NixOS module options

Each Dassie release publishes a flake with a NixOS module. These are its options, under services.dassie. Dassie on NixOS walks through setting it up.

On this page

Using the module
services.dassie.enable
services.dassie.package
services.dassie.log
services.dassie.environment
services.dassie.openFirewall

Using the module

Import nixosModules.default from the release's flake (nixosModules.dassie is the same module). It sets services.dassie.package to that release, so a minimal setup is:

flake.nix

{
  inputs = {
    nixpkgs.url = "github:NixOS/nixpkgs/nixos-unstable";
    dassie.url = "https://get.dassie.land/flake/latest.tar.gz";
    dassie.inputs.nixpkgs.follows = "nixpkgs";
  };

  outputs = { nixpkgs, dassie, ... }: {
    nixosConfigurations.my-server = nixpkgs.lib.nixosSystem {
      system = "x86_64-linux";
      modules = [
        ./configuration.nix
        dassie.nixosModules.default
        { services.dassie.enable = true; }
      ];
    };
  };
}

The flake also has packages.<system>.dassie and an overlay, overlays.default, which adds pkgs.dassie.

`services.dassie.enable`

Type: boolean
Default: false

Runs the Dassie node, on ports 80 and 443. It installs the release's own systemd units and enables them as the installer does: dassie.service and its sockets dassie-http (TCP 80), dassie-https (TCP 443), dassie-quic (UDP 443), dassie-feed (UDP 7768, for requests for the node's snapshot) and dassie-ipc (/run/dassie.sock). It also creates the group dassie-users, whose members may use the IPC socket and so administer the node, and puts dassie on the system path.

QUIC is the peer protocol's only transport, so dassie.service doesn't start without its QUIC socket: while something else holds UDP 443, the node doesn't start. The snapshot socket is optional: if UDP 7768 is taken, the node warns and runs without it.

The units keep their sandbox, so the node runs as it does on any other Linux, with its data in /var/lib/private/dassie. The updater's units are left out: the version is the one your flake locks, and you update by updating the flake input.

`services.dassie.package`

Type: package
Default: The flake's release, set by nixosModules.default.

The Dassie package the units run: the release's own signed binary, fetched by the sum the release key signed, and never compiled or patched.

`services.dassie.log`

Type: string
Default: "info"
Example: "info,dassie::peer=debug"

What the node logs, as DASSIE_LOG: a level (trace, debug, info, warn, error or off), or directives per target, separated by commas. The example logs info and above everywhere, and the peer protocol's debug events too. Read the log with journalctl -u dassie.

`services.dassie.environment`

Type: attribute set of strings
Default: { }
Example: { DASSIE_RELAY = ""; }

More environment variables for the node. Environment variables lists them all. A variable set here wins over services.dassie.log, so set DASSIE_LOG through log. The example is the module's own: an empty DASSIE_RELAY means no relay. Without it, a node without a hostname keeps the front door at relay.dassiepay.net as its relay. That front door is a machine the project runs: it learns when the node is online, and reads the Open Payments requests it passes on. A node with a hostname keeps none either way, so on a server you give a hostname the example changes nothing. DASSIE_RELAY has the details.

`services.dassie.openFirewall`

Type: boolean
Default: false

Opens the node's ports in the NixOS firewall: TCP 80 and 443, UDP 443 for QUIC, and UDP 7768, where anyone may ask the node for its snapshot. Files, ports and sockets says what each one is for.