Sovran_Systems/Sovran_SystemsOS
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases 2 Wiki Activity

security: harden Lightning Wallet Connections (NWC)

Browse Source 
- Add rate limiting to public LNURL endpoints (30 req/min per IP)
- Add audit logging for wallet lifecycle events (create, drain, delete, rotate)
- Add Unix socket support for Python ↔ Alby Hub communication
- Add LND macaroon permission documentation/warning
- Add pairing secret rotation API endpoint + CLI command
- Make Nostr relay configurable; auto-use Haven relay when enabled
- Strengthen domain validation (FQDN only, reject localhost/IP)
- Add structured audit log at /var/log/sovran-nwc-audit.log

Co-authored-by: arena-agent <297053741+arena-agent@users.noreply.github.com>
This commit is contained in:
naturallaw777
2026-07-29 02:52:45 +00:00
co-authored by arena-agent
parent adde78320d
commit 2e2a9b2d44
6 changed files with 339 additions and 11 deletions
Download Patch File Download Diff File Expand all files Collapse all files
modules/nwc-wallets.nix
+9 -2
View File
@@ -19,12 +19,16 @@ let
NWC_LND_ADDRESS = "${lndRpcAddress}:${lndRpcPort}";
NWC_LND_CERT_FILE = lndCertPath;
NWC_LND_MACAROON_FILE = "/run/lnd/albyhub.macaroon";
NWC_RELAY = lib.mkIf config.sovran_systemsOS.features.haven
"wss://haven.${config.networking.domain}/nostr"
"wss://relay.getalby.com,wss://relay2.getalby.com";
};
wrappedNwcWallet = lib.hiPrio (pkgs.writeShellScriptBin "nwc-wallet" ''
export NWC_ALBY_HUB_API_BASE='${pythonManagerEnvironment.NWC_ALBY_HUB_API_BASE}'
export NWC_LND_ADDRESS='${pythonManagerEnvironment.NWC_LND_ADDRESS}'
export NWC_LND_CERT_FILE='${pythonManagerEnvironment.NWC_LND_CERT_FILE}'
export NWC_LND_MACAROON_FILE='${pythonManagerEnvironment.NWC_LND_MACAROON_FILE}'
export NWC_RELAY='${pythonManagerEnvironment.NWC_RELAY}'
exec ${config.services.sovranHub.webPackage}/bin/nwc-wallet "$@"
'');
@@ -108,7 +112,10 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
WORK_DIR = "/var/lib/albyhub";
DATABASE_URI = "/var/lib/albyhub/nwc.db";
PORT = toString albyHubPort;
RELAY = "wss://relay.getalby.com,wss://relay2.getalby.com";
# Use private Nostr relay if Haven is enabled, otherwise default to Alby's public relays
RELAY = lib.mkIf config.sovran_systemsOS.features.haven
"wss://haven.${config.networking.domain}/nostr"
"wss://relay.getalby.com,wss://relay2.getalby.com";
AUTO_LINK_ALBY_ACCOUNT = "false";
SEND_EVENTS_TO_ALBY = "false";
LOG_TO_FILE = "false";
@@ -170,4 +177,4 @@ lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
needsDDNS = true;
}
];
}
}