feat: add Docker support for palladium-lightning node

- Dockerfile.palladium-lightning: multi-stage build (ubuntu:22.04)
  builder stage compiles lightningd from source with git submodules;
  runtime stage copies palladium-cli from palladium-node:local image
  (no Rust plugins, no cross-compilation, amd64 only)

- docker-compose.lightning.yml: joins external `palladium-net`, exposes
  port 9735 (P2P), connects to palladiumd:2332 via RPC using credentials
  from .env

- .env.example: template for PALLADIUM_RPCUSER / PALLADIUM_RPCPASSWORD

- .gitignore: add .env to prevent accidental credential commits

.env.example

@@ -0,0 +1,4 @@
+# Copy this file to .env and fill in your palladiumd RPC credentials.
+# The .env file is gitignored — never commit it.
+PALLADIUM_RPCUSER=your_rpc_user
+PALLADIUM_RPCPASSWORD=your_rpc_password

.gitignore

@@ -27,6 +27,9 @@ cli/lightning-cli
 # Custom local binaries for testing
 /palladium-bin/
 
+# Local secrets — never commit
+.env
+
 coverage
 # Coverage profiling data files
 *.profraw
@@ -34,6 +37,7 @@ coverage
 # Generated Python API documentation
 docs/python
 ccan/config.h
+ccan/config.h.*
 __pycache__
 config.vars
 monkeytype.sqlite3

Dockerfile.palladium-lightning

@@ -0,0 +1,98 @@
+# syntax=docker/dockerfile:1.7-labs
+# Palladium Lightning — production image (amd64, no cross-compilation, no Rust plugins)
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Stage 1: builder
+# ──────────────────────────────────────────────────────────────────────────────
+FROM ubuntu:22.04 AS builder
+
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        autoconf \
+        automake \
+        build-essential \
+        ca-certificates \
+        gcc \
+        git \
+        gettext \
+        jq \
+        libffi-dev \
+        libicu-dev \
+        libprotobuf-c-dev \
+        libsodium-dev \
+        libsqlite3-dev \
+        libssl-dev \
+        libtool \
+        pkg-config \
+        protobuf-compiler \
+        python3-dev \
+        zlib1g-dev && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+WORKDIR /opt/lightningd
+
+# Copy source (excluding .git, added back below for submodule init)
+COPY --exclude=.git/ . .
+COPY .git/ .git/
+
+RUN git submodule update --init --recursive --depth 1 --jobs "$(nproc)"
+
+RUN ./configure \
+        --prefix=/tmp/lightning_install \
+        --disable-valgrind \
+        --disable-compat
+
+RUN make install-program -j"$(nproc)"
+
+# Strip debug symbols to reduce image size
+RUN find /tmp/lightning_install -type f -executable \
+    -exec sh -c 'file "$1" | grep -q ELF && strip --strip-unneeded "$1"' _ {} \;
+
+
+# ──────────────────────────────────────────────────────────────────────────────
+# Stage 2: runtime
+# ──────────────────────────────────────────────────────────────────────────────
+FROM ubuntu:22.04 AS lightningd
+
+SHELL ["/bin/bash", "-euo", "pipefail", "-c"]
+
+ENV DEBIAN_FRONTEND=noninteractive
+
+RUN apt-get update && \
+    apt-get install -y --no-install-recommends \
+        ca-certificates \
+        inotify-tools \
+        jq \
+        libffi8 \
+        libicu70 \
+        libsodium23 \
+        libsqlite3-0 \
+        socat && \
+    apt-get clean && rm -rf /var/lib/apt/lists/*
+
+# palladium-cli is needed by the bcli plugin to talk to palladiumd.
+# Copy it from the already-built palladium-node image so we don't duplicate binaries.
+# Build palladium-node:local first: docker compose -f docker-compose.yml build
+COPY --from=palladium-node:local /usr/local/bin/palladium-cli /usr/local/bin/palladium-cli
+
+# Lightning binaries and plugins
+COPY --from=builder /tmp/lightning_install/ /usr/local/
+
+COPY tools/docker-entrypoint.sh /entrypoint.sh
+RUN chmod +x /entrypoint.sh
+
+ENV LIGHTNINGD_DATA=/root/.lightning
+ENV LIGHTNINGD_NETWORK=palladium
+ENV LIGHTNINGD_PORT=9735
+ENV LIGHTNINGD_RPC_PORT=9835
+ENV EXPOSE_TCP=false
+
+EXPOSE 9735
+
+VOLUME ["/root/.lightning"]
+
+ENTRYPOINT ["/entrypoint.sh"]

