Run your own Lightning node

Self-hosted node for bitcoin-blake2b, controlled from the app

SHA256(tlw-node-installer-0.4.0.tar.gz) = 0e312b98ca44d23f842023dcd53e0c40977cccf82736a88732b4f99da8dbf465

sha256sum tlw-node-installer-0.4.0.tar.gz

Get-FileHash .\tlw-node-installer-0.4.0.tar.gz -Algorithm SHA256

Install (3 commands)

tar -xzf tlw-node-installer-0.4.0.tar.gz
cd tlw-node-installer-0.4.0
./install.sh --bitcoind-rpc rpcuser:[email protected]:8332

Run it as your regular user: sudo is never required.

At the end the installer prints the connection string (NWC/NCC URI) — see “Connect the app” below for where to find it and a format example.

Requirements

Lightning means running a real node: the installer sets everything up for you, but the machine and the full node must already be there.

• A machine you keep online (server / VM / homelab): Ubuntu 22.04 / 24.04 / 26.04 (x86_64). Other distributions only with custom artifacts (--cln-url/--cln-sha256 --allow-custom-urls); Debian 12 is not covered by the upstream binaries.
• A synced bitcoind blake2b full node, reachable via RPC — it is not installed by this package (reference: DarkWebDivingClub/bitcoin-knots). Auto-detected from ~/.bitcoin/bitcoin.conf, or pass --bitcoind-rpc user:pass@host:port.
• curl and python3 — standard on Ubuntu.
• No sudo, no system changes: everything is user-level (~/cln-blake2b, ~/bridge, ~/.lightning). --uninstall removes the binaries but never the wallet datadir (funds, channels, keys stay).
• No open ports needed: the bridge connects outbound to a Nostr relay and your phone reaches the node through the relay — nothing has to be exposed on your router; clnrest stays bound to loopback.

Connect the app (NWC/NCC)

To control the node from the app you need the connection string (NWC URI): the installer prints it at the end and stores it on the server.

cat ~/bridge/uri.txt

Paste it in the app under Lightning → Connect. Format example (fake values):

nostr+walletconnect://<bridge-pubkey-64-hex>?relay=wss://relay.primal.net&secret=<64-hex>

The string contains a personal authorization secret: treat it like a password and never share it. Authorize another device with ./install.sh --gen-uri; revoke a lost one with ./install.sh --revoke-client <pubkey>.

Being reachable by other peers (optional, Tor)

Channels and payments do not need an inbound address: your node connects outbound to the peers it can reach. An inbound address matters only if you want other nodes to be able to connect to you — useful when testing with the community.

Tor is enough: no open ports, no public IP, no router changes. Create a hidden service (one sudo step):

sudo mkdir -p /var/lib/tor/cln-hs && sudo chown debian-tor:debian-tor /var/lib/tor/cln-hs
printf 'HiddenServiceDir /var/lib/tor/cln-hs\nHiddenServicePort 9735 127.0.0.1:9735\n' | sudo tee -a /etc/tor/torrc
sudo systemctl restart tor && sudo cat /var/lib/tor/cln-hs/hostname

Then add these lines to ~/.lightning/config (with the address printed by the last command) and restart lightningd:

proxy=127.0.0.1:9050
announce-addr=<your-address>.onion:9735
bind-addr=0.0.0.0:9735

⚠️ bind-addr is not optional: with announce-addr alone, lightningd stops listening on port 9735 and binds to 19735 instead — the hidden service would then have nothing to forward to and outside connections are refused.

Test node of this project (announced on Tor):

mxesrfjokenxcmukvbltm3k6ewbj2v3wsjkt3ip56ckga2equiujsfad.onion:9735

What the installer does

• installs Core Lightning (blake2b fork) and the NWC/NCC bridge, each with a pinned SHA-256: any mismatch stops the installation (fail-closed);
• creates a dedicated rune on the node and an authorization URI per device;
• everything is user-level (~/cln-blake2b, ~/bridge, ~/.lightning): no system changes, no root;
• --uninstall removes binaries and configuration but never touches the wallet datadir (funds, channels, keys stay).

Security & trust

• self-hosted by design: the node runs on your server; nobody else can operate it;
• the bridge accepts requests only from devices you authorized;
• step-by-step guide, FAQ and threat model: installer documentation.