Install SatBooth.

The release

What you need

• Two hosts, a private hub host and a public host. They are never one machine, because the Lightning bound holds only if the hub is in a separate trust domain.
• A private link between them, such as WireGuard, or a private network with a firewall that admits only the public host to the hub host’s ports. Setting it up is yours.
• Docker with Compose on both hosts, in its default mode. The setup wrapper refuses a rootless Docker engine and Podman. Check out the repository on both hosts at the release tag you deploy.
• What the hub host runs, from the bundle: Alby Hub, SatBooth’s relay, a dedicated bitcoind and its Electrum server, and with Monero, monerod and monero-wallet-rpc.
• For on-chain bitcoin, a watch-only descriptor of a new account in your own wallet.
• For Monero, the primary address and the private view key of a wallet that is only for shop income. SatBooth never holds a spend key.
• For Lightning refunds, optionally, the public key of an approval signing key that stays off both hosts.

Four steps

The setup command writes every configuration file and generates every secret, once per host. It opens no network connection and runs in a pinned image. These are the stages; each refuses to run out of turn.

1. 01public host

   deploy/setup.sh <dir> public init

   Writes SatBooth’s secrets and a handoff file for the hub host, and prints the pairing links. Add -answers <file> to give the answers from a file; without it the command asks.

2. 02hub host

   deploy/setup.sh <dir> hub init -handoff <public-to-hub.json> -digest "<digest>"

   Checks the handoff, writes the hub host’s configuration and secrets, and prints the steps to start the hub alone and pair it. -answers <file> is optional here too.

3. 03hub host

   deploy/setup.sh <dir> hub pair -invoice-wallet <key> -payout-wallet <key>

   Writes the relay’s configuration from the two Wallet Public Keys and a handoff file back for the public host.

4. 04public host

   deploy/setup.sh <dir> public finish -handoff <hub-to-public.json> -digest "<digest>"

   Writes SatBooth’s configuration and prints the command that starts it. With Monero, add -wallet-rpc-pass <the carried file>.

Between the stages you start the hub, set its unlock password, pair the two connections and import your descriptor. The deployment guide walks through each.

Verify before you trust

Every release tag is an annotated tag signed with one OpenPGP key. The release signing key fingerprint is:

5BEB DE79 EDDE D015 7398 1D4F 70C6 001B 0A49 776E

Import the key, compare its full fingerprint with the one above, and verify the tag:

curl -fsSL https://github.com/fishcakeday.gpg | gpg --import
gpg --fingerprint '5BEB DE79 EDDE D015 7398 1D4F 70C6 001B 0A49 776E'
git tag -v v0.1.0-rc.1

git tag -v must report a good signature from that fingerprint. Then, in a clean checkout, select the tag’s commit and check that HEAD is that commit:

git switch --detach "refs/tags/v0.1.0-rc.1^{commit}"
git rev-parse HEAD
git rev-parse "refs/tags/v0.1.0-rc.1^{commit}"

The two git rev-parse lines must print the same hash. The bundles pin each image by digest, and the pins in the tree of a signed tag are the ones that release published. Two checks go further.

Attestation. For each image ref printed by scripts/release-pins.sh show, remove the :<tag> part so that it reads <name>@sha256:<digest>. This accepts only this repository’s release workflow, run from the tag on a GitHub-hosted runner:

gh attestation verify oci://ghcr.io/satbooth/<name>@sha256:<digest> -R SatBooth/SatBooth \
  --signer-workflow SatBooth/SatBooth/.github/workflows/release.yml \
  --source-ref refs/tags/v0.1.0-rc.1 --deny-self-hosted-runners

Rebuild. The build is reproducible: the same sources give the same digests on any machine. It needs Docker with buildx and jq, and prints match orpinned X, built Y for each image:

out=$(mktemp -d)
scripts/release-build.sh "$out"
scripts/release-pins.sh check "$out/digests.txt"

The attestation proves where an image was built, not who authorised the release: the tag signature is that check. The deployment guide has the full text.