A bitcoin-node privacy machine in the template #14
Labels
No labels
blocked
bug
decision
duplicate
enhancement
help wanted
invalid
landed?
question
ready-to-merge
stale
wontfix
bug
duplicate
enhancement
help wanted
invalid
question
wontfix
No milestone
No project
No assignees
2 participants
Notifications
Due date
No due date set.
Dependencies
No dependencies set
Reference
allod/profiles#14
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
A pruned Bitcoin Core node as a template privacy machine: Tor-only after its first sync, on a data disk, running a verified binary, so a fork gets a node by declaring one.
Primary goals:
bitcoin-nodeprivacy profile —bitcoindwithprune,blockfilterindex, a data disk at the inventory'sdata_diskpath,dbcacheand the read/write caps sized for a 4-8 GB guest; Tor-only egress enforced in nftables, not inbitcoin.conf.outputstill jumps to it, so the node is Tor-only by topology.facts.nixthe profile and the operator command both read, so nothing is spelled twice.Current state and specifics
A private deployment runs this profile today (synced, Tor-only across reboots, every live witness passed). The public template has
data_disksupport in inventory andprovision-vm, and theprivacyarchetype; the profile, its facts file and the clearnet switch are what move. Sizing numbers from the private node at height 970k, pruned with the filter index: chainstate 19 GB, filter index 13 GB, blocks under 1 GB; the data disk is sized from those, never from the block count.Scope
In: the profile directory under
hosts/privacy/bitcoin-node/,facts.nix, the inventory example entry with its data disk. Out: the operator command (allod/nexus), any wallet, any clearnet mode as a standing option.Implementation is ready on branch
agent/bitcoin-node-profile, one commit, relayed to the owner for the pull request. Proposed PR body follows.This adds a
bitcoin-nodeprivacy machine definition to the template: a pruned Bitcoin Core node that syncs once over clearnet, then switches itself to Tor-only and stays there across reboots, with its chain on a data disk. Nothing changes for any machine the template already builds: no inventory entry selects the new definition yet, so the example fleet rebuilds to the same closures (the deploy gate with this branch substituted passes every step unchanged). What proves it is the NixOS VM test this change adds, which boots the real profile with a stand-inbitcoindand checks the nftables topology, the one-way switch, the marker's ownership, and the data-volume-absent case. If it is wrong, revert the commit: it creates no state anywhere.To use it, a deployment declares a
bitcoin-nodeinventory entry with adata_diskand a privacy identity insecrets; the README now shows the entry in the template's addressing. The template's own inventory and secrets do not get one in this change, so the example fleet does not grow a machine until a follow-up adds both.What moves
hosts/privacy/bitcoin-node/configuration.nix,facts.nix,home.nix: the profile that runs on a private deployment today (synced, Tor-only across reboots), carried over unchanged except the fix round below.checks/bitcoin-node.nix, wired aschecks.<system>.bitcoin-node-machineonx86_64-linuxandaarch64-linux: the VM test, eight subtests.flake.nix: theprivacy.bitcoin-nodedefinition. The flake keepsnixpkgsas its only input.README.md: a Bitcoin node section with the inventory example, the data-disk sizing rule, and the by-handbitcoin-cliline.Decisions a reviewer should know
pkgs.bitcoind, not a Guix-build flake input. The issue names abitcoind-gunixinput. The deployment that passed every live witness runs nixpkgs' cached binary and never builds Bitcoin Core locally, and this flake's contract isnixpkgsalone, so that is what is promoted. The rule that travels is the comment onbitcoindPkg: never override it into a source build. A verified Guix binary is a separate change if the owner wants one.facts.nixis the one file the profile and the operator command (allod bitcoin, allod/nexus#93) both read. An assertion now fails evaluation ifnodeUserdrifts from the account the nixpkgs module creates.Fix round (one cold cross-family review, gpt-5.6-sol)
Four findings taken: the documented
bitcoin-cliline lacked-datadirand could not find the RPC cookie; the data-volume top is now forced toroot:root 0755by the data-dir unit on every start, so a preformatted volume cannot leave the marker deletable by the node's account (the existing test assertion witnesses it); the account name is read fromfacts.nodeUsereverywhere and asserted against the module; the VM check is exported only on the two systems the NixOS test driver builds on, sincenix flake show --all-systemsfailed onpowerpc64le-linuxbefore. Four comment findings discarded as traps that stay.Risk
R3: a privacy boundary (Tor-only egress) and persistent state on a data disk. Residual after validation: the VM test uses a stand-in daemon, so the real
bitcoind's behaviour against the config is witnessed by the private deployment, not here. Rollback is a revert.Validation
Branch
agent/bitcoin-node-profile, one commit (a11c209). Run on the integrator's machine against that commit unless noted:nix flake check -L .: passes. The VM testbitcoin-node-machinebuilt fresh after the fix round (test script finished in 449.13s), all eight subtests: marker absent / switch with no node / switch order / marker present / idempotent switch / after a reboot / each predicate alone / data volume absent. The README-only amend after it reuses the same test derivation.nix flake show --all-systems: exit 0 (failed onpowerpc64le-linuxbefore the fix round).allod check --override-input profiles <this worktree>in the template deploy flake:All 7 steps passed (checks: 1 built), withprofilesresolved toa11c209. Every existing machine still evaluates; none selects the new definition.nix eval .#lib.profileDefinitions --json | jq '.privacy | keys':["bitcoin-node","privacy-1"].Closes allod/profiles#14.
