Trying to understand how to set up a dev environment for payments and wallets

[ed-kung]

I'm trying to understand how to set up a dev environment with payments and wallets enabled, something I've not done in the past.

Could anyone provide a rundown of the basic things to know? All I can tell so far is that a bitcoin and lightning regtest network are set up, but I'm not sure how to use these networks to do things like:

• Create and fund lightning wallets for multiple test users
• Attach wallets to those users
• Buy cowboy credits from those users
• Send sats to the test users' lightning wallets

I'm also getting these error messages that I don't understand:

worker        | [
worker        |   503,
worker        |   'UnexpectedInvoiceSubscriptionError',
worker        |   {
worker        |     err: Error: 14 UNAVAILABLE: No connection established. Last error: self-signed certificate (2025-05-23T20:16:53.709Z)
worker        |         at callErrorFromStatus (/app/node_modules/@grpc/grpc-js/src/call.ts:82:17)
worker        |         at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/src/client.ts:612:51)
worker        |         at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/src/client-interceptors.ts:419:48)
worker        |         at <anonymous> (/app/node_modules/@grpc/grpc-js/src/resolving-call.ts:163:24)
worker        |         at process.processTicksAndRejections (node:internal/process/task_queues:77:11)
worker        |     for call at
worker        |         at ServiceClientImpl.makeServerStreamRequest (/app/node_modules/@grpc/grpc-js/src/client.ts:595:42)
worker        |         at ServiceClientImpl.<anonymous> (/app/node_modules/@grpc/grpc-js/src/make-client.ts:189:15)
worker        |         at /app/node_modules/lightning/lnd_methods/invoices/subscribe_to_invoices.js:95:43
worker        |         at check (/app/node_modules/async/doWhilst.js:61:9)
worker        |         at doWhilst (/app/node_modules/async/doWhilst.js:64:12)
worker        |         at awaitable (/app/node_modules/async/internal/awaitify.js:14:28)
worker        |         at doUntil (/app/node_modules/async/doUntil.js:41:35)
worker        |         at module.exports (/app/node_modules/lightning/lnd_methods/invoices/subscribe_to_invoices.js:90:3)
worker        |         at <anonymous> (/app/worker/wallet.js:66:17) {
worker        |       code: 14,
worker        |       details: 'No connection established. Last error: self-signed certificate (2025-05-23T20:16:53.709Z)',
worker        |       metadata: [Metadata]
worker        |     }
worker        |   }
worker        | ]
worker        | error subscribing - trying again
worker        | [
worker        |   503,
worker        |   'UnexpectedPaymentsSubErr',
worker        |   {
worker        |     err: Error: 14 UNAVAILABLE: No connection established. Last error: self-signed certificate (2025-05-23T20:16:53.709Z)
worker        |         at callErrorFromStatus (/app/node_modules/@grpc/grpc-js/src/call.ts:82:17)
worker        |         at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/src/client.ts:612:51)
worker        |         at Object.onReceiveStatus (/app/node_modules/@grpc/grpc-js/src/client-interceptors.ts:419:48)
worker        |         at <anonymous> (/app/node_modules/@grpc/grpc-js/src/resolving-call.ts:163:24)
worker        |         at process.processTicksAndRejections (node:internal/process/task_queues:77:11)
worker        |     for call at
worker        |         at ServiceClientImpl.makeServerStreamRequest (/app/node_modules/@grpc/grpc-js/src/client.ts:595:42)
worker        |         at ServiceClientImpl.<anonymous> (/app/node_modules/@grpc/grpc-js/src/make-client.ts:189:15)
worker        |         at module.exports (/app/node_modules/lightning/lnd_methods/offchain/subscribe_to_payments.js:110:32)
worker        |         at <anonymous> (/app/worker/wallet.js:171:17)
worker        |         at <anonymous> (/app/worker/wallet.js:29:15)
worker        |         at new Promise (<anonymous>)
worker        |         at forever (/app/worker/wallet.js:28:20)
worker        |         at RetryOperation.runAttempt [as _fn] (/app/node_modules/async-retry/lib/index.js:42:15)
worker        |         at Timeout._onTimeout (/app/node_modules/retry/lib/retry_operation.js:85:10)
worker        |         at listOnTimeout (node:internal/timers:569:17)
worker        |         at process.processTimers (node:internal/timers:512:7) {
worker        |       code: 14,
worker        |       details: 'No connection established. Last error: self-signed certificate (2025-05-23T20:16:53.709Z)',
worker        |       metadata: [Metadata]
worker        |     }
worker        |   }
worker        | ]
worker        | error subscribing - trying again

[ekzyis]

Could anyone provide a rundown of the basic things to know? All I can tell so far is that a bitcoin and lightning regtest network are set up

Does that mean you are including wallets in the environment variable COMPOSE_PROFILES, so it looks like this:

COMPOSE_PROFILES=minimal,payments,wallets

You can also put that into .env.local. For reference, my .env.local looks like this with only the line that I need not commented out:

#COMPOSE_PROFILES=minimal
#COMPOSE_PROFILES=minimal,search
#COMPOSE_PROFILES=minimal,payments
COMPOSE_PROFILES=minimal,payments,wallets

Create and fund lightning wallets for multiple test users

You can use sndev set_balance <name> <msats> for that

Attach wallets to those users

There are ATTACH docs in the wallets/ folder for almost every wallet. For example, here is the one for NWC.

