2ro
b2e11ff1fe
Close the remaining "secrets touch a plaintext file" gap. The unattended restart mode now SEALS the operator-chosen wallet password to the host with `systemd-creds encrypt` (ciphertext at rest, read via LoadCredentialEncrypted, decrypted into a tmpfs credentials dir at each start), so no plaintext wallet key is written to disk. When systemd-creds is unavailable it falls back to the legacy root-owned 0400 plaintext file with a loud warning, and re-running `setup --reconfigure` once it is available upgrades to encryption. - wizard: seal via systemd-creds (injectable for tests), write the encrypted.conf drop-in, keep the manual.conf tmpfs path unchanged; reconfiguring a till that keeps no readable password on disk (encrypted or manual) now prompts for the existing password to reopen the wallet. - startup: loud deprecation warning when a money secret (GP_MNEMONIC, GP_WALLET_PASSWORD, GP_NSEC) is supplied INLINE rather than via a *_FILE or systemd credential; the value is never logged, only the variable name. - docs: README, .env.example, install.sh, and the systemd unit updated to the encrypted-at-rest default and the honest fallback/trade-off. Tests: gp-core config + gp-core/gp-server setup cover the inline-secret warning, the encrypted drop-in, the sealed-vs-plaintext shapes, and encrypted reconfigure. Full workspace suite green; fmt introduces no new drift; clippy -D warnings clean on the workspace crates.
59 lines
2.9 KiB
Bash
59 lines
2.9 KiB
Bash
# GoblinPay environment. Copy to /etc/goblinpay.env (bare metal) or deploy/.env
|
|
# (docker compose), then edit. NON-SECRET config only: the Grin seed and the
|
|
# wallet password live as separate files (a systemd credential / the compose
|
|
# ./secrets mount), never in this file.
|
|
#
|
|
# SECURITY: never put GP_MNEMONIC or GP_WALLET_PASSWORD (the seed and the key
|
|
# that decrypts it) inline in this file or the environment. An inline env var is
|
|
# readable by the whole process and, via /proc, by root for the life of the
|
|
# service; the server prints a loud deprecation warning if you do. Deliver them
|
|
# as files (GP_MNEMONIC_FILE / GP_WALLET_PASSWORD_FILE) or a systemd credential.
|
|
#
|
|
# The recommended path is `gp-server setup`, which has YOU choose the wallet
|
|
# password (entered twice, grin-wallet-faithful; never auto-generated), shows a
|
|
# fresh 24-word seed once for you to write down (or takes your recovery phrase),
|
|
# and asks how the till should restart: UNATTENDED (default) or MANUAL. In
|
|
# UNATTENDED mode the password is sealed to this host with `systemd-creds encrypt`
|
|
# (ENCRYPTED at rest, decrypted at each start) so the service auto-restarts with
|
|
# no plaintext key on disk; MANUAL keeps nothing on disk and you re-enter it after
|
|
# every restart. This file is the by-hand path.
|
|
|
|
# --- domain / URLs ---
|
|
# docker-compose serves GoblinPay on GP_DOMAIN and the bundled relay on
|
|
# relay.<GP_DOMAIN>; point BOTH DNS records at this host before `compose up`.
|
|
GP_DOMAIN=pay.example
|
|
GP_PUBLIC_URL=https://pay.example
|
|
|
|
# --- relay (bundled is the default: GoblinPay runs its own relay) ---
|
|
GP_RELAY_MODE=bundled
|
|
# The bundled relay's PUBLIC url: it is BOTH dialed by the server AND advertised
|
|
# to payers in the checkout nprofile, so it must be reachable from the internet.
|
|
GP_BUNDLED_RELAY_URL=wss://relay.pay.example
|
|
# For GP_RELAY_MODE=external instead, drop the bundled relay and set:
|
|
#GP_RELAY_MODE=external
|
|
#GP_RELAYS=wss://relay.damus.io,wss://nos.lol
|
|
|
|
# --- Grin node (read-only: confirmations + balance) ---
|
|
GP_NODE_URL=https://main.gri.mw
|
|
|
|
# --- API / admin tokens (bearer capabilities; use strong random values) ---
|
|
GP_API_TOKEN=change-me-api-token
|
|
GP_ADMIN_TOKEN=change-me-admin-token
|
|
|
|
# --- webhook to your store (optional; the URL requires the secret) ---
|
|
#GP_WEBHOOK_URL=https://your-store/hook
|
|
#GP_WEBHOOK_SECRET=change-me-webhook-secret
|
|
|
|
# --- default payment-matching mode: memo | derived | amount ---
|
|
GP_MATCH_MODE=derived
|
|
|
|
# --- grin1 / Tor rail (operator opt-in; PACKAGED DEFAULT OFF) ---
|
|
# When off (or unset) GoblinPay is Goblin/Nostr-only: no Tor onion service, no
|
|
# local Foreign API listener, and the pay page shows only "Pay with Goblin".
|
|
# Set to `on` to also accept payments from ANY Grin wallet over Tor: the till
|
|
# publishes an onion service whose identity IS its grin1 slatepack address key
|
|
# (grin1 address == onion address), serving the Grin Foreign API v2.
|
|
#GP_GRIN1_RAIL=on
|
|
# Loopback port the Foreign API binds (the onion service proxies to it).
|
|
#GP_GRIN1_FOREIGN_PORT=3416
|