Roles of the public and privileged bitcoind users

[nyonson]

I recently migrated my bitcoind and lnd instances over to nix-bitcoin, but ran into just one small hiccup during the process. I have bitcoind and lnd running on different machines and wanted to keep it that way. I got bitcoind running no problem and then followed these recommend settings for "remote bitcoind" on my lnd instance. lnd wasn't happy at first and it took me a bit to realize it was using the wrong rpc username. I interpreted the docs as "use the privileged user to connect to bitcoind" (which as I type that, sounds bad...), but the lnd module is hardcoded to use the public password. Things were iron'd out as soon as I set both the correct username for the public user.

Is there a reason to not just set both the public and privileged rpc users instead of both as the same as the docs currently recommend? I'll admit I only run bitcoind and lnd so I am not sure how the rpc users are used in the rest of the nix-bitcoin system.

[erikarvstedt]

Is there a reason to not just set both the public and privileged rpc users instead of both as the same as the docs currently recommend?

Yes, the docs only make minimal assumptions about the remote bitcoind node, which may not be a nix-bitcoin node.
So they assume that just a privileged RPC user exists.

Setting all RPC user names to the same privileged user name does away with the security benefits of nix-bitcoin's fine-grained RPC permissions, but it requires no further setup on the bitcoind node.

If your remote bitcoind node runs on nix-bitcoin, you can configure lnd to use the restricted public RPC user like so:

1. Remove these settings that are mentioned in the manual:

   rpc.users = let
     # The fully privileged bitcoind RPC username of the other node
     name = "myrpcuser";
   in {
     privileged.name = name;
     public.name = name;
     ## Set this if you use btcpayserver
     # btcpayserver.name = name;
     ## Set this if you use joinmarket-ob-watcher
     # joinmarket-ob-watcher.name = name;
   };

   Now the privileged and public RPC user names are reset to their defaults, which also match those on the bitcoind node.

2. Copy this password file from the bitcoind node to the lnd node:

   $secretsDir/bitcoin-rpcpassword-public
   

[nyonson]

Yep, that is what I ended up doing, glad it checks out. I think as a new nix user, it wasn't obvious to me that the settings in the manual were changing the defaults which would have worked out of the box.