[v0.1.x-branch] Backport #998: waved: allow notls/no-macaroons on mainnet behind an opt-in flag - #999
Merged
Conversation
The daemon refuses rpc.notls and rpc.no-macaroons on mainnet TCP listeners so a stray flag can't silently stand up an unauthenticated, plaintext RPC surface on real funds. That guard assumes the daemon terminates its own transport security, which isn't true for deployments that front waved with a proxy that terminates TLS and enforces auth before traffic ever reaches the listener. For those operators the guard is a false positive that blocks startup outright. In this commit, we add an allow-insecure-mainnet escape hatch. The flag is off by default, so the guard still stands for everyone who hasn't deliberately opted out; when set, it lifts the mainnet-TCP refusal for both options. The lightning-infra tracking issue carries the rationale for why external TLS termination is the deployment model here. (cherry picked from commit 6b4cf14)
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Backport of #998
Motivation
The mainnet instance currently can't start with
--rpc.notlsand--rpc.no-macaroons.validateRPCSecurityrefuses both on mainnet TCPlisteners so that a stray flag can't silently expose an unauthenticated,
plaintext RPC surface on real funds.
That guard assumes the daemon terminates its own transport security. It
isn't true for our release deployment, where
wavedsits behind a proxythat terminates TLS and enforces authentication before any traffic
reaches the listener. For that topology the guard is a false positive
that blocks startup outright. The rationale for external TLS termination
is tracked in the lightning-infra issue.
This PR
Adds an
--allow-insecure-mainnetopt-in that lifts the mainnet-TCPrefusal for both
rpc.notlsandrpc.no-macaroons:deliberately opted out. This mirrors the existing
--allow-mainnetsafety-flag pattern.
and the refusal error now names the flag so an operator who hits it
knows the escape hatch exists.
Testing
TestConfigValidateMainnetInsecureRPCcovers the matrix: each optionrefused by default, and each (plus both together) accepted once the
override is set.
Companion
Paired with the server-side change in lumos, which adds the same
--allow-insecure-mainnetopt-in for its client and admin RPC guards.