
|
As a client, supply this to the server via HTTP's basic authentication
|
|
method.
|
|
'';
|
|
};
|
|
|
|
rpcPassword = mkOption {
|
|
type = types.str;
|
|
description = ''
|
|
Require a this password to specified and require rpc_user to
|
|
be checked for RPC access via the rpcIp and rpcPort. The user and password
|
|
must be specified via HTTP's basic authentication method.
|
|
As a client, supply this to the server via HTTP's basic authentication
|
|
method.
|
|
'';
|
|
};
|
|
|
|
rpcStartup = mkOption {
|
|
example = [ ''"command" : "log_level"'' ''"partition" : "ripplecalc"'' ''"severity" : "trace"'' ];
|
|
description = "List of RPC commands to run at startup.";
|
|
};
|
|
|
|
rpcSecure = mkOption {
|
|
default = false;
|
|
description = ''
|
|
false: Server certificates are not provided for RPC clients using SSL [default]
|
|
true: Client RPC connections wil be provided with SSL certificates.
|
|
|
|
Note that if rpc_secure is enabled, it will also be necessasry to configure the
|
|
certificate file settings located in rpcSslCert, rpcSslChain, and rpcSslKey
|
|
'';
|
|
};
|
|
*/
|
|
|
|
extraConfig = mkOption {
|
|
default = "";
|
|
description = ''
|
|
Extra lines to be added verbatim to the rippled.cfg configuration file.
|
|
'';
|
|
};
|
|
|
|
};
|
|
|
|
};
|
|
|
|
|
|
###### implementation
|
|
|
|
config = mkIf cfg.enable {
|
|
|
|
users.extraUsers = singleton
|
|
{ name = "rippled";
|
|
description = "Ripple server user";
|
|
uid = config.ids.uids.rippled;
|
|
home = "/var/lib/rippled";
|
|
};
|
|
|
|
systemd.services.rippled = {
|
|
path = [ pkgs.rippled ];
|
|
|
|
after = [ "network.target" ];
|
|
wantedBy = [ "multi-user.target" ];
|
|
|
|
serviceConfig = {
|
|
ExecStart = "${pkgs.rippled}/bin/rippled --fg -q --conf ${rippledStateCfgFile}";
|
|
WorkingDirectory = "/var/lib/rippled";
|
|
};
|
|
};
|
|
|
|
networking.firewall.allowedTCPPorts = mkIf (cfg.peerIp != null) [ cfg.peerPort ];
|
|
|
|
system.activationScripts.rippled = ''
|
|
mkdir -p /var/{lib,log}/rippled
|
|
chown -R rippled /var/{lib,log}/rippled
|
|
ln -sf ${rippledCfgFile} ${rippledStateCfgFile}
|
|
'';
|
|
};
|
|
}
|