Skip to content

wallets.md

Latest commit

 

History

History
95 lines (71 loc) · 4.22 KB

wallets.md

File metadata and controls

95 lines (71 loc) · 4.22 KB
Raw

Connecting a Wallet

How to point an external Monero wallet — one running on your phone or another machine, not the dashboard — at the bundled node's RPC, so it can sync and check your balance against your own node instead of a public one.

This is for a wallet, not another Pithead/P2Pool stack. If you're pointing another stack's P2Pool at this node instead, see Connecting to a remote Monero node — it needs ZMQ too, a wallet doesn't.

Enable RPC access

The node's RPC (18081) is localhost-only by default. Turn on monero.rpc_lan_access, then apply:

// config.json
"monero": { "rpc_lan_access": true }
./pithead apply

The flag only takes effect once apply re-renders .env and recreates the monerod container — editing config.json alone does nothing.

monero.zmq_lan_access is a separate switch and not needed for a wallet — it's the block-notify feed a remote P2Pool consumes, wallets don't use it. Leave it off; turning it on only widens exposure (the ZMQ pub has no authentication at all — see Security below).

Point the wallet at it

  • Node address: <stack-host>:18081 (the host's LAN IP or hostname, port 18081).
  • Credentials: the node always requires digest auth, and this port is always the restricted listener, the same kind public nodes run, so the wallet needs a username and password, not just the address.

Read them from config.json on the stack host:

jq -r '.monero.node_username, .monero.node_password' config.json

These are auto-generated on setup/every apply (username admin, a random password) and are not shown by pithead status or the dashboard's config view (masked there like any other secret) — config.json is the only place to read them.

Any wallet that supports a custom daemon with RPC login works, for example monero-wallet-gui (the official GUI wallet), Feather, or Cake Wallet — named here as compatible options, not endorsements.

Verify with a raw RPC call

Confirming the node answers before configuring a wallet narrows down a failure: a connection error means the port or firewall, an auth error means the credentials.

curl --digest -u "$MONERO_NODE_USERNAME:$MONERO_NODE_PASSWORD" \
  -H 'Content-Type: application/json' \
  -d '{"jsonrpc":"2.0","id":"0","method":"get_info"}' \
  http://<stack-host>:18081/json_rpc

A working node returns a JSON body with "status":"OK". Wrong credentials return 401; no response at all (connection refused/timeout) means the port isn't reachable — check rpc_lan_access, that apply ran, that the wallet's address is a LAN address (see Security), ./pithead doctor for a port held on 127.0.0.1, and any firewall between the wallet and the host.

Security

The RPC is digest-auth'd, but that auth rides plaintext HTTP — no TLS. Treat it as LAN-only:

  • LAN sources only. The stack drops connections to 18081 from any address outside loopback, 10.0.0.0/8, 172.16.0.0/12, 192.168.0.0/16 and 100.64.0.0/10, so a port-forward from the internet does not work. Use WireGuard or Tailscale to reach it from outside your LAN. See LAN-only sources.
  • Docker publishes container ports with its own iptables rules, ahead of the INPUT chain a host firewall (ufw, plain iptables) usually configures. A rule that looks like it blocks 18081 may not — see Connecting Miners › Firewall for the same caveat on the stratum port, and test with the curl call above from off-host, not just by reading the rules.

See also