Bitcoin full node and query server

January 2026

Archive of the libbitcoin Slack #general channel.

Thursday, January 1, 2026

u32Luke00:39
Happy new year all! Thank you to all of the developers for pushing us towards greater decentralization and growth 🎉
🎉 1
Howdy! Happy New Year!
🎉 1
evoskuil16:29
I'll be here today for the meeting in 30 mins.
Huddle with evoskuil, eynhaender · 140 min17:02

Friday, January 2, 2026

evoskuil10:36
I've completed the split of libbitcoin-server and the bitcoin-server (bs) console builds from libbitcoin-node and bitcoin-node (bn). This means there is no longer a bn console application. node is now a dependency of server, and server provides the console application. The node and server libraries are about the same size, and splitting them has simplified and better organized the code and sped up the individual builds. The only difference for general usage is that the install.sh from the libbitcoin-server must be used, the console application is bs, and the log file names are bs_begin.log and bs_end.log. Config settings were already organized with the anticipated (server) names, so there is no impact to settings.
(edited)
👍 1
eynhaender12:50
Excellent, that's now absolutely consistent and makes it clearer in external communication. I'll clean up the readme later.
👍🏻 1
evoskuil18:51
Looks like there are some build configuration issues in libbitcoin-server, so there's no console at this point. Should have it ironed out soon.
evoskuil20:28
All good now.
evoskuil22:51
I've updated the secp256k1 NuGet package, adding a proper versioned release for the outdated version we have been using for the past year, and also a release that tracks with the current release. https://www.nuget.org/packages/secp256k1_vc143
I'm looking into LTCG for the vc++ and eventually all other builds. This should reduce binary size and improve performance. We've supported these builds for some time, but dependencies must be built with the same compiler, not just the same version compiler but often the same patch release. So by updating the secp256k1 library this updates the ltcg binaries to the current vc++ compiler that I'm using and therefore enables this scenario.
👍 2

Sunday, January 4, 2026

evoskuil05:52
X (formerly Twitter)
StackOverflow graph of questions asked per month. Holy shit.
😮 1
eynhaender05:57
ouch
evoskuil08:17
It took 1 day to integrate SOCKS5 for [outbound] and [manual] (p2p) connections. These are configured independently (and there is no inbound p2p or incoming service endpoint support).
[outbound]
socks = localhost:1080
username = foo
password = bar

[manual]
socks = localhost:1080
username =
password =
Credentials settings are parsed, but password authentication is not hooked up yet. I'll get that in the morning. This is the very first successful round trip message via socks5 proxy, and the very first block synced (later in the same connection).
image.pngimage.png
🚀 2
evoskuil08:28
About half the work for this was just passing through the settings via the config, node connector factories, sessions, and connector construct, and updating all tests. The rest was nothing more than a derived connector class. The connector and acceptor are socket factories, establishing one socket connection per instance, managing timeouts, name resolution, bindings, socket config, etc. So this just overrides connector::handle_connect(...) and connector::start(...) protected base class methods and implements the indirection on the socket strand. https://github.com/evoskuil/libbitcoin-network/blob/master/src/net/connector_socks.cpp
evoskuil08:34
Once the connection is established the socket is handed off as before with no other impact. Note that the connector operates on the network strand, and establishes sockets - which have their own strand. The socket is used in the handshake with the socks5 proxy server, so that operates on the socket's own strand. Given socket::stop() and all other methods are thread safe and dispatch to its own strand, it's pretty simple. And when already on own strand, dispatch is a no-op. So the communication sequence enters the socket strand and then returns to the connector's network strand, to safely complete the base operations.
(edited)
evoskuil08:39
I worked primarily from datatracker.ietf.org/doc/html/rfc1928 and used a simple/crappy local proxy called shinysocks https://github.com/jgaa/shinysocks and Wireshark for traffic analysis.
Also, I compiled with LTCG in vc++ and ran some performance tests. Noticeably worse, and the binary was even slightly larger. So that's back on ice.
evoskuil08:50
I tried running a default sync against the little proxy, and it of course crashes in a few seconds. Also the node is rejecting multiple connections because they reflect the same IP address. Still need to capture the outbound address as the channel address (which normally we get from the socket itself).
evoskuil19:23
SOCKS5 is what gives us Tor and I2P support. So that's now implemented, with the exception of gossiping onion and garlic host addresses via p2p. That just requires processing of the address_v2 message, with updates to the address pool.

Monday, January 5, 2026

evoskuil03:14
Syncing via SOCKS5 through Tor now, with and without password authentication. Tor is one of the easy ways to functionally verify this, as it accepts any username/password, or not, which are distinct protocols. Also the issue of the socks proxy being identified as the endpoint authority is now resolved, using the configured endpoint to address as the outbound authority when proxied.
(edited)
🔥 1👍 1
evoskuil04:42
100-200Mbps over Tor, on over 50 channels.
image.pngimage.png
Rate limiting of course kicks in, as the bandwidth of the entire Tor network is under 1Tbps. But certainly our proxy client is working 🙂.
evoskuil04:54
This seems to mitigate the throttling, as well as some of the connection rejection. It appears to accept on just one thread, and reducing the batch size to 1 reduces some of the connection establishment concurrency. Reducing the number of connections doesn't drop the bandwidth, but smooths out the throttling. Tor attempts to connect for 15 seconds, so I also increased those timeouts (from 5 secs) to reduce connection churn. This now cycles between 50 and 175 Mbps
[outbound]
socks = localhost:9050
connections = 50
connect_batch_size = 1

