From 0c22db4d7ba488e96eef085902a4325a3d34eb01 Mon Sep 17 00:00:00 2001
From: padreug <padreug@aiolabs.dev>
Date: Wed, 8 Oct 2025 17:50:12 +0200
Subject: [PATCH] Add LNBits service configuration and Nginx integration

Introduced a new configuration for the LNBits service, enabling it with customizable options such as host, port, and environment variables. The Nginx configuration has been updated to include WebSocket support and proxy settings for LNBits, ensuring secure and efficient handling of requests. This enhances the overall web service management and modularity of the NixOS setup.
---
 config/lnbits.nix                 |  83 ++++++++++++++++++++
 config/modules/lnbits-service.nix | 123 ++++++++++++++++++++++++++++++
 config/shared.nix                 |  12 +--
 3 files changed, 208 insertions(+), 10 deletions(-)
 create mode 100644 config/lnbits.nix
 create mode 100644 config/modules/lnbits-service.nix

diff --git a/config/lnbits.nix b/config/lnbits.nix
new file mode 100644
index 0000000..8d25e3d
--- /dev/null
+++ b/config/lnbits.nix
@@ -0,0 +1,83 @@
+{ domain, ... }:
+
+{
+  # LNBits service configuration
+  services.lnbits = {
+    enable = true;
+    host = "0.0.0.0";
+    port = 5000;
+    openFirewall = true;
+    stateDir = "/var/lib/lnbits";
+    package = (builtins.getFlake "path:/etc/nixos/sources/lnbits").packages.x86_64-linux.lnbits;
+    env = {
+      LNBITS_ADMIN_UI = "true";
+      AUTH_ALLOWED_METHODS = "user-id-only, username-password";
+      LNBITS_BACKEND_WALLET_CLASS = "FakeWallet";
+      LNBITS_SITE_TITLE = "AIO";
+      LNBITS_SITE_TAGLINE = "Open Source Lightning Payments Platform";
+      LNBITS_SITE_DESCRIPTION = "A lightning wallet for the community";
+      LIGHTNING_INVOICE_EXPIRY = "3600";
+      LNBITS_DEFAULT_WALLET_NAME = "AIO Wallet";
+      LNBITS_EXTENSIONS_MANIFESTS =
+        "https://raw.githubusercontent.com/lnbits/lnbits-extensions/main/extensions.json";
+      LNBITS_EXTENSIONS_DEFAULT_INSTALL =
+        "nostrclient,nostrmarket,nostrrelay,lnurlp,events";
+      LNBITS_ADMIN_EXTENSIONS = "ngrok,nostrclient,nostrrelay";
+      LNBITS_USER_DEFAULT_EXTENSIONS = "lnurlp,nostrmarket,events";
+      FORWARDED_ALLOW_IPS = "*";
+    };
+  };
+
+  services.nginx = {
+    # Add the connection upgrade map
+    appendHttpConfig = ''
+      map $http_upgrade $connection_upgrade {
+        default upgrade;
+        ""      close;
+      }
+    '';
+    
+    virtualHosts."lnbits.${domain}" = {
+      forceSSL = true;
+      enableACME = true;
+      locations = {
+        # WebSocket endpoints with additional headers that LNbits might expect
+        "~ ^/(api/v1/ws/|.*relay.*/)" = {
+          proxyPass = "http://127.0.0.1:5000";
+          extraConfig = ''
+            # WebSocket configuration
+            proxy_http_version 1.1;
+            proxy_set_header Upgrade $http_upgrade;
+            proxy_set_header Connection $connection_upgrade;
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+            
+            # WebSocket timeouts
+            proxy_read_timeout 3600s;
+            proxy_send_timeout 3600s;
+            proxy_connect_timeout 60s;
+            
+            # Disable buffering
+            proxy_buffering off;
+            proxy_request_buffering off;
+            proxy_cache off;
+          '';
+        };
+        
+        # General HTTP requests (with basic proxy headers)
+        "/" = {
+          proxyPass = "http://127.0.0.1:5000";
+          extraConfig = ''
+            # Basic proxy headers for HTTP (not WebSocket)
+            proxy_set_header Host $host;
+            proxy_set_header X-Real-IP $remote_addr;
+            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+            proxy_set_header X-Forwarded-Proto $scheme;
+          '';
+        };
+      };
+    };
+  };
+}
diff --git a/config/modules/lnbits-service.nix b/config/modules/lnbits-service.nix
new file mode 100644
index 0000000..358f300
--- /dev/null
+++ b/config/modules/lnbits-service.nix
@@ -0,0 +1,123 @@
+{ config, pkgs, lib, ... }:
+
