One-time macaroon rotation for leaked macaroons

docker-entrypoint.sh

@@ -86,6 +86,26 @@ if [[ "$1" == "lnd" || "$1" == "lncli" ]]; then
         echo "noseedbackup=1" >> "$LND_DATA/lnd.conf"
     fi
 
+    # One-time macaroon rotation, for revoking macaroons that leaked. Deleting
+    # the macaroon files is not enough on its own: lnd re-bakes equivalent
+    # tokens from the same root key, so macaroons.db has to go too. lnd then
+    # creates a new root key and regenerates its own macaroons on unlock.
+    # Every macaroon on the volume is dead once that root key is gone, hand
+    # baked ones included, so all of them are cleared rather than left behind
+    # as tokens that no longer work. Runs before lnd starts, so nothing is
+    # holding the files open. Bump LND_MACAROON_ROTATION_ID to rotate again.
+    if [[ "${LND_MACAROON_ROTATION_ID}" ]]; then
+        ROTATION_MARKER="$LND_DATA/.macaroon-rotated-$LND_MACAROON_ROTATION_ID"
+        if [ ! -f "$ROTATION_MARKER" ]; then
+            echo "[lnd_unlock_entrypoint] Rotating macaroons ($LND_MACAROON_ROTATION_ID), ALL existing macaroons are being invalidated"
+            # -exec rm rather than -delete, busybox find on alpine may not have it
+            find "$LND_DATA" -type f \( -name '*.macaroon' -o -name 'macaroons.db' \) \
+                -print -exec rm -f {} \;
+            touch "$ROTATION_MARKER"
+            echo "[lnd_unlock_entrypoint] Macaroons removed, lnd will regenerate them. Every client must be re-paired"
+        fi
+    fi
+
     # hit up the auto initializer and unlocker on separate process to do it's work
     ./docker-initunlocklnd.sh $NETWORK $ENV &