Fix SSH fingerprint checking

Always showing currency name to prevent LND confusion

BTCPayServer.Tests/RateRulesTest.cs

@@ -46,8 +46,8 @@ namespace BTCPayServer.Tests
             {
                 Assert.Equal(test.Expected, rules.GetRuleFor(CurrencyPair.Parse(test.Pair)).ToString());
             }
-            rules.GlobalMultiplier = 2.32m;
-            Assert.Equal("(bittrex(DOGE_BTC) * gdax(BTC_USD) * 1.1) * 2.32", rules.GetRuleFor(CurrencyPair.Parse("DOGE_USD")).ToString());
+            rules.Spread = 0.2m;
+            Assert.Equal("(bittrex(DOGE_BTC) * gdax(BTC_USD) * 1.1) * (0.8, 1.2)", rules.GetRuleFor(CurrencyPair.Parse("DOGE_USD")).ToString());
             ////////////////
 
             // Check errors conditions
@@ -113,22 +113,22 @@ namespace BTCPayServer.Tests
             builder.AppendLine("BTC_USD = -3 + coinbase(BTC_CAD) + 50 - 5");
             builder.AppendLine("DOGE_BTC = 2000");
             Assert.True(RateRules.TryParse(builder.ToString(), out rules));
-            rules.GlobalMultiplier = 1.1m;
+            rules.Spread = 0.1m;
 
             rule2 = rules.GetRuleFor(CurrencyPair.Parse("DOGE_USD"));
-            Assert.Equal("(2000 * (-3 + coinbase(BTC_CAD) + 50 - 5)) * 1.1", rule2.ToString());
+            Assert.Equal("(2000 * (-3 + coinbase(BTC_CAD) + 50 - 5)) * (0.9, 1.1)", rule2.ToString());
             rule2.ExchangeRates.SetRate("coinbase", CurrencyPair.Parse("BTC_CAD"), new BidAsk(1000m));
             Assert.True(rule2.Reevaluate());
-            Assert.Equal("(2000 * (-3 + 1000 + 50 - 5)) * 1.1", rule2.ToString(true));
-            Assert.Equal((2000m * (-3m + 1000m + 50m - 5m)) * 1.1m, rule2.BidAsk.Bid);
+            Assert.Equal("(2000 * (-3 + 1000 + 50 - 5)) * (0.9, 1.1)", rule2.ToString(true));
+            Assert.Equal((2000m * (-3m + 1000m + 50m - 5m)) * 0.9m, rule2.BidAsk.Bid);
 
             // Test inverse
             rule2 = rules.GetRuleFor(CurrencyPair.Parse("USD_DOGE"));
-            Assert.Equal("(1 / (2000 * (-3 + coinbase(BTC_CAD) + 50 - 5))) * 1.1", rule2.ToString());
+            Assert.Equal("(1 / (2000 * (-3 + coinbase(BTC_CAD) + 50 - 5))) * (0.9, 1.1)", rule2.ToString());
             rule2.ExchangeRates.SetRate("coinbase", CurrencyPair.Parse("BTC_CAD"), new BidAsk(1000m));
             Assert.True(rule2.Reevaluate());
-            Assert.Equal("(1 / (2000 * (-3 + 1000 + 50 - 5))) * 1.1", rule2.ToString(true));
-            Assert.Equal((1.0m / (2000m * (-3m + 1000m + 50m - 5m))) * 1.1m, rule2.BidAsk.Bid);
+            Assert.Equal("(1 / (2000 * (-3 + 1000 + 50 - 5))) * (0.9, 1.1)", rule2.ToString(true));
+            Assert.Equal((1.0m / (2000m * (-3m + 1000m + 50m - 5m))) * 0.9m, rule2.BidAsk.Bid);
             ////////
 
             // Make sure kraken is not converted to CurrencyPair

BTCPayServer.Tests/UnitTest1.cs

@@ -849,6 +849,22 @@ namespace BTCPayServer.Tests
             Assert.Equal("abed2", search.Filters["status"].Skip(1).First());
         }
 
