LND Remote Signer Guide

30 min

Overview

The LND remote signer architecture allows you to separate your Lightning node into two components:

Watch-only node (hosted on Voltage Cloud): Contains only public keys and handles all network operations
Signer node (your infrastructure): Holds private keys and only signs transactions when requested

This setup provides enhanced security by keeping your private keys completely offline and under your control, while still benefiting from Voltage's reliable cloud infrastructure for node operations.

LND Remote Signing Documentation

Use Cases

Remote signing is ideal when you want to:

Maximize security: Keep private keys in cold storage or air-gapped environments
Maintain control: Never expose private keys to cloud infrastructure
Meet compliance requirements: Some organizations require key material to remain on-premises
Run redundant signers: Multiple signer instances for high availability

Prerequisites

Before starting:

Active Voltage Cloud account with an LND node deployed
Separate secure infrastructure for hosting the signer node
Ability to expose a single gRPC port from your signer to Voltage
Basic understanding of LND operations and gRPC

Step-by-Step Setup Guide

Step 1: Deploy Standard Voltage Node

First, deploy a standard LND node on Voltage Cloud:

Log into your Voltage dashboard
Create a new LND node as normal
Access and save your seed phrase securely - Can be found on your Lightning Node Dashboard under "Backup & Export" tab
Let the node fully sync with the Bitcoin network
Stop the node once synced (we'll convert it to watch-only mode)

Step 2: Set Up Your Signer Infrastructure

On your secure infrastructure:

2.1 Install LND

# Download the same LND version as your Voltage node wget https://github.com/lightningnetwork/lnd/releases/download/v0.XX.X/lnd-linux-amd64-v0.XX.X.tar.gz tar -xzf lnd-linux-amd64-v0.XX.X.tar.gz sudo install -m 0755 -o root -g root -t /usr/local/bin lnd-linux-amd64-v0.XX.X/*

2.2 Configure Signer Node

Create /home/lnd/.lnd/lnd.conf:

[Application Options] # Disable P2P listening - signer never connects to network nolisten=true # Don't connect to bootstrap nodes nobootstrap=true # gRPC port that Voltage will connect to rpclisten=0.0.0.0:10019 # Optional: restrict to Voltage IP # rpclisten=YOUR_VOLTAGE_IP:10019 [Bitcoin] # Signal we're using Bitcoin bitcoin.active=true bitcoin.mainnet=true # No chain backend needed for signer bitcoin.node=nochainbackend

2.3 Initialize Signer with Existing Seed

# Start LND lnd --configfile=/home/lnd/.lnd/lnd.conf # In another terminal, restore with your Voltage seed lncli create # Choose "recover existing wallet" # Enter the seed phrase from your Voltage node

Step 3: Export Account Information

From your signer node, export the extended public keys:

lncli wallet accounts list > accounts-signer.json

This file contains all the xpubs needed for the watch-only wallet. Copy this file securely to your local machine.

Step 4: Create Custom Macaroon

Generate a restricted macaroon that only allows signing operations:

lncli bakemacaroon --save_to signer.custom.macaroon \ message:write signer:generate address:read onchain:write

Also copy the TLS certificate:

cp ~/.lnd/tls.cert signer.tls.cert

Step 5: Configure Voltage Node for Remote Signing

For new nodes (recommended):

Contact Voltage support BEFORE creating the node
Request they configure the node in "Watch-Only" mode with remote signer settings
This prevents the node from being initialized with private keys

For existing nodes:

Update your LND conf manually through the Voltage API using the "Update Node Settings" endpoint: https://docs.voltage.cloud/voltage-api#femA1

Updates needed to LND conf:

[remotesigner] remotesigner.enable=true remotesigner.rpchost=your-signer-host:10019 remotesigner.tlscertpath=/path/to/signer.tls.cert remotesigner.macaroonpath=/path/to/signer.custom.macaroon

Note: Voltage may need to handle file uploads for the TLS cert and macaroon - coordinate with support for the best approach.

Step 6: Initialize Watch-Only Wallet

Once remote signer mode is configured:

Restart your Voltage node
Initialize it as watch-only using the exported accounts via Voltage's terminal or API:

# Via Voltage's terminal or API lncli createwatchonly accounts-signer.json

Note: For new nodes created in watch-only mode, this initialization happens on first startup. For existing nodes being migrated, work with Voltage support to ensure proper conversion.

