Building Bitcoin Lightning testnet node on Raspberry Pi3

Part I of II

Lightning testnet node on Raspberry Pi3
Written by Danny Hallwood <danny@hallwood.co.uk>

Notes for a repeatable build of a Lightning node onto the bitcoin testnet
Credits to Linux, raspbian, btcd, lnd, lightning network

Lightning is a really exciting development which could transform how we interact with our wealth on a day to day basis, providing peer to peer payment between parties in an affordable, secure, and convenient manner without dependency on banks and traditional payment processors such as Visa or Mastercard.

Raspberry Pi3 is a $35 armv7 computer with a large and active community. Its low cost and mature opensource support lowers the cost barrier for the public to take an active interest in the early development, testing, and tinkering of the Lightning network.

Lightning is an off-chain solution to facilitate near free and instant bitcoin and other blockchain type transactions. Lightning makes use of segwit wallets and addressing to achieve this

The best place to learn about lightning is from those leading the charge!
http://lightning.community/

This readme is in two parts.
This is Part 1 which will deploy an operational lnd node. Part 2 will provide instruction how to utilise the node, create channels, and make payments over the lightening network.

*******
Contents:

1.  PreRequirements
2.  Operating Installation and Hardening
3.  Network NAT forward, BTCD and LND ports
4.  Installation of go, git, glide, and btcd, roasbeef branch
5.  Install and Configure LND

0 Pre-Requirements - build components:

The following are needed to begin

•  RaspberryPi3 and  SDCARD (8GB or over for testnet) 
•  Network that provides DHCP and Internet access
•  Laptop with SSH

This build delivers lightning functionality with and on-top of:

•  Hardware: RaspberryPi 3
•  Operating System: Raspbian Stretch Lite
•  Firewall: UFW / Netfilter  
•  Bitcoin Node: btcd / roasbeef branch
•  Lightning Daemon: lnd 

This readme makes use of 192.168.0.0/24 and 192.168.0.225 as example LAN network and Raspberry PI IP Address. These will need to be changed to your own network and assigned IP during the build. 

1. Operating Installation and Hardening

Build Notes: OS Install and Hardening
This section covers installing Raspbian, applying patches, and setting a correct firewall policy

1.1 Download Raspbian image:

This build has chosen to make use of Raspbian due to its being officially supported by the Pi foundation and builds on-top of Debian with its deep and proven package management ecosystem 'apt'

The version is Raspbian Stretch Lite, this is a minimal installed that suits the need.
Raspbian can be downloaded from: https://www.raspberrypi.org/downloads/raspbian/

1.2  Flash the image to the SDCARD

There are hundreds of guides on the internet for flashing a RaspberryPi SDCARDS with an Operating System image. Im going to recommend you skip those and use etcher.io as the simplest

Etcher can be downloaded for OSX/Windows/Linux here:
Site: https://etcher.io/

Download and run etcher.io, select the ubuntu image to flash and the SDCARD to write the image to.
The process will take a few minutes to flash the data and confirm.

1.3 SSH'ing to you RaspberryPI

To enable SSH without a keyboard and monitor on the Pi, add a file to the SDCARD root named "ssh" without quotes.

Place the SDCARD in the RaspberryPi, power on, and you're ready to begin!

Connect the Pi to your local ethernet that provides DHCP services.

To discover the IP address your router should provide a table of devices on the network and IPs assigned to them.

*nb - it may take a few minutes for the first boot to come the state where the host is up and accessible.

If your router does not provide the IP another means to discover the address is to nmap your local network for SSH ports, as example, if your local lan is 192.168.0.0/24, then run:
  nmap -sV -p 22 192.168.0.1-254

The default username and password are pi / raspberry

To connect open your Terminal and type  (or use PuTTY as your SSH client if in windows)
  ssh pi@192.168.0.225  [Replace this IP address for the one you just found]
  [password is "raspberry"]

1.4 Update to latest security patches, firmware, set timezone

Once logged in the system you should change your password, using the cmd:
  passwd

The next step should be to update to latest patch and firmware releases. This will help ensure known bugs and security fixes are applied.

