tor for the dev environment

2024-10-26 01:28:07 +02:00 · 2024-10-26 01:28:07 +02:00 · 5a09c48e04
parent 18565200e6
commit 5a09c48e04
13 changed files with 3320 additions and 54 deletions
--- a/.env.development
+++ b/.env.development
@ -157,7 +157,8 @@ PERSISTENCE=1
 SKIP_SSL_CERT_DOWNLOAD=1

 # tor
-TOR_PROXY=http://127.0.0.1:7050/
+TOR_PROXY=http://tor:7050/
+GRPC_PROXY=http://tor:7050/

 # lnbits
 LNBITS_WEB_PORT=5001
--- a/docker-compose.yml
+++ b/docker-compose.yml
@ -40,6 +40,18 @@ services:
    labels:
      CONNECT: "localhost:5431"
    cpu_shares: "${CPU_SHARES_IMPORTANT}"
+  tor:
+    build:
+      context: ./docker/tor
+    container_name: tor
+    restart: unless-stopped
+    volumes:
+      - tordata:/tordata/
+    cpu_shares: "${CPU_SHARES_LOW}"
+    env_file: *env_file
+    healthcheck:
+      <<: *healthcheck
+      test: ["CMD-SHELL", "bash /tor.sh check"]
  app:
    container_name: app
    stdin_open: true
@ -359,8 +371,13 @@ services:
    healthcheck:
      <<: *healthcheck
      test: ["CMD-SHELL", "lncli", "getinfo"]
-    depends_on: *depends_on_bitcoin
+    depends_on: 
+      tor:
+        condition: service_healthy
+        restart: true
+      <<: *depends_on_bitcoin     
    env_file: *env_file
+    entrypoint: /tor-entrypoint
    command:
      - 'lnd'
      - '--noseedbackup'
@ -369,6 +386,7 @@ services:
      - '--externalip=stacker_lnd'
      - '--tlsextradomain=stacker_lnd'
      - '--tlsextradomain=host.docker.internal'
+      - '--tlsextradomain=$${ONION_DOMAIN}'
      - '--listen=0.0.0.0:9735'
      - '--rpclisten=0.0.0.0:10009'
      - '--rpcmiddleware.enable'
@ -394,6 +412,7 @@ services:
      - "${STACKER_LND_GRPC_PORT}:10009"
    volumes:
      - stacker_lnd:/home/lnd/.lnd
+      - tordata:/home/lnd/.tor
    labels:
      ofelia.enabled: "true"
      ofelia.job-exec.stacker_lnd_channel_cron.schedule: "@every 1m"
@ -618,3 +637,4 @@ volumes:
  s3:
  nwc_send:
  nwc_recv:
+  tordata:
--- a/docker/lnd/Dockerfile
+++ b/docker/lnd/Dockerfile
@ -10,3 +10,6 @@ RUN apt-get update -y \

 COPY ["./$LN_NODE_FOR/regtest/*", "/home/lnd/.lnd/data/chain/bitcoin/regtest/"]
 COPY ["./$LN_NODE_FOR/tls.*", "/home/lnd/.lnd/"]
+
+ADD tor-entrypoint.sh /tor-entrypoint
+RUN chmod +x /tor-entrypoint
--- a/docker/lnd/stacker/tls.cert
+++ b/docker/lnd/stacker/tls.cert
@ -1,15 +0,0 @@
-----BEGIN CERTIFICATE-----
-MIICRzCCAe2gAwIBAgIQc06vWIBuP9uKeQNHKbFllDAKBggqhkjOPQQDAjA4MR8w
-HQYDVQQKExZsbmQgYXV0b2dlbmVyYXRlZCBjZXJ0MRUwEwYDVQQDEww4Y2M4NDFk
-MjY2MzgwHhcNMjQwMzA3MTcwMjE5WhcNMjUwNTAyMTcwMjE5WjA4MR8wHQYDVQQK
-ExZsbmQgYXV0b2dlbmVyYXRlZCBjZXJ0MRUwEwYDVQQDEww4Y2M4NDFkMjY2Mzgw
-WTATBgcqhkjOPQIBBggqhkjOPQMBBwNCAAQT/nwvMHaVCfdVaeIgv8MKS+SHAS9c
-Elif7Xqa7qsVvPiW7Vnh4MDVEBlM5rg0nkaH6V17sCC3rse/OqPLfVY1o4HYMIHV
-MA4GA1UdDwEB/wQEAwICpDATBgNVHSUEDDAKBggrBgEFBQcDATAPBgNVHRMBAf8E
-BTADAQH/MB0GA1UdDgQWBBQmamVn/KcRqHoNR9dk9C1g2M+jSTB+BgNVHREEdzB1
-ggw4Y2M4NDFkMjY2MziCCWxvY2FsaG9zdIILc3RhY2tlcl9sbmSCFGhvc3QuZG9j
