github.com/decred/dcrlnd@v0.7.6/docs/watchtower.md

# Private Altruist Watchtowers

As of v0.7.0, `lnd` supports the ability to run a private, altruist watchtower
as a fully-integrated subsystem of `lnd`. Watchtowers act as a second line of
defense in responding to malicious or accidental breach scenarios in the event
that the client’s node is offline or unable to respond at the time of a breach,
offering greater degree of safety to channel funds.

In contrast to a _reward watchtower_ which demand a portion of the channel funds
as a reward for fulfilling its duty, an _altruist watchtower_ returns all of the
victim’s funds (minus on-chain fees) without taking a cut. Reward watchtowers
will be enabled in a subsequent release, though are still undergoing further
testing and refinement.

In addition, `lnd` can now be configured to operate as a _watchtower client_,
backing up encrypted breach-remedy transactions (aka. justice transactions) to
other altruist watchtowers. The watchtower stores fixed-size, encrypted blobs
and is only able to decrypt and publish the justice transaction after the
offending party has broadcast a revoked commitment state. Client communications
with a watchtower are encrypted and authenticated using ephemeral keypairs,
mitigating the amount of tracking the watchtower can perform on its clients
using long-term identifiers.

Note that we have chosen to deploy a restricted set of features in this release
that can begin to provide meaningful security to `lnd` users. Many more
watchtower-related features are nearly complete or have meaningful progress, and
we will continue to ship them as they receive further testing and become safe to
release.

Note: *For now, watchtowers will only backup the `to_local` and `to_remote` outputs
from revoked commitments; backing up HTLC outputs is slated to be deployed in a
future release, as the protocol can be extended to include the extra signature
data in the encrypted blobs.*

## Configuring a Watchtower

To set up a watchtower, command line users should compile in the
`watchtowerrpc` subserver, which will offer the ability to interface with the
tower via gRPC or `lncli`.

The minimal configuration needed to activate the tower is `watchtower.active=1`.

Retrieving information about your tower’s configurations can be done using
`lncli tower info`:

```
🏔 lncli tower info
{
        "pubkey": "03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63",
        "listeners": [
                "[::]:9911"
        ],
        "uris": null,
}
```

The entire set of watchtower configuration options can be found using 
`lnd -h`:

```
watchtower:
      --watchtower.active                                     If the watchtower should be active or not
      --watchtower.towerdir=                                  Directory of the watchtower.db (default: $HOME/.lnd/data/watchtower)
      --watchtower.listen=                                    Add interfaces/ports to listen for peer connections
      --watchtower.externalip=                                Add interfaces/ports where the watchtower can accept peer connections
      --watchtower.readtimeout=                               Duration the watchtower server will wait for messages to be received before hanging up on client connections
      --watchtower.writetimeout=                              Duration the watchtower server will wait for messages to be written before hanging up on client connections
```

### Listening Interfaces

By default, the watchtower will listen on `:9911` which specifies port `9911`
listening on all available interfaces. Users may configure their own listeners
via the `--watchtower.listen=` option. You can verify your configuration by
checking the `"listeners"` field in `lncli tower info`. If you're having trouble
connecting to your watchtower, ensure that `<port>` is open or your proxy is
properly configured to point to an active listener.

### External IP Addresses

Additionally, users can specify their tower’s external IP address(es) using
`watchtower.externalip=`, which will expose the full tower URIs
(pubkey@host:port) over RPC or `lncli tower info`: 

```
        ...
        "uris": [
                "03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63@1.2.3.4:9911"
        ]
```

The watchtower's URIs can be given to clients in order to connect and use the
tower with the following command:

```
🏔 lncli wtclient add 03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63@1.2.3.4:9911
```

If the watchtower's clients will need remote access, be sure to either:
 - Open port 9911 or a port chosen via `watchtower.listen`.
 - Use a proxy to direct traffic from an open port to the watchtower's listening
   address.