[network]
connect_timeout_seconds = 15
handshake_timeout_seconds = 15
evoskuil05:04
Gotta say, I'm pretty happy with that, especially since we had zero proxy work done as of 48 hours ago.
evoskuil05:31
I also bumped up the standard deviation threshold, as it doesn't seem possible to hold anywhere near enough connections to saturate bandwidth. So no need to be dropping the slow ones (stalled ones still get dropped). The default value is 1.5, and a (negative) SD limit of 2.0 rarely drops.
[node]
allowed_deviation = 2.0
Even better...
image.png
evoskuil06:04
Can even loopback over the simple ShinySocks proxy:
2026-01-05T06:02:24Z.0 Node is running.
2026-01-05T06:02:26Z.2 Accepted peer connection [127.0.0.1:61716] on binding [0.0.0.0:8333].
2026-01-05T06:02:26Z.1 Outbound [127.0.0.1:8333] version (70015) "/Satoshi:0.14.2/"
2026-01-05T06:02:26Z.1 Inbound [127.0.0.1:61716] version (70015) "/Satoshi:0.14.2/"
2026-01-05T06:02:26Z.2 Manual channel start [127.0.0.1:8333] success
proxy log:
2026-01-05 01:01:49.572 Eastern Standard Time INFO 61612 ShinySocks 1.4.0 starting up. Log level:
2026-01-05 01:01:49.579 Eastern Standard Time INFO 61612 Resolving host=0.0.0.0, port=1080
2026-01-05 01:01:49.585 Eastern Standard Time INFO 61612 Listener on 0.0.0.0:1080
2026-01-05 01:02:26.151 Eastern Standard Time INFO 33196 Incoming connection on socket.
2026-01-05 01:02:26.156 Eastern Standard Time INFO 24472 Proxy starting on socket 127.0.0.1:1080<-->127.0.0.1:61715
2026-01-05 01:02:26.161 Eastern Standard Time INFO 24472 ParseV5Header: Will try to connect to: 127.0.0.1
2026-01-05 01:02:26.167 Eastern Standard Time INFO 24472 Connecting to endpoint 127.0.0.1:8333
evoskuil06:13
Tor doesn't like the loopback:
Jan 05 01:11:56.000 [warn] Rejecting SOCKS request for anonymous connection to private address [scrubbed].
Note that I often use something like this for p2p testing:
[node]
user_agent = "/Satoshi:0.14.2/"
(edited)
evoskuil06:47
And I just realized that string shouldn't be quoted :)).
evoskuil07:20
Running a full sync now over Tor. I'd expect it to be 10-15 hours (vs 1), which would still beat bitcoind (without Tor) on this machine! :)
(edited)
🔥 3😂 1
I'm going to merge this in a bit. The only issue presently is that fqdn peers (e.g. manual.peer and outbound.seed) will not resolve when passed via a proxy. I'll deal with this when I add onion/garlic resolution and address gossip.
evoskuil17:41
Windows maxi is on block 872,646 at 10.7 hours over Tor. That's about twice as fast as Core on the same machine without Tor. When it hits 900k I'll plot the data, but it looks to have been pretty constant all night. Full validation would be about the same time, since maxi only needs 4.2 hours to validate.
(edited)
🚀 2
evoskuil18:41
900k over Tor in 11.7 hrs.
🎉 2
evoskuil21:05
Pretty consistent rate.
image.png
evoskuil21:36
image.png
eynhaender21:57
nice
evoskuil22:20
On this machine bitcoind took 24 hours to assume valid to block 850,000 (no Tor).
(edited)
eynhaender23:28
I'm increasingly getting the impression that assumevalid takes longer than the standard sync.
1 reply · evoskuil · last Jan 05, 2026
evoskuil23:29
It should be the same as long as there is excess CPU when fully validating, and there is always excess CPU when validating blocks sequentially.

Tuesday, January 6, 2026

pmienk01:16
Pretty big whoopsie
Always back up your keys
👍🏻 1

Wednesday, January 7, 2026

stratan19:09
replied to a thread: view
Hello again! Your feedback regarding the disk space was correct. I wasn't expecting it to really be a disk issue as I had over 100gigs of disk space (don't remember the exact number). Now libbitcoin-node spawns and works just fine. I stumbled upon another "issue" when trying to port libbitcoin-node as a target for fuzzamoto. That is, fuzzamoto uses Nyx for deterministic snapshot fuzzing but due to its limited resources it doesn't have enough space to pre-allocate a regtest db profile. I played around and hacked a regtest config that seems to work ok and I would appreciate your feedback on whether I'm overdoing it or not. I haven't found any documentation around libbitcoin-node + regtest so I'm open to suggestions on that side too.
[log]
path = {logdir}

[bitcoin]
# Regtest genesis block (hex-encoded)
genesis_block = {genesis_hex}
# Regtest proof of work limit (0x207fffff = 545259519)
proof_of_work_limit = 545259519
# Accept any valid chain (no minimum work requirement)
minimum_work = 0000000000000000000000000000000000000000000000000000000000000000

[forks]
# Regtest allows easy mining without real proof of work
difficult = false

[network]
# Regtest network magic (0xDAB5BFFA = 3669344250)
identifier = 3669344250

[inbound]
# Listen for P2P connections
bind = 127.0.0.1:{p2p_port}
connections = 10
enable_loopback = true

[outbound]
# Disable outbound connections to prevent contacting mainnet seeds
connections = 0
host_pool_capacity = 0

[database]
path = {datadir}
# Tiny regtest DB profile (avoid multi-GB prealloc).
header_buckets = 1
header_size = 1000
txs_buckets = 1
txs_size = 1000
tx_buckets = 1
tx_size = 1000
point_buckets = 1
point_size = 1000
strong_tx_buckets = 1
strong_tx_size = 1000

input_size = 1000
ins_size = 1000
output_size = 1000
outs_size = 1000

candidate_size = 1000
confirmed_size = 1000
duplicate_buckets = 1
duplicate_size = 100
prevout_buckets = 0
prevout_size = 1

validated_bk_buckets = 1
validated_bk_size = 1000
validated_tx_buckets = 1
validated_tx_size = 1000

address_buckets = 1
address_size = 1000
filter_bk_buckets = 0
filter_tx_buckets = 0

[node]
# Don't delay inbound peers waiting for "current" chain state (regtest genesis is old).
delay_inbound = false