-a2VyLmludGVybmFsggR1bml4ggp1bml4cGFja2V0ggdidWZjb25uhwR/AAABhxAA
-AAAAAAAAAAAAAAAAAAABhwSsGwAGMAoGCCqGSM49BAMCA0gAMEUCIFD273WBcMKz
-UPoOL8bwq15JXtrSGePKpAeN1TblY4Q5AiEAvKtuk+ssx9WQFZBEiWxCSjW5geKk
-6HB7TdxsU+ZbfLg=
-----END CERTIFICATE-----
--- a/docker/lnd/stacker/tls.key
+++ b/docker/lnd/stacker/tls.key
@ -1,5 +0,0 @@
-----BEGIN EC PRIVATE KEY-----
-MHcCAQEEIOxH9uY8mpnlo/X5gRAAVOzOuEPIAOuHHlezkba3vIuHoAoGCCqGSM49
-AwEHoUQDQgAEE/58LzB2lQn3VWniIL/DCkvkhwEvXBJYn+16mu6rFbz4lu1Z4eDA
-1RAZTOa4NJ5Gh+lde7Agt67Hvzqjy31WNQ==
-----END EC PRIVATE KEY-----
--- a/docker/lnd/tor-entrypoint.sh
+++ b/docker/lnd/tor-entrypoint.sh
@ -0,0 +1,13 @@
+#!/bin/bash
+
+ONION_DOMAIN=""
+
+if [ -f /home/lnd/.tor/hidden_service/hostname ]; then
+    ONION_DOMAIN=$(cat /home/lnd/.tor/hidden_service/hostname)
+fi
+
+# expand the cmd arguments 
+args=$(echo "$@" | sed -e "s/\${ONION_DOMAIN}/$ONION_DOMAIN/g")
+
+# Execute the original entry point script with the modified command line``
+/entrypoint.sh $args
--- a/docker/tor/Dockerfile
+++ b/docker/tor/Dockerfile
@ -0,0 +1,16 @@
+FROM debian:bookworm
+
+RUN apt-get update -y \
+    && apt-get install -y tor bash openssl netcat-traditional privoxy \
+    && apt-get clean \
+    && rm -rf /var/lib/apt/lists/* /tmp/* /var/tmp/*
+
+ADD torrc /etc/tor/torrc.template
+ADD tor.sh /tor.sh
+ADD services.conf /services.conf
+ADD privoxy.conf  /etc/privoxy/config
+RUN mkdir -p /tordata && groupadd -g 1000 tor && useradd -u 1000 -g 1000 -m tor && chown -R tor:tor /tordata
+EXPOSE 9050 9051 7050
+VOLUME "/tordata"
+USER tor
+ENTRYPOINT [ "bash", "/tor.sh" ]
--- a/docker/tor/privoxy.conf
+++ b/docker/tor/privoxy.conf
--- a/docker/tor/services.conf
+++ b/docker/tor/services.conf
@ -0,0 +1 @@
+HiddenServicePort 10009 stacker_lnd:10009
--- a/docker/tor/tor.sh
+++ b/docker/tor/tor.sh
@ -0,0 +1,69 @@
+#!/bin/bash
+
+function initialize { 
+    ####################### generate and save control password ########################
+    cp -f /etc/tor/torrc.template /tordata/torrc
+    TOR_PASSWORD=""
+    if [ -f /tordata/.env.torpass ]; then source /tordata/.env.torpass; fi
+
+    if [ -z "$torPassword" ]; then
+        TOR_PASSWORD=$(openssl rand -hex 32)
+        echo "TOR_PASSWORD=$TOR_PASSWORD" > /tordata/.env.torpass
+    fi
+
+    TOR_PASSWORD_HASH=$(tor --hash-password "$TOR_PASSWORD" 2>/dev/null | tail -n 1)
+    echo "Replacing %HashedControlPassword% with $TOR_PASSWORD_HASH"
+    sed -i "s|%HashedControlPassword%|$TOR_PASSWORD_HASH|g" /tordata/torrc
+    ##################################################################################
+}
+
+function mergeServices {
+    cat /services.conf >> /tordata/torrc
+}
+
+# There is a circular dependency between tor and stacker_lnd:
+#  <-> tor needs stacker_lnd to be running to resolve the hidden service target
+#  <-> stacker_lnd needs to wait for tor to start and generate the hidden service address
+# Afaik there isn't an "official" solution for this issue.