Buy cowboy credits from those users

You mean for, right? You can do that with the frontend like you would on https://stacker.news/. You can pay these invoices from the SN LND node (container name is sn_lnd) with sndev fund <bolt11>. This will then pay using another LND node (container name is lnd).

Send sats to the test users' lightning wallets

You can do that with sndev withdraw.

I'm also getting these error messages that I don't understand:

Thank you, looking into this right now!

[huumn]

Could anyone provide a rundown of the basic things to know?

1. you can do basic lightning things with lightning invoices:
   • sndev fund -> pays a given bolt11 invoice that can be used to pay invoices to SN
   • sndev withdraw -> generates a bolt11 invoice for a given amount that can be used to withdraw from SN
   • for context, the above commands were created when SN was still custodial, so that's where their names come from
2. to attach wallets, each wallet has it's own documentation, e.g. wallets/lnbits/ATTACH.md

Buy cowboy credits from those users

Do you mean from or for?

Send sats to the test users' lightning wallets

Their attached wallets or their SN/custodial one for reward sats?

[sutt]

Hey all, just wanted to jump in and leave preliminary notes that I'm also experiencing this issue.

Specifically: 503 on generating invoices from SN.

Obviously, good chance of user-error here, I'll add more details in this thread as I investigate (unless directed otherwise).

Working:

• Run with profiles miminal payments,wallets
• Login with two user: Alice, Bob
• set_balance on two users and see sats appear on these users accounts
• conect separate lnbits wallets (v0.12) send+recieve to Alice's and Bob's accounts
• able to send regtest sats between the separate lnbits wallets with BOLT-11's
• Autowithdrawal limit triggers, sats deducted from account (but withdrawal does not arrive in connected lnbits, see below)
• Purchase cowboy credits when user has sats in account
• P2P zaps with cowboy credits

Not working

• Purchase cowboy credits without sats in account
  • clicking purchase credit generates Unexpected error value: [503, "UnexpectedAddHodlInvoiceError", { err: [Error] }] (see [1])
• Perform P2P real sat zaps between Alice and Bob on a created Item
  • receiver's lnbits wallet logs generates failed to wrap invoice: Unable to fetch identity: undefined (see [2])
• succesfully receive withdrawals, both manual specified BOLT-11 and triggered auto-withdrawal
  • withdrawals end up stuck in pending, in (see [3])
• able to generate an invoice onPostSubmit to post as anon
  • again 503, UnexpectedHodlInvoiceError

Screenshots

1

2

2h |   | ERROR | failed to wrap invoice: Unable to fetch identity: undefined | -

  | amount | 7,000 msats
  | bolt11 | lnbcrt70n1p5rxs4xpp55cxq6skcmfqx0k4f37k55m3n6euxhutf0qf9y0zdytmrmkjvvyaqdp22d8r5gr6v9czqvfsypekzarnyp6x7gprxs6njveexqcqzzsxqzjcsp5u8newwp9zffzsgaj432wsl7z52v0s7nzxyajqsawuaamfd52q80q9qxpqysgqnuxxw2tyymxl0y2cfed8ulqwq8uvj2y7n2244c85n9sfyuq3y9u8nk26kuv6wgwq2lsezrf55fsvnaqzah9fd96zmf2lxxyve86l6eqpjcrssu
  | created_at | 2025-05-25T16:17:42.000Z
  | expires_at | 2025-05-25T16:27:42.000Z
  | description | SN: zap 10 sats to #459390
  | payment_hash | a60c0d42d8da4067daa98fad4a6e33d6786bf1697812523c4d22f63dda4c613a

3

[sutt]

Alright some snips of logs below, same as @ed-kung with 503 on Subscribe to LND methods because of "self-signed cert".

Tracking the ip addr via docker network inspect stackernews1_default point to sn_lnd refusing the connection initiated in worker. This makes sense then why I can't do things that require sn to create an invoice.

I am running this via docker in Ubuntu22.04 on WSL2. I noticed weird things happen in this environment happen when this full compose is running. Wonder if this is a weird WSL2 thing.

I'll keep digging to try to do ln-service gRPC conn manually.