Thursday, January 8, 2026

evoskuil03:44
replied to a thread: view
Hi, you've definitely got the right idea. I haven't tested regtest or testnet in a long time, so it's good to see this. I’m traveling so can provide much more feedback, but it should work. Just note that one bucket means the hash table becomes a linked list. That's fine but of course will be a bit slow if there are a lot of entries. I do it by accident sometimes and am always surprised that’s it’s pretty fast considering. Also, I don't think you want loopback. That allows the node to connect to itself.
evoskuil03:44
replied to a thread: view
Also, bn is no longer. You will need to move to bs for future work. Same config and command line otherwise.
stratan07:19
replied to a thread: view
Thank you for the feedback! I’ll keep it in mind.
stratan07:22
replied to a thread: view
As far as I understand bs isn't at a “usable state” according to its README, which is why I pivoted to bn. How do you suggest I proceed?
(edited)
Huddle with pmienk · 31 min16:54

Sunday, January 11, 2026

evoskuil19:31
I've merged the last of the socks5 work. This generalizes the socket address handling so that both numeric and non-numeric (fqdn) addresses remain supported for both proxied and unproxied connections. Previously the presumption was that the far end of the connection was always resolvable to its IP address, which was used for certain aspects of peer tracking and logging. This is now generalized to non-IP names. This is necessary because under a proxy the name resolution should occur at the proxy, and the resolved IP address is not necessarily returned to the caller under socks5 (e.g. Tor proxy). Given this change address tracking is now based on the outgoing config::endpoint as opposed to the outgoing config::authority. And the resolved IP address remains used only for differentiating incoming connections.

Monday, January 12, 2026

evoskuil19:15
I've merged a few updates to the explore interface, which will allow for completion of the block explorer. One of these queries is pretty expensive, since we don't cache fees. Fees require prevouts, and where we skip full validation and client filtering, there's no point at which we have prevout association during sync, which means no fees. The current "block details" query pulls in the whole block and its prevouts in order to compute fee-related values, and a bunch of other stuff available given the populated block. On a single thread this takes < 100ms for a warm store, which is fine for now. On a cold store the paging cost can bring that up to 1-2 seconds. The cost can be dramatically reduced be de-normalizing the query (not getting the full block/prevouts). We could provide an option to impose fee caching in the exact same way to impose client filter building, which would slightly increase the store size and reduce this query to almost nothing (~3ms, like the others). On the maxi that would raise milestone sync time from 1 hr to 2.5 hrs (basically client filters). Really there's no need for high speed block fee queries, and that would be very reasonable for a server. When performing full validation there would be only trivial time increase. So a simple approach would be to drop block + prevout computed values into the client filters table and use that as optimized query when available. WRT analogous values for txs, it's probably not work the space to cache such values.

Tuesday, January 13, 2026

evoskuil03:37
New record maxi milestone sync time of 52.8 mins to block 900,000. This just my periodic check to make sure changes aren't causing some unexpected hit. This build incorporated generalizations of the socket class to simplify secure transport integration for each of the transport protocols (zmq and sv2 stubbed in but deferred): p2p/s, http/s, ws/s, zmq/s, rpc/s, sv2/s.
I also further enhanced the block explorer endpoint, adding this for /v1/tx/[hash]/details:
{
  "wtxid": "e327dd4ebd756a127b8e9c630f43ed870eb0e248767f99b629d4f11a601b200b",
  "segregated": true,
  "coinbase": false,
  "nominal": 157,
  "maximal": 373,
  "weight": 844,
  "value": 345274,
  "spend": 344809,
  "fee": 465,
  "confirmed": {
    "height": 900000,
    "position": 500,
    "sigops": 6
  }
}
This has been added for /v1/configuration:
{
  "address": false,
  "filter": false,
  "turbo": true,
  "witness": true,
  "retarget": true,
  "difficult": true
}
This for /v1/block/hash/[hash]/header/context:
{
  "hash": "00000000000000000000a53fede899a452adc99a5fa732ce218be735e734c65a",
  "height": 905112,
  "mtp": 1752256704,
  "state": {
    "wire": 1676772,
    "count": 1952,
    "validated": true,
    "confirmed": true,
    "confirmable": true,
    "unconfirmable": false
  },
  "forks": {
    "bip30": false,
    "bip34": true,
    "bip66": true,
    "bip65": true,
    "bip90": true,
    "bip68": true,
    "bip112": true,
    "bip113": true,
    "bip141": true,
    "bip143": true,
    "bip147": true,
    "bip42": true,
    "bip341": true,
    "bip342": true
  }
}
This for /v1/block/hash/[hash]/details:
{
  "hash": "00000000000000000000a53fede899a452adc99a5fa732ce218be735e734c65a",
  "height": 905112,
  "count": 1952,
  "sigops": 7837,
  "segregated": true,
  "nominal": 772126,
  "maximal": 1676772,
  "weight": 3993150,
  "fees": 2549618,
  "subsidy": 312500000,
  "reward": 315049618,
  "claim": 315049618
}
(edited)
Same works for /v1/block/height/[height]/... of course.
evoskuil03:55
I'm primarily working on secure transport at this point. I expect to have TLS support for http, websockets, electrum, and stratum-v1 by next week. Maybe another week for bip324.
(edited)
🎉 3

Wednesday, January 14, 2026

evoskuil19:13
I've embedded wolfssl sources into libbitcoin-network. This is quite a large library, but has an integrated openssl compat layer, and a GPLv3 license, which allows it to drop in to the boost::beast::ssl::stream template. A large number of the source file can be removed once it's all working and we know exactly what the requirements are. Given the openssl interface, it should be possible to replace it with another implementation or even roll our own behind the interface at some point.
🎉 2👍🏻 1

Thursday, January 15, 2026

evoskuil08:18
We now have the full wolfssl embedded in network, imported by boost, and boost::asio::ssl::socket defined. Next step is to drop the new socket type into the socket class member variant to support http/s, ws/s and rpc/s.
evoskuil08:27
Looks like the non-windows node & server projects are missing a required path definition, so those will be broken until that's updated.
Huddle with pmienk, Marnix, eynhaender, evoskuil, neillm, Rowan Voskuil, Enligths · 222 min16:53
4 replies · neillm, Enligths, pmienk · last Jan 15, 2026
neillm16:55
Hoping to join for a little bit in ~20m
E
Enligths17:45
Hello everyone. Just hanging around
👋 1👍 1👍🏻 1
neillm19:21
Gotta run, thanks all!
👍🏻 1
pmienk20:27
<coverage>
    <exclude path="" />
</coverage>
currently in for qrencode.