+#
+# This workaround starts tor the first time without the lnd hidden service
+# and then re-start tor with the full configuration after the lnd service is ready.
+
+
+if [ -f /tordata/start.timestamp ];
+then
+    # Remove leftovers from a previous run
+    rm /tordata/start.timestamp
+fi
+
+if [ "$1" = "check" ];
+then
+    if [ ! -f /tordata/start.timestamp ]; then
+        # if still initializing we just check if the hidden service was generated and use this as a healthcheck
+        if [ -f /tordata/hidden_service/hostname ]; then exit 0; else exit 1; fi
+    else
+        # run the real healthcheck
+        echo -e 'AUTHENTICATE "'$TOR_PASSWORD'"\nGETINFO status/circuit-established\nQUIT' | nc 127.0.0.1 9051 | grep OK || exit 1
+        exit 0
+    fi
+else
+    # Step 1: we start tor with a fake hidden service that points to port 8080, 
+    # just to get it to generate the hidden service data, then we kill it immediately after
+    echo "Initializing..."
+    initialize
+    tor -f /tordata/torrc &
+    pid=$!
+    sleep 60
+    kill $pid
+
+    # debug
+    ls /tordata/hidden_service/
+    
+    # Step 2: we merge the service configuration and start tor again
+    echo "Starting tor..."
+    initialize
+    mergeServices
+    date +%s > /tordata/start.timestamp
+    privoxy --no-daemon /etc/privoxy/config&
+    tor -f /tordata/torrc
+fi
--- a/docker/tor/torrc
+++ b/docker/tor/torrc
@ -0,0 +1,260 @@
+## Configuration file for a typical Tor user
+## Last updated 28 February 2019 for Tor 0.3.5.1-alpha.
+## (may or may not work for much older or much newer versions of Tor.)
+##
+## Lines that begin with "## " try to explain what's going on. Lines
+## that begin with just "#" are disabled commands: you can enable them
+## by removing the "#" symbol.
+##
+## See 'man tor', or https://www.torproject.org/docs/tor-manual.html,
+## for more options you can use in this file.
+##
+## Tor will look for this file in various places based on your platform:
+## https://support.torproject.org/tbb/tbb-editing-torrc/
+
+## Tor opens a SOCKS proxy on port 9050 by default -- even if you don't
+## configure one below. Set "SOCKSPort 0" if you plan to run Tor only
+## as a relay, and not make any local application connections yourself.
+SOCKSPort 0.0.0.0:9050 # Default: Bind to localhost:9050 for local connections.
+#SOCKSPort 192.168.0.1:9100 # Bind to this address:port too.
+#HTTPTunnelPort 127.0.0.1:7051
+## Entry policies to allow/deny SOCKS requests based on IP address.
+## First entry that matches wins. If no SOCKSPolicy is set, we accept
+## all (and only) requests that reach a SOCKSPort. Untrusted users who
+## can access your SOCKSPort may be able to learn about the connections
+## you make.
