Merge pull request 'Add Tor support for LND' (#332) from feature/lnd_tor into chore/upgrade_bitcoin_software

Reviewed-on: #332

nodes/bitcoin-2.json

@@ -26,6 +26,8 @@
       "kosmos-bitcoin::dotnet",
       "kosmos-bitcoin::nbxplorer",
       "kosmos-bitcoin::btcpay",
+      "tor-full",
+      "tor-full::default",
       "apt::default",
       "timezone_iii::default",
       "timezone_iii::debian",
@@ -82,6 +84,7 @@
     "recipe[kosmos-bitcoin::c-lightning]",
     "recipe[kosmos-bitcoin::lnd]",
     "recipe[kosmos-bitcoin::rtl]",
-    "role[btcpay]"
+    "role[btcpay]",
+    "recipe[tor-full]"
   ]
 }

site-cookbooks/kosmos-bitcoin/attributes/default.rb

@@ -25,6 +25,9 @@ node.default['bitcoin']['conf'] = {
   zmqpubrawtx: 'tcp://127.0.0.1:8338'
 }
 
+# Also enables Tor for LND
+node.default['bitcoin']['tor_enabled'] = true
+
 node.default['c-lightning']['repo'] = 'https://github.com/ElementsProject/lightning'
 node.default['c-lightning']['revision'] = 'v0.10.0'
 node.default['c-lightning']['source_dir'] = '/opt/c-lightning'

site-cookbooks/kosmos-bitcoin/metadata.rb

@@ -26,3 +26,4 @@ depends 'kosmos-nginx'
 depends 'kosmos-nodejs'
 depends 'firewall'
 depends 'application_javascript'
+depends 'tor-full'

site-cookbooks/kosmos-bitcoin/recipes/lnd.rb

@@ -71,6 +71,9 @@ template "#{lnd_dir}/lnd.conf" do
   notifies :restart, "systemd_unit[lnd.service]", :delayed
 end
 
+exec_flags = ""
+exec_flags += "--tor.active --tor.v3" if node['bitcoin']['tor_enabled']
+
 systemd_unit 'lnd.service' do
   content({
     Unit: {
@@ -83,7 +86,7 @@ systemd_unit 'lnd.service' do
       User: bitcoin_user,
       Group: bitcoin_group,
       Type: 'simple',
-      ExecStart: '/opt/go/bin/lnd',
+      ExecStart: "/opt/go/bin/lnd #{exec_flags}",
       Restart: 'always',
       RestartSec: '30',
       TimeoutSec: '240',
@@ -108,3 +111,8 @@ firewall_rule 'lnd' do
   protocol :tcp
   command  :allow
 end
+
+if node['bitcoin']['tor_enabled']
+  node.override['tor']['ControlPort'] = 9051
+  node.override['tor']['CookieAuthentication'] = true
+end

site-cookbooks/kosmos-bitcoin/recipes/source.rb

@@ -81,6 +81,14 @@ user bitcoin_user do
   shell "/bin/bash"
 end
 
+if node['bitcoin']['tor_enabled']
+  group 'debian-tor' do
+    action :modify
+    members bitcoin_user
+    append true
+  end
+end
+
 [bitcoin_datadir, bitcoin_walletdir].each do |path|
   directory path do
     owner bitcoin_user

site-cookbooks/tor-full/README.md

@@ -32,6 +32,8 @@ The following platform families are supported:
 * `node['tor']['MinLogLevel']` - The minimum log level to log. Possible values include debug, info, notice, warn, and err.
 * `node['tor']['LogDestination']` - Where logs should be written. Valid values include a path to a file or "syslog"
 * `node['tor']['SocksPorts']` - List of 'address:port' to open tor socks proxy on. Defaults to disabled
+* `node['tor']['ControlPort']` - The port on which Tor will listen for local connections from Tor controller applications
+* `node['tor']['CookieAuthentication']` - Enable this (`true`) when using ControlPort
 
 ### Hidden Services config section
 

site-cookbooks/tor-full/templates/default/torrc.erb

@@ -65,11 +65,11 @@ DataDirectory <%= node['tor']['DataDirectory'] %>
 
 ## The port on which Tor will listen for local connections from Tor
 ## controller applications, as documented in control-spec.txt.
-#ControlPort 9051
+<% if node['tor']['ControlPort'] %>ControlPort <%= node['tor']['ControlPort'] %><% else %>#ControlPort 9051<% end %>
 ## If you enable the controlport, be sure to enable one of these
 ## authentication methods, to prevent attackers from accessing it.
 #HashedControlPassword 16:872860B76453A77D60CA2BB8C1A7042072093276A3D701AD684053EC4C
-#CookieAuthentication 1
+<% if node['tor']['CookieAuthentication'] %>CookieAuthentication 1<% else %>#CookieAuthentication 1<% end %>
 
 ############### This section is just for location-hidden services ###