Restructure opt-add-lightning-terminal and at CLI scripts

docker-compose-generator/docker-fragments/opt-add-lightning-terminal.yml

@@ -1,45 +1,40 @@
-required-routes:
-  - "lightning-terminal"
 services:
   btcpayserver:
-    environment:
-      BTCPAY_EXTERNALSERVICES: "Lightning Terminal:${BTCPAY_PROTOCOL:-https}://${BTCPAY_HOST}/lit/;"
+    volumes:
+      - "lnd_lit_datadir:/lit:ro"
   lnd_bitcoin:
     environment:
       LND_EXTRA_ARGS: |
         rpcmiddleware.enable=true
   lnd_lit:
-    image: "lightninglabs/lightning-terminal:v0.17.6-path-prefix"
+    image: "lightninglabs/lightning-terminal:v0.17.6"
+    container_name: btcpayserver_litd
     restart: unless-stopped
     environment:
       LIT_AUTO_MIGRATE_TO_SQL: "true"
     expose:
-      - "8080"
-    secrets:
-      - lit_password
+      - "8443"
     volumes:
-      - "lnd_lit_datadir:/root/.lit"
+      - "lnd_lit_datadir:/lit"
       - "lnd_bitcoin_datadir:/data/lnd:ro"
-      - "bitcoin_datadir:/deps/.bitcoin:ro"
     links:
-      - bitcoind
       - lnd_bitcoin
     command:
-      - "--insecure-httplisten=0.0.0.0:8080"
+      - "--disableui"
+      - "--lit-dir=/lit/.lit"
+      - "--loop.loopdir=/lit/.loop"
+      - "--pool.basedir=/lit/.pool"
+      - "--faraday.faradaydir=/lit/.faraday"
+      - "--taproot-assets.tapddir=/lit/.tapd"
+      - "--httpslisten=0.0.0.0:8443"
       - "--network=${NBITCOIN_NETWORK}"
-      - "--uipassword_file=/run/secrets/lit_password"
       - "--lnd-mode=remote"
       - "--remote.lnd.rpcserver=lnd_bitcoin:10009"
       - "--remote.lnd.macaroonpath=/data/lnd/admin.macaroon"
       - "--remote.lnd.tlscertpath=/data/lnd/tls.cert"
-      - "--faraday.connect_bitcoin"
-      - "--faraday.bitcoin.host=bitcoind:43782"
-      - "--faraday.bitcoin.user=lnd"
-      - "--faraday.bitcoin.passwordfile=/deps/.bitcoin/RPCUsers/lnd"
+
 volumes:
   lnd_lit_datadir:
-secrets:
-  lit_password:
-    file: ../secrets/lit_password
+
 required:
   - "bitcoin-lnd"

docs/lightning-terminal.md

@@ -1,7 +1,7 @@
 # Lightning Terminal
 
-[Lightning Terminal](https://github.com/lightninglabs/lightning-terminal) (LiT) is a browser-based interface for managing channel liquidity.
-It integrates the Lightning Labs services Loop, Poold and Faraday all in one and offers a web UI to manage them.
+[Lightning Terminal](https://github.com/lightninglabs/lightning-terminal) (LiT) is a software bundle for Lightning Labs products and services.
+It integrates Loop, Pool, Faraday and Taproot Assets and includes LND Accounts and LNC Sessions.
 This fragment requires Bitcoin LND. It selects that dependency automatically.
 
 ## Installation
@@ -10,9 +10,7 @@ This requires an existing BTCPay Server Docker deployment and must be run from a
 root login shell. The fragment selects Bitcoin LND automatically.
 
 > **Important:** Lightning Terminal receives LND's administrative macaroon and
-> can control funds and channels; it is not a read-only dashboard. Its UI and
-> RPC endpoints are routed through the public BTCPay hostname. Protect the
-> generated UI password and consider an additional access-control layer.
+> can control funds and channels. Generate LNC Sessions with caution.
 
