[TrezorHannes]

Description

Adds TunnelSats (v1.0.0, App SDK v2) to the MyNode Marketplace under rootfs/standard/usr/share/mynode_apps/tunnelsats/ and registers tunnelsats in scripts/print_app_download_hashes.sh.

TunnelSats provides dedicated WireGuard VPN tunnels with static port forwarding for Lightning Network nodes, allowing myNode LND operators to run hybrid Clearnet + Tor routing without exposing their residential IP address.

Key Highlights

• Native MyNode App SDK v2 Packaging:
  • Runs as unprivileged user tunnelsats on 127.0.0.1:18739 behind nginx (8739 HTTP / 8740 HTTPS).
  • Source archive (v1.0.0) pinned in tunnelsats.json (download_source_sha256) and registered in MARKETPLACE_APPS in scripts/print_app_download_hashes.sh.
  • Validated with python3 app_sdk/create.py check tunnelsats and ./scripts/print_app_download_hashes.sh --check tunnelsats.
• MyNode LND Configuration Persistence & Fail-Closed Dataplane:
  • Integrates with /mnt/hdd/mynode/settings/lnd_extra_config.conf so hybrid LND listener and externalhosts settings survive mynode_gen_lnd_config.sh regeneration across LND restarts and system upgrades.
  • Supports both Mode A (Integrated 1-Click Mode) via a narrowly scoped reconciler and Mode B (Secure Manual CLI Mode) with zero privileged web execution.
  • Enforces a fail-closed cgroup v2 (tunnelsats.slice) + nftables (inet tunnelsats) kill switch on Debian 12+ so LND never leaks clearnet traffic over the residential ISP if the tunnel is down.
• In-App Features:
  • Server region discovery, BOLT11 Lightning checkout, automatic claiming/renewal, $1 bandwidth top-ups, NIP-47 NWC auto-renewal over Tor, local X25519 key custody, and 1-click tunnelsatsv2.conf backup/import.
  • Upstream repository: https://github.com/Tunnelsats/ts-mynode (Release v1.0.0: https://github.com/Tunnelsats/ts-mynode/releases/tag/v1.0.0)

Question for Maintainers: Permission to Use the myNode Logo in Launch Marketing

We are preparing co-branded launch announcements for the MyNode community (static social key-art images and a short launch video showreel). In accordance with Section 9.a.3 of the myNode License, may we have your permission to include the official myNode logo alongside the TunnelSats logo in our static images and video launch material for this integration?

Checklist

• tested successfully on local MyNode, if yes, list the device(s) below
• mentioned related open issue, if any

List of test device(s)

• MyNode Debian 12 (Bookworm, kernel 6.1, cgroup v2) x86_64 VM (v0.3.50) - full install, upgrade, LND hybrid Clearnet + Tor peering, kill-switch verification, and uninstall roundtrip tested.