+#SOCKSPolicy accept 192.168.0.0/16
+#SOCKSPolicy accept6 FC00::/7
+SOCKSPolicy accept *
+
+## Logs go to stdout at level "notice" unless redirected by something
+## else, like one of the below lines. You can have as many Log lines as
+## you want.
+##
+## We advise using "notice" in most cases, since anything more verbose
+## may provide sensitive information to an attacker who obtains the logs.
+##
+## Send all messages of level 'notice' or higher to @LOCALSTATEDIR@/log/tor/notices.log
+#Log notice file @LOCALSTATEDIR@/log/tor/notices.log
+## Send every possible message to @LOCALSTATEDIR@/log/tor/debug.log
+#Log debug file @LOCALSTATEDIR@/log/tor/debug.log
+## Use the system log instead of Tor's logfiles
+Log notice stdout
+## To send all messages to stderr:
+#Log debug stderr
+
+## Uncomment this to start the process in the background... or use
+## --runasdaemon 1 on the command line. This is ignored on Windows;
+## see the FAQ entry if you want Tor to run as an NT service.
+#RunAsDaemon 1
+
+## The directory for keeping all the keys/etc. By default, we store
+## things in $HOME/.tor on Unix, and in Application Data\tor on Windows.
+#DataDirectory @LOCALSTATEDIR@/lib/tor
+
+## The port on which Tor will listen for local connections from Tor
+## controller applications, as documented in control-spec.txt.
+ControlPort 127.0.0.1:9051
+## If you enable the controlport, be sure to enable one of these
+## authentication methods, to prevent attackers from accessing it.
+HashedControlPassword %HashedControlPassword%
+#CookieAuthentication 1
+
+############### This section is just for location-hidden services ###
+
+## Once you have configured a hidden service, you can look at the
+## contents of the file ".../hidden_service/hostname" for the address
+## to tell people.
+##
+## HiddenServicePort x y:z says to redirect requests on port x to the
+## address y:z.
+
+#HiddenServiceDir @LOCALSTATEDIR@/lib/tor/hidden_service/
+#HiddenServicePort 80 127.0.0.1:80
+
+HiddenServiceDir /tordata/hidden_service/
+# Fake service just to initialize the hidden service directory
+HiddenServicePort 8080 127.0.0.1:8080
+
+
+
+
+################ This section is just for relays #####################
+#
+## See https://community.torproject.org/relay for details.
+
+## Required: what port to advertise for incoming Tor connections.
+#ORPort 9001
+## If you want to listen on a port other than the one advertised in
+## ORPort (e.g. to advertise 443 but bind to 9090), you can do it as
+## follows.  You'll need to do ipchains or other port forwarding
+## yourself to make this work.
+#ORPort 443 NoListen
+#ORPort 127.0.0.1:9090 NoAdvertise
+## If you want to listen on IPv6 your numeric address must be explicitly
+## between square brackets as follows. You must also listen on IPv4.
+#ORPort [2001:DB8::1]:9050
+
+## The IP address or full DNS name for incoming connections to your
+## relay. Leave commented out and Tor will guess.
+#Address noname.example.com
+
+## If you have multiple network interfaces, you can specify one for
+## outgoing traffic to use.
+## OutboundBindAddressExit will be used for all exit traffic, while
+## OutboundBindAddressOR will be used for all OR and Dir connections
+## (DNS connections ignore OutboundBindAddress).
+## If you do not wish to differentiate, use OutboundBindAddress to
+## specify the same address for both in a single line.
+#OutboundBindAddressExit 10.0.0.4
+#OutboundBindAddressOR 10.0.0.5
+
+## A handle for your relay, so people don't have to refer to it by key.
+## Nicknames must be between 1 and 19 characters inclusive, and must
+## contain only the characters [a-zA-Z0-9].
+## If not set, "Unnamed" will be used.
+#Nickname ididnteditheconfig
+
+## Define these to limit how much relayed traffic you will allow. Your
+## own traffic is still unthrottled. Note that RelayBandwidthRate must
+## be at least 75 kilobytes per second.
+## Note that units for these config options are bytes (per second), not
+## bits (per second), and that prefixes are binary prefixes, i.e. 2^10,
+## 2^20, etc.