Friday, January 16, 2026

evoskuil01:42
------------------------------------------------------------------------------
 wolfSSL version 5.8.4
------------------------------------------------------------------------------
macro    test passed!
error    test passed!
MEMORY   test passed!
base64   test passed!
base16   test passed!
asn      test passed!
SHA-256  test passed!
RANDOM   test passed!
Hash     test passed!
HMAC-SHA256 test passed!
HMAC-KDF    test passed!
TLSv1.2 KDF test passed!
TLSv1.3 KDF test passed!
Chacha   test passed!
POLY1305 test passed!
ChaCha20-Poly1305 AEAD test passed!
OPENSSL  test passed!
OPENSSL (EVP MD) passed!
OPENSSL (PKEY0) passed!
OPENSSL (PKEY1) passed!
OPENSSL (EVP Sign/Verify) passed!
ECC      test passed!
CURVE25519 test passed!
logging  test passed!
time     test passed!
mutex    test passed!
memcb    test passed!
crypto callback test passed!
Test complete

*** No errors detected

Sunday, January 18, 2026

evoskuil06:53
The above is the set of tests against primitive algorithms in wolfssl. For the past couple of days I've been working on the suite of wolfssl unit tests that set up client-server socket communication and perform TLS communication using various protocol variations. There's about 300 of them in the suite of protocols I've set up. Most of this was just getting configuration right, along with a little bit of de-linting. The verbose output is crazy detailed and really shows how complex tls is in all of its variations. So both of these test suites are now integrated into network test. This include their certificates and test driver text files. boost::asio::ssl::socket compiles cleanly against it, and boost invokes wolfssl context startup and shutdown, using its openssl compat interface, just as a consequence of including <boost/asio/ssl.hpp>. I've also set up a define that can be used to exclude the internal implementation, which would allow the library to be linked against and headers included against openssl, an external wolfssl, or any other compatible library. The internal sources are mostly in their original file layout, and I haven't yet stripped out any unused source files. So the whole library is present, apart from test data and certs that don't get used (old protocols we don't compile). The compile of wolf is entirely isolated from our sources and only takes a few seconds. I will eventually use the already enabled callbacks to invoke our own hardware optimized sha256, hmac and hkdf, which gives us less code (no redundancy) without the ugly compiler config and raw assembly (which also doesn't work in vc++). The library and its integration with boost give us file system based certificate management.
The configuration is isolated to this one file:
#ifndef LIBBITCOIN_NETWORK_SSL_WOLFSSL_WOLFCRYPT_USER_SETINGS_H
#define LIBBITCOIN_NETWORK_SSL_WOLFSSL_WOLFCRYPT_USER_SETINGS_H

/* This file is imported into all wolfssl sources when WOLFSSL_USER_SETTINGS */
/* is defined, which is done at project scope. This is also imported by boost */
/* asio via options.h import when BOOST_ASIO_USE_WOLFSSL is defined. */
/* The /ssl/openssl/ directory is provided for direct import by boost when */
/* #include <boost/asio/ssl.hpp> is specified, forwarding to wolfssl headers. */

/* This build has no dependency on any libbitcoin sources. */
/* #include <bitcoin/network/define.hpp> */
#if defined(_MSC_VER)
    /* C99 variable-length arrays (VLAs) are not supported by MSVC. */
    #define WOLFSSL_SP_NO_DYN_STACK

    /* Avoid conflict with min/max compatibility macros. */
    #define WOLFSSL_HAVE_MIN
    #define WOLFSSL_HAVE_MAX
#endif

/* Documentation for the options below. */
/* wolfssl.com/documentation/manuals/wolfssl/chapter02.html */

/* In a library build, "HAVE_" symbols are set on the command line. But since */
/* this is embedded they are set here just as with "NO_", "WC_" and "WOLFSSL_". */

/* Used with BOOST_ASIO_USE_WOLFSSL to optimize boost integration. */
/* wolfssl.com/wolfssl-support-asio-boost-asio-c-libraries */
#define WOLFSSL_ASIO

/* Suppress warnings on unnecessary file inclusions. */
#define WOLFSSL_IGNORE_FILE_WARN

/* wolfssl.com/documentation/manuals/wolfssl/chapter05.html */
/* Requires that send and receive data copy functions be defined. */
/* #define WOLFSSL_USER_IO */

/* No reason to define this as the library does not use sockets (test only). */
/* #define WOLFSSL_NO_SOCK */

/* Required by boost for certificate management via filesystem. */
/* #define NO_FILESYSTEM */
#define WOLFSSL_PEM_TO_DER
#define WOLFSSL_CERT_GEN
#define WOLFSSL_DER_LOAD
#define WOLFSSL_KEY_GEN

/* TLS is required, not just cryptographic functions. */
#define WOLFSSL_TLS13

/* At least one encryption method is required. */
/* ECC is needed for Curve25519-based key exchange in modern TLS. */
#define HAVE_SUPPORTED_CURVES
#define HAVE_TLS_EXTENSIONS
#define HAVE_CURVE25519
#define HAVE_POLY1305
#define HAVE_CHACHA
#define HAVE_SHA256
#define HAVE_HKDF
#define HAVE_HMAC
#define HAVE_ECC

/* Callback requires at least one union element to be defined. */
#define WOLF_CRYPTO_CB
/* This removes default RNG fallback (must set a callback RNG). */
/* #define WC_NO_HASHDRBG */
/* On Windows OS RNG APIs are used, these on others. */
/* #define NO_DEV_RANDOM */
/* #define NO_DEV_URANDOM */

/* These are openssl settings that affect wolfssl and/or boost asio. */
#define OPENSSL_VERSION_NUMBER 0x10101000L
#define OPENSSL_NO_ENGINE
#define OPENSSL_NO_SSL3
#define OPENSSL_NO_SSL2
#define OPENSSL_EXTRA

