feat: add lnproxy server, webui and check payment hashes as a client (#3637)

* lnproxy: check if payment hashes match #3636

* go update to 1.19.5 and verify checkums

* add lnproxy install script

* add lnproxy-webui

* pin versions and fix formatting

* add nginx configs for lnproxy

home.admin/_commands.sh

@@ -78,16 +78,17 @@ function blitzhelp() {
   echo "  ckbunker     CKbunker"
   echo
   echo "Extras:"
-  echo "  manage       use the lndmanage bonus app"
   echo "  whitepaper   download the whitepaper from the blockchain to /home/admin/bitcoin.pdf"
   echo "  notifyme     wrapper for blitz.notify.sh that will send a notification using the configured method and settings"
   echo "  suez         visualize channels (for the default ln implementation and chain when installed)"
+  exho "  lnproxy      wrap invoices with lnproxy"
   echo
   echo "LND:"
   echo "  lncli        LND commandline interface (when installed)"
   echo "  balance      your satoshi balance"
   echo "  channels     your lightning channels"
   echo "  fwdreport    show forwarding report"
+  echo "  manage       use the lndmanage bonus app"
   echo
   echo "CLN:"
   echo " lightning-cli Core Lightning commandline interface (when installed)"
@@ -529,17 +530,32 @@ function bm() {
 
 # command: lnproxy
 function lnproxy() {
-  if [ $(cat /mnt/hdd/raspiblitz.conf 2>/dev/null | grep -c "runBehindTor=on") -eq 1 ]; then
+  source /mnt/hdd/raspiblitz.conf
-    echo
+  if [ $# -gt 0 ]; then
-    echo "Requesting a wrapped invoice from rdq6tvulanl7aqtupmoboyk2z3suzkdwurejwyjyjf4itr3zhxrm2lad.onion ..."
+    invoice=$1
-    echo
-    torify curl http://rdq6tvulanl7aqtupmoboyk2z3suzkdwurejwyjyjf4itr3zhxrm2lad.onion/api/${1}
   else
-    echo
+    echo "Paste the invoice to be wrapped and press enter:"
-    echo "Requesting a wrapped invoice from https://lnproxy.org ..."
+    read -r invoice
-    echo
-    curl https://lnproxy.org/api/${1}
   fi
+  if systemctl is-active --quiet tor@default; then
+    if [ -z "${lnproxy_override_tor}" ]; then
+      lnproxy_override_tor="rdq6tvulanl7aqtupmoboyk2z3suzkdwurejwyjyjf4itr3zhxrm2lad.onion/api"
+    fi
+    wrapped=$(torsocks curl -sS http://${lnproxy_override_tor}/${invoice})
+    echo
+    echo "Requesting a wrapped invoice from ${lnproxy_override_tor}"
+  else
+    if [ -z "${lnproxy_override_clearnet}" ]; then
+      lnproxy_override_clearnet="lnproxy.org/api"
+    fi
+    wrapped=$(curl -sS https://${lnproxy_override_clearnet}/${invoice})
+    echo
+    echo "Requesting a wrapped invoice from ${lnproxy_override_clearnet}"
+  fi
+  echo
+  /home/admin/config.scripts/blitz.check-invoice-wrap.py "$1" "$wrapped"
+  echo
+  echo $wrapped
 }
 
 # command: suez

home.admin/assets/nginx/sites-available/lnproxy_ssl.conf

@@ -0,0 +1,27 @@
+## lnproxy_ssl.conf
+
+server {
+    listen 4749 ssl http2;
+    listen [::]:4749 ssl http2;
+    server_name _;
+
+    include /etc/nginx/snippets/ssl-params.conf;
+    include /etc/nginx/snippets/ssl-certificate-app-data.conf;
+
+    include /etc/nginx/snippets/gzip-params.conf;
+
+    access_log /var/log/nginx/access_lnproxy.log;
+    error_log /var/log/nginx/error_lnproxy.log;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:4747;
+
+        include /etc/nginx/snippets/ssl-proxy-params.conf;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:4748;
+
+        include /etc/nginx/snippets/ssl-proxy-params.conf;
+    }
+}

