nixpkgs/nixos/modules/services/networking/namecoind.nix

{
  config,
  lib,
  pkgs,
  ...
}:

with lib;

let
  cfg = config.services.namecoind;
  dataDir = "/var/lib/namecoind";
  useSSL = (cfg.rpc.certificate != null) && (cfg.rpc.key != null);
  useRPC = (cfg.rpc.user != null) && (cfg.rpc.password != null);

  listToConf = option: list: concatMapStrings (value: "${option}=${value}\n") list;

  configFile = pkgs.writeText "namecoin.conf" (
    ''
      server=1
      daemon=0
      txindex=1
      txprevcache=1
      walletpath=${cfg.wallet}
      gen=${if cfg.generate then "1" else "0"}
      ${listToConf "addnode" cfg.extraNodes}
      ${listToConf "connect" cfg.trustedNodes}
    ''
    + optionalString useRPC ''
      rpcbind=${cfg.rpc.address}
      rpcport=${toString cfg.rpc.port}
      rpcuser=${cfg.rpc.user}
      rpcpassword=${cfg.rpc.password}
      ${listToConf "rpcallowip" cfg.rpc.allowFrom}
    ''
    + optionalString useSSL ''
      rpcssl=1
      rpcsslcertificatechainfile=${cfg.rpc.certificate}
      rpcsslprivatekeyfile=${cfg.rpc.key}
      rpcsslciphers=TLSv1.2+HIGH:TLSv1+HIGH:!SSLv2:!aNULL:!eNULL:!3DES:@STRENGTH
    ''
  );

in

{

  ###### interface

  options = {

    services.namecoind = {

      enable = mkEnableOption "namecoind, Namecoin client";

      wallet = mkOption {
        type = types.path;
        default = "${dataDir}/wallet.dat";
        description = ''
          Wallet file. The ownership of the file has to be
          namecoin:namecoin, and the permissions must be 0640.
        '';
      };

      generate = mkOption {
        type = types.bool;
        default = false;
        description = ''
          Whether to generate (mine) Namecoins.
        '';
      };

      extraNodes = mkOption {
        type = types.listOf types.str;
        default = [ ];
        description = ''
          List of additional peer IP addresses to connect to.
        '';
      };

      trustedNodes = mkOption {
        type = types.listOf types.str;
        default = [ ];
        description = ''
          List of the only peer IP addresses to connect to. If specified
          no other connection will be made.
        '';
      };

      rpc.user = mkOption {
        type = types.nullOr types.str;
        default = null;
        description = ''
          User name for RPC connections.
        '';
      };

      rpc.password = mkOption {
        type = types.nullOr types.str;
        default = null;
        description = ''
          Password for RPC connections.
        '';
      };

      rpc.address = mkOption {
        type = types.str;
        default = "0.0.0.0";
        description = ''
          IP address the RPC server will bind to.
        '';
      };

      rpc.port = mkOption {
        type = types.port;
        default = 8332;
        description = ''
          Port the RPC server will bind to.
        '';
      };

      rpc.certificate = mkOption {
        type = types.nullOr types.path;
        default = null;
        example = "/var/lib/namecoind/server.cert";
        description = ''
          Certificate file for securing RPC connections.
        '';
      };

      rpc.key = mkOption {
        type = types.nullOr types.path;
        default = null;
        example = "/var/lib/namecoind/server.pem";
        description = ''
          Key file for securing RPC connections.
        '';
      };

      rpc.allowFrom = mkOption {
        type = types.listOf types.str;
        default = [ "127.0.0.1" ];
        description = ''
          List of IP address ranges allowed to use the RPC API.
          Wiledcards (*) can be user to specify a range.
        '';
      };

    };

  };

  ###### implementation

  config = mkIf cfg.enable {

    users.users.namecoin = {
      uid = config.ids.uids.namecoin;
      description = "Namecoin daemon user";
      home = dataDir;
      createHome = true;
    };

    users.groups.namecoin = {
      gid = config.ids.gids.namecoin;
    };

    systemd.services.namecoind = {
      description = "Namecoind daemon";
      after = [ "network.target" ];
      wantedBy = [ "multi-user.target" ];

      startLimitIntervalSec = 120;
      startLimitBurst = 5;
      serviceConfig = {
        User = "namecoin";
        Group = "namecoin";
        ExecStart = "${pkgs.namecoind}/bin/namecoind -conf=${configFile} -datadir=${dataDir} -printtoconsole";
        ExecStop = "${pkgs.coreutils}/bin/kill -KILL $MAINPID";
        ExecReload = "${pkgs.coreutils}/bin/kill -HUP $MAINPID";
        Nice = "10";
        PrivateTmp = true;
        TimeoutStopSec = "60s";
        TimeoutStartSec = "2s";
        Restart = "always";
      };

      preStart = optionalString (cfg.wallet != "${dataDir}/wallet.dat") ''
        # check wallet file permissions
        if [ "$(stat --printf '%u' ${cfg.wallet})" != "${toString config.ids.uids.namecoin}" \
           -o "$(stat --printf '%g' ${cfg.wallet})" != "${toString config.ids.gids.namecoin}" \
           -o "$(stat --printf '%a' ${cfg.wallet})" != "640" ]; then
           echo "ERROR: bad ownership or rights on ${cfg.wallet}" >&2
           exit 1
        fi
      '';

    };

  };

  meta.maintainers = with lib.maintainers; [ rnhmjoj ];

}