The GRPC connection logger is very verbose and normally not very useful.
So it leads to more confusion and unnecessary log bloat than it actually
helps to debug things.
So we disable it by default, meaning that if GRPC=<level> doesn't appear
in the log level config string, we add GRPC=off.
That means we can still manually turn it on by adding ,GRPC=info to the
log config (e.g. --lnd.debuglevel=debug,GRPC=info).
This commit adds the `tlsextraip` and `tlsextradomain` config fields to
the LiT config. This allows users to specify additional IPs and domains
to be included in the TLS certificate.
Fix the macaroon path construction so that even if the network is not
mainnet, the path gets constructed correctly from a user specified
"--lit.dir" flag.
By default the taproot assets subserver will start in integrated mode
like the rest of subservers. An execption is if we are running in
"mainnet" where we want it disabled because it is not yet supported.
Users won't be able to start the sub-server in "mainnet" even if they
set the `--taproot-assets-mode=` flag.
Enable to start litd with taproot asset subserver disabled.
The default mode for the new sub-server is "Disabled"
Add coverage in itests for flows with some subservers disabled (based on
Elle's #537)
Ensure that all of Lit's subserver loggers have been registered _before_
the config is validated. This will allow users to use the
`--lnd.debuglevel` flag to set Lit specific subserever logger levels.
Add a new `disableui` config option. If this option is set then the user
no longer needs to set the `uipassword` config option. This also means
that the user will no longer be able to interact with the local UI.
In this commit, we remove Lit's dependency on LND's tls cert in
integrated mode. With this commit, even if Lit is started in integrated
mode, it will create its own tls cert to use for serving the webserver.
This commit fixes an issue with file system paths on Windows. The path
package is only intended to be used with URIs or non file system paths.
For anything OS dependent, filepath should be used instead.
In this commit, we add a deadline for the initial connection of an LNC
connection. So with this, the user is forced to use their pairing phrase
within a certain time frame. After this initial connection, future
connections are made with the second handshake version meaning that the
pairing phrase is rendered useless. By adding a time limit to the time
in which a user can use their pairing phrase, we reduce the risk created
by the users pairing phrase being leaked. The default time limit is set
to 10 minutes but can be customsed with the new `firstlncconndeadline`
flag.
In integrated mode we hook directly into lnd's bufconn listener for any
connections to it. So we don't need any TLS setup and can bake a single
super macaroon that is used for all RPC calls.
To make sure we set the log level for all registered loggers, we need to
move the call that sets the level. Since we only have one root logger,
we can only use one value for the global level. So we use the
--remote.lit-debuglevel in remote lnd mode and the --lnd.debuglevel in
integrated mode. Individual sub loggers can still be overwritten if the
following syntax is used: --lnd.debuglevel=debug,AUCT=trace for example.
We want to give the REST proxy the same functionality as the lnd built
in REST proxy has and therefore enable CORS and WebSocket support on it
as well.
Fixes#213 by allowing users to enable REST calls to be made directly to
the main HTTP(S) listener(s). This approach is chosen over spinning up
an additional listener (or multiple, if non-TLS is also needed) just for
REST because it should make everyone's lives easier if only one port
needs to be used. There also shouldn't be any security tradeoff since a
macaroon is still required and all communication happens over TLS
anyway.
Partially reverts c917e91f and fixes#195: The default remote lnd admin
macaroon path we added in c917e91f was a mistake since by default that
value isn't set until we call lnd.ValidateConfig() which we never do in
the remote mode.
We fix this by providing a sane default value for the admin macaroon
again.
As a first step towards making it possible to only run the UI itself and
have all daemons run on another host (or in another process), we add new
remote configuration options for each of the remaining daemons.
Since we know that only the Bitcoin network is used and that all
components must operate on the same network, we can make the
configuration a lot easier for the user by allowing them to only specify
a single option for the network. We'll then go ahead and set that in all
the necessary sub structs.
To make the macaroon handling a bit more intuitive and the code easier
to understand we now remove the deprecated macaroondir config option in
favor of the more explicit macaroonpath one.
With the new lndclient version we can specify a single, custom macaroon.
We use the admin macaroon as the custom macaroon in the remote
connection case which removes the need to copy all subserver macaroons
to the host where LiT is running. Users baking custom non-admin
macaroons can also specify that directly with a new configuration
option.
For uses of LiT through Tor connections that add their own layer of
transport security, it doesn't make sense to add TLS on top. We
therefore allow running an additional HTTP only listener.