+        [Fact]
+        public void CanParseFingerprint()
+        {
+            Assert.True(SSH.SSHFingerprint.TryParse("4e343c6fc6cfbf9339c02d06a151e1dd", out var unused));
+            Assert.Equal("4e:34:3c:6f:c6:cf:bf:93:39:c0:2d:06:a1:51:e1:dd", unused.ToString());
+            Assert.True(SSH.SSHFingerprint.TryParse("4e:34:3c:6f:c6:cf:bf:93:39:c0:2d:06:a1:51:e1:dd", out unused));
+            Assert.True(SSH.SSHFingerprint.TryParse("SHA256:Wl7CdRgT4u5T7yPMsxSrlFP+HIJJWwidGkzphJ8di5w", out unused));
+            Assert.True(SSH.SSHFingerprint.TryParse("SHA256:Wl7CdRgT4u5T7yPMsxSrlFP+HIJJWwidGkzphJ8di5w=", out unused));
+            Assert.True(SSH.SSHFingerprint.TryParse("Wl7CdRgT4u5T7yPMsxSrlFP+HIJJWwidGkzphJ8di5w=", out unused));
+            Assert.Equal("SHA256:Wl7CdRgT4u5T7yPMsxSrlFP+HIJJWwidGkzphJ8di5w", unused.ToString());
+
+            Assert.True(SSH.SSHFingerprint.TryParse("Wl7CdRgT4u5T7yPMsxSrlFP+HIJJWwidGkzphJ8di5w=", out var f1));
+            Assert.True(SSH.SSHFingerprint.TryParse("SHA256:Wl7CdRgT4u5T7yPMsxSrlFP+HIJJWwidGkzphJ8di5w", out var f2));
+            Assert.Equal(f1.ToString(), f2.ToString());
+        }
+
         [Fact]
         public void TestAccessBitpayAPI()
         {
@@ -982,8 +998,8 @@ namespace BTCPayServer.Tests
 
                 var storeController = user.GetController<StoresController>();
                 var vm = (RatesViewModel)((ViewResult)storeController.Rates()).Model;
-                Assert.Equal(1.0, vm.RateMultiplier);
-                vm.RateMultiplier = 0.5;
+                Assert.Equal(0.0, vm.Spread);
+                vm.Spread = 40;
                 storeController.Rates(vm).Wait();
 
 
@@ -997,7 +1013,11 @@ namespace BTCPayServer.Tests
                     FullNotifications = true
                 }, Facade.Merchant);
 
-                Assert.True(invoice2.BtcPrice.Almost(invoice1.BtcPrice * 2, 0.00001m));
+                // The rate was 5000 USD per BTC
+                // Now it should be 3000 USD per BTC
+                // So the expected price should be
+                var expected = Money.Coins(5000m / 3000m);
+                Assert.True(invoice2.BtcPrice.Almost(expected, 0.00001m));
             }
         }
 
@@ -1079,7 +1099,7 @@ namespace BTCPayServer.Tests
                 var rateVm = Assert.IsType<RatesViewModel>(Assert.IsType<ViewResult>(store.Rates()).Model);
                 Assert.False(rateVm.ShowScripting);
                 Assert.Equal("coinaverage", rateVm.PreferredExchange);
-                Assert.Equal(1.0, rateVm.RateMultiplier);
+                Assert.Equal(0.0, rateVm.Spread);
                 Assert.Null(rateVm.TestRateRules);
 
                 rateVm.PreferredExchange = "bitflyer";
@@ -1088,13 +1108,13 @@ namespace BTCPayServer.Tests
                 Assert.Equal("bitflyer", rateVm.PreferredExchange);
 
                 rateVm.ScriptTest = "BTC_JPY,BTC_CAD";
-                rateVm.RateMultiplier = 1.1;
+                rateVm.Spread = 10;
                 store = user.GetController<StoresController>();
                 rateVm = Assert.IsType<RatesViewModel>(Assert.IsType<ViewResult>(store.Rates(rateVm, "Test").Result).Model);
                 Assert.NotNull(rateVm.TