Is it possible to set up a merchant site where:
The customer facing website generates valid lightning invoices, given some kind of master public key, that it gives users to pay
The actual lnd server is located on an entirely different server, and the front facing website works entirely without making any outbound RPC calls to the lnd server. The lnd server would be updating a backoffice database and would not have contact with the front facing website at all.
I would expect this to be possible, maybe by having the customer facing site and lnd both share the same seed that they use to generate preimages using. I have tried just making my own script to generate valid invoices using, but it seems like lnd still needs its
AddInvoice RPC call for it to handle those invoices.
The parallel of course being BIP32, where we can put a public xpub key on the customer facing site, have the actual wallet software checking for payments on an entirely different server, and the 2 never having to talk to each other. In a worst case if an attacker took over the customer facing site, they'd only get my xpub for that week, since there are no private keys.