To update Raspbian easy via the included package management system "apt"
To update follow the below three steps
Become root:
  sudo su -  [ enter your password when prompted ]

Update apt with latest repository data:
  apt-get update

Update system to the latest packages
  apt-get upgrade  [ enter Y to confirm update ]

Set the timezone of the Pi using:
 dpkg-reconfigure tzdata

Reboot the Pi after the installations are complete.

1.5 Configure your firewall

As there's no real reason to not firewall your node from unnecessary traffic we'll do that with UFW (Uncomplicated FireWall) which manages netfilter firewall.

First install the UFW package and dependencies with apt.
  apt-get install ufw

Set the basic policies, allow outgoing connections, deny incoming, allow SSH.
* this assumes your local network is 192.168.0.0/24 and your RaspberryPi is 192.168.0.225
* modify this network range and device ip in the rules to your own

  sudo su - [enter your password]
Add firewall rules
  ufw default deny incoming
  ufw default allow outgoing
  ufw allow from 192.168.0.0/24 to any port 22 comment 'allow SSH from local LAN'

We will also set rules for BTCD and LND
  ufw allow 9735 comment 'allow connections from Lightning to LND'
  ufw allow 18333 comment 'allow connections to Bitcoin testnet to BTCD'
  ufw allow from 192.168.0.225 to any port 18334 comment 'con self to BTCD test RPC'
Rules unneeded but added to modify later if connect to mainnet not testnet
  ufw reject 8333 comment 'reject connections from Bitcoin mainnet to BTCD'
  ufw reject from 192.168.0.225 to any port 18334 comment 'con self to BTCD main RPC'

Enable firewall, set systemctl to start the firewall on boot
  ufw enable   [answer yes to warning may disrupt SSH, it should not]
  systemctl enable ufw

View rules
  ufw status
  ufw status verbose

Reboot and view rules
  init 6

2. Network NAT forward, BTCD and LND ports

For btcd, and also lnd work fully, then traffic should be forwarded from the internet to the raspberry pi3.

Ports 18333 and 9735 on the outside of your router to be NAT forwarded to the RaspberryPi
Port 18333 is for bitcoin testnet. For reference port 8333 is the mainnet.

There are many ADSL, Cable, routers so offering detailed configuration of your device is outside the capability of this readme. Most routers will offer a menu option labeled NAT, or Virtual Server, or Port Forward.  Googling your router make with these search term should provide an easy guide to follow.

In my setup the Pi3 is on internal IP 192.168.0.225
My cable router configuration is set to forward
  External Port 18333 to internal 192.168.0.225 port 18333
  External Port  9735 to internal 192.168.0.225 port  9735
 

3. Installation of go, git, glide, and btcd, roasbeef branch

btcd is the bitcoin node software daemon that works in tandem with the Lightning node LND.
To support LND btcd has been modified by the lead engineer roasbeef, these changes will make there way into the main branch which are namely to support segwit addresses, in the near future.

3.1 Create a user for btcd

Create a user for btcd as general good practice to separate function and account.

First become root then add the user, create the home dir:
  sudo su - [enter your password]
  useradd -m -s $(which bash) -G sudo btcd
  passwd btcd [enter a password for the user]
  su - btcd

3.2 Install GO version 1.8. Armv6 binaries on Armv7

The btcd and LND packages depend on golang, whilst there are no official binaries for armv7 packaged the Pi3 armv7 processor will execute armv6 binaries.

