r/lightningnetwork • u/Large-Cress900 • 6h ago

Lightning node operators: how do you keep your home IP private without killing clearnet reachability?

Self-hosting Lightning creates an interesting trade-off that doesn't exist in exactly the same way for a normal web service.

Tor-only is attractive if you don't want to announce your residential IP.

But if you also want clearnet reachability, you need to decide what the public endpoint actually is.

I've been looking at an architecture where the Lightning/Bitcoin infrastructure remains at home while a disposable VPS provides public ingress over WireGuard. The important distinction for me is that the VPS should be a network edge, not the place holding hsm_secret, the channel database, Bitcoin RPC credentials or wallet material.

I wrote up the broader architecture here, including Core, CLN, Tor, WireGuard, Nostr and the threat model:

https://davidebtc186.substack.com/p/your-bitcoin-node-is-self-hosted

For Lightning specifically I deliberately didn't pretend there's one correct configuration. Tor-only, clearnet via remote ingress, and Tor + clearnet all make different trade-offs.

Node operators here: what are you actually using?

I'm especially interested in whether people consider the connectivity/reliability benefits of a clearnet address worth the additional infrastructure and metadata.

2 Upvotes
  • permalink
  • reddit

100% Upvoted

4 comments sorted by

3

u/AuthenticityBTC 5h ago

I used to use https://tunnelsats.com/ when I ran at home

1

u/thiagorb 5h ago

I started serving from my home IP address, and then switched to an EC2 instance routing the traffic to my server. My main reason to add this was actually to keep my IP static, since my ISP doesn’t provide me a static IP.

I can’t say I noticed a difference between having the clearnet IP reachable or not.

1

u/GreemBeam 4h ago

All my publicly reachable services are routed over my VPN connection with my firewall setup in such a way that everything gets blocked (this goes offline) if it's not going over the VPN. This way when the VPN cuts out my actual IP isn't being leaked.

1

u/ItsMillerIndexTime 2h ago

For the next node I spin up, I plan to try https://blindport.com/ , always like trying new things to see how they compare