feat: add hub-managed Wallet Connections scaffolding

modules/core/caddy.nix

@@ -12,6 +12,7 @@ let
     || config.sovran_systemsOS.services.nextcloud
     || config.sovran_systemsOS.services.vaultwarden
     || config.sovran_systemsOS.features.haven
+    || config.sovran_systemsOS.features."nwc-wallets"
     || config.sovran_systemsOS.features.element-calling;
 in
 {
@@ -70,6 +71,7 @@ in
       BTCPAY=$(read_domain btcpayserver)
       VAULTWARDEN=$(read_domain vaultwarden)
       HAVEN=$(read_domain haven)
+      LIGHTNING=$(read_domain lightning)
       ACME_EMAIL=$(read_domain sslemail)
 
       # Start with global config — use ACME only when domain-based services are active
@@ -186,6 +188,18 @@ $HAVEN {
 EOF
       fi
 
+      # ── Wallet Connections LNURL ──────────────────────
+      if [ -n "$LIGHTNING" ]; then
+        cat >> /run/caddy/Caddyfile <<EOF
+
+$LIGHTNING {
+  # LNURL endpoints are served by the local Sovran Hub backend on 8937.
+  reverse_proxy /.well-known/lnurlp/* http://127.0.0.1:8937
+  reverse_proxy /lnurlp/* http://127.0.0.1:8937
+}
+EOF
+      fi
+
       # ── Sovran Hub (LAN access via mDNS) ────────────
       cat >> /run/caddy/Caddyfile <<EOF
 

modules/core/local-domain-loopback.nix

@@ -88,7 +88,7 @@ let
       # NOTE: The hostname validation regex below must stay in sync with
       # _SAFE_DOMAIN_RE in app/sovran_systemsos_web/server.py.
       ENTRIES=""
-      for KEY in matrix wordpress nextcloud btcpayserver vaultwarden haven element-calling; do
+      for KEY in matrix wordpress nextcloud btcpayserver vaultwarden haven element-calling lightning; do
         FILE="$DOMAINS_DIR/$KEY"
         [ -f "$FILE" ] || continue
         # Read the domain value (strip all whitespace, limit to 253 chars)

modules/core/role-logic.nix

@@ -34,6 +34,7 @@
         mempool = lib.mkForce false;
         element-calling = lib.mkForce false;
         bitcoin-core = lib.mkForce false;
+        "nwc-wallets" = lib.mkForce false;
       };
 
       sovran_systemsOS.web.btcpayserver = lib.mkForce false;

modules/core/roles.nix

@@ -46,6 +46,7 @@
       mempool = lib.mkEnableOption "Bitcoin Mempool Explorer";
       element-calling = lib.mkEnableOption "Element Video and Audio Calling";
       bitcoin-core = lib.mkEnableOption "Bitcoin Core";
+      "nwc-wallets" = lib.mkEnableOption "Wallet Connections";
       rdp = lib.mkEnableOption "Gnome Remote Desktop";
       sshd = lib.mkEnableOption "SSH remote access";
 

modules/core/sovran-hub.nix

@@ -61,6 +61,9 @@ let
         { label = "Server"; value = "tcp://127.0.0.1:50001 (Electrs)"; }
         { label = "Status"; value = "Auto-configured on first boot"; }
       ]; }
+      { name = "Wallet Connections"; unit = "nwc-wallets.service"; type = "system"; icon = "zeus"; enabled = cfg.features."nwc-wallets"; category = "bitcoin-apps"; credentials = [
+        { label = "Lightning Address Domain"; file = "/var/lib/domains/lightning"; }
+      ]; }
       { name = "Mempool";            unit = "mempool.service";      type = "system"; icon = "mempool";      enabled = cfg.features.mempool;  category = "bitcoin-apps"; credentials = [
         { label = "Tor Address — Access from anywhere via Tor Browser"; file = "/var/lib/tor/onion/mempool-frontend/hostname"; prefix = "http://"; }
         { label = "Local Network — Access on your home network only"; file = "/var/lib/secrets/internal-ip"; prefix = "http://"; suffix = ":60847"; }
@@ -353,6 +356,16 @@ uvicorn.run(
 LAUNCHER
       chmod +x $out/bin/sovran-hub-web
 
+      cat > $out/bin/nwc-wallet <<LAUNCHER
+#!${pkgs.python3}/bin/python3
+import os, sys
+base = os.path.join("$out", "lib", "sovran-hub-web")
+sys.path.insert(0, base)
+from sovran_systemsos_web.nwc_wallet_cli import main
+sys.exit(main())
+LAUNCHER
+      chmod +x $out/bin/nwc-wallet
+
       runHook postInstall
     '';
 

modules/modules.nix

@@ -32,6 +32,7 @@
 
     # ── Features (default OFF — enable in custom.nix) ─────────
     ./haven.nix
+    ./nwc-wallets.nix
     ./element-calling.nix
     ./mempool.nix
     ./bitcoin-core.nix

modules/nwc-wallets.nix

@@ -0,0 +1,62 @@
+{ config, pkgs, lib, ... }:
+
+lib.mkIf config.sovran_systemsOS.features."nwc-wallets" {
+  assertions = [
+    {
+      assertion = config.services.lnd.enable;
+      message = "Wallet Connections requires services.lnd.enable = true.";
+    }
+  ];
+
+  users.groups.nwc-wallets = {};
+  users.users.nwc-wallets = {
+    isSystemUser = true;
+    group = "nwc-wallets";
+    home = "/var/lib/nwc-wallets";
+    createHome = true;
+  };
+
+  systemd.tmpfiles.rules = [
+    "d /var/lib/nwc-wallets 0750 nwc-wallets nwc-wallets -"
+    "f /var/lib/nwc-wallets/state.json 0640 nwc-wallets nwc-wallets -"
+  ];
+
+  systemd.services.nwc-wallets = {
+    description = "Wallet Connections state initializer";
+    wantedBy = [ "multi-user.target" ];
+    after = [ "lnd.service" "sovran-hub-web.service" ];
+    requires = [ "lnd.service" "sovran-hub-web.service" ];
+    serviceConfig = {
+      Type = "oneshot";
+      RemainAfterExit = true;
+      User = "nwc-wallets";
+      Group = "nwc-wallets";
+      UMask = "0027";
+      NoNewPrivileges = true;
+      PrivateTmp = true;
+      ProtectHome = true;
+      ProtectSystem = "strict";
+      ReadWritePaths = [ "/var/lib/nwc-wallets" ];
+      ExecStart = pkgs.writeShellScript "nwc-wallets-init" ''
+        set -euo pipefail
+        install -d -m 0750 -o nwc-wallets -g nwc-wallets /var/lib/nwc-wallets
+        if [ ! -s /var/lib/nwc-wallets/state.json ]; then
+          cat > /var/lib/nwc-wallets/state.json <<'EOF'
+{"wallets":[]}
+EOF
+          chown nwc-wallets:nwc-wallets /var/lib/nwc-wallets/state.json
+          chmod 0640 /var/lib/nwc-wallets/state.json
+        fi
+      '';
+    };
+  };
+
+  sovran_systemsOS.domainRequirements = [
+    {
+      name = "lightning";
+      label = "Lightning Address Domain";
+      example = "pay.yourdomain.com";
+      needsDDNS = true;
+    }
+  ];
+}