### Tor Hidden Services

Watchtowers have tor hidden service support and can automatically generate a
hidden service on startup with the following flags:

```
🏔 lnd --tor.active --tor.v3 --watchtower.active
```

The onion address is then shown in the "uris" field when queried with `lncli tower info`:

```
...
"uris": [
        "03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63@bn2kxggzjysvsd5o3uqe4h7655u7v2ydhxzy7ea2fx26duaixlwuguad.onion:9911"
]
```

Note: *The watchtower’s public key is distinct from `lnd`’s node public key. For
now this acts as a soft whitelist as it requires clients to know the tower’s
public key in order to use it for backups before more advanced whitelisting
features are implemented. We recommend NOT disclosing this public key openly,
unless you are prepared to open your tower up to the entire Internet.*

### Watchtower Database Directory

The watchtower's database can be moved using the `watchtower.towerdir=`
configuration option. Note that a trailing `/bitcoin/mainnet/watchtower.db`
will be appended to the chosen directory to isolate databases for different
chains, so setting `watchtower.towerdir=/path/to/towerdir` will yield a
watchtower database at `/path/to/towerdir/bitcoin/mainnet/watchtower.db`.

On Linux, for example, the default watchtower database will be located at:

```
/$USER/.lnd/data/watchtower/bitcoin/mainnet/watchtower.db
```

## Configuring a Watchtower Client

In order to set up a watchtower client, you’ll need two things:

1. The watchtower client must be enabled with the `--wtclient.active` flag.

```
🏔 lnd --wtclient.active
```

2. The watchtower URI of an active watchtower.

```
🏔 lncli wtclient add 03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63@1.2.3.4:9911
```

Multiple watchtowers can be configured through this method.

### Justice Fee Rates

Users may optionally configure the fee rate of justice transactions by setting
the `wtclient.sweep-fee-rate` option, which accepts values in sat/byte. The
default value is 10 sat/byte, though users may choose to target higher rates to
offer greater priority during fee-spikes. Modifying the `sweep-fee-rate` will
be applied to all new updates after the daemon has been restarted.

### Monitoring

With the addition of the `lncli wtclient` command, users are now able to
interact with the watchtower client directly to obtain/modify information about
the set of registered watchtowers.

As as example, with the `lncli wtclient tower` command, you can obtain the
number of sessions currently negotiated with the watchtower added above and
determine whether it is currently being used for backups through the
`active_session_candidate` value.

```
🏔 lncli wtclient tower 03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63
{
	"pubkey": "03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63",
	"addresses": [
		"1.2.3.4:9911"
	],
	"active_session_candidate": true,
	"num_sessions": 1,
	"sessions": []
}
```

To obtain information about the watchtower's sessions, users can use the
`--include_sessions` flag.

```
🏔 lncli wtclient tower --include_sessions 03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63
{
        "pubkey": "03281d603b2c5e19b8893a484eb938d7377179a9ef1a6bca4c0bcbbfc291657b63",
        "addresses": [
                "1.2.3.4:9911"
        ],
        "active_session_candidate": true,
        "num_sessions": 1,
        "sessions": [
                {
                        "num_backups": 0,
                        "num_pending_backups": 0,
                        "max_backups": 1024,
                        "sweep_sat_per_byte": 10
                }
        ]
}
```

The entire set of watchtower client configuration options can be found with
`lncli wtclient -h`:

```
NAME:
   lncli wtclient - Interact with the watchtower client.

USAGE:
   lncli wtclient command [command options] [arguments...]

COMMANDS:
     add     Register a watchtower to use for future sessions/backups.
     remove  Remove a watchtower to prevent its use for future sessions/backups.
     towers  Display information about all registered watchtowers.
     tower   Display information about a specific registered watchtower.
     stats   Display the session stats of the watchtower client.
     policy  Display the active watchtower client policy configuration.

OPTIONS:
   --help, -h  show help
```