home.admin/assets/nginx/sites-available/lnproxy_tor.conf

@@ -0,0 +1,26 @@
+## lnproxy_tor.conf
+
+server {
+    listen 4750;
+    server_name _;
+
+    include /etc/nginx/snippets/ssl-params.conf;
+    include /etc/nginx/snippets/ssl-certificate-app-data.conf;
+
+    include /etc/nginx/snippets/gzip-params.conf;
+
+    access_log /var/log/nginx/access_lnproxy.log;
+    error_log /var/log/nginx/error_lnproxy.log;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:4747;
+
+        include /etc/nginx/snippets/ssl-proxy-params.conf;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:4748;
+
+        include /etc/nginx/snippets/ssl-proxy-params.conf;
+    }
+}

home.admin/assets/nginx/sites-available/lnproxy_tor_ssl.conf

@@ -0,0 +1,26 @@
+## lnproxy_tor_ssl.conf
+
+server {
+    listen 4751 ssl http2;
+    server_name _;
+
+    include /etc/nginx/snippets/ssl-params.conf;
+    include /etc/nginx/snippets/ssl-certificate-app-data.conf;
+
+    include /etc/nginx/snippets/gzip-params.conf;
+
+    access_log /var/log/nginx/access_lnproxy.log;
+    error_log /var/log/nginx/error_lnproxy.log;
+
+    location /api/ {
+        proxy_pass http://127.0.0.1:4747;
+
+        include /etc/nginx/snippets/ssl-proxy-params.conf;
+    }
+
+    location / {
+        proxy_pass http://127.0.0.1:4748;
+
+        include /etc/nginx/snippets/ssl-proxy-params.conf;
+    }
+}

home.admin/config.scripts/blitz.check-invoice-wrap.py

@@ -0,0 +1,54 @@
+#!/usr/bin/env python3
+# adapted from: https://github.com/lnproxy/lnproxy-cli/blob/fe18d16e42b58f635b94c7da59a34d5e092e4d56/check-wrap.py
+# Parses payment hashes and amounts in bolt11 invoices to check lnproxy
+# Can skip most bolt11 checks since both the user's wallet and lnproxy will do that
+
+from decimal import Decimal
+
+CHARSET = "qpzry9x8gf2tvdw0s3jn54khce6mua7l"
+units = {
+	'p': 10**12,
+	'n': 10**9,
+	'u': 10**6,
+	'm': 10**3,
+}
+
+def parse(invoice):
+	invoice = invoice.lower()
+	pos = invoice.rfind('1')
+	amount = invoice[4:pos]
+	if amount == '':
+		amount = Decimal(0)
+	else:
+		amount = Decimal(amount[:-1]) / units[amount[-1]]
+	data = invoice[pos+1+7:]
+	i = 0
+	while i < len(data):
+		if data[i] == 'p' and data[i+1:i+1+2] == 'p5':
+			payment_hash = data[i+1+2:i+1+2+52]
+			break
+		else:
+			i += 3 + CHARSET.find(data[i+1]) * 32 + CHARSET.find(data[i+1+1])
+	return (amount, payment_hash)
+
+from sys import stderr, argv
+try:
+	if len(argv) != 3:
+		raise Exception("Incorrect number of arguments")
+
+	amt1, hash1 = parse(argv[1])
+	amt2, hash2 = parse(argv[2])
+
+	if hash1 != hash2:
+		print(f"Payment hashes do not match!", file=stderr)
+		exit(3)
+
+	if amt1 != Decimal(0):
+		print(f"Hashes match, routing fee is {(amt2-amt1)*10**8:0,.0f} sat ({(amt2-amt1)/amt1*100:0.2f}%)")
+	else:
+		print(f"Hashes match")
+
+except Exception as err:
+	print('Error:', err)
+	print(f"usage: {argv[0]} <original invoice> <wrapped invoice>", file=stderr)
+	exit(2)

