Skip to content

lnaddress: fix Docker healthcheck, port docs and CLN security notes - #15

Open
nGoline wants to merge 2 commits into
mainfrom
docs/readme
Open

nGoline wants to merge 2 commits into
mainfrom
docs/readme

Conversation

@nGoline

@nGoline nGoline commented Oct 22, 2026 •

Copy link
Copy Markdown
Owner

Fixes the deployment problems found running v0.1.0 against Core Lightning, plus README drift.

Image

  • Built-in HEALTHCHECK: polls /health with busybox wget (the alpine image has no curl) on ${ASPNETCORE_HTTP_PORTS:-8080}. Deployments no longer need their own healthcheck; the example compose file drops its copy.
  • Quieter logs: ships an appsettings.json that logs Microsoft.AspNetCore at Warning. The healthcheck used to log about 6 Information lines every 30 s; now it logs none. Startup lines (Microsoft.Hosting.Lifetime) are kept. Set Logging__LogLevel__Microsoft.AspNetCore=Information to see requests again. .dockerignore now allows that one file.

docker-compose.yml

  • Port 8080: the image runs as non-root and listens on 8080, so ASPNETCORE_URLS=http://+:80 is dropped and the mapping becomes 65535:8080. example.nginx still points at 65535.
  • The broken curl healthcheck is removed; the image's healthcheck is used instead.

README

  • docker run examples used -p 80:80 → -p 8080:8080.
  • CLN security warning: cln-grpc client certificates can't be scoped and grant full control of the node, funds included. Keep gRPC on a private Docker network, proxy only /.well-known/lnurlp/ and /lnurl/, and treat CLN__* like hot-wallet keys.
  • New Docker Image section: port, healthcheck, log levels.
  • LND cert one-liner (the old /.lnd/tls.cert path was wrong; raw PEM isn't accepted), TLS requirement for the proxy, release binaries, endpoint table, development and test commands, docker compose.

Verified

End to end against a CLN v26.06.9 regtest node, with this branch combined with #13 and #16 and the deployment's layout (container-to-container gRPC, only 8080 published):

  • Container goes healthy.
  • 0 /health log lines over 10 s; startup lines still shown.
  • Also confirmed lnaddress: commit invoices to the LNURL metadata #16 in the same run: description_hash == sha256(metadata) per lightning-cli decode, comment in the label, real payment settles, and verify returns the preimage.

Merges cleanly with #13, #14 and #16.

🤖 Generated with Claude Code

The image listens on 8080 and ships wget but not curl, so the compose
healthcheck always failed and the docker run examples mapped the wrong
port. Fix both, along with the LND certificate instructions, and note
that the reverse proxy must terminate TLS since callback URLs are
always https.

Document the release binaries, the HTTP endpoints, and how to build and
run the tests.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
Add a HEALTHCHECK that polls /health with busybox wget, so deployments
no longer need their own, and drop it from the example compose file.

Ship an appsettings.json that logs Microsoft.AspNetCore at Warning, so
the healthcheck doesn't log six lines every 30 seconds.

Document that cln-grpc client certificates grant full control of the
node and how to limit their exposure.

Co-Authored-By: Claude Opus 5.5 <noreply@anthropic.com>
@nGoline nGoline changed the title doc: bring README and docker-compose in line with the image lnaddress: fix Docker healthcheck, port docs and CLN security notes Oct 22, 2026
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment

Labels

None yet

Projects

None yet

Development

Successfully merging this pull request may close these issues.

1 participant