Lightning Nodes

Node Security and Backup

Functions are reusable blocks of code designed to perform specific tasks. They improve code organization, reduce repetition, and enhance maintainability.

Protect your Lightning node and ensure business continuity.

API Reference: This document focuses on security and backup practices. For complete API endpoint documentation, including authentication methods, request/response schemas, and curl examples, see api-reference.md.

Security Overview

Threat Model

Primary Risks:

Unauthorized API access
Private key compromise
Channel state loss
Force-close attacks
DDoS attacks

Mitigation Layers:

Access control
Encryption
Monitoring
Backup/recovery
Incident response

Access Control

API Architecture: Comet Platform uses two types of APIs:

Lightning Node API: Direct calls to your deployed Lightning nodes (LND API) at https://your-node.example.com/v1/... using macaroon authentication
Backend Services API: Calls to Comet Platform services for managing nodes, billing, and users:

See api-reference.md for complete API documentation.

API Authentication

API Key Management:

Available via Dashboard: API Keys → Create API Key, or via API.

Generate new key with custom name and permissions
List all existing keys
Revoke keys when no longer needed

cURL Examples:

List API Keys:

curl -X GET \\
  -H "Authorization: Bearer <access_token>" \\
  <https: users.cometplatform.com="" apikeys=""

Create API Key:

curl -X POST \\
  -H "Authorization: Bearer <access_token>" \\
  -H "Content-Type: application/json" \\
  -d '{
    "name": "My API Key",
    "permissions": ["read", "write"]
  }' \\
  <https: users.cometplatform.com="" apikeys=""

For full API documentation, see the User Service section in api-reference.md.

Key Rotation:

Rotate every 90 days
Immediate rotation if compromised
Automated rotation via API

Best Practices:

Unique key per application
Least-privilege permissions
Never commit to version control
Store in secrets manager (Vault, AWS Secrets Manager)

Permission Scopes

Available Scopes:

read: View node/channel info
write: Create invoices, send payments
admin: Node configuration, channel management

Example Configuration:

{
  "key_name": "payment-processor",
  "scopes": ["read", "write"],
  "rate_limit": 1000,
  "ip_whitelist": ["203.0.113.0/24"]
}

IP Whitelisting

Available via Dashboard: API Keys → Select Key → Edit → IP Whitelist, or via API.

Rate Limiting

Default Limits:

100 requests/minute (read)
20 requests/minute (write)
5 requests/minute (admin)

Custom Limits: Available via Dashboard: API Keys → Select Key → Edit → Rate Limits, or via API.

Encryption

Data at Rest

Automatic Encryption:

Channel state: AES-256
Backups: AES-256
Logs: AES-256
API keys: Hashed (bcrypt)

Key Management:

Keys stored in HSM
Automatic key rotation
No user action required

Data in Transit

TLS/HTTPS:

All API calls use TLS 1.3
Certificate pinning available
Perfect forward secrecy

Verify Certificate: Use standard TLS verification tools or check via Dashboard → Security → Certificate Info.

Macaroon Security

Macaroon Permissions: Available via Dashboard: My Nodes → Select Node → Access → Bake Macaroon, or via API.

Generate restricted macaroons with specific permissions
Bake macaroons with time and IP restrictions

cURL Examples:

Upload Macaroon (via Backend Services API):

curl -X POST \\
  -H "Authorization: Bearer <access_token>" \\
  -H "Content-Type: application/json" \\
  -d '{
    "encrypted_macaroon": "encrypted_data...",
    "permissions": "readonly"
  }' \\
  <https: provisioning.cometplatform.com="" company="" company_abc123="" nodes="" node_abc123="" macaroon=""

Get Macaroon (via Backend Services API):

curl -X GET \\
  -H "Authorization: Bearer <access_token>" \\
  <https: provisioning.cometplatform.com="" company="" company_abc123="" nodes="" node_abc123="" macaroon="" readonly=""

Note: Once you have a macaroon, use it to authenticate against your Lightning Node API endpoints (e.g., https://your-node.example.com/v1/...). See the Lightning Node API section in api-reference.md for node endpoint usage.