+#RelayBandwidthRate 100 KBytes  # Throttle traffic to 100KB/s (800Kbps)
+#RelayBandwidthBurst 200 KBytes # But allow bursts up to 200KB (1600Kb)
+
+## Use these to restrict the maximum traffic per day, week, or month.
+## Note that this threshold applies separately to sent and received bytes,
+## not to their sum: setting "40 GB" may allow up to 80 GB total before
+## hibernating.
+##
+## Set a maximum of 40 gigabytes each way per period.
+#AccountingMax 40 GBytes
+## Each period starts daily at midnight (AccountingMax is per day)
+#AccountingStart day 00:00
+## Each period starts on the 3rd of the month at 15:00 (AccountingMax
+## is per month)
+#AccountingStart month 3 15:00
+
+## Administrative contact information for this relay or bridge. This line
+## can be used to contact you if your relay or bridge is misconfigured or
+## something else goes wrong. Note that we archive and publish all
+## descriptors containing these lines and that Google indexes them, so
+## spammers might also collect them. You may want to obscure the fact that
+## it's an email address and/or generate a new address for this purpose.
+##
+## If you are running multiple relays, you MUST set this option.
+##
+#ContactInfo Random Person <nobody AT example dot com>
+## You might also include your PGP or GPG fingerprint if you have one:
+#ContactInfo 0xFFFFFFFF Random Person <nobody AT example dot com>
+
+## Uncomment this to mirror directory information for others. Please do
+## if you have enough bandwidth.
+#DirPort 9030 # what port to advertise for directory connections
+## If you want to listen on a port other than the one advertised in
+## DirPort (e.g. to advertise 80 but bind to 9091), you can do it as
+## follows.  below too. You'll need to do ipchains or other port
+## forwarding yourself to make this work.
+#DirPort 80 NoListen
+#DirPort 127.0.0.1:9091 NoAdvertise
+## Uncomment to return an arbitrary blob of html on your DirPort. Now you
+## can explain what Tor is if anybody wonders why your IP address is
+## contacting them. See contrib/tor-exit-notice.html in Tor's source
+## distribution for a sample.
+#DirPortFrontPage @CONFDIR@/tor-exit-notice.html
+
+## Uncomment this if you run more than one Tor relay, and add the identity
+## key fingerprint of each Tor relay you control, even if they're on
+## different networks. You declare it here so Tor clients can avoid
+## using more than one of your relays in a single circuit. See
+## https://support.torproject.org/relay-operators/multiple-relays/
+## However, you should never include a bridge's fingerprint here, as it would
+## break its concealability and potentially reveal its IP/TCP address.
+##
+## If you are running multiple relays, you MUST set this option.
+##
+## Note: do not use MyFamily on bridge relays.
+#MyFamily $keyid,$keyid,...
+
+## Uncomment this if you want your relay to be an exit, with the default
+## exit policy (or whatever exit policy you set below).
+## (If ReducedExitPolicy, ExitPolicy, or IPv6Exit are set, relays are exits.
+## If none of these options are set, relays are non-exits.)
+#ExitRelay 1
+
+## Uncomment this if you want your relay to allow IPv6 exit traffic.
+## (Relays do not allow any exit traffic by default.)
+#IPv6Exit 1
+
+## Uncomment this if you want your relay to be an exit, with a reduced set
+## of exit ports.
+#ReducedExitPolicy 1
+
+## Uncomment these lines if you want your relay to be an exit, with the
+## specified set of exit IPs and ports.
+##
+## A comma-separated list of exit policies. They're considered first
+## to last, and the first match wins.
+##
+## If you want to allow the same ports on IPv4 and IPv6, write your rules
+## using accept/reject *. If you want to allow different ports on IPv4 and
+## IPv6, write your IPv6 rules using accept6/reject6 *6, and your IPv4 rules
+## using accept/reject *4.
+##
+## If you want to _replace_ the default exit policy, end this with either a
+## reject *:* or an accept *:*. Otherwise, you're _augmenting_ (prepending to)
+## the default exit policy. Leave commented to just use the default, which is
+## described in the man page or at
+## https://support.torproject.org/relay-operators
+##
+## Look at https://support.torproject.org/abuse/exit-relay-expectations/
+## for issues you might encounter if you use the default exit policy.
