Install BTCPayServer on RaspiBlitz

BTCPayServer on Raspiblitz

#Install Dot-Net for ARM
cd /home/admin
sudo apt-get -y install libunwind8 gettext
wget https://download.visualstudio.microsoft.com/download/pr/201cbc49-c122-4653-a6c6-0680643d9a26/1951cfc077d868a31563a5a172d18d78/dotnet-sdk-2.1.500-linux-arm.tar.gz
wget https://download.visualstudio.microsoft.com/download/pr/9c5d6af2-868c-4021-8b25-4913daca41c3/46cfc8ddb9b8f10ebd56de1b1a534e32/aspnetcore-runtime-2.1.6-linux-arm.tar.gz
sudo mkdir /opt/dotnet
sudo tar -xvf dotnet-sdk-2.1.500-linux-arm.tar.gz -C /opt/dotnet/
sudo tar -xvf aspnetcore-runtime-2.1.6-linux-arm.tar.gz -C /opt/dotnet/
sudo ln -s /opt/dotnet/dotnet /usr/local/bin
dotnet --info

#Install Nginx & Certbot
sudo apt-get install nginx-full certbot -y

#Install NBXplorer
cd /home/admin
git clone https://github.com/dgarage/NBXplorer.git
cd NBXplorer
./build.sh

#Create the NBXplorer system unit file
sudo nano /etc/systemd/system/nbxplorer.service

#copy and past the following code
## Start of nbxplorer service file ##
[Unit]
Description=NBXplorer daemon
Requires=bitcoind.service
After=bitcoind.service

[Service]
ExecStart=/usr/local/bin/dotnet "/home/admin/NBXplorer/NBXplorer/bin/Release/netcoreapp2.1/NBXplorer.dll" -c /home/admin/.nbxplorer/Main/settings.config
User=admin
Group=admin
Type=simple
PIDFile=/run/nbxplorer/nbxplorer.pid
Restart=on-failure

PrivateTmp=true
ProtectSystem=full
NoNewPrivileges=true
PrivateDevices=true

[Install]
WantedBy=multi-user.target
## end of nbxplorer service file ##

#reload the systemd daemon
sudo systemctl daemon-reload

#enable nbxplorer service
sudo systemctl enable nbxplorer

#start nbxplorer service
sudo systemctl start nbxplorer

#check to see if nbxplorer is running
sudo systemctl status nbxplorer

#add your Raspiblitz RPC credentials to the nbxplorer configuration settings
nano /home/admin/.nbxplorer/Main/settings.config

#Locate the "#By user name and password" section and uncomment these two lines and change the username and password.
#the username is raspibolt and the password is what you set while installing raspiblitz
btc.rpc.user=raspibolt
btc.rpc.password=yourVerySecretPassword

#restart nbxplorer
sudo systemctl restart nbxplorer

#Install BTCPayServer
cd /home/admin
git clone https://github.com/btcpayserver/btcpayserver.git
cd btcpayserver
./build.sh

#create the BTCPayServer system unit fil
sudo nano /etc/systemd/system/btcpayserver.service

#copy and past the following code
## Start of btcpayserver service file ##
[Unit]
Description=BtcPayServer daemon
Requires=btcpayserver.service
After=nbxplorer.service

[Service]
ExecStart=/usr/local/bin/dotnet run --no-launch-profile --no-build -c Release -p "/home/admin/btcpayserver/BTCPayServer/BTCPayServer.csproj" -- $@
User=admin
Group=admin
Type=simple
PIDFile=/run/btcpayserver/btcpayserver.pid
Restart=on-failure

[Install]
WantedBy=multi-user.target
## End of BTCPayServer service file ##

#reload the systemd daemon
sudo systemctl daemon-reload

#enable btcpayserver service
sudo systemctl enable btcpayserver

#start btcpayserver
sudo systemctl start btcpayserver

#check to see if btcpayserver is running
sudo systemctl status btcpayserver

#enable the LND rest interface on port 8080 
cd /home/bitcoin/.lnd
sudo nano lnd.conf

#add the following line to the [Application Options] section
restlisten=127.0.0.1:8080

#backup existing TLS cert and key files
sudo mv tls.cert tls.cert.backup
sudo mv tls.key tls.key.backup

#restarting lnd will generate new tls files
sudo systemctl restart lnd

#copy new tls.cert file to admin folder
sudo cp tls.cert /home/admin/.lnd


#update your btcpayserver settings
nano /home/admin/.btcpayserver/Main/settings.config

#make sure the following items are uncommented and correct.  Replace example.com with your domain name
### Global settings ###
network=mainnet

### Server settings ###
port=23000
bind=127.0.0.1
externalurl=https://btcpay.example.com

### NBXplorer settings ###
BTC.explorer.url=http://127.0.0.1:24444/
BTC.lightning=type=lnd-rest;server=https://127.0.0.1:8080/;macaroonfilepath=/home/admin/.lnd/data/chain/bitcoin/mainnet/admin.macaroon;certthumbprint=<paste your thumbprint here>

#save file we will get the cert thumbprint next
#get your cert thumbprint for BTCPayServer Lightning configuration
cd /home/admin
openssl x509 -noout -fingerprint -sha256 -inform pem -in ~/.lnd/tls.cert

#copy thumbprint output to clipboard
#replace thumbprint for lightning configuration
sudo nano /home/admin/.btcpayserver/Main/settings.config

#paste thumbprint at the end of this line
BTC.lightning=type=lnd-rest;server=https://127.0.0.1:8080/;macaroonfilepath=/home/admin/.lnd/data/chain/bitcoin/mainnet/admin.macaroon;certthumbprint=<paste your thumbprint here>

#restart btcpayserver 
sudo systemctl restart btcpayserver

#Get your SSL certification using certbot
sudo certbot certonly --authenticator standalone -d btcpay.example.com --pre-hook "service nginx stop" --post-hook "service nginx start"


#Open Port 80
sudo ufw allow 80, 443

#add reverse proxy for btcpayserver

#remove default nginx configuration
sudo rm /etc/nginx/sites-enabled/default

#create the btcpayserver configuration 
sudo nano /etc/nginx/sites-available/btcpayserver

#Paste the following, make sure you change the domain name to yours

server {
    listen 80 default_server;
    server_name _;
    return 301 https://$host$request_uri;
}

server {
  listen 443 ssl;
  server_name btcpay.example.com;
  ssl on;

  ssl_certificate /etc/letsencrypt/live/btcpay.example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/btcpay.example.com/privkey.pem;
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;
  ssl_protocols TLSv1.1 TLSv1.2;
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
  ssl_prefer_server_ciphers on;
  ssl_stapling on;
  ssl_stapling_verify on;
  ssl_trusted_certificate /etc/letsencrypt/live/btcpay.example.com/chain.pem;

  location / {
    proxy_pass http://localhost:23000;
  }
}

#remove default nginx configuration
sudo rm /etc/nginx/sites-enabled/default

#add symlink for btcpayserver site
sudo ln -s /etc/nginx/sites-available/btcpayserver /etc/nginx/sites-enabled/

#restart nginx
sudo systemctl restart nginx