 The fragment enables LiT's automatic bbolt-to-SQL migration. Once that migration
 completes, its data cannot be downgraded to a pre-0.17 LiT release or migrated
@@ -26,20 +24,46 @@ Enable the fragment:
 btcpay-fragments add opt-add-lightning-terminal
 ```
 
-Setup generates a 64-character UI password once, stores it in
-`secrets/lit_password`, and mounts it into the container as a Compose secret.
-Display the password from a root login shell with:
+Lightning Terminal appears under **Server Settings > Services**.
 
-```bash
-cat "$BTCPAY_BASE_DIRECTORY/btcpayserver-docker/secrets/lit_password"
-```
+## Command Line Interface
+
+To interact with LiT you may use the command line interface over gRPC. To create an admin session:
+
+`litcli.sh sessions add --label "btcpay" --type admin`
+
+To see the current Loop terms:
+
+`loop.sh terms`
+
+To interact with Pool:
+
+`pool.sh getinfo`
+
+
+To get a report from Faraday:
+
+`frcli.sh insights`
+
+To interact with Taproot Assets:
+
+`tapcli.sh getinfo`
+
+## Web Interface
+
+To interact with LiT through the web-UI you will have to first generate a session through the command line (shown above).
+
+Then, navigate to `https://terminal.lightning.engineering` and click on "Connect My Node."
+
+Enter your pairing phrase and set a password. Each pairing phrase can only be used once.
+
+You may inspect your sessions with:
+
+`litcli.sh sessions list all`
 
-Treat the secret file and Docker access as privileged. To rotate the password,
-replace the file contents with a new password of at least eight characters and
-restart the `lnd_lit` service.
+Retrieve the local pubkey using the command above revoke a session with:
 
-Lightning Terminal appears under **Server Settings > Services** and is served at
-`/lit/` on the BTCPay Server host.
+`litcli.sh sessions revoke --localpubkey <your local pubkey>`
 
 ## Troubleshooting
 

frcli.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+. /etc/profile.d/btcpay-env.sh
+
+docker exec btcpayserver_litd frcli \
+    --rpcserver=localhost:8443 \
+    --tlscertpath=/lit/.lit/tls.cert \
+    --macaroonpath="/lit/.faraday/$NBITCOIN_NETWORK/faraday.macaroon" \
+    --network="$NBITCOIN_NETWORK" \
+    "$@"
+
+# Example usage: . ./bitcoin-frcli.sh insights

generate-secrets.sh

@@ -64,20 +64,15 @@ while IFS= read -r secret; do
     fi
 
     temporary="$(mktemp "$secret_dir/.btcpay-secret.XXXXXX")"
-    # Preserve the UI password when migrating existing LiT deployments.
-    if [[ "$relative_path" == "lit_password" && -n "${LIT_PASSWD:-}" ]]; then
-        printf '%s' "$LIT_PASSWD" > "$temporary"
-    else
-        secret_value=""
-        while (( ${#secret_value} < 64 )); do
-            secret_value+="$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | LC_ALL=C tr -dc 'a-zA-Z0-9')"
-        done
-        printf '%s' "${secret_value:0:64}" > "$temporary"
-    fi
+    secret_value=""
+    while (( ${#secret_value} < 64 )); do
+        secret_value+="$(dd if=/dev/urandom bs=128 count=1 2>/dev/null | LC_ALL=C tr -dc 'a-zA-Z0-9')"
+    done
+    printf '%s' "${secret_value:0:64}" > "$temporary"
     chmod 644 -- "$temporary"
     if [[ ! -e "$secret_path" && ! -L "$secret_path" ]]; then
         mv -n -- "$temporary" "$secret_path"
         printf 'Generated secret %s\n' "$secret"
     fi
     rm -f -- "$temporary"
-done < <(jq -r '(.secrets // [])[]' "$manifest")
+done < <(jq -r '(.secrets // [])[]' "$manifest")

helpers.sh

@@ -29,6 +29,11 @@ install_tooling() {
                 "btcpayserver_bitcoind" "bitcoin-cli.sh" "Command line for your Bitcoin instance" \
                 "btcpayserver_clightning_bitcoin" "bitcoin-lightning-cli.sh" "Command line for your Bitcoin C-Lightning instance" \
                 "btcpayserver_lnd_bitcoin" "bitcoin-lncli.sh" "Command line for your Bitcoin LND instance" \
+                "btcpayserver_litd" "frcli.sh" "Command Line for your Faraday instance" \