+##
+## If certain IPs and ports are blocked externally, e.g. by your firewall,
+## you should update your exit policy to reflect this -- otherwise Tor
+## users will be told that those destinations are down.
+##
+## For security, by default Tor rejects connections to private (local)
+## networks, including to the configured primary public IPv4 and IPv6 addresses,
+## and any public IPv4 and IPv6 addresses on any interface on the relay.
+## See the man page entry for ExitPolicyRejectPrivate if you want to allow
+## "exit enclaving".
+##
+#ExitPolicy accept *:6660-6667,reject *:* # allow irc ports on IPv4 and IPv6 but no more
+#ExitPolicy accept *:119 # accept nntp ports on IPv4 and IPv6 as well as default exit policy
+#ExitPolicy accept *4:119 # accept nntp ports on IPv4 only as well as default exit policy
+#ExitPolicy accept6 *6:119 # accept nntp ports on IPv6 only as well as default exit policy
+#ExitPolicy reject *:* # no exits allowed
+
+## Uncomment this if you want your exit relay to reevaluate its exit policy on
+## existing connections when the exit policy is modified.
+#ReevaluateExitPolicy 1
+
+## Bridge relays (or "bridges") are Tor relays that aren't listed in the
+## main directory. Since there is no complete public list of them, even an
+## ISP that filters connections to all the known Tor relays probably
+## won't be able to block all the bridges. Also, websites won't treat you
+## differently because they won't know you're running Tor. If you can
+## be a real relay, please do; but if not, be a bridge!
+##
+## Warning: when running your Tor as a bridge, make sure than MyFamily is
+## NOT configured.
+#BridgeRelay 1
+## By default, Tor will advertise your bridge to users through various
+## mechanisms like https://bridges.torproject.org/. If you want to run
+## a private bridge, for example because you'll give out your bridge
+## address manually to your friends, uncomment this line:
+#BridgeDistribution none
+
+## Configuration options can be imported from files or folders using the %include
+## option with the value being a path. This path can have wildcards. Wildcards are
+## expanded first, using lexical order. Then, for each matching file or folder, the following
+## rules are followed: if the path is a file, the options from the file will be parsed as if
+## they were written where the %include option is. If the path is a folder, all files on that
+## folder will be parsed following lexical order. Files starting with a dot are ignored. Files
+## on subfolders are ignored.
+## The %include option can be used recursively.
+#%include /etc/torrc.d/*.conf
+
--- a/53
+++ b/53
@ -524,6 +524,57 @@ USAGE
  echo "$help"
 }

+sndev__help_stacker_lnd() {
+  help="
+
+USAGE
+  $ sndev stacker_lnd get_cert         get the tls cert
+  $ sndev stacker_lnd get_onion        get the onion address
+"
+
+  echo "$help"
+}
+
+sndev__stacker_lnd() {  
+  shift
+  if [ -z "$1" ]; then
+    echo "no command provided"
