officer
e0452e7aec
The hooks build `/${service}/_config`, so their argument is the MOUNT name.
It still said 'wallet' after the plugin was renamed to bitcoin-wallet, so every
request 404'd.
The symptom was not an error. `data` stayed undefined, the seeding effect
returns early on !data, and `url` never left '' — so `!trimmed` disabled the
button and the "http://127.0.0.1:32838" visible in the field was the
placeholder, not a value. The `(—)` in the hint was the same missing data.
Credential rows are keyed on the PROTOCOL ('esplora' / 'nbxplorer') by the
sidecar's config.ts, so nothing already saved is affected by the rename.
Wallet
A self-custodial bitcoin wallet inside Officer, with the keys held on your server rather than on a phone or in a browser.
What you get
- On-chain balance, receive addresses and transaction history
- Send, with fee control, coin selection and UTXO freezing
- Labels for addresses and transactions
- Multiple wallets, one active
- Chain data from Esplora or your own NBXplorer
How the keys are held
Read docs/wallet-key-custody.md in the platform for the full design. The short version:
- Your seed is encrypted under a key derived from your own passphrase (scrypt, N=2¹⁷), then encrypted again at rest. The server never stores the passphrase.
- The wallet is usable while locked — balances, history and fresh receive addresses all work without it. Unlocking is required only to sign.
- An unlock lasts 15 minutes by default and does not extend on use. A restart relocks everything.
- There is no "forgot passphrase". There is no recovery. Your seed backup is the recovery.
Multi-user
Each account gets its own wallet, sealed under its own passphrase. Granting the bitcoin-wallet permission
to a role gives those people a wallet of their own — it does not give them yours, and it does not give
you theirs. Not through the app, and not with root either: their seed is sealed under a passphrase you
do not have.
One caveat, stated plainly: balances and history are stored unencrypted so a locked wallet still shows them. Anyone with the database — or a backup of it — can see any user's balances. They can never move anything.
Permissions
One permission, bitcoin-wallet. Grantable per role like any other app permission.
Requirements
None to start. Esplora is used by default; point it at your own NBXplorer if you run one.