bitcoin/chainparams.c

@@ -30,12 +30,22 @@ const struct chainparams networks[] = {
      .onchain_hrp = "plm",
      .lightning_hrp = "plm",
      .bip70_name = "main",
+     /* genesis = 000000000019d6689c085ae165831e934ff763ae46a2a6c172b3f1b60a8ce26f
+      * (same as Bitcoin mainnet - Palladium kept the original genesis block)
+      *
+      * OPERATIONAL NOTES FOR PALLADIUM MAINNET:
+      * - Resilience Fork at block 340,000: block target changes from 10 min to 2 min.
+      *   Operators should tune --cltv-expiry-delta and --cltv-final accordingly.
+      *   Default cltv_expiry_delta=14 blocks ≈ 28 min (was 140 min on Bitcoin).
+      * - Taproot (BIP341) activates via BIP9 (bit 2), window opens Feb 14 2026.
+      *   On regtest Taproot is ALWAYS_ACTIVE. Anchor/Taproot channels work
+      *   on regtest immediately; on mainnet only after BIP9 lock-in. */
      .genesis_blockhash = {{{.u.u8 = {0x6f, 0xe2, 0x8c, 0x0a, 0xb6, 0xf1, 0xb3,
 				      0x72, 0xc1, 0xa6, 0xa2, 0x46, 0xae, 0x63,
 				      0xf7, 0x4f, 0x93, 0x1e, 0x83, 0x65, 0xe1,
 				      0x5a, 0x08, 0x9c, 0x68, 0xd6, 0x19, 0x00,
 				      0x00, 0x00, 0x00, 0x00}}}},
-     .rpc_port = 2333,
+     .rpc_port = 2332,
      .ln_port = 9735,
      .cli = "palladium-cli",
      .cli_args = NULL,
@@ -50,8 +60,7 @@ const struct chainparams networks[] = {
      .max_funding = AMOUNT_SAT_INIT((1 << 24) - 1),
      .max_payment = AMOUNT_MSAT_INIT(0xFFFFFFFFULL),
      .max_supply = AMOUNT_SAT_INIT(2100000000000000),
-     /* "Lightning Charge Powers Developers & Blockstream Store" */
-     .when_lightning_became_cool = 504500,
+     .when_lightning_became_cool = 1,
      .p2pkh_version = 55,
      .p2sh_version = 5,
      .testnet = false,
@@ -59,6 +68,34 @@ const struct chainparams networks[] = {
      .bip32_key_version = {.bip32_pubkey_version = BIP32_VER_MAIN_PUBLIC,
 			   .bip32_privkey_version = BIP32_VER_MAIN_PRIVATE},
      .is_elements = false},
+    {.network_name = "testnet",
+     .onchain_hrp = "tplm",
+     .lightning_hrp = "tplm",
+     .bip70_name = "test",
+     /* genesis = 000000000933ea01ad0ee984209779baaec3ced90fa3f408719526f8d77f4943
+      * (same as Bitcoin testnet - Palladium kept the original testnet genesis block) */
+     .genesis_blockhash = {{{.u.u8 = {0x43, 0x49, 0x7f, 0xd7, 0xf8, 0x26, 0x95,
+				      0x71, 0x08, 0xf4, 0xa3, 0x0f, 0xd9, 0xce,
+				      0xc3, 0xae, 0xba, 0x79, 0x97, 0x20, 0x84,
+				      0xe9, 0x0e, 0xad, 0x01, 0xea, 0x33, 0x09,
+				      0x00, 0x00, 0x00, 0x00}}}},
+     .rpc_port = 12332,
+     .ln_port = 19735,
+     .cli = "palladium-cli",
+     .cli_args = "-testnet",
+     .cli_min_supported_version = 150000,
+     .dust_limit = { 546 },
+     .max_funding = AMOUNT_SAT_INIT((1 << 24) - 1),
+     .max_payment = AMOUNT_MSAT_INIT(0xFFFFFFFFULL),
+     .max_supply = AMOUNT_SAT_INIT(2100000000000000),
+     .when_lightning_became_cool = 1,
+     .p2pkh_version = 127,
+     .p2sh_version = 115,
+     .testnet = true,
+     .fee_asset_tag = NULL,
+     .bip32_key_version = {.bip32_pubkey_version = BIP32_VER_TEST_PUBLIC,
+			   .bip32_privkey_version = BIP32_VER_TEST_PRIVATE},
+     .is_elements = false},
     {.network_name = "regtest",
      .onchain_hrp = "rplm",
      .lightning_hrp = "rplm",
@@ -68,7 +105,7 @@ const struct chainparams networks[] = {
 				      0x5b, 0xbf, 0x28, 0xc3, 0x4f, 0x3a, 0x5e,
 				      0x33, 0x2a, 0x1f, 0xc7, 0xb2, 0xb7, 0x3c,
 				      0xf1, 0x88, 0x91, 0x0f}}}},
-     .rpc_port = 28444,
+     .rpc_port = 12443,
      .ln_port = 19846,
      .cli = "palladium-cli",
      .cli_args = "-regtest",

