Unlock LND wallet using wallet password file for an lnd stateless node

[ronballesteros]

We're exploring unlocking an LND wallet following this, but I don't see an option to do this for a stateless node. Is this possible?

[guggero]

No, that's not possible. Because the only way to get access to the admin macaroon on a stateless node is from the response of the lncli unlock call. And if you use auto-unlocking, then this step is skipped.
Also, in my opinion, auto-unlocking and stateless mode are (from a security perspective) orthogonal to each other.

[ronballesteros]

Thanks for the response!

Do you see this is as a use case?

In our case (we're on k8s), we run our nodes in stateless mode and unlock the wallet automatically using a wallet unlock script that is executed as a post start feature. The password file works great in our scenario since we can retrieve the password from our secrets manager than having to create a k8s secret resource). This leaves no trace of the lnd password on the pod itself. The problem is we can't do it with a stateless node.

[guggero]

Yeah, I think I do see a use case here. Though I think that would rather be a new command for lndinit.
Two questions out of curiosity:

• What's your secret source? We are planning on adding Hashicorp Vault as a secret source to lndinit, then unlocking could happen directly from Vault.
• How and where are you planning on storing the admin macaroon in order for you to be able to access the node after unlocking?

[ronballesteros]

What's your secret source? We are planning on adding Hashicorp Vault as a secret source to lndinit, then unlocking could happen directly from Vault.

We use Hashicorp Vault to manage our secrets combined with vault security webhooks for secrets injection.

How and where are you planning on storing the admin macaroon in order for you to be able to access the node after unlocking?

We use a lightning cli node (that has the macaroon) and only enable it whenever we need to operate on the lnd node directly.

[ronballesteros]

Would you like me to create an issue for this?

[guggero]

Yeah, sure. Definitely makes sense as a feature request in the lndinit repo. Thanks!