Updated: the template now ships the machine itself (allod/inventory#26, allod/secrets#45, tracked in allod/strategy#68), so the body above this comment is superseded. Branch
agent/bitcoin-node-profileatd03e92a, one commit, relayed to the owner. Proposed PR body follows.This adds a
bitcoin-nodeprivacy machine definition to the template: a pruned Bitcoin Core node that syncs once over clearnet, then switches itself to Tor-only and stays there across reboots, with its chain on a data disk. Nothing changes for any machine the template already builds; the machine itself arrives in the same lock bump through allod/inventory#26 and allod/secrets#45 (allod/strategy#68 tracks the four), and the framework's machine-key assertion refuses the data entries without this definition, so the three land together. What proves it is the NixOS VM test this change adds, which boots the real profile with a stand-inbitcoindand checks the nftables topology, the one-way switch, the marker's ownership, and the data-volume-absent case. If it is wrong, revert the commit: it creates no state anywhere.On a fresh install
provision-vm bitcoin-nodeis then the whole of it. A fork that will never host a node leaves it unprovisioned; a switch to take a template machine out of the build entirely is allod/strategy#67.What moves
hosts/privacy/bitcoin-node/configuration.nix,facts.nix,home.nix: the profile that runs on a private deployment today (synced, Tor-only across reboots), carried over unchanged except the fix round below.checks/bitcoin-node.nix, wired aschecks.<system>.bitcoin-node-machineonx86_64-linuxandaarch64-linux: the VM test, eight subtests.flake.nix: theprivacy.bitcoin-nodedefinition. The flake keepsnixpkgsas its only input.README.md: a Bitcoin node section: what the template declares for it, the data-disk sizing rule, and the by-handbitcoin-cliline.Decisions a reviewer should know
pkgs.bitcoind, not a Guix-build flake input. The issue names abitcoind-gunixinput. The deployment that passed every live witness runs nixpkgs' cached binary and never builds Bitcoin Core locally, and this flake's contract isnixpkgsalone, so that is what is promoted. The rule that travels is the comment onbitcoindPkg: never override it into a source build. A verified Guix binary is a separate change if the owner wants one.facts.nixis the one file the profile and the operator command (allod bitcoin, allod/nexus#93) both read. An assertion now fails evaluation ifnodeUserdrifts from the account the nixpkgs module creates.Fix round (one cold cross-family review, gpt-5.6-sol)
Four findings taken: the documented
bitcoin-cliline lacked-datadirand could not find the RPC cookie; the data-volume top is now forced toroot:root 0755by the data-dir unit on every start, so a preformatted volume cannot leave the marker deletable by the node's account (the existing test assertion witnesses it); the account name is read fromfacts.nodeUsereverywhere and asserted against the module; the VM check is exported only on the two systems the NixOS test driver builds on, sincenix flake show --all-systemsfailed onpowerpc64le-linuxbefore. Four comment findings discarded as traps that stay.Risk
R3: a privacy boundary (Tor-only egress) and persistent state on a data disk. Residual after validation: the VM test uses a stand-in daemon, so the real
bitcoind's behaviour against the config is witnessed by the private deployment, not here. Rollback is a revert.Validation
Branch
agent/bitcoin-node-profile, one commit (d03e92a). Run on the integrator's machine against that commit unless noted:nix flake check -L .: passes. The VM testbitcoin-node-machinebuilt fresh after the fix round (test script finished in 449.13s), all eight subtests: marker absent / switch with no node / switch order / marker present / idempotent switch / after a reboot / each predicate alone / data volume absent. The README-only amend after it reuses the same test derivation.nix flake show --all-systems: exit 0 (failed onpowerpc64le-linuxbefore the fix round).allod check --override-input profiles <this worktree>in the template deploy flake:All 7 steps passed (checks: 1 built), withprofilesresolved to this branch. Every existing machine still evaluates. The full composition with the inventory and secrets branches substituted as well is recorded on allod/strategy#68.nix eval .#lib.profileDefinitions --json | jq '.privacy | keys':["bitcoin-node","privacy-1"].Closes allod/profiles#14.
Follow-up to the node definition: branch
agent/nexus-bitcoin-wiringat80d3b99, one commit, relayed to the owner. Proposed PR body follows.This gives the template's hypervisor the
allod bitcoincommand, so a fresh install has both the node and the way to drive it. Nothing else changes: the only new file sets two Home Manager options from the node profile's own facts file, and the hypervisor's package list gains exactly one entry,allod-bitcoin. What proves it is the deploy gate with this branch substituted (all 8 steps) and an evaluation of the composed hypervisor's packages showing that one name. If it is wrong, revert the commit; the command holds no state.What changes
hosts/hypervisor/nexus/home.nix:nexus.bitcoinNode.factsimported fromhosts/privacy/bitcoin-node/facts.nix,nexus.bitcoinNode.machines = [ "bitcoin-node" ].flake.nix: thehypervisor.nexusdefinition gains that home module.README.md: one sentence in the Bitcoin node section.Risk
R1: an operator command installed on the hypervisor behind options the template now sets; the command's own tests live in allod/nexus. Rollback is a revert.
Validation
nix flake check .: passes.allod check --override-input profiles <branch>in the template deploy flake:All 8 steps passed (checks: 1 built).nixosConfigurations.nexus.config.home-manager.users.allod.home.packagesfiltered toallod-bitcoinwith that override:[ "allod-bitcoin" ].Refs allod/profiles#14. Part of allod/strategy#68.
Landed on master in commit
cc6eb42: hosts/privacy/bitcoin-node profile and VM test, with the hypervisor wiring in826f409. Verified against the files on master today; closing as completed.