/* Side-channel protection is not required. */
/* #define WOLFSSL_HARDEN_TLS 128 */
#define NO_ECC_TIMING_RESISTANT
#define NO_TFM_TIMING_RESISTANT
#define WC_NO_HARDEN

/* Remove unused or undesired components. */
#define WOLFSSL_NO_CLIENT_AUTH
#define NO_SESSION_CACHE
#define NO_OLD_TLS
#define NO_OCSP
#define NO_DES3
#define NO_PSK
#define NO_AES
#define NO_SHA
#define NO_DSA
#define NO_RSA
#define NO_MD4
#define NO_MD5
#define NO_RC4
#define NO_DH

#ifdef _MSC_VER
    /* Warnings emitted due to missing define in vc++. */
    #define WC_MAYBE_UNUSED __pragma(warning(suppress:4505))

    /* Build break in test_ossl_bio.c due to missing define in vc++. */
    #ifndef STDERR_FILENO
    #define STDERR_FILENO _fileno(stderr)
    #endif
#endif

#ifndef NDEBUG
    #define DEBUG_WOLFSSL
    #define DEBUG_SUITE_TESTS
    ////#define WOLFSSL_VERBOSE_ERRORS
    #define WOLFSSL_HAVE_ERROR_QUEUE

    #ifndef WOLFSSL_LOGGINGENABLED_DEFAULT
    #define WOLFSSL_LOGGINGENABLED_DEFAULT 1
    #endif
    #ifndef WOLFSSL_CERT_LOG_ENABLED_DEFAULT
    #define WOLFSSL_CERT_LOG_ENABLED_DEFAULT 1
    #endif
#endif

#define NO_MAIN_DRIVER
#define NO_TESTSUITE_MAIN_DRIVER
#define CERT_WRITE_TEMP_DIR "./"

#endif
Which is picked up by the library and tests, and boost via this:
#if defined(WITH_SSL)
#define HAVE_SSL
#define BOOST_ASIO_USE_WOLFSSL
#include <boost/asio/ssl.hpp>
#endif // WITH_SSL
And then we can do this...
namespace ssl {

typedef boost::asio::ssl::context context;
typedef boost::asio::ssl::stream<asio::socket> socket;

// Just testing out the ssl socket compile.
inline void foobar() THROWS
{
    io_context my_io_context{};
    context my_ssl_context{ context::tlsv12_server };
    socket my_ssl_socket{ my_io_context, my_ssl_context };
}

