Virtual Private Node v0.3.0 — Lightning Accounts

This release adds LndHub.go as a new add-on. Create separate Lightning
wallet accounts for family, friends, or AI agents — all backed by your
own LND node. Built from source at a pinned release tag. No prebuilt
binaries. Managed entirely from the SSH dashboard.

Each account gets a one-time login and password. Share the credentials
or scan a QR code. The admin cannot see user balances. Deactivation
records the balance so you can refund to a new account. Passwords are
shown once and never stored anywhere.

The bigger change is how clearnet connections work. Previously, LndHub
was exposed over unencrypted HTTP in hybrid P2P mode. Now a TLS reverse
proxy sits in front of it — self-signed ECDSA P-256 certificate with
your server's IP in the SAN. Same approach LND uses for its REST API.
Zeus users accept the cert on first connection. Tor connections bypass
the proxy entirely.

The proxy only exists when you need it. Tor-only mode: no proxy, no
open port, LndHub reachable only through the hidden service. Hybrid
mode: proxy auto-installs, firewall opens port 3000 for encrypted
access. Upgrade from Tor to hybrid later and the proxy gets added
automatically.

Security fixes throughout: SQL injection prevention on database queries,
double-sudo bug fix, account name input validation, sshd hardening with
drop-in config files, version cache moved out of /tmp. Code cleanup:
consistent command execution patterns, idiomatic timeouts, migrated
GPG calls to the system package abstraction.

One command installs Bitcoin Core, LND, and Tor on Debian. Add LndHub,
Lightning Terminal, and Syncthing from the dashboard. No wrappers. No
abstractions. Your keys, your node.

github.com/ripsline/virtual-private-node