[New App] Tunnel⚡Sats: Privacy-Preserving VPN Routing for Lightning Nodes

[TrezorHannes]

Request

Add TunnelSats to the official Umbrel App Store under the bitcoin category.

Tunnel⚡Sats provides a premium networking layer designed exclusively for LND and Core Lightning node runners. By utilizing high-performance WireGuard tunnels, it solves the 'Home IP' exposure conundrum and enables stable, anonymous clearnet connectivity without compromising your entire Umbrel’s traffic.

Architectural & Security Justification

TunnelSats requires the following elevated permissions to function as a routing daemon:

• Host Networking: Required to manage nftables rules and intercept specific Lightning traffic at the system level.
• Root User: Mandatory for manipulation of network namespaces and routing tables.
• Docker Socket: Used by the verify.sh diagnostic utility to identify peer container IPs (LND/CLN) for automated configuration.

Resolution

• PR App Submission: Tunnelsats v3.1.0 #4919: Adds the TunnelSats v3.1.0 manifest, pinned Docker digest, and verified diagnostic scripts.
• Linter Status: 100% Passing (Schema & Metadata).

Impact

• Enables users behind CGNAT or dynamic home IPs to run stable, clearnet-reachable Lightning nodes.
• Provides NWC-based automated renewals for hands-off node management.
• Strengthens the privacy posture of the Umbrel ecosystem by segregating Lightning traffic from general node traffic.