} // namespace ssl
Which believe it or not is the whole point, just getting that socket type defined!
evoskuil07:01
Here's the last 3% or so of the network test suite output:
trying server command line[77]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -c ./certs/server-ecc.pem -k ./certs/ecc-key.pem -2
connecting to 127.0.0.1:11111
peer has no cert!
listening on port 11111
connecting to 127.0.0.1:11111
peer has no cert!
trying client command line[78]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -A ./certs/ca-ecc-cert.pem -2 -H defCipherList
Using default cipher list for testing
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL signature algorithm is SHA256
SSL curve name is SECP256R1
Server Random : AE540D93436BD8426610F184B069CB53A22E15B7203E9E041C55C9A91CE86011
Alternate cert chain used
 issuer : /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 subject: /C=US/ST=Washington/L=Seattle/O=Elliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 serial number:03
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL signature algorithm is (null)
SSL curve name is SECP256R1
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICozCCAkigAwIBAgIBAzAKBggqhkjOPQQDAjCBlzELMAkGA1UEBhMCVVMxEzAR
BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dv
bGZTU0wxFDASBgNVBAsMC0RldmVsb3BtZW50MRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjUxMTEz
MjA0MTE1WhcNMjgwODA5MjA0MTE1WjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxETAPBgNVBAoMCEVsbGlwdGlj
MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS
IX/wzxjakRECNIboIFgzC4A0idijgYkwgYYwHQYDVR0OBBYEFF1dJu+sfjb5m3YV
K0olAiPvsokwMB8GA1UdIwQYMBaAFFaOmsPwQt4YuUVVbvmTz+rD86UhMAwGA1Ud
EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBEG
CWCGSAGG+EIBAQQEAwIGQDAKBggqhkjOPQQDAgNJADBGAiEA+C/0OZkZlxE3n9jX
fwSmynRZmv4wW03lMQZVnOj2tHECIQChUslyicZPIue/l2jc/32XFQWd2FYp9d/e
py2Q0cUnMA==
-----END CERTIFICATE-----
Session timeout set to 500 seconds
Client Random : 32674149ACF0D86723D6096BA57CE61869932685A9B03DF65F9A79326F7EBE52
Client message: hello wolfssl!
I hear you fa shizzle!
repeating test with non blocking on
trying server command line[79]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -c ./certs/server-ecc.pem -k ./certs/ecc-key.pem -2 -N
trying client command line[80]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -A ./certs/ca-ecc-cert.pem -2 -N
... client would read block
... client would read block
... client would read block
Alternate cert chain used
 issuer : /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 subject: /C=US/ST=Washington/L=Seattle/O=Elliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 serial number:03
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL signature algorithm is (null)
SSL curve name is SECP256R1
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
---
Server certificate
SSL signature algorithm is SHA256
SSL curve name is SECP256R1
Server Random : 6981CA62172E2CA4A8048C0C67AE805406986BFEBA240D0368A9854649A31789
-----BEGIN CERTIFICATE-----
MIICozCCAkigAwIBAgIBAzAKBggqhkjOPQQDAjCBlzELMAkGA1UEBhMCVVMxEzAR
BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dv
bGZTU0wxFDASBgNVBAsMC0RldmVsb3BtZW50MRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjUxMTEz
MjA0MTE1WhcNMjgwODA5MjA0MTE1WjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxETAPBgNVBAoMCEVsbGlwdGlj
MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS
IX/wzxjakRECNIboIFgzC4A0idijgYkwgYYwHQYDVR0OBBYEFF1dJu+sfjb5m3YV
K0olAiPvsokwMB8GA1UdIwQYMBaAFFaOmsPwQt4YuUVVbvmTz+rD86UhMAwGA1Ud
EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBEG
CWCGSAGG+EIBAQQEAwIGQDAKBggqhkjOPQQDAgNJADBGAiEA+C/0OZkZlxE3n9jX
fwSmynRZmv4wW03lMQZVnOj2tHECIQChUslyicZPIue/l2jc/32XFQWd2FYp9d/e
py2Q0cUnMA==
-----END CERTIFICATE-----
Session timeout set to 500 seconds
Client Random : CEFBB6F323090BBCE2BBE541144C41DD668872FC109DD8DF42A682DB5ECCF9CF
Client message: hello wolfssl!
I hear you fa shizzle!
listening on port 11111
connecting to 127.0.0.1:11111
peer has no cert!
listening on port 11111
connecting to 127.0.0.1:11111
peer has no cert!
repeating test with client cert request off
trying server command line[81]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -c ./certs/server-ecc.pem -k ./certs/ecc-key.pem -2 -d
trying client command line[82]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -A ./certs/ca-ecc-cert.pem -2
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL signature algorithm is SHA256
SSL curve name is SECP256R1
Server Random : 9ECD0D77EFA48587436326450557A0526CF2BFBC2E346F1DE5A16AA4B4BEFE4D
Alternate cert chain used
 issuer : /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 subject: /C=US/ST=Washington/L=Seattle/O=Elliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 serial number:03
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL signature algorithm is (null)
SSL curve name is SECP256R1
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICozCCAkigAwIBAgIBAzAKBggqhkjOPQQDAjCBlzELMAkGA1UEBhMCVVMxEzAR
BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dv
bGZTU0wxFDASBgNVBAsMC0RldmVsb3BtZW50MRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjUxMTEz
MjA0MTE1WhcNMjgwODA5MjA0MTE1WjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxETAPBgNVBAoMCEVsbGlwdGlj
MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS
IX/wzxjakRECNIboIFgzC4A0idijgYkwgYYwHQYDVR0OBBYEFF1dJu+sfjb5m3YV
K0olAiPvsokwMB8GA1UdIwQYMBaAFFaOmsPwQt4YuUVVbvmTz+rD86UhMAwGA1Ud
EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBEG
CWCGSAGG+EIBAQQEAwIGQDAKBggqhkjOPQQDAgNJADBGAiEA+C/0OZkZlxE3n9jX
fwSmynRZmv4wW03lMQZVnOj2tHECIQChUslyicZPIue/l2jc/32XFQWd2FYp9d/e
py2Q0cUnMA==
-----END CERTIFICATE-----
Session timeout set to 500 seconds
Client Random : 8630606A7C9B7095E3038FFE08F7D3221EB0207C907A14188B000BEDDC6DC464
Client message: hello wolfssl!
I hear you fa shizzle!
repeating test with client cert request off
repeating test with non blocking on
trying server command line[83]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -c ./certs/server-ecc.pem -k ./certs/ecc-key.pem -2 -d -N
trying client command line[84]: SuiteTest -v 4 -l TLS13-CHACHA20-POLY1305-SHA256 -A ./certs/ca-ecc-cert.pem -2 -N
... client would read block
... client would read block
... client would read block
... client would read block
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL signature algorithm is SHA256
SSL curve name is SECP256R1
Server Random : 7AAFED592B0561EFF53C5F37A80B93A0CF77A79EACDE60205EB3BE9E4E698C85
Alternate cert chain used
 issuer : /C=US/ST=Washington/L=Seattle/O=wolfSSL/OU=Development/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 subject: /C=US/ST=Washington/L=Seattle/O=Elliptic/OU=ECC/CN=www.wolfssl.com/emailAddress=info@wolfssl.com
 serial number:03
SSL version is TLSv1.3
SSL cipher suite is TLS_CHACHA20_POLY1305_SHA256
SSL signature algorithm is (null)
SSL curve name is SECP256R1
---
Server certificate
-----BEGIN CERTIFICATE-----
MIICozCCAkigAwIBAgIBAzAKBggqhkjOPQQDAjCBlzELMAkGA1UEBhMCVVMxEzAR
BgNVBAgMCldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxEDAOBgNVBAoMB3dv
bGZTU0wxFDASBgNVBAsMC0RldmVsb3BtZW50MRgwFgYDVQQDDA93d3cud29sZnNz
bC5jb20xHzAdBgkqhkiG9w0BCQEWEGluZm9Ad29sZnNzbC5jb20wHhcNMjUxMTEz
MjA0MTE1WhcNMjgwODA5MjA0MTE1WjCBkDELMAkGA1UEBhMCVVMxEzARBgNVBAgM
Cldhc2hpbmd0b24xEDAOBgNVBAcMB1NlYXR0bGUxETAPBgNVBAoMCEVsbGlwdGlj
MQwwCgYDVQQLDANFQ0MxGDAWBgNVBAMMD3d3dy53b2xmc3NsLmNvbTEfMB0GCSqG
SIb3DQEJARYQaW5mb0B3b2xmc3NsLmNvbTBZMBMGByqGSM49AgEGCCqGSM49AwEH
A0IABLszrEwnUErGSqUEwzzenzbbci3OlOor+ssgCTksFuhhAumvTdMCk5oxW5eS
IX/wzxjakRECNIboIFgzC4A0idijgYkwgYYwHQYDVR0OBBYEFF1dJu+sfjb5m3YV
K0olAiPvsokwMB8GA1UdIwQYMBaAFFaOmsPwQt4YuUVVbvmTz+rD86UhMAwGA1Ud
EwEB/wQCMAAwDgYDVR0PAQH/BAQDAgOoMBMGA1UdJQQMMAoGCCsGAQUFBwMBMBEG
CWCGSAGG+EIBAQQEAwIGQDAKBggqhkjOPQQDAgNJADBGAiEA+C/0OZkZlxE3n9jX
fwSmynRZmv4wW03lMQZVnOj2tHECIQChUslyicZPIue/l2jc/32XFQWd2FYp9d/e
py2Q0cUnMA==
-----END CERTIFICATE-----
Session timeout set to 500 seconds
Client Random : 30AAF3DE24B255B5DCC79D57226ECC5518A944A968EA57AF3B7FE55DDE5F1F9E
Client message: hello wolfssl!
I hear you fa shizzle!
starting TLSv13 Downgrade extra tests
starting certificate chain cipher suite tests
starting dh prime tests
starting tests that expect failure

