Rotate the LND macaroons like this: ``` sudo su - docker exec btcpayserver_lnd_bitcoin rm -f /data/*.macaroon docker exec btcpayserver_lnd_bitcoin rm -f /data/data/macaroons.db docker exec btcpayserver_lnd_bitcoin rm -f /data/data/chain/bitcoin/mainnet/macaroons.db docker exec btcpayserver_lnd_bitcoin rm -f /data/data/chain/bitcoin/mainnet/*.macaroon docker restart btcpayserver_lnd_bitcoin ```
EVAN KALOUDIS's avatar EVAN KALOUDIS
🚨PSA for LND + BTCPay Server users🚨 Don’t assume you’re safe after upgrading. You’re going to want to explicitly destroy your macaroons and macaroons.db and recreate them fresh.This also applies to auth mechanisms for other LN backends. Also, if you generated a hot on-chain wallet in BTCPay you want to move those funds. View quoted note →
View quoted note →

Replies (6)

Not confirmed by Umbrel or BTCPay dev yet but here is what I did and it looks like it worked on my Umbrel: PLEASE CONFIRM THAT IT'S CORRECT BEFORE DOING IT BLINDLY Open Umbrel WebUI, stop BTCPay (right click on icon -> stop). Update BTCPay to version 2.4.2 if not done already. After update, stop it again as it will start automatically. Stop Lightning (right click, stop) SSH into your umbrel from a terminal on your machine (or from the terminal in Umbrel settings). ssh umbrel@your_umbrel_ip First I did backup the macaroon just in case, but I guess it's not needed, up to you: cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/admin.macaroon ~/admin.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/invoice.macaroon ~/invoice.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/invoices.macaroon ~/invoices.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/readonly.macaroon ~/readonly.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/chainnotifier.macaroon ~/chainnotifier.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/router.macaroon ~/router.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/signer.macaroon ~/signer.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/walletkit.macaroon ~/walletkit.macaroon.backup cp /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/macaroons.db ~/macaroon.db.backup Now is the important part, to remove all macaroon files: rm -f /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/macaroons.db rm -f /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/*.macaroons You can check that all .macaroon and the macaroons.db are gone ls -la /home/umbrel/umbrel/app-data/lightning/data/lnd/data/chain/bitcoin/mainnet/ Return into Umbrel WebUI (you can do it with a command, but I like WebUI to see when it's done and because I'm not nerdy enough): Start Lightning (wait that it starts, check that it works) Start BTCPay Server (wait that it starts, check that it works). Done. I my case everything worked after that. (i tested RTL, worked without restart. If other apps are not working, try to restart the app first).
As written you delete macaroons.db and leave all 8 macaroon files in place. LND then generates a fresh root key but will not regenerate those files — it only bakes the defaults when they're absent (see lnd discussion #7566). You end up with 8 macaroons signed by a dead key: every app fails auth, and nothing regenerates until you go back and delete them properly. Fix: rm -f "$M"/*.macaroon "$M"/macaroons.db "$M"/macaroons.db.last-compacted
Ok yes good spot, I did got an error and then redo without s but copy paste the wrong line. Will edit (for those who see edit).