add standalone clightning-rest service

- Rename `services.rtl.cl-rest` to `services.clightning-rest`.
  `clightning-rest` is generally useful for connecting external REST clients
  to clightning.

- Add a dedicated network namespace in netns-isolation.

- Add nodeinfo entry.

- Add datadir (which contains REST auth data) to backups.

modules/clightning-rest.nix

@@ -0,0 +1,104 @@
+{ config, lib, pkgs, ... }:
+
+with lib;
+let
+  options.services.clightning-rest = {
+    enable = mkEnableOption "lightning-rest";
+    port = mkOption {
+      type = types.port;
+      default = 3001;
+      description = "REST server port.";
+    };
+    docPort = mkOption {
+      type = types.port;
+      default = 4001;
+      description = "Swagger API documentation server port.";
+    };
+    dataDir = mkOption {
+      type = types.path;
+      default = "/var/lib/clightning-rest";
+      description = "The data directory for clightning-rest.";
+    };
+    extraConfig = mkOption {
+      type = types.attrs;
+      default = {};
+      example = {
+        DOMAIN = "mynode.org";
+      };
+      description = ''
+        Extra config options.
+        See: https://github.com/Ride-The-Lightning/c-lightning-REST#option-1-via-config-file-cl-rest-configjson
+      '';
+    };
+    # Used by ./rtl.nix
+    group = mkOption {
+      readOnly = true;
+      default = clightning.group;
+      description = "The group under which clightning-rest is run.";
+    };
+    # Rest server address.
+    # Not configurable. The server always listens on all interfaces:
+    # https://github.com/Ride-The-Lightning/c-lightning-REST/issues/84
+    # Required by netns-isolation.
+    address = mkOption {
+      internal = true;
+      default = "0.0.0.0";
+    };
+    tor.enforce = nbLib.tor.enforce;
+  };
+
+  cfg = config.services.clightning-rest;
+  nbLib = config.nix-bitcoin.lib;
+  nbPkgs = config.nix-bitcoin.pkgs;
+
+  inherit (config.services)
+    bitcoind
+    clightning;
+
+  configFile = builtins.toFile "clightning-rest-config" (builtins.toJSON ({
+    PORT = cfg.port;
+    DOCPORT = cfg.docPort;
+    LNRPCPATH = "${clightning.dataDir}/${bitcoind.makeNetworkName "bitcoin" "regtest"}/lightning-rpc";
+    EXECMODE = "production";
+    PROTOCOL = "https";
+    RPCCOMMANDS = ["*"];
+  } // cfg.extraConfig));
+in {
+  inherit options;
+
+  config = mkIf cfg.enable {
+    services.clightning.enable = true;
+
+    systemd.tmpfiles.rules = [
+      "d '${cfg.dataDir}' 0770 ${clightning.user} ${cfg.group} - -"
+    ];
+
+    systemd.services.clightning-rest = mkIf cfg.enable {
+      wantedBy = [ "multi-user.target" ];
+      requires = [ "clightning.service" ];
+      after = [ "clightning.service" ];
+      path = [ pkgs.openssl ];
+      environment.CL_REST_STATE_DIR = cfg.dataDir;
+      preStart = ''
+        ln -sfn ${configFile} cl-rest-config.json
+      '';
+      postStart = ''
+        while [[ ! -e '${cfg.dataDir}/certs/access.macaroon' ]]; do
+          sleep 0.1
+        done
+      '';
+      serviceConfig = nbLib.defaultHardening // {
+        # clightning-rest reads the config file from the working directory
+        WorkingDirectory = cfg.dataDir;
+        ExecStart = "${nbPkgs.clightning-rest}/bin/cl-rest";
+        # Show "clightning-rest" instead of "node" in the journal
+        SyslogIdentifier = "clightning-rest";
+        User = clightning.user;
+        Restart = "on-failure";
+        RestartSec = "10s";
+        ReadWritePaths = cfg.dataDir;
+      } // nbLib.allowedIPAddresses cfg.tor.enforce
+        // nbLib.nodejs;
+    };
+  };
+}