If you're not convinced by the Tailscale connection, or if managing a dual VPN seems too much of a hassle, this chapter suggests another way of using a remote mobile client to pay for and receive sats via your Lightning node: Nostr Wallet Connect.

For this example, we'll be using the Alby Go mobile application, which is very well designed and particularly easy to learn. That said, you can also use Zeus or any other NWC-compatible mobile application. You'll find a list of compatible applications on the awesome-nwc GitHub repository.

Nostr Wallet Connect is a standardized protocol that allows an application or website to trigger actions on a remote Lightning node, without establishing a direct network connection to that node (no API LND exposed, no VPN, no .onion service...). NWC defines how an application formulates an intent (e.g. pay_invoice) and receives the result.

It works quite simply. You initialize a session by scanning a QR code or via a deeplink nostr+walletconnect:. This string contains the session parameters and an authorization secret. Then, when the application wants to pay, it serializes the request, encrypts it, and publishes it as an event on a Nostr relay. The node reads the event on the relay, decrypts it, checks that the author is authorized for this session, executes the payment, then returns an encrypted response (success with preimage, or error). The relay only acts as a transport intermediary: it cannot read the content, but it can observe the timing and frequency of requests.

Compared with a connection via Tailscale or Tor, the main advantage of NWC is that your node is not directly reachable from the outside. This greatly simplifies mobile use: your node doesn't need to accept incoming connections, it just needs to be able to communicate with a relay. On the other hand, you introduce a functional dependency on Nostr relays: if they are unavailable, the experience degrades. Also, even if messages are encrypted, the relay can observe a certain level of activity metadata.

The difference in security models is also important. With Tailscale or Tor, you expose direct access to your node (via API of LND) protected by highly sensitive secrets. This is powerful, because you can administer everything, but it's also a lower-layer attack surface. With NWC, access is more applicative: you delegate a session token that authorizes only certain actions.

Previously, there was an application specifically dedicated to NWC connections in the Umbrel App Store, but unfortunately this is no longer available. You'll now need to use Alby Hub to establish this type of connection. To do this, start by installing the Alby Hub application directly from the store.

On opening, skip the introductory screens, then click on the Get Started (LND) button. It's important to check that it says LND, not LDK, in brackets. If LND appears, this means that Alby Hub has correctly detected your existing Lightning node and will configure itself as the interface for it. On the other hand, if LDK is displayed, this indicates that Alby Hub has not detected your node and is about to create a new one, which is not the aim here.

You will then be asked to set up a Alby account. For use limited to NWC, this is not necessary, but you may wish to do so if you wish to take advantage of Alby's specific services. If not, click on Maybe later to continue.

Then choose a strong, unique password. This will protect access to Alby Hub on your node. Remember to save it in your password manager.

This brings you to the Alby Hub interface. You don't need to go through the whole configuration process, unless you want to use it as the main manager of your Lightning node. As we saw earlier, Alby Hub can in fact replace the use of ThunderHub for the administration of your node. If you'd like to find out more about Alby Hub's options, take a look at our dedicated tutorial:

Go to the Connections menu.

Here you can see all the applications that can connect to your Lightning node via NWC. These include Zeus, already mentioned in the previous chapter. Here, we'll be using Alby Go. Click on Alby Go, then on the Connect to Alby Go button to start the connection process.

On your smartphone, install the Alby Go application:

In Alby Hub, configure the rights you wish to grant to the Alby Go application on your Lightning node. You can, for example, set spending limits per period, an expiry date for the NWC link, or leave total control. Once you've set the parameters, click on the Next button.

Alby Hub then generates a QR code to establish the NWC connection between your Lightning node and Alby Go.

On the Alby Go application, when first opened, click on Connect Wallet, then scan the QR code supplied by Alby Hub.

Choose a name to identify this wallet. You now have remote access to your Lightning node via Alby Go. You can generate invoices to receive sats on your node, or set Lightning invoices directly with it.

For example, I sent 1543 sats from the Alby Go interface.

If I go to the basic interface of my Lightning node on Umbrel, I can see that this payment has indeed been made by my node.

Now you know how to easily use your Lightning node from anywhere.