common/configdir.c

@@ -340,8 +340,8 @@ struct configvar **initial_config_opts(const tal_t *ctx,
 			       "Set base directory: network-specific subdirectory is under here");
 	opt_register_early_arg("--network", opt_set_network, opt_show_network,
 			       NULL,
-			       "Select the network parameters (bitcoin, testnet,"
-			       " signet, or regtest)");
+			       "Select the network parameters (palladium, testnet,"
+			       " or regtest)");
 	opt_register_early_noarg("--testnet",
 				 opt_set_specific_network, "testnet",
 				 "Alias for --network=testnet");
@@ -353,7 +353,7 @@ struct configvar **initial_config_opts(const tal_t *ctx,
 				 "Alias for --network=signet");
 	opt_register_early_noarg("--mainnet",
 				 opt_set_specific_network, "palladium",
-				 "Alias for --network=bitcoin");
+				 "Alias for --network=palladium");
 	opt_register_early_noarg("--regtest",
 				 opt_set_specific_network, "regtest",
 				 "Alias for --network=regtest");

configure

@@ -538,8 +538,7 @@ else
 fi
 
 if ! check_command 'lowdown' lowdown; then
-    echo "*** We need lowdown!" >&2
-    exit 1
+    echo "WARNING: lowdown not found, man page generation will be skipped." >&2
 fi
 
