github-such-software/smirk-backend-core
1
0
Fork 0
mirror of https://github.com/Such-Software/smirk-backend-core.git synced 2026-10-17 07:21:32 +02:00
Code Issues Packages Projects Releases Wiki Activity

electrum: make the fallback privacy tradeoff visible to operators

Browse Source 
Falling back to public Electrum is a PRIVACY decision, not just an availability
one: the queries carry user addresses. It is easy to miss because the failover
is silent and correct, so the only symptom is that balances keep working. Our own
LTC Fulcrum was dead for 11 days with every lookup going to third parties, and
nothing surfaced it.

- startup: log how many third-party fallbacks are configured and how to fail
  closed instead, so the posture is visible in the operator's own logs
- .env.example: state the tradeoff at the setting, with both choices spelled out
  rather than a default presented as obviously correct
- OPERATOR_SETUP: same note where an operator configures chains

Also expands the shipped fallback lists (BTC 3 -> 8, LTC 4 -> 7), which is both
more resilience and a wider spread of which server sees any given query.
This commit is contained in:
jwinterm
2026-08-02 20:56:32 -04:00
parent 465ffe5cbd
commit f48373282f
3 changed files with 66 additions and 2 deletions
Download Patch File Download Diff File Expand all files Collapse all files
docs/operations/OPERATOR_SETUP.md
+22
View File
@@ -53,6 +53,28 @@ flag is on but whose source is unconfigured reports `enabled: false` via
| XMR / WOW | `{XMR,WOW}_LWS_URL`, `{XMR,WOW}_LWS_ADMIN_URL`, `{XMR,WOW}_LWS_ADMIN_KEY`, `{XMR,WOW}_DAEMON_URL`. |
| Grin | `GRIN_OWNER_API_URL` + `GRIN_OWNER_API_SECRET`, `GRIN_WALLET_PASSWORD`, `GRIN_FOREIGN_API_URL`, and the node's `GRIN_NODE_*`. |
> **Electrum fallbacks are a privacy decision.**
>
> `{BTC,LTC}_ELECTRUM_FALLBACKS` are third-party servers. If your own
> Electrum/Fulcrum becomes unreachable, the backend fails over to them and the
> queries it sends carry **your users' addresses**.
>
> The failover is silent and correct, which is the trap: the only symptom is that
> balances keep working. Our own Litecoin Fulcrum was dead for 11 days before
> anyone noticed, with every lookup going to public servers in the meantime.
>
> Decide deliberately:
>
> - **Keep fallbacks** for availability. Balances survive your node dying. The
> backend logs `third-party Electrum fallback(s) configured` at startup so the
> choice is visible in your logs, and you should alert on your own Electrum
> being down rather than relying on users to notice.
> - **Leave them empty** to fail closed. Balances break when your node breaks,
> and every query stays on infrastructure you control. This is the right
> default for a privacy-first or air-gapped instance.
>
> There is no third option where a dead node is both invisible and private.
## 4. Run
```sh