home.admin/config.scripts/bonus.go.sh

@@ -1,10 +1,15 @@
 #!/usr/bin/env sh
 
 # set version, check: https://golang.org/dl/
-goVersion="1.18.7"
+goVersion="1.19.5"
+# checksums:
+amd64Checksum="36519702ae2fd573c9869461990ae550c8c0d955cd28d2827a6b159fda81ff95"
+armv6lChecksum="ec14f04bdaf4a62bdcf8b55b9b6434cc27c2df7d214d0bb7076a7597283b026a"
+arm64Checksum="fc0aa29c933cec8d76f5435d859aaf42249aa08c74eb2d154689ae44c08d23b3"
+
 downloadFolder="/home/admin/download"
 
-usage(){
+usage() {
   printf "Config script to install or remove Go\n"
   printf "./bonus.go.sh [on|off]\n"
   exit 1
@@ -12,21 +17,26 @@ usage(){
 
 case "$1" in
 
-  1|on) # switch on
+1 | on)          # switch on
   . /etc/profile # get Go vars - needed if there was no log-out since Go installed
-    printf "Check Framework: Go\n"
+  printf "# Check Framework: Go\n"
-    if go version 2>/dev/null | grep -q "${goVersion}" ; then
+  if go version 2>/dev/null | grep -q "${goVersion}"; then
     printf "\nThe requested version of Go is already installed.\n"
     go version
     printf "\n"
   else
-      architecture="$(uname -m)"
+    goOSversion=$(dpkg --print-architecture)
-      case "${architecture}" in
+    if [ ${goOSversion} = "armv6l" ]; then
-        arm*) goOSversion="armv6l";;
+      checksum=${armv6lChecksum}
-        aarch64) goOSversion="arm64";;
+    elif [ ${goOSversion{} = "arm64" ]; then
-        x86_64) goOSversion="amd64";;
+      checksum=${arm64Checksum}
-        *) printf %s"Not available for architecture=${architecture}\n"; exit 1
+    elif [ ${goOSversion} = "amd64" ]; then
-      esac
+      checksum=${amd64Checksum}
+    else
+      echo "# architecture $goOSversion not supported"
+      exit 1
+    fi
+
     printf %s"\n*** Installing Go v${goVersion} for ${goOSversion} \n***"
     wget https://dl.google.com/go/go${goVersion}.linux-${goOSversion}.tar.gz -P ${downloadFolder}
     if [ ! -f "${downloadFolder}/go${goVersion}.linux-${goOSversion}.tar.gz" ]; then
@@ -34,7 +44,13 @@ case "$1" in
       rm -fv go${goVersion}.linux-${goOSversion}.tar.gz*
       exit 1
     fi
-      printf "Clean old Go version\n"
+    if ! echo ${checksum} ${downloadFolder}/go${goVersion}.linux-${goOSversion}.tar.gz | sha256sum -c; then
+      printf "# FAIL: Download corrupted\n"
+      rm -fv ${downloadFolder}/go${goVersion}.linux-${goOSversion}.tar.gz*
+      exit 1
+    fi
+
+    printf "# Clean old Go version\n"
     sudo rm -rf /usr/local/go /usr/local/gocode
     sudo tar -C /usr/local -xzf ${downloadFolder}/go${goVersion}.linux-${goOSversion}.tar.gz
     rm -fv ${downloadFolder}/go${goVersion}.linux-${goOSversion}.tar.gz*
@@ -46,17 +62,20 @@ case "$1" in
     export PATH=$PATH:$GOPATH/bin
     sudo grep -q "GOROOT=" /etc/profile || { printf "\nGOROOT=/usr/local/go\nPATH=\$PATH:\$GOROOT/bin/\nGOPATH=/usr/local/gocode\nPATH=\$PATH:\$GOPATH/bin/\n\n" | sudo tee -a /etc/profile; }
     go env -w GOPATH=/usr/local/gocode # set GOPATH https://github.com/golang/go/wiki/SettingGOPATH
-      go version | grep -q "go" || { printf "FAIL: Unable to install Go\n"; exit 1; }
+    go version | grep -q "go" || {
+      printf "FAIL: Unable to install Go\n"
+      exit 1
+    }
     printf %s"Installed $(go version 2>/dev/null)\n\n"
   fi
   ;;
 
-  0|off) # switch off
+0 | off) # switch off
   printf "*** REMOVING GO ***\n"
   sudo rm -rf /usr/local/go /usr/local/gocode
-    printf "OK Go removed.\n"
+  printf "# OK Go removed.\n"
   ;;
 
-  *) usage
+*) usage ;;
 
 esac

home.admin/config.scripts/bonus.lnproxy.sh

@@ -0,0 +1,252 @@
+#!/bin/bash
+
+# https://github.com/lnproxy/lnproxy/commits/main
+LNPROXYVERSION="423723b58cc45daa2fdf6c8b22537d560aca4d7a"
+# https://github.com/lnproxy/lnproxy-webui/commits/main
+WEBUIVERSION=24d291c884a0b60126c1915301f29c893900a155
+
+# command info
+if [ $# -eq 0 ] || [ "$1" = "-h" ] || [ "$1" = "-help" ]; then
+  echo "config script to install or uninstall the lnproxy server"
+  echo "bonus.lnproxy.sh [on|off|menu]"
+  echo "installs the version $LNPROXYVERSION by default"
+  exit 1
+fi
+
+source /mnt/hdd/raspiblitz.conf
+localip=$(hostname -I | awk '{print $1}')
+
+# menu
+if [ "$1" = "menu" ]; then
+
+  if systemctl is-active --quiet lnproxy; then
+    # get network info
+    torAddress=$(sudo cat /mnt/hdd/tor/lnproxy/hostname 2>/dev/null)
+    fingerprint=$(openssl x509 -in /mnt/hdd/app-data/nginx/tls.cert -fingerprint -noout | cut -d"=" -f2)
+
+    if [ "${runBehindTor}" = "on" ] && [ -n "${torAddress}" ]; then
+      # Info with Tor
+      sudo /home/admin/config.scripts/blitz.display.sh qr "${torAddress}"
+      whiptail --title " lnproxy-webui and API" --msgbox "\
+Open in your local web browser:
+http://${localip}:4748
+https://${localip}:4749 with Fingerprint:
+${fingerprint}\n
+Hidden Service address for Tor Browser (see LCD for QR):
+${torAddress}\n
+To use the API:
+curl -k https://${localip}:4749/api/{invoice}?routing_msat={budget}\n
+The Tor Hidden Service address to share for using the API:
+${torAddress}/api
+" 19 67
+      sudo /home/admin/config.scripts/blitz.display.sh hide
+    else
+      # Info without Tor
+      whiptail --title " lnproxy-webui " --msgbox "Open in your local web browser:
+http://${localip}:4748\n
+Activate Tor to access the web interface from outside your local network.
+" 15 57
+    fi
+    echo "# please wait ..."
+  else
+    echo "# *** LNPROXY IS NOT INSTALLED ***"
+  fi
+  exit 0
+fi
+
+# install
+if [ "$1" = "1" ] || [ "$1" = "on" ]; then
+
+  if systemctl is-active --quiet lnproxy; then
+    echo "# FAIL - lnproxy already installed"
+    sleep 3
+    exit 1
+  fi
+
+  echo "*** INSTALL LNPROXY ***"
+  # check and install Go
+  /home/admin/config.scripts/bonus.go.sh on
+
+  # create lnproxy user
+  sudo adduser --disabled-password --gecos "" lnproxy
+
+  # create macaroon
+  cd /home/bitcoin || exit 1
+  sudo -u bitcoin lncli bakemacaroon --save_to lnproxy.macaroon \
+    uri:/lnrpc.Lightning/DecodePayReq \
+    uri:/lnrpc.Lightning/LookupInvoice \
+    uri:/invoicesrpc.Invoices/AddHoldInvoice \
+    uri:/invoicesrpc.Invoices/SubscribeSingleInvoice \
+    uri:/invoicesrpc.Invoices/CancelInvoice \
+    uri:/invoicesrpc.Invoices/SettleInvoice \
+    uri:/routerrpc.Router/SendPaymentV2
+  sudo mv ./lnproxy.macaroon /home/lnproxy/
+  sudo chown lnproxy:lnproxy /home/lnproxy/lnproxy.macaroon
+  sudo chmod 600 /home/lnproxy/lnproxy.macaroon
+
+  # make sure symlink to central app-data directory exists
+  sudo rm -rf /home/lnproxy/.lnd # not a symlink.. delete it silently
+  # create symlink
+  sudo ln -s "/mnt/hdd/app-data/lnd/" "/home/lnproxy/.lnd"
+
+  # download source code
+  cd /home/lnproxy/ || exit 1
+  sudo -u lnproxy git clone https://github.com/lnproxy/lnproxy.git /home/lnproxy/lnproxy
+  cd /home/lnproxy/lnproxy || exit 1
+  sudo -u lnproxy git reset --hard ${LNPROXYVERSION} || exit 1
+
+  # build
+  sudo -u lnproxy /usr/local/go/bin/go get lnproxy
+  sudo -u lnproxy /usr/local/go/bin/go build
+
+  # manual start (in tmux)
+  # sudo -u lnproxy /home/lnproxy/lnproxy/lnproxy -lnd-cert /home/lnproxy/.lnd/tls.cert /home/lnproxy/lnproxy.macaroon
+
+  # create systemd service
+  cat <<EOF | sudo tee /etc/systemd/system/lnproxy.service
+[Unit]
+Description=lnproxy
+After=lnd.service
+
+[Service]
+User=lnproxy
+Group=lnproxy
+Type=simple
+ExecStart=/home/lnproxy/lnproxy/lnproxy -lnd-cert /home/lnproxy/.lnd/tls.cert /home/lnproxy/lnproxy.macaroon
+Restart=on-failure
+RestartSec=30
+TimeoutSec=120
+
+# Hardening measures
+PrivateTmp=true
+ProtectSystem=full
+NoNewPrivileges=true
+PrivateDevices=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+  # enable and start service
+  sudo systemctl enable lnproxy
+
+  source <(/home/admin/_cache.sh get state)
+  if [ "${state}" == "ready" ]; then
+    echo "# OK - the lnproxy.service is enabled, system is on ready so starting service"
+    sudo systemctl start lnproxy
+  else
+    echo "# OK - the lnproxy.service is enabled, to start manually use: sudo systemctl start lnproxy"
+  fi
+
+  # lnproxy-webui
+  cd /home/lnproxy/ || exit 1
+  sudo -u lnproxy git clone https://github.com/lnproxy/lnproxy-webui
+  cd /home/lnproxy/lnproxy-webui || exit 1
+  sudo -u lnproxy git reset --hard ${WEBUIVERSION} || exit 1
+
+  # build
+  sudo -u lnproxy /usr/local/go/bin/go get lnproxy-webui
+  sudo -u lnproxy /usr/local/go/bin/go build
+
+  # create systemd service
+  cat <<EOF | sudo tee /etc/systemd/system/lnproxy-webui.service
+[Unit]
+Description=lnproxy-webui
+After=lnproxy.service
+
+[Service]
+WorkingDirectory=/home/lnproxy/lnproxy-webui
+User=lnproxy
+Group=lnproxy
+Type=simple
+ExecStart=/home/lnproxy/lnproxy-webui/lnproxy-webui
+Restart=on-failure
+RestartSec=30
+TimeoutSec=120
+
+# Hardening measures
+PrivateTmp=true
+ProtectSystem=full
+NoNewPrivileges=true
+PrivateDevices=true
+
+[Install]
+WantedBy=multi-user.target
+EOF
+
+  # enable and start service
+  sudo systemctl enable lnproxy-webui
+
+  source <(/home/admin/_cache.sh get state)
+  if [ "${state}" == "ready" ]; then
+    echo "# OK - the lnproxy-webui.service is enabled, system is on ready so starting service"
+    sudo systemctl start lnproxy-webui
+  else
+    echo "# OK - the lnproxy-webui.service is enabled, to start manually use: sudo systemctl start lnproxy-webui"
+  fi
+
+  ##################
+  # NGINX
+  ##################
+  # setup nginx symlinks
+  if ! [ -f /etc/nginx/sites-available/lnproxy_ssl.conf ]; then
+    sudo cp -f /home/admin/assets/nginx/sites-available/lnproxy_ssl.conf /etc/nginx/sites-available/lnproxy_ssl.conf
+  fi
+  if ! [ -f /etc/nginx/sites-available/lnproxy_tor.conf ]; then
+    sudo cp /home/admin/assets/nginx/sites-available/lnproxy_tor.conf /etc/nginx/sites-available/lnproxy_tor.conf
+  fi
+  if ! [ -f /etc/nginx/sites-available/lnproxy_tor_ssl.conf ]; then
+    sudo cp /home/admin/assets/nginx/sites-available/lnproxy_tor_ssl.conf /etc/nginx/sites-available/lnproxy_tor_ssl.conf
+  fi
+  sudo ln -sf /etc/nginx/sites-available/lnproxy_ssl.conf /etc/nginx/sites-enabled/
+  sudo ln -sf /etc/nginx/sites-available/lnproxy_tor.conf /etc/nginx/sites-enabled/
+  sudo ln -sf /etc/nginx/sites-available/lnproxy_tor_ssl.conf /etc/nginx/sites-enabled/
+  sudo nginx -t
+  sudo systemctl reload nginx
+
+  sudo ufw allow 4747 comment lnproxy-HTTP
+  sudo ufw allow 4748 comment lnproxy-webui-HTTP
+  sudo ufw allow 4749 comment lnproxy-HTTPS
+
+  /home/admin/config.scripts/tor.onion-service.sh lnproxy 80 4750 443 4751
+
+  # setting value in raspi blitz config
+  /home/admin/config.scripts/blitz.conf.sh set lnproxy "on"
+
+  echo "# API:"
+  echo "curl http://${localip}:4747/{your_invoice}?routing_msat={routing_budget}"
+  echo "# WebUI:"
+  echo "http://${localip}:4748"
+  echo "# More info at:"
+  echo "https://github.com/lnproxy/lnproxy"
+
+  exit 0
+fi
+
+# switch off
+if [ "$1" = "0" ] || [ "$1" = "off" ]; then
+  echo "*** REMOVING LNPROXY***"
+  # remove user and home directory
+  sudo userdel -rf lnproxy
+
+  # remove systemd services
+  sudo systemctl disable --now lnproxy
+  /etc/systemd/system/lnproxy.service
+  sudo systemctl disable --now lnproxy-webui
+  /etc/systemd/system/lnproxy-webui.service
+
+  # remove Tor service
+  /home/admin/config.scripts/tor.onion-service.sh off lnproxy
+
+  # close ports on firewall
+  sudo ufw delete allow 4747
+  sudo ufw delete allow 4748
+  sudo ufw delete allow 4749
+
+  # setting value in raspi blitz config
+  /home/admin/config.scripts/blitz.conf.sh set lnproxy "off"
+
+  echo "# OK, lnproxy is removed."
+
+  exit 0
+fi