 Success -- All results as expected.
 End Cipher Suite Tests

*** No errors detected
evoskuil08:01
No impact here :)
image.png
evoskuil17:50
New maxi record of 51.9 mins to milestone 900,000 (previous 52.8 min). Mini still holds the overall record at 48 mins but I don't run it as often.
👌🏻 1👌 1

Monday, January 19, 2026

evoskuil05:15
Today I completed the work to open up the network library to external ssl library linkage. So the embedded wolfssl just works with no dependencies, and is picked up automatically by boost::asio::ssl. We don't even reference it anywhere in the code. And dependent libraries pick it up as well. However it can be configured in the vc++ (visual studio) UI and via the install.sh to exclude the internal linkage, allowing a developer to simply link any openssl compatible library (including an external wolfssl). The internal ssl is fully configured and tested, but by linking it externally full control is handed over. This solves the non-trivial problem of making ssl easy as well as flexible.
(edited)
evoskuil09:05
I was able to drop 111 unused source file from the build without modifying any sources. The bulk of these are .c files, as the header are directly included in bulk from the unit test drivers. If I dropped or modified the test drivers we could probably drop at least another 100 .h files. But with the source file removed the headers are not of much consequence unless compiling the tests, since these extras aren't referenced otherwise. So I'm opting for non-modification over compactness, as that preserves upgrade simplicity.

Tuesday, January 20, 2026

evoskuil04:54
After a fix to the wolfssl embed, I was finally able to move on to socket integration of the ssl context. The socket is now fully able to support tls over tcp (for electrum/stratum-v1 json-rpc), http (bitcoind json-rpc, rest, admin web, rest API), and websockets (fully implemented but currently not used). The remaining work is all connecting the dots between configuration, construction/retention of the ssl context for a given endpoint, and passage of the context via session->acceptor for accept, and acceptor->socket upon tcp connect (at socket construct). Nothing complicated here, so expect to have this all hooked up tomorrow, and be able to start configuring and testing it. The implementation is able to support packet level privacy, server auth, and client auth, based on context config for a given endpoint, with independent context for each endpoint. It will also support secure and non-secure endpoints for the same service, if enabled by configuration. Finally, the socket can accept other types of configuration context (variant), and other types of socket streams (also variant), so this will allow drop-in support for zmq::context and p2p::context security. And of course we will need stream types for zmq to implement that framing, as well as for stratum-v2. But now the implementation will allow these to drop right in to config, context, stream, and security.
👍🏻 1👍 1

Thursday, January 22, 2026

Huddle with pmienk, Rowan Voskuil, eynhaender · 65 min16:55
Huddle with pmienk, evoskuil, Enligths, Marnix, Rowan Voskuil · 144 min18:18
E
Enligths19:23
Last year I built libbitcoin-system on a very old Ubuntu machine (4GB ram) and on a recent windows machine (16GB ram/i9 processor). The build time was way faster on the windows machine (maybe 10 times I don't remember). I am quite new to C++ and building project. I am wondering what the cause of this stark difference. Is it due mainly to the hardware? Is the build time dependent on the CPU? Thanks
(edited)
7 replies · pmienk, Enligths, evoskuil · last Jan 23, 2026
pmienk22:10
ram, cpu, disk speed will all significantly impact build speed. That said, without additional details I wouldn't guess at the issues. That said, a quick look at the CI build times for windows vs cmake vs autotools builds for libbitcoin-system shows that the last executed run was approximately 34-48 minutes for msvc/windows, 13-30 minutes for cmake/autotools/linux/mac combinations. these have differing parameterizations and we aren't in control of the hardware.
E
Enligths04:05
Ok it is really a combination of different factors.
evoskuil06:42
It can take longer to build than to sync 😵‍💫.
🤣 1
E
Enligths09:44
Every time I modify a test file in the test folder, do I need to build the entire libbitcoin-system?
evoskuil09:45
No, only the test build.
evoskuil09:47
And if you want to speed up work there you can delete most of the test sources temporarily. You need to retain main.cpp, test.cpp, and test.hpp.
E
Enligths09:54
Ok I will try later.
👍🏻 1

Friday, January 23, 2026

evoskuil08:58
First successful TLS connection.
image.png
👀 1🎉 1
evoskuil09:08
Same with certificate trust bypassed (-k):
image.png
evoskuil10:01
Had to add a some options to support Chrome, and here is the first browser TLS connection. These are using test certs from our wolfssl unit test suite.
image.png
evoskuil10:18
and the block explorer...
image.png
REST endpoint via curl:
image.png

Saturday, January 24, 2026

evoskuil06:54
Password encrypted server certs now enabled.
[explore]
connections = 100
bind = 0.0.0.0:80
safe = [::1]:443
safe = [fe80::abd1:6763:de41:21ae]:443
certificate_path = m:/server/certs/server-ecc384-cert.pem
key_path = m:/server/certs/server-ecc384-key-enc.pem
key_password = libbitcoin