+                "btcpayserver_litd" "litcli.sh" "Command Line for your litd instance" \
+                "btcpayserver_litd" "loop.sh" "Command Line for your Loop instance" \
+                "btcpayserver_litd" "pool.sh" "Command Line for your Pool instance" \
+                "btcpayserver_litd" "tapcli.sh" "Command Line for your Taproot Assets instance" \
                 "phoenixd" "phoenix-cli.sh" "Command line for your Phoenixd instance" \
                 "btcpayserver_dashd" "dash-cli.sh" "Command line for your Dash instance" \
                 "btcpayserver_dogecoind" "dogecoin-cli.sh" "Command line for your Dogecoin instance" \

litcli.sh

@@ -0,0 +1,10 @@
+#!/bin/bash
+
+. /etc/profile.d/btcpay-env.sh
+
+docker exec btcpayserver_litd litcli \
+    --basedir="/lit/.lit/" \
+    --network="$NBITCOIN_NETWORK" \
+    "$@"
+
+# Example usage: . ./bitcoin-litcli.sh status

loop.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+. /etc/profile.d/btcpay-env.sh
+
+docker exec btcpayserver_litd loop \
+    --rpcserver=localhost:8443 \
+    --tlscertpath=/lit/.lit/tls.cert \
+    --macaroonpath="/lit/.loop/$NBITCOIN_NETWORK/loop.macaroon" \
+    --network="$NBITCOIN_NETWORK" \
+    "$@"
+
+# Example usage: . ./bitcoin-loop.sh getinfo

pool.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+. /etc/profile.d/btcpay-env.sh
+
+docker exec btcpayserver_litd pool \
+    --rpcserver=localhost:8443 \
+    --tlscertpath=/lit/.lit/tls.cert \
+    --macaroonpath="/lit/.pool/$NBITCOIN_NETWORK/pool.macaroon" \
+    --network="$NBITCOIN_NETWORK" \
+    "$@"
+
+# Example usage: . ./bitcoin-pool.sh getinfo

tapcli.sh

@@ -0,0 +1,12 @@
+#!/bin/bash
+
+. /etc/profile.d/btcpay-env.sh
+
+docker exec btcpayserver_litd tapcli \
+    --rpcserver=localhost:8443 \
+    --tlscertpath=/lit/.lit/tls.cert \
+    --macaroonpath="/lit/.tapd/data/$NBITCOIN_NETWORK/admin.macaroon" \
+    --network="$NBITCOIN_NETWORK" \
+    "$@"
+
+# Example usage: . ./bitcoin-tapcli.sh getinfo

tests/docker-compose-generator-test.sh

@@ -119,29 +119,6 @@ docker compose \
     -f "$test_dir/Generated/docker-compose.clightning-tor-test.yml" \
     config --quiet
 
-(
-    cd "$generator_dir"
-    BTCPAYGEN_REVERSEPROXY="nginx" \
-    BTCPAYGEN_ADDITIONAL_FRAGMENTS="opt-add-lightning-terminal" \
-    BTCPAYGEN_SUBNAME="lit-secret-test" \
-    dotnet run \
-        --no-build \
-        --project src/docker-compose-generator.csproj \
-        --configuration Release \
-        --no-launch-profile \
-        -p:TargetFrameworkOverride=net8.0
-)
-
-jq -e '.secrets | index("../secrets/lit_password") != null' \
-    "$test_dir/Generated/manifest.json" >/dev/null
-grep -q -- '--uipassword_file=/run/secrets/lit_password' \
-    "$test_dir/Generated/docker-compose.lit-secret-test.yml"
-if grep -q -- '--uipassword=' \
-    "$test_dir/Generated/docker-compose.lit-secret-test.yml"; then
-    printf 'Lightning Terminal password was rendered into the command\n' >&2
-    exit 1
-fi
-
 set +e
 proxy_conflict_output="$({
     cd "$generator_dir" || exit 1

tests/generate-secrets-test.sh

@@ -20,14 +20,6 @@ original="$(< "$test_dir/secrets/test")"
 "$repo_dir/generate-secrets.sh" "$test_dir/Generated/manifest.json"
 [[ "$(< "$test_dir/secrets/test")" == "$original" ]]
 
-jq -n '{secrets:["../secrets/lit_password"]}' > "$test_dir/Generated/manifest.json"
-LIT_PASSWD="existing-lit-password" \
-    "$repo_dir/generate-secrets.sh" "$test_dir/Generated/manifest.json"
-[[ "$(< "$test_dir/secrets/lit_password")" == "existing-lit-password" ]]
-LIT_PASSWD="replacement-lit-password" \
-    "$repo_dir/generate-secrets.sh" "$test_dir/Generated/manifest.json"
-[[ "$(< "$test_dir/secrets/lit_password")" == "existing-lit-password" ]]
-
 jq -n '{requiredRoutes:[],optionalRoutes:[],fragments:[]}' > "$test_dir/Generated/manifest.json"
 "$repo_dir/generate-secrets.sh" "$test_dir/Generated/manifest.json"