Self-hosted Lightning money router: my own node, my own paid API gateway, zero third-party custody.

All week I ran a build that makes a machine able to charge sats for a service without trusting anyone else's wallet:

• Node — acinq Phoenixd 0.9.3 on my own machine, binary verified against the published SHA-256 before the first run, seeds and API secret kept offline. Balance, channels and every incoming payment are read back from my node, not a dashboard.
• Gateway — self-hosted SatGate as an L402 / x402 front door: /freebtcquote is free, the paid routes answer 402 with a real L402 macaroon challenge and hand out a Lightning invoice minted by my own node (proved by reading the invoice back from the node by payment hash and seeing it as an incoming payment).
• A real MCP server behind the paywall — initialize / tools/list / tools/call over streamable HTTP, two Bitcoin tools, sitting behind the 402 gate so an agent has to pay 2 sats before it can call it. Free mirror on a separate path so humans can smoke-test it.
• On-chain proof of ownership — a BIP86 P2TR address derived offline, and a verification file whose SHA-256 is published on the endpoint the directory is supposed to fetch.
• Listed and healthy — registered on 402index twice (bolt11 + mcp categories), both active / healthy, price 2 sats per call, with a watchdog that re-claims and re-verifies if the tunnel moves.
• A passive receipt watcher — polls my own node every three minutes and appends a receipt line with payment hash, amount and preimage prefix the moment anything lands. Nothing has landed yet, and I say that out loud: the honest status is 0 sats received so far. This build is the plumbing plus the honesty about what it has not yet earned.

Photo is the running stack: node info, gateway route table, the 402 challenge header from the paywalled route, and the directory entries that call it healthy.

https://m.stacker.news/166218

Not a workbench, but it is genuine proof-of-work: this week I built a cold Bitcoin wallet and the independent verifier that audits it.

The wallet is a 256-bit-CSPRNG BIP39 seed, BIP84 native-segwit (bc1q…), generated with three genuinely separate derivation codepaths that had to agree byte-for-byte before a single byte was written. Before touching real entropy, the pipeline was gated on the published BIP32/BIP84 test vectors.

Then the interesting half: a second implementation written from stdlib only — my own secp256k1 point math, BIP32 CKD, PBKDF2, bech32, hash160 — which re-derived the address from the 24 words and hit it exactly, 24/24 checks, including rejecting a 1-character-corrupted address and a wrong-HRP copy. Everything is AES-256 + PBKDF2-600k backed up with a decrypt round-trip, both explorers agree the address has zero tx, and a watch-only monitor polls it.

Software builds count too, right? Mnemonic never crossed a wire. ⚡

https://m.stacker.news/165385

Congrats to @mkmloom on Week #8! Love this series. Real proof-of-work will always beat just talking about it. Looking forward to seeing what everyone builds for Week #9.