Macaroon Best Practices:

Time-limited macaroons for temporary access
IP restrictions for known clients
Minimal permissions
Revoke after use

Backup Strategy

Backup Architecture:

Automated backups are handled by Comet Platform backend services and infrastructure
Manual channel backups are retrieved directly from your Lightning node via the Lightning Node API
Node state backups (seeds, macaroons, configuration) are managed through the Backend Services API

Automated Backups

Backup Schedule:

Channel state: Every 10 minutes
Static Channel Backup (SCB): Real-time
Configuration: On change
Full snapshot: Daily

Backup Locations:

Primary: Comet cloud storage (encrypted)
Secondary: User-specified S3/GCS bucket
Tertiary: Local export (manual)

Configure External Backup: Available via Dashboard: My Nodes → Select Node → Backup → Configure External Backup, or via API.

Configure S3, GCS, or other cloud storage providers for automated backups.

Note: External backup configuration is managed through Comet Platform backend services. Automated backups are handled by the platform infrastructure, while manual backups can be performed via the Lightning Node API for channel backups or Backend Services API for full node state.

Manual Backups

Export Static Channel Backup: Available via Dashboard: My Nodes → Select Node → Backup → Export Channel Backup, or via API.

cURL Example (Channel Backup via Lightning Node API):

curl -X GET \\
  -H "Grpc-Metadata-macaroon: <macaroon_hex>" \\
  <https: your-node.example.com="" v1="" channels="" backup=""

Note: Channel backups are retrieved directly from your Lightning node using the Lightning Node API. The macaroon must have appropriate permissions. See the Lightning Node API section in api-reference.md for complete endpoint documentation.

Export Full State: Available via Dashboard: My Nodes → Select Node → Backup → Export Full Backup, or via API.

Note: Full state backups (including node configuration, seeds, and macaroons) are managed through the Backend Services API. See the Provisioning Service section in api-reference.md for seed and macaroon management endpoints.

Backup Contents:

Channel state database
Static channel backups
Node configuration
Macaroons
TLS certificates

Backup Verification

Test Restoration: Available via Dashboard: My Nodes → Select Node → Backup → Verify Backup, or via API.

Verify backup integrity
Test restoration (dry-run) before full restore

Verification Schedule:

Weekly: Automated integrity checks
Monthly: Manual restoration test
Quarterly: Full disaster recovery drill

Disaster Recovery

Recovery Architecture:

Node creation and provisioning is handled through the Provisioning Service API (https://provisioning.cometplatform.com)
Channel backup restoration uses Lightning Node API endpoints on your deployed node
Full node state restoration involves both Backend Services API (for seeds, macaroons) and Lightning Node API (for channel recovery)

See api-reference.md for complete API endpoint documentation.

Recovery Scenarios

Scenario 1: Node Failure

Create new node
Restore from latest backup
Verify channel states
Resume operations

Scenario 2: Data Corruption

Stop node
Restore from last known good backup
Verify integrity
Restart node

Scenario 3: Complete Loss

Create new node
Restore from SCB
Initiate channel recovery
Wait for force-closures
Funds return to on-chain wallet

Recovery Procedures

Restore from SCB:

Create new node via Dashboard: My Nodes → Create Node, or via API (see Provisioning Service in api-reference.md)
Restore backup via Dashboard: My Nodes → Select Node → Backup → Restore Backup, or via API
Monitor recovery via Dashboard: My Nodes → Select Node → Backup → Recovery Status, or via API

Note: Node creation and management is handled through the Provisioning Service API (https://provisioning.cometplatform.com). Channel backup restoration uses the Lightning Node API endpoints on your deployed node. See api-reference.md for complete API documentation.

Recovery Timeline:

SCB upload: Immediate
Channel recovery initiation: 1-6 hours
Force-close confirmations: ~24 hours
Funds available: 1-3 days

Recovery Testing

Test Plan:

Create testnet node
Open test channels
Export backup
Delete node
Restore from backup
Verify channel recovery

Frequency: Quarterly

Monitoring & Alerts

Security Monitoring

Monitoring Architecture:

Security events and alerts are managed through Comet Platform backend services
Node-level monitoring can be performed via Lightning Node API endpoints
Audit logs are accessible through Backend Services API

Key Events:

Failed authentication attempts
API key usage anomalies
Unusual payment patterns
Channel force-closures
Node downtime

Configure Alerts: Available via Dashboard: My Nodes → Select Node → Settings → Alerts → Create Alert, or via API.

Configure alerts for:

Failed authentication attempts (threshold, time window, webhook)
Unusual payment amounts (threshold, webhook)
Force closures (webhook)

Audit Logging

Logged Events:

All API calls
Authentication attempts
Configuration changes
Channel operations
Payment activity

Access Logs: Available via Dashboard: My Nodes → Select Node → Logs → Audit Logs, or via API.

