Running your own Bitcoin infrastructure is supposed to reduce the number of people and systems you have to trust.

But there's a part of the threat model that's easy to forget: logs.

I started looking into this after a recent Core Lightning change involving I/O logs that could contain runes and other sensitive information.

What interested me wasn't just the CLN fix. It was what happens after something sensitive reaches a log.

It may end up in journald. Docker. Plugin output. Reverse proxy logs. Monitoring. Backups. Old snapshots. Even shell history.

So I audited the whole path on a self-hosted setup rather than looking only at lightningd.

I wrote up the process here:

https://davidebtc186.substack.com/p/your-lightning-node-may-be-logging

I'm not suggesting disabling logs. They're incredibly useful when you're operating your own infrastructure.

The goal is knowing what you're retaining, where it goes, who can read it, and when it disappears.

The question I ended up using for my own threat model was:

If someone got a copy of every log on my Bitcoin server today, what would I need to consider compromised?

Curious how other self-hosters here handle log retention — especially people running Bitcoin Core + Lightning + monitoring on the same machine.

Y ahora estamos en la parte alcista del ciclo?

In future BTC will be the real in physical currency 💴 and the entire world will be dependent on it. This is the right time to invest.

🦗crickets lol🦗