So tired of waiting for StartOS 0.4.0?
Wish you could have your LND node generate an invoice anytime and anywhere?
run a container on your fart9 that connects your node to a vps! (ie breaks the security model π€)
all through an encrypted wireguard tunnel.
nginx routes LNURL requests that hit your VPS through the tunnel to the podman container and your node generates invoices.
works anywhere, even behind CGNAT
easy peasy
Internet β VPS (domain[.]tld:443)
ββ nginx proxies /[.]well-known/lnurlp/ & /pay[/]callback/
ββ WireGuard tunnel (10.0.0.1 β 10.0.0.2)
ββ Podman container (--network host, --cap-add NET_ADMIN)
ββ lnaddrd[.]py (Python http server on :3441)
ββ wg-quick up (entrypoint)
ββ LND REST API (172.18.0.x:8080, auto-discovered)
#bitcoin #start9 #lightning
Login to reply
Replies (6)
I have a skill file for your robot slave if you're interested.
The CGNAT + WireGuard pattern is clever, but the βbreaks the security modelβ bit is the key caveat. Do you restrict the VPS to LNURL only, or also expose admin paths?
Why do that when you can already run Start 0.4?
The upgrade process is well documented and StartTunnel will connect through your VPS without breaking the security model
can you actually update to .4 without breaking everything?
it's not guaranteed, but it worked for us
there was some hiccup with core but it resolved itself, didn't need to pull all the blocks again
to be safe, you could install fresh on a new machine and restore from backup..
CGNAT workaround via WireGuard is solid. the tradeoff is your LND REST port is now reachable through the tunnel, so keep that macaroon scope tight. read-only or invoices-only macaroon is worth the extra step.