+let
+  defaultUser = "lnbits";
+  cfg = config.services.lnbits;
+  inherit (lib) mkOption mkIf types optionalAttrs literalExpression;
+in
+
+{
+  options = {
+    services.lnbits = {
+      enable = mkOption {
+        default = false;
+        type = types.bool;
+        description = ''
+          Whether to enable the lnbits service
+        '';
+      };
+      openFirewall = mkOption {
+        type = types.bool;
+        default = false;
+        description = ''
+          Whether to open the ports used by lnbits in the firewall for the server
+        '';
+      };
+      package = mkOption {
+        type = types.package;
+        defaultText = literalExpression "pkgs.lnbits";
+        default = pkgs.lnbits;
+        description = ''
+          The lnbits package to use.
+        '';
+      };
+      stateDir = mkOption {
+        type = types.path;
+        default = "/var/lib/lnbits";
+        description = ''
+          The lnbits state directory
+        '';
+      };
+      host = mkOption {
+        type = types.str;
+        default = "127.0.0.1";
+        description = ''
+          The host to bind to
+        '';
+      };
+      port = mkOption {
+        type = types.port;
+        default = 8231;
+        description = ''
+          The port to run on
+        '';
+      };
+      user = mkOption {
+        type = types.str;
+        default = "lnbits";
+        description = "user to run lnbits as";
+      };
+      group = mkOption {
+        type = types.str;
+        default = "lnbits";
+        description = "group to run lnbits as";
+      };
+      env = mkOption {
+        type = types.attrsOf types.str;
+        default = {};
+        description = ''
+          Additional environment variables that are passed to lnbits.
+          Reference Variables: https://github.com/lnbits/lnbits/blob/dev/.env.example
+        '';
+        example = {
+          LNBITS_ADMIN_UI = "true";
+        };
+      };
+    };
+  };
+
+  config = mkIf cfg.enable {
+    users.users = optionalAttrs (cfg.user == defaultUser) {
+      ${defaultUser} = {
+        isSystemUser = true;
+        group = defaultUser;
+      };
+    };
+
+    users.groups = optionalAttrs (cfg.group == defaultUser) {
+      ${defaultUser} = { };
+    };
+
+    systemd.tmpfiles.rules = [
+      "d ${cfg.stateDir}                            0700 ${cfg.user} ${cfg.group} - -"
+      "d ${cfg.stateDir}/data                       0700 ${cfg.user} ${cfg.group} - -"
+    ];
+
+    systemd.services.lnbits = {
+      enable = true;
+      description = "lnbits";
+      wantedBy = [ "multi-user.target" ];
+      after = [ "network-online.target" ];
+      environment = lib.mkMerge [
+        {
+          LNBITS_DATA_FOLDER = "${cfg.stateDir}/data";
+          # LNBits automatically appends '/extensions' to this path
+          LNBITS_EXTENSIONS_PATH = "${cfg.stateDir}";
+        }
+        cfg.env
+      ];
+      serviceConfig = {
+        User = cfg.user;
+        Group = cfg.group;
+        WorkingDirectory = "${cfg.package}/lib/python3.12/site-packages";
+        StateDirectory = "lnbits";
+        ExecStart = "${cfg.package}/bin/lnbits --port ${toString cfg.port} --host ${cfg.host}";
+        Restart = "always";
+        PrivateTmp = true;
+      };
+    };
+    networking.firewall = mkIf cfg.openFirewall {
+      allowedTCPPorts = [ cfg.port ];
+    };
+  };
+}
diff --git a/config/shared.nix b/config/shared.nix
index 159df12..8e9023d 100644
--- a/config/shared.nix
+++ b/config/shared.nix
@@ -4,6 +4,8 @@
   imports = [
     ./nginx.nix
     ./pict-rs.nix
+    ./modules/lnbits-service.nix
+    ./lnbits.nix
   ];
 
   # Set hostname (passed as parameter)
@@ -31,16 +33,6 @@
         tryFiles = "$uri $uri/ /index.html";
       };
     };
-
-    # LNbits service (adjust port as needed)
-    "lnbits.${domain}" = {
-      forceSSL = true;
-      enableACME = true;
-      locations."/" = {
-        proxyPass = "http://localhost:5000";
-        proxyWebsockets = true;
-      };
-    };
   };
 
   # NixOS release version