Unlock LND wallet using wallet password file for an lnd stateless node #8714
-
|
We're exploring unlocking an LND wallet following this, but I don't see an option to do this for a stateless node. Is this possible? |
Beta Was this translation helpful? Give feedback.
Replies: 1 comment 5 replies
-
|
No, that's not possible. Because the only way to get access to the admin macaroon on a stateless node is from the response of the |
Beta Was this translation helpful? Give feedback.
-
|
Thanks for the response! Do you see this is as a use case? In our case (we're on k8s), we run our nodes in stateless mode and unlock the wallet automatically using a wallet unlock script that is executed as a post start feature. The password file works great in our scenario since we can retrieve the password from our secrets manager than having to create a k8s secret resource). This leaves no trace of the lnd password on the pod itself. The problem is we can't do it with a stateless node. |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, I think I do see a use case here. Though I think that would rather be a new command for
|
Beta Was this translation helpful? Give feedback.
-
We use Hashicorp Vault to manage our secrets combined with vault security webhooks for secrets injection.
We use a lightning cli node (that has the macaroon) and only enable it whenever we need to operate on the lnd node directly. |
Beta Was this translation helpful? Give feedback.
-
|
Would you like me to create an issue for this? |
Beta Was this translation helpful? Give feedback.
-
|
Yeah, sure. Definitely makes sense as a feature request in the |
Beta Was this translation helpful? Give feedback.
No, that's not possible. Because the only way to get access to the admin macaroon on a stateless node is from the response of the
lncli unlockcall. And if you use auto-unlocking, then this step is skipped.Also, in my opinion, auto-unlocking and stateless mode are (from a security perspective) orthogonal to each other.