Filter by time range, event type, and export for analysis.

Note: Audit logging is handled by Comet Platform backend services. For API access to audit logs and monitoring endpoints, see the Backend Services API section in api-reference.md.

Log Retention: 90 days (configurable)

Intrusion Detection

Automated Detection:

Brute force attempts
Credential stuffing
API abuse
Unusual access patterns

Response Actions:

Temporary key suspension
IP blocking
Alert notification
Manual review queue

Incident Response

Response Plan

Phase 1: Detection (0-5 minutes)

Alert triggered
Initial assessment
Severity classification

Phase 2: Containment (5-30 minutes)

Revoke compromised credentials
Block malicious IPs
Isolate affected systems

Phase 3: Investigation (30 minutes - 4 hours)

Review audit logs
Identify attack vector
Assess damage

Phase 4: Recovery (4-24 hours)

Restore from backups if needed
Rotate all credentials
Apply security patches

Phase 5: Post-Mortem (1-7 days)

Document incident
Update procedures
Implement preventive measures

Incident Playbooks

Compromised API Key:

Revoke key immediately
Review recent API calls
Check for unauthorized payments
Generate new key
Update applications
Monitor for 48 hours

Suspected Breach:

Rotate all API keys
Export fresh backups
Review all channel states
Check for force-closures
Contact Comet support
File incident report

Node Compromise:

Stop node immediately
Export emergency backup
Create new node
Restore from backup
Investigate attack vector
Implement additional security

Security Hardening

Network Security

Firewall Rules: Comet Platform manages firewall rules automatically. Required ports:

9735: Lightning P2P
443: HTTPS API

DDoS Protection:

Comet provides automatic DDoS mitigation
Rate limiting per IP
Connection throttling
Geographic filtering (optional)

Application Security

Secure Coding:

Validate all inputs
Sanitize outputs
Use parameterized queries
Implement CSRF protection
Enable CORS restrictions

Example (cURL):

curl -X POST \\
  -H "Grpc-Metadata-macaroon: <macaroon_hex>" \\
  -H "Content-Type: application/json" \\
  -d '{
    "memo": "Payment for order",
    "value": "50000",
    "value_msat": "50000000",
    "expiry": "3600"
  }' \\
  <https: your-node.example.com="" v1="" invoices=""

Notes:

Always use https:// for all API calls and validate certificates where possible.
Never log full responses or sensitive fields (macaroons, API keys, payment hashes); log only high‑level status or IDs.
For Lightning Node API endpoints, use macaroon authentication. For Backend Services API (user, billing, provisioning), use Bearer token authentication. See api-reference.md for complete endpoint documentation.

Operational Security

Access Management:

Multi-factor authentication (MFA)
Role-based access control (RBAC)
Principle of least privilege
Regular access reviews

Change Management:

Document all changes
Peer review for critical changes
Staged rollouts
Rollback procedures

Compliance

Data Protection

GDPR Compliance:

Data minimization
Right to erasure
Data portability
Privacy by design

Data Retention: Available via Dashboard: Account Settings → Compliance, or via API.

Configure data retention periods
Export user data for portability
Delete user data upon request

Note: Compliance and data management endpoints are available through the Backend Services API. See the User Service section in api-reference.md for API endpoint details.

Audit Requirements

Audit Trail:

All financial transactions
Configuration changes
Access events
Security incidents

Export Audit Logs: Available via Dashboard: My Nodes → Select Node → Logs → Export Audit Logs, or via API.

Export in various formats (CSV, JSON) for compliance and analysis.

Note: Audit log access is provided through Comet Platform backend services. See the Backend Services API section in api-reference.md for API endpoint details.

Security Best Practices: https://docs.cometplatform.com/security
Incident Reporting: security@cometplatform.com
Bug Bounty: https://cometplatform.com/security/bounty
Status Page: https://status.cometplatform.com
Support: support@cometplatform.com

Emergency Contacts

Security Incidents:

Email: security@cometplatform.com
Emergency: +1-555-COMET-911
PGP Key: https://cometplatform.com/security/pgp

Support:

Email: support@cometplatform.com
Chat: https://cometplatform.com/support

Syntax and Structure

Node Security and Backup

Node Security and Backup

Table of Contents