Snips from logs

    at <anonymous> (/app/worker/wallet.js:171:17)
    at <anonymous> (/app/worker/wallet.js:29:15)
    at new Promise (<anonymous>)
    at forever (/app/worker/wallet.js:28:20)

    worker       |   503,
    worker       |   'UnexpectedInvoiceSubscriptionError',
    worker       |   {
    worker       |     err: Error: 14 UNAVAILABLE: No connection established. Last error: self-signed certificate (2025-05-25T19:29:35.282Z)

    2025-05-25 19:41:40.891 [ERR] CMGR: Can't accept connection: unable to accept connection from 172.18.0.10:59660: chacha20poly1305: message authentication failed

docker version

Client: Docker Engine - Community
 Version:           28.1.1
 API version:       1.49
 Go version:        go1.23.8
 Git commit:        4eba377
 Built:             Fri Apr 18 09:52:10 2025
 OS/Arch:           linux/amd64
 Context:           default

Server: Docker Engine - Community
 Engine:
  Version:          28.1.1
  API version:      1.49 (minimum version 1.24)
  Go version:       go1.23.8
  Git commit:       01f442b
  Built:            Fri Apr 18 09:52:10 2025
  OS/Arch:          linux/amd64
  Experimental:     false
 containerd:
  Version:          1.7.27
  GitCommit:        05044ec0a9a75232cad458027ca83437aae3f4da
 runc:
  Version:          1.2.5
  GitCommit:        v1.2.5-0-g59923ef
 docker-init:
  Version:          0.19.0
  GitCommit:        de40ad0

[ekzyis]

Oh, apparently Github does not mention in a discussion if it was mentioned in a PR.

I fixed the SSL error in #2179. The error "self-signed certificate" is misleading because the issue is that it expired:

$ openssl x509 -in docker/lnd/sn/tls.cert -text -noout
Certificate:
    Data:
        Version: 3 (0x2)
        Serial Number:
            6b:d2:3c:e2:1f:87:7b:73:fc:64:2b:80:45:74:d4:31
        Signature Algorithm: ecdsa-with-SHA256
        Issuer: O=lnd autogenerated cert, CN=b601eb10c983
        Validity
            Not Before: Mar  7 17:02:19 2024 GMT
            Not After : May  2 17:02:19 2025 GMT
        Subject: O=lnd autogenerated cert, CN=b601eb10c983
        Subject Public Key Info:
            Public Key Algorithm: id-ecPublicKey
                Public-Key: (256 bit)
                pub:
                    04:9e:62:32:9b:4f:e2:49:27:b6:ca:82:98:33:9a:
                    5d:b1:21:ad:3a:37:5b:61:fc:ea:77:4b:5b:3c:f8:
                    e2:40:f3:1e:9d:c4:88:7f:d9:e1:d4:90:eb:b1:81:
                    9e:a9:e4:80:8a:22:8e:d9:4c:be:63:61:cb:c2:bb:
                    2f:40:dc:a9:c5
                ASN1 OID: prime256v1
                NIST CURVE: P-256
        X509v3 extensions:
            X509v3 Key Usage: critical
                Digital Signature, Key Encipherment, Certificate Sign
            X509v3 Extended Key Usage:
                TLS Web Server Authentication
            X509v3 Basic Constraints: critical
                CA:TRUE
            X509v3 Subject Key Identifier:
                53:59:5C:A7:7B:B4:71:A2:DB:A1:AA:C4:EB:CA:21:66:8F:AB:25:53
            X509v3 Subject Alternative Name:
                DNS:b601eb10c983, DNS:localhost, DNS:sn_lnd, DNS:host.docker.internal, DNS:unix, DNS:unixpacket, DNS:bufconn, IP Address:127.0.0.1, IP Address:0:0:0:0:0:0:0:1, IP Address:172.27.0.5
    Signature Algorithm: ecdsa-with-SHA256
    Signature Value:
        30:45:02:21:00:f2:c6:a5:25:fa:b8:19:fa:85:51:64:bf:e7:
        8c:f7:4d:ab:65:74:6b:1f:b3:28:c9:f3:4e:41:65:17:37:3b:
        6a:02:20:2c:8d:9f:db:aa:8a:f5:68:52:ee:98:e7:84:02:6c:
        bf:5f:f4:b5:96:c9:3c:d0:9d:a6:a7:7a:2c:07:fd:08:a4

Letting LND generate a new one fixes this.

Sorry for the bad initial experience @sutt 👀

[sutt]

Woohoo, this works. Thank you @ekzyis. And not a bad experience at all, thanks for prompt fix.

Explanation for those finding this discussion below...

Simple fix:

• stop all containers: ./sndev stop
• remove the existing volume on sn_lnd container: docker volume rm stackernews1_sn_lnd
• start all containers with profiles containing, e.g. COMPOSE_PROFILES='minimal,payments'

Fix Explained

• If you've already run sn_lnd container, you'll already have a cert saved in a persistent folder between start/stops.
• You can find this by starting the containers as: docker inspect sn_lnd | jq '.[0].Mounts' which will give:

[
  {
    "Type": "bind",
    "Source": "/var/lib/docker/volumes/stackernews1_sn_lnd",
    "Destination": ...,
    ...
  }

Inside this Source path you'll filnd _data/tls.cert. You can run `cat on this and save the value. It will change in the next steps...

• When you run docker volume rm stackernews1_sn_lnd this folder will get deleted.
• And when you run ./sndev start after this command the folder will reappear with a new tls.cert and you can compare against the previous value, it should be different.
• An easy way to check if this works is if you can click ProfileMenu > Credits > Cowboy Credits > Buy > An invoice generates (when the account has no sats in it)

[sutt]

Easier reset way: ./sndev compose down -v
Note: this will erase all volumes so you'll lose anything you saved in the app/database too.

[huumn]

we usually just run sndev delete and then sndev start

It only takes about a minute.