 if echo | check_command sha256sum sha256sum; then

docker-compose.lightning.yml

@@ -0,0 +1,46 @@
+# Palladium Lightning — docker-compose
+#
+# Joins the existing `palladium-net` network created by the palladiumd compose stack.
+# The palladium-node:local image must be built before this one (palladium-cli is copied from it).
+#
+# Usage:
+#   # 1. Create .env with RPC credentials (see .env.example)
+#   # 2. Ensure palladiumd is running on palladium-net
+#   docker compose -f docker-compose.lightning.yml build
+#   docker compose -f docker-compose.lightning.yml up -d
+#
+#   # Check status
+#   docker logs palladium-lightning
+#   docker exec palladium-lightning lightning-cli --network=palladium getinfo
+
+networks:
+  palladium-net:
+    external: true  # created by the palladiumd compose stack
+
+services:
+  palladium-lightning:
+    build:
+      context: .
+      dockerfile: Dockerfile.palladium-lightning
+    image: palladium-lightning:local
+    container_name: palladium-lightning
+    restart: unless-stopped
+    networks:
+      - palladium-net
+    ports:
+      - "0.0.0.0:9735:9735"   # Lightning P2P — must be reachable from the internet
+      # RPC (9835) is NOT exposed on the host.
+      # Use: docker exec palladium-lightning lightning-cli --network=palladium <command>
+    volumes:
+      - ./.lightning:/root/.lightning
+    environment:
+      LIGHTNINGD_NETWORK: palladium
+      EXPOSE_TCP: "false"
+    command: >
+      --network=palladium
+      --palladium-rpcconnect=palladiumd
+      --palladium-rpcport=2332
+      --palladium-rpcuser=${PALLADIUM_RPCUSER}
+      --palladium-rpcpassword=${PALLADIUM_RPCPASSWORD}
+      --palladium-cli=/usr/local/bin/palladium-cli
+      --log-level=info

lightningd/dual_open_control.c

@@ -2654,7 +2654,7 @@ json_openchannel_bump(struct command *cmd,
 	/* Ok, we're kosher to start.  Delay if not synced yet. */
 	if (!topology_synced(cmd->ld->topology)) {
 		json_notify_fmt(cmd, LOG_UNUSUAL,
-				"Waiting to sync with bitcoind network (block %u of %u)",
+				"Waiting to sync with palladiumd network (block %u of %u)",
 				get_block_height(cmd->ld->topology),
 				get_network_blockheight(cmd->ld->topology));
 
@@ -3287,7 +3287,7 @@ static struct command_result *json_openchannel_init(struct command *cmd,
 
 	if (!topology_synced(cmd->ld->topology)) {
 		json_notify_fmt(cmd, LOG_UNUSUAL,
-				"Waiting to sync with bitcoind network (block %u of %u)",
+				"Waiting to sync with palladiumd network (block %u of %u)",
 				get_block_height(cmd->ld->topology),
 				get_network_blockheight(cmd->ld->topology));
 

lightningd/opening_control.c

@@ -1456,7 +1456,7 @@ static struct command_result *json_fundchannel_start(struct command *cmd,
 			= tal(cmd, struct fundchannel_start_info);
 
 		json_notify_fmt(cmd, LOG_UNUSUAL,
-				"Waiting to sync with bitcoind network (block %u of %u)",
+				"Waiting to sync with palladiumd network (block %u of %u)",
 				get_block_height(cmd->ld->topology),
 				get_network_blockheight(cmd->ld->topology));
 

lightningd/peer_htlcs.c

@@ -720,7 +720,7 @@ const u8 *send_htlc_out(const tal_t *ctx,
 	/* Note: we allow outgoing HTLCs before sync, for fast startup. */
 	if (!topology_synced(out->peer->ld->topology)) {
 		log_debug(out->log, "Sending HTLC while still syncing"
-			  " with bitcoin network (%u vs %u)",
+			  " with palladium network (%u vs %u)",
 			  get_block_height(out->peer->ld->topology),
 			  get_network_blockheight(out->peer->ld->topology));
 	}
@@ -2409,7 +2409,7 @@ void peer_got_commitsig(struct channel *channel, const u8 *msg)
 		return;
 	}
 
-	/* If we're not synced with bitcoin network, we can't accept
+	/* If we're not synced with palladium network, we can't accept
 	 * any new HTLCs.  We stall at this point, in the hope that it
 	 * won't take long! */
 	if (added && !topology_synced(ld->topology)) {