2

If I wanted to move my c-lightning node to an other machine, is there a way to do that (and how)? Specifically, without changing my node key or closing my channels?

This question was asked by plant-boy on IRC.

1 Answer 1

4

This question was answered by Christian Decker on IRC.

Yes, it's a bit tricky, because you never want to start the old copy once you started the new one, but absolutely doable. 1) stop the old node, 2) rename the .lightning directory so you can't accidentally restart the old node (maybe verify that starting will create a new node), 3) copy the renamed .lightning to new host in the place where you'll be running from, and 4) point lightningd to the copied directory and start it.

I'd also delete any copy remaining on the old host for safety (starting that one may lead to loss of funds). While you're at it, make a backup of hsm_secret files in the directory (those are static and safe to copy)

7
  • starting that one may lead to loss of funds Interesting. Isn't that a bug and something that should/can be fixed?
    – user103136
    Commented Dec 13, 2021 at 16:07
  • No, more a footgun than a bug. Like accidentally broadcasting a revoked state could lead to you being punished and losing all your funds in the channel. Of course in an ideal world these footguns wouldn't exist but we don't know how to magic them away in the Lightning protocol (and it may well be impossible without designing a completely different protocol). Commented Dec 13, 2021 at 16:21
  • I guess we are talking definitions/semantics. I would describe a footgun as something that is addressed with user guidance, user docs etc but it is well known and understood in the protocol. I would describe a bug as something that is discovered out of the blue and needs squashing asap (ie there is no reason for it to exist). Of course in consensus systems some bugs (like the CHECKMULTISIG OP_0 bug) can't be squashed without a hard fork so the definitions do get confusing and create grey areas. Commented Dec 13, 2021 at 16:28
  • 1
    Correct, losing any state transition is deadly in the LN protocol, which is why we came up with a more forgiving protocol with eltoo. The protocol itself makes backups and restores pretty dangerous (and this migration is pretty much just a backup + restore), because even missing a single update may lead to loss of funds (and that's true for all implementations).
    – cdecker
    Commented Dec 13, 2021 at 16:29
  • @MichaelFolkson Magic? Impossible? Not sure if I agree with that part. I will experiment and see if this can be used by attackers. Will share if I find anything interesting with some possible solutions/workarounds.
    – user103136
    Commented Dec 13, 2021 at 16:37

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service and acknowledge you have read our privacy policy.

Not the answer you're looking for? Browse other questions tagged or ask your own question.