+    sndev__help_stacker_lnd
+    exit 1
+  fi
+  if [ "$1" = "get_cert" ]; then
+    echo $(docker__exec -t stacker_lnd openssl base64 -A -in /home/lnd/.lnd/tls.cert)
+  elif [ "$1" = "get_onion" ];
+  then
+    onion="$(docker__exec -t stacker_lnd cat /home/lnd/.tor/hidden_service/hostname | tr -d '[:space:]')"
+    echo "$onion:10009"
+  fi  
+}
+
+sndev__help_tor() {
+  help="
+
+USAGE
+  $ sndev tor get_onion         get the onion address
+"
+  
+  echo "$help"
+}
+
+sndev__tor() {  
+  shift
+  if [ -z "$1" ]; then
+    echo "no command provided"
+    sndev__help_tor
+    exit 1
+  fi
+  if [ "$1" = "get_onion" ];
+  then
+    onion="$(docker__exec -t stacker_lnd cat /home/lnd/.tor/hidden_service/hostname | tr -d '[:space:]')"
+    echo "$onion"
+  fi  
+}
+
 sndev__help() {
    if [ $# -eq 2 ]; then
      call "sndev__$1_$2" "$@"
@ -584,6 +635,8 @@ COMMANDS
    stacker_lndcli         lncli passthrough on stacker_lnd
    stacker_clncli         lightning-cli passthrough on stacker_cln
    stacker_litcli         litcli passthrough on litd
+    tor get_onion          get the onion address
+    stacker_lnd get_cert   get the tls cert
 "
  echo "$help"
 }
--- a/wallets/lnd/ATTACH.md
+++ b/wallets/lnd/ATTACH.md
@ -4,6 +4,14 @@ For testing lnd as an attached receiving wallet, you'll need a macaroon and the

 `stacker_lnd:10009`

+## host and port (onion)
+
+To get the onion address run this command:
+
+```bash
+sndev stacker_lnd get_onion
+```
+
 # generate macaroon

 ```bash
@ -12,14 +20,8 @@ sndev stacker_lndcli -n regtest bakemacaroon invoices:write invoices:read

 # get cert

-This is static in dev env so you can use this one:
+To get the cert run this command:

 ```bash
-LS0tLS1CRUdJTiBDRVJUSUZJQ0FURS0tLS0tCk1JSUNSekNDQWUyZ0F3SUJBZ0lRYzA2dldJQnVQOXVLZVFOSEtiRmxsREFLQmdncWhrak9QUVFEQWpBNE1SOHcKSFFZRFZRUUtFeFpzYm1RZ1lYVjBiMmRsYm1WeVlYUmxaQ0JqWlhKME1SVXdFd1lEVlFRREV3dzRZMk00TkRGawpNalkyTXpnd0hoY05NalF3TXpBM01UY3dNakU1V2hjTk1qVXdOVEF5TVRjd01qRTVXakE0TVI4d0hRWURWUVFLCkV4WnNibVFnWVhWMGIyZGxibVZ5WVhSbFpDQmpaWEowTVJVd0V3WURWUVFERXd3NFkyTTROREZrTWpZMk16Z3cKV1RBVEJnY3Foa2pPUFFJQkJnZ3Foa2pPUFFNQkJ3TkNBQVFUL253dk1IYVZDZmRWYWVJZ3Y4TUtTK1NIQVM5YwpFbGlmN1hxYTdxc1Z2UGlXN1ZuaDRNRFZFQmxNNXJnMG5rYUg2VjE3c0NDM3JzZS9PcVBMZlZZMW80SFlNSUhWCk1BNEdBMVVkRHdFQi93UUVBd0lDcERBVEJnTlZIU1VFRERBS0JnZ3JCZ0VGQlFjREFUQVBCZ05WSFJNQkFmOEUKQlRBREFRSC9NQjBHQTFVZERnUVdCQlFtYW1Wbi9LY1JxSG9OUjlkazlDMWcyTStqU1RCK0JnTlZIUkVFZHpCMQpnZ3c0WTJNNE5ERmtNalkyTXppQ0NXeHZZMkZzYUc5emRJSUxjM1JoWTJ0bGNsOXNibVNDRkdodmMzUXVaRzlqCmEyVnlMbWx1ZEdWeWJtRnNnZ1IxYm1sNGdncDFibWw0Y0dGamEyVjBnZ2RpZFdaamIyNXVod1IvQUFBQmh4QUEKQUFBQUFBQUFBQUFBQUFBQUFBQUJod1NzR3dBR01Bb0dDQ3FHU000OUJBTUNBMGdBTUVVQ0lGRDI3M1dCY01LegpVUG9PTDhid3ExNUpYdHJTR2VQS3BBZU4xVGJsWTRRNUFpRUF2S3R1aytzc3g5V1FGWkJFaVd4Q1NqVzVnZUtrCjZIQjdUZHhzVStaYmZMZz0KLS0tLS1FTkQgQ0VSVElGSUNBVEUtLS0tLQo=
-```
-
-Which is generated with the following command
-
-```bash
-openssl base64 -A -in docker/lnd/stacker/tls.cert
+sndev stacker_lnd get_cert
 ```