Step 7: Network Configuration

Firewall Rules

On your signer infrastructure:

# First, obtain your Voltage node's dedicated IP address from the dashboard # Allow inbound gRPC from Voltage node's IP only sudo ufw allow from VOLTAGE_NODE_IP to any port 10019 # Deny all other inbound connections sudo ufw default deny incoming sudo ufw enable

Important Network Requirements:

Your signer must be exposed to the internet (on port 10019)
Each Voltage node has a dedicated IP address (check your node dashboard)
Restrict access to only your Voltage node's IP for security
Ensure your signer has a stable, publicly accessible hostname or IP

TLS Considerations

The signer's TLS certificate must be valid
Consider using Let's Encrypt for production deployments
Ensure certificate renewal doesn't break connectivity

Security Best Practices

Signer Node Hardening

Network Isolation
- Place signer in DMZ or separate VLAN
- Use jump hosts for administration
- No outbound internet access
Access Control
- Implement IP whitelisting
- Use fail2ban for brute force protection
- Enable SELinux/AppArmor
Monitoring
- Log all signing requests
- Set up alerts for unusual activity
- Monitor system resources
Key Management
- Consider hardware security modules (HSM)
- Implement key rotation procedures
- Maintain secure backups

Operational Security

Regular Updates
- Keep LND versions synchronized
- Apply security patches promptly
- Test updates in staging first
Backup Strategy
- Encrypted backups of signer configuration
- Test restore procedures regularly
- Store backups in multiple locations
Incident Response
- Document emergency procedures
- Have rollback plans ready
- Maintain communication channels with Voltage support

Troubleshooting

Common Issues

Connection Refused

# Check if signer is running systemctl status lnd-signer # Verify port is open netstat -tlnp | grep 10019 # Test connectivity from Voltage telnet signer-host 10019

Certificate Errors

# Regenerate certificates if needed lncli stop rm ~/.lnd/tls.cert ~/.lnd/tls.key lnd --configfile=/home/lnd/.lnd/lnd.conf

Account Mismatch

Ensure all required account xpubs are exported
Verify purpose/coin_type/account values match
Check for Taproot account (required for v0.15+)

Migration Scenarios

From Standard to Remote Signer

Export seed from existing Voltage node
Set up signer with same seed
Contact Voltage to enable migration mode
Node will purge private keys and convert to watch-only

Upgrading LND Versions

Upgrade signer node first
Export new account information if needed
Import new accounts to watch-only node
Upgrade Voltage node

Monitoring and Maintenance

Health Checks

Create monitoring scripts:

#!/bin/bash # Check signer responsiveness lncli --rpcserver=localhost:10019 getinfo # Monitor signing operations tail -f ~/.lnd/logs/bitcoin/mainnet/lnd.log | grep "signing" # Alert on connection issues if ! nc -z signer-host 10019; then echo "Signer offline!" | mail -s "LND Signer Alert" [email protected] fi

Performance Optimization

Use persistent gRPC connections
Implement connection pooling
Consider geographic proximity between Voltage and signer
Monitor network latency

Advanced Configurations

High Availability Setup

Deploy multiple signer instances with:

Active/passive failover
Load balancing for signing requests
Shared state management
Health check automation

Hardware Security Module Integration

For maximum security, integrate HSM:

Store master seed in HSM
Derive keys on-demand
Audit trail for all operations
FIPS compliance

Support and Resources

Voltage Support: Contact through dashboard for remote signer setup
LND Documentation: Remote Signing Guide
Community: Lightning Network Discord and Telegram groups

Conclusion

Remote signing with Voltage Cloud provides the best of both worlds: enterprise-grade infrastructure for your Lightning node operations while maintaining complete control over your private keys. This setup is ideal for security-conscious operators and organizations with strict compliance requirements.

Remember to:

Test thoroughly in a development environment first
Maintain regular backups
Keep both nodes updated and synchronized
Monitor operations continuously

With proper setup and maintenance, remote signing offers a robust and secure way to operate Lightning nodes at scale.