Sunday, January 25, 2026

evoskuil04:44
Client (mutual) authentication now enabled.
[explore]
...
key_password = libbitcoin
key_path = m:/server/certs/server-ecc384-key-enc.pem
certificate_path = m:/server/certs/server-ecc384-cert.pem
certificate_authorities = m:/server/certs
certs>curl -v -k --cert client-ecc384-cert.pem --key client-ecc384-key.pem --cacert ca-ecc384-cert.pem https://localhost:443/v1/top?format=json --verbose
Note: Using embedded CA bundle, for proxies (225076 bytes)
* Host localhost:443 was resolved.
* IPv6: ::1
* IPv4: 127.0.0.1
*   Trying [::1]:443...
* ALPN: curl offers h2,http/1.1
* TLSv1.3 (OUT), TLS handshake, Client hello (1):
* SSL Trust: peer verification disabled
* TLSv1.3 (IN), TLS handshake, Server hello (2):
* TLSv1.3 (IN), TLS handshake, Unknown (8):
* TLSv1.3 (IN), TLS handshake, Request CERT (13):
* TLSv1.3 (IN), TLS handshake, Certificate (11):
* TLSv1.3 (IN), TLS handshake, CERT verify (15):
* TLSv1.3 (IN), TLS handshake, Finished (20):
* TLSv1.3 (OUT), TLS handshake, Certificate (11):
* TLSv1.3 (OUT), TLS handshake, CERT verify (15):
* TLSv1.3 (OUT), TLS handshake, Finished (20):
* SSL connection using TLSv1.3 / TLS_AES_256_GCM_SHA384 / [blank] / UNDEF
* ALPN: server did not agree on a protocol. Uses default.
* Server certificate:
*   subject: C=US; ST=Washington; L=Seattle; O=Elliptic; OU=ECC384Srv; CN=www.wolfssl.com; emailAddress=info@wolfssl.com
*   start date: Nov 13 20:41:06 2025 GMT
*   expire date: Nov  6 20:41:06 2055 GMT
*   issuer: C=US; ST=Washington; L=Seattle; O=wolfSSL; OU=Development; CN=www.wolfssl.com; emailAddress=info@wolfssl.com
*   Certificate level 0: Public key type ? (384/192 Bits/secBits), signed using ecdsa-with-SHA384
*  SSL certificate verification failed, continuing anyway!
* Established connection to localhost (::1 port 443) from ::1 port 54146
* using HTTP/1.x
> GET /v1/top?format=json HTTP/1.1
> Host: localhost
> User-Agent: curl/8.18.0
> Accept: */*
>
* Request completely sent off
< HTTP/1.1 200 OK
< Date: Sun, 25 Jan 2026 04:41:59 GMT
< Server: libbitcoin/4
< Keep-Alive: timeout=599
< Content-Type: application/json
< Transfer-Encoding: chunked
<
900000
evoskuil20:38
The embed of the wolfssl dependency is optional, as it can alternatively be satisficed with any openssl compatible dependency. We only access it via boost. The total amount of non-config code to implement all of the above TLS features is about 22 lines of code in the socket and 3 lines in the proxy wrapper. We are supporting 5 services with it (web, rest, bitcoind jsonrpc/rest, electrum, stratum-v1), each with independent config. The total to support the implementation is about 50 lines of config code. Adding test modifications and explicit comprehensive tests harnesses for wolfssl, the full implementation across the stack is about 100 lines.

Monday, January 26, 2026

evoskuil04:13
TLS over TCP in support of Electrum and Stratum-v1 is now verified (using the Electrum desktop wallet application). No changes required, just some improved logging, source documentation, a couple of localhost self-signed certificates added to ssl/test/vectors.
2026-01-26T04:08:46Z.0 Node is started.
2026-01-26T04:08:46Z.1 Not configured for inbound peer connections.
2026-01-26T04:08:46Z.1 Not configured for outbound connections.
2026-01-26T04:08:46Z.1 Not configured for web connections.
2026-01-26T04:08:46Z.1 Accepting 100 explore connections on 1 clear and 1 private bindings.
2026-01-26T04:08:46Z.1 Bound to private explore endpoint [[::1]:443].
2026-01-26T04:08:46Z.1 Bound to clear explore endpoint [127.0.0.1:80].
2026-01-26T04:08:46Z.1 Not configured for bitcoind connections.
2026-01-26T04:08:46Z.1 Accepting 100 electrum connections on 1 clear and 1 private bindings.
2026-01-26T04:08:46Z.1 Bound to private electrum endpoint [0.0.0.0:50002].
2026-01-26T04:08:46Z.1 Bound to clear electrum endpoint [0.0.0.0:50001].
2026-01-26T04:08:46Z.1 Not configured for stratum_v1 connections.
2026-01-26T04:08:46Z.1 Not configured for stratum_v2 connections.
2026-01-26T04:08:46Z.0 Node is running.
2026-01-26T04:08:52Z.2 Accepted private electrum connection [127.0.0.1:59800] on binding [0.0.0.0:50002].
2026-01-26T04:08:53Z.0 Rpc request: [1024] server.version(...).
2026-01-26T04:08:53Z.0 Electrum [127.0.0.1:59800] version (1.4) electrum/4.6.2
2026-01-26T04:08:53Z.0 Rpc response: [60], success.
2026-01-26T04:08:53Z.2 Inbound electrum channel start [127.0.0.1:59800] success
(edited)
🎉 2🚀 1

Tuesday, January 27, 2026

evoskuil09:19
TLS and clear handshake and connections via Sparrow wallet also verified. A couple of issues were discovered as @eynhaender started putting the client-server e2e test suite together. Also Sparrow ping of our bitcoind endpoint was verified. Bitcoin Core doesn't support TLS and only provides http basic auth, which is awful and I'd rather not offer it (despite it being trivial to implement). Setting up proper client auth using a self-signed cert is easy. Generating passwords at startup and/or using them over the wire in clear text is 😳.
(edited)

Wednesday, January 28, 2026

evoskuil01:05
I've renamed [explore] to [native] and [web] to [admin].
(edited)
👍🏻 1
evoskuil01:26
Externally (outside of sources) this affects only the above config file section names.

Thursday, January 29, 2026

evoskuil09:40
This took all day, and only for Windows. But it's now simple and working well. The console application now has a window frame for capturing messages, and can initiate close while suspending logoff with custom user override prompt. And an icon to make the prompt look right.
IMG_0969
evoskuil09:51
What this means is that the store won't have to revert to a snapshot just because the user logs off. I tested it while performing a snapshot, to significantly slow the logoff, and no problems. It starts the process shutdown, initiated by the Windows account logoff, during the snapshot. Can continue to the logoff once complete/stopped, or the user can suspend the logoff and the process remains stopped until the user restarts it.
Huddle with pmienk, Marnix, evoskuil · 122 min16:55
1 reply · pmienk · last Jan 29, 2026
pmienk18:29
venv\Scripts\activate
pmienk18:29
replied to a thread: view
venv\Scripts\activate