To install golang v1.8 and add to btcd path execute the following as the btcd user:
  wget https://storage.googleapis.com/golang/go1.8.linux-armv6l.tar.gz
  sudo tar -C /usr/local -xzf go1.8.linux-armv6l.tar.gz [enter btcd password]
  echo 'export PATH=$PATH:/usr/local/go/bin' >> /home/btcd/.profile
  export PATH=$PATH:/usr/local/go/bin

Set and preserve GOPATH for the btcd user.
mkdir /home/btcd/gocode
echo 'export GOPATH=~/gocode' >> /home/btcd/.profile
echo 'export PATH=$PATH:$GOPATH/bin' >> /home/btcd/.profile
export GOPATH=~/gocode
export PATH=$PATH:$GOPATH/bin

The install can be checked with
which go  [should return /usr/local/go/bin/go]
go version [should return go version go1.8 linux/arm]

3.3 Install Git and Glide

glide and git are also required to install btcd and lnd daemons.
To install git and glide, run the following as the btcd user:
  sudo apt-get install git [enter your password when promoted]
  go get -u -v github.com/Masterminds/glide

3.4 Installation of btcd roasbeef branch

A node on the lightning network requires an up-to date copy of the bitcoin blockchain in order to view and confirm transactions, open and close channels and so forth.

Roasbeef the lead developer for lnd has a modified branch of the btcd daemon that support lnd hooks, namely segwit addressing.

To install btcd execute the following as the btcd user:
  go get -v -u github.com/roasbeef/btcutil
  cd $GOPATH/src/github.com/roasbeef/btcd
  glide install
  go install . ./cmd/...

btcd can be started with an RPC user / password, which lnd will use later.
Connections to rpc will be limited to from localhost by the firewall a good password should still be set as there is no reason not to.

We will start the daemon to begin syncing the bitcoin blockchain from testnet.
This may take a few hours as there are over 125,000 blocks at time of writing.

To start the btcd daemon execute:
  btcd --testnet --txindex --rpcuser=locallnduser --rpcpass=[somepasswordyouchose]

The daemon should log to the terminal, this guide will later cover creating a systemctl wrapper for btcd.

Progress of the sync can aslo be checked by tailing the btcd log:
To tail the log file, connect a second ssh session the pi and login as btcd
  ssh btcd@192.168.0.225
  tail -f .btcd/logs/testnet/btcd.log

4. Installation of LND

4.1 Install LND

Whilst btcd is syncing lnd and lncli can be installed and configured using a separate SSH session.

To do so:
ssh btcd@192.168.0.225
cd $GOPATH
git clone https://github.com/lightningnetwork/lnd $GOPATH/src/github.com/lightningnetwork/lnd
cd $GOPATH/src/github.com/lightningnetwork/lnd
    glide install
    go install . ./cmd/...

4.2 Configure and start LDN

The lnd installation can be tested using the following. lnd will not be fully supported till after the btcd testnet sync has completed. This may take many hours dependent on your internet speed.

The lnd daemon requires a few runtime parameters, these can be held in a lnd config file to save repeated typing an extended start command.

One parameter used is your external IP address. This allows lnd to broadcast its routable IP address for inbound connects, channels, payments and so forth.

To find your external IP address use the command from your Pi
  sudo apt-get install dnsutils
  dig +short myip.opendns.com @resolver1.opendns.com

  The dig command should return your external IP for the Pi.

Create and edit your lnd.conf to set default runtime variables 

  vi /home/btcd/.lnd/lnd.conf

Enter:
  [Application Options]
  debuglevel=trace
  debughtlc=true
  maxpendingchannels=10
  externalip=[your external IP address]
  
  [Bitcoin]
  bitcoin.active=1
  bitcoin.rpcuser=locallnduser
  bitcoin.rpcpass=[your btcd rpc password]

To start the LND daemon execute:
  lnd --bitcoin.active --bitcoin.testnet

When prompted the user will be asked to create a lightning wallet, this will allow the tests to complete.

To create, or on subsequent starts open, the wallet make use of another ssh connection and use the lncli command:
 ssh btcd@192.168.0.225
 lncli create
 [enter a wallet password]
 [confirm the same password - do not forget these]

5....
To exercise the lnd functionality, create channels and make payments see part 2!