---
title: LND Remote Signer Guide
slug: lnd-remote-signer-guide
docTags: 
createdAt: 2025-08-26T15:30:20.021Z
---

![](https://api.archbee.com/api/optimize/CGGF0VLgJQypTJbZ1FbQy/hIjJteVi2F2gIW5wuKyiz-20250918-152342.png)

## Overview

The LND remote signer architecture allows you to separate your Lightning node into two components:

- **Watch-only node** (hosted on Voltage Cloud): Contains only public keys and handles all network operations
- **Signer node** (your infrastructure): Holds private keys and only signs transactions when requested

This setup provides enhanced security by keeping your private keys completely offline and under your control, while still benefiting from Voltage's reliable cloud infrastructure for node operations.

[LND Remote Signing Documentation](https://github.com/lightningnetwork/lnd/blob/master/docs/remote-signing.md)

## Use Cases

Remote signing is ideal when you want to:

- **Maximize security**: Keep private keys in cold storage or air-gapped environments
- **Maintain control**: Never expose private keys to cloud infrastructure
- **Meet compliance requirements**: Some organizations require key material to remain on-premises
- **Run redundant signers**: Multiple signer instances for high availability

## Prerequisites

Before starting:

1. Active Voltage Cloud account with an LND node deployed
2. Separate secure infrastructure for hosting the signer node
3. Ability to expose a single gRPC port from your signer to Voltage
4. Basic understanding of LND operations and gRPC

## Step-by-Step Setup Guide

### Step 1: Deploy Standard Voltage Node

First, deploy a standard LND node on Voltage Cloud:

1. Log into your Voltage dashboard
2. Create a new LND node as normal
3. **Access and save your seed phrase securely** - Can be found on your Lightning Node Dashboard under "Backup & Export" tab
4. Let the node fully sync with the Bitcoin network
5. Stop the node once synced (we'll convert it to watch-only mode)

### Step 2: Set Up Your Signer Infrastructure

On your secure infrastructure:

2.1 Install LND

:::BlockQuote
\# Download the same LND version as your Voltage node
wget https\://github.com/lightningnetwork/lnd/releases/download/v0.XX.X/lnd-linux-amd64-v0.XX.X.tar.gz
tar -xzf lnd-linux-amd64-v0.XX.X.tar.gz
sudo install -m 0755 -o root -g root -t /usr/local/bin lnd-linux-amd64-v0.XX.X/\*
:::

2.2 Configure Signer Node

Create /home/lnd/.lnd/lnd.conf:

:::BlockQuote
\[Application Options]
\# Disable P2P listening - signer never connects to network
nolisten=true

\# Don't connect to bootstrap nodes
nobootstrap=true

\# gRPC port that Voltage will connect to
rpclisten=0.0.0.0:10019

\# Optional: restrict to Voltage IP
\# rpclisten=YOUR\_VOLTAGE\_IP:10019

\[Bitcoin]
\# Signal we're using Bitcoin
bitcoin.active=true
bitcoin.mainnet=true

\# No chain backend needed for signer
bitcoin.node=nochainbackend
:::

2.3 Initialize Signer with Existing Seed

:::BlockQuote
\# Start LND
lnd --configfile=/home/lnd/.lnd/lnd.conf

\# In another terminal, restore with your Voltage seed
lncli create
\# Choose "recover existing wallet"
\# Enter the seed phrase from your Voltage node
:::

### Step 3: Export Account Information

From your signer node, export the extended public keys:

:::BlockQuote
lncli wallet accounts list > accounts-signer.json
:::

This file contains all the xpubs needed for the watch-only wallet. Copy this file securely to your local machine.

### Step 4: Create Custom Macaroon

Generate a restricted macaroon that only allows signing operations:

:::BlockQuote
lncli bakemacaroon --save\_to signer.custom.macaroon \\
    message\:write signer\:generate address\:read onchain\:write
:::

Also copy the TLS certificate:

:::BlockQuote
cp \~/.lnd/tls.cert signer.tls.cert
:::

### Step 5: Configure Voltage Node for Remote Signing

**For new nodes (recommended):**

- Contact Voltage support BEFORE creating the node
- Request they configure the node in "Watch-Only" mode with remote signer settings
- This prevents the node from being initialized with private keys

**For existing nodes:**

- Update your LND conf manually through the Voltage API using the "Update Node Settings" endpoint: https\://docs.voltage.cloud/voltage-api#femA1

Updates needed to LND conf:

:::BlockQuote
\[remotesigner]
remotesigner.enable=true
remotesigner.rpchost=your-signer-host:10019
remotesigner.tlscertpath=/path/to/signer.tls.cert
remotesigner.macaroonpath=/path/to/signer.custom.macaroon
:::

Note: Voltage may need to handle file uploads for the TLS cert and macaroon - coordinate with support for the best approach.

### Step 6: Initialize Watch-Only Wallet

Once remote signer mode is configured:

1. Restart your Voltage node
2. Initialize it as watch-only using the exported accounts via Voltage's terminal or API:

:::BlockQuote
\# Via Voltage's terminal or API
lncli createwatchonly accounts-signer.json
:::

Note: For new nodes created in watch-only mode, this initialization happens on first startup. For existing nodes being migrated, work with Voltage support to ensure proper conversion.

### Step 7: Network Configuration

Firewall Rules

On your signer infrastructure:

:::BlockQuote
\# First, obtain your Voltage node's dedicated IP address from the dashboard

\# Allow inbound gRPC from Voltage node's IP only
sudo ufw allow from VOLTAGE\_NODE\_IP to any port 10019

\# Deny all other inbound connections
sudo ufw default deny incoming
sudo ufw enable
:::

**Important Network Requirements:**

- Your signer must be exposed to the internet (on port 10019)
- Each Voltage node has a dedicated IP address (check your node dashboard)
- Restrict access to only your Voltage node's IP for security
- Ensure your signer has a stable, publicly accessible hostname or IP

TLS Considerations

- The signer's TLS certificate must be valid
- Consider using Let's Encrypt for production deployments
- Ensure certificate renewal doesn't break connectivity

## Security Best Practices

### Signer Node Hardening

1. **Network Isolation**
   - Place signer in DMZ or separate VLAN
   - Use jump hosts for administration
   - No outbound internet access
2. **Access Control**
   - Implement IP whitelisting
   - Use fail2ban for brute force protection
   - Enable SELinux/AppArmor
3. **Monitoring**
   - Log all signing requests
   - Set up alerts for unusual activity
   - Monitor system resources
4. **Key Management**
   - Consider hardware security modules (HSM)
   - Implement key rotation procedures
   - Maintain secure backups

### Operational Security

1. **Regular Updates**
   - Keep LND versions synchronized
   - Apply security patches promptly
   - Test updates in staging first
2. **Backup Strategy**
   - Encrypted backups of signer configuration
   - Test restore procedures regularly
   - Store backups in multiple locations
3. **Incident Response**
   - Document emergency procedures
   - Have rollback plans ready
   - Maintain communication channels with Voltage support

## Troubleshooting

### Common Issues

**Connection Refused**

:::BlockQuote
\# Check if signer is running
systemctl status lnd-signer

\# Verify port is open
netstat -tlnp | grep 10019

\# Test connectivity from Voltage
telnet signer-host 10019
:::

**Certificate Errors**

:::BlockQuote
\# Regenerate certificates if needed
lncli stop
rm \~/.lnd/tls.cert \~/.lnd/tls.key
lnd --configfile=/home/lnd/.lnd/lnd.conf
:::

**Account Mismatch**

- Ensure all required account xpubs are exported
- Verify purpose/coin\_type/account values match
- Check for Taproot account (required for v0.15+)

### Migration Scenarios

**From Standard to Remote Signer**

1. Export seed from existing Voltage node
2. Set up signer with same seed
3. Contact Voltage to enable migration mode
4. Node will purge private keys and convert to watch-only

**Upgrading LND Versions**

1. Upgrade signer node first
2. Export new account information if needed
3. Import new accounts to watch-only node
4. Upgrade Voltage node

## Monitoring and Maintenance

### Health Checks

Create monitoring scripts:

:::BlockQuote
\#!/bin/bash
\# Check signer responsiveness
lncli --rpcserver=localhost:10019 getinfo

\# Monitor signing operations
tail -f \~/.lnd/logs/bitcoin/mainnet/lnd.log | grep "signing"

\# Alert on connection issues
if ! nc -z signer-host 10019; then
    echo "Signer offline!" | mail -s "LND Signer Alert" ops\@example.com
fi
:::

### Performance Optimization

- Use persistent gRPC connections
- Implement connection pooling
- Consider geographic proximity between Voltage and signer
- Monitor network latency

## Advanced Configurations

### High Availability Setup

Deploy multiple signer instances with:

- Active/passive failover
- Load balancing for signing requests
- Shared state management
- Health check automation

### Hardware Security Module Integration

For maximum security, integrate HSM:

- Store master seed in HSM
- Derive keys on-demand
- Audit trail for all operations
- FIPS compliance

## Support and Resources

- **Voltage Support**: Contact through dashboard for remote signer setup
- **LND Documentation**: Remote Signing Guide
- **Community**: Lightning Network Discord and Telegram groups

## Conclusion

Remote signing with Voltage Cloud provides the best of both worlds: enterprise-grade infrastructure for your Lightning node operations while maintaining complete control over your private keys. This setup is ideal for security-conscious operators and organizations with strict compliance requirements.

Remember to:

- Test thoroughly in a development environment first
- Maintain regular backups
- Keep both nodes updated and synchronized
- Monitor operations continuously

With proper setup and maintenance, remote signing offers a robust and secure way to operate Lightning nodes at scale.