waved: allow notls/no-macaroons on mainnet behind an opt-in flag - #998
Merged
Conversation
![gemini-code-assist[bot]](https://avatars.githubusercontent.com/in/956858?s=60&v=4){kind=small}
There was a problem hiding this comment.
Code Review
This pull request introduces the allow-insecure-mainnet configuration option and CLI flag, which permits running mainnet TCP listeners without TLS or macaroons when transport security is handled externally. It updates the validation logic to respect this override and adds corresponding unit tests to verify the behavior. I have no feedback to provide.
Important
The consumer version of Gemini Code Assist on GitHub is being sunset. Starting June 18, 2026, new organization installations will be blocked, and all code review activity will officially cease on July 17, 2026.
For more details on the timeline and next steps, please review the Help Documentation.
The daemon refuses rpc.notls and rpc.no-macaroons on mainnet TCP listeners so a stray flag can't silently stand up an unauthenticated, plaintext RPC surface on real funds. That guard assumes the daemon terminates its own transport security, which isn't true for deployments that front waved with a proxy that terminates TLS and enforces auth before traffic ever reaches the listener. For those operators the guard is a false positive that blocks startup outright. In this commit, we add an allow-insecure-mainnet escape hatch. The flag is off by default, so the guard still stands for everyone who hasn't deliberately opted out; when set, it lifts the mainnet-TCP refusal for both options. The lightning-infra tracking issue carries the rationale for why external TLS termination is the deployment model here.
Roasbeef
force-pushed
the
mainnet-insecure-override
branch
from
July 20, 2026 17:59
26e38d4 to
6b4cf14
Compare
Roasbeef
added
the
backport-v0.1.x-branch
|
Successfully created backport PR for |
Roasbeef
added a commit
that referenced
this pull request
Jul 20, 2026
[v0.1.x-branch] Backport #998: waved: allow notls/no-macaroons on mainnet behind an opt-in flag
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Motivation
The mainnet instance currently can't start with
--rpc.notlsand--rpc.no-macaroons.validateRPCSecurityrefuses both on mainnet TCPlisteners so that a stray flag can't silently expose an unauthenticated,
plaintext RPC surface on real funds.
That guard assumes the daemon terminates its own transport security. It
isn't true for our release deployment, where
wavedsits behind a proxythat terminates TLS and enforces authentication before any traffic
reaches the listener. For that topology the guard is a false positive
that blocks startup outright. The rationale for external TLS termination
is tracked in the lightning-infra issue.
This PR
Adds an
--allow-insecure-mainnetopt-in that lifts the mainnet-TCPrefusal for both
rpc.notlsandrpc.no-macaroons:deliberately opted out. This mirrors the existing
--allow-mainnetsafety-flag pattern.
and the refusal error now names the flag so an operator who hits it
knows the escape hatch exists.
Testing
TestConfigValidateMainnetInsecureRPCcovers the matrix: each optionrefused by default, and each (plus both together) accepted once the
override is set.
Companion
Paired with the server-side change in lumos, which adds the same
--allow-insecure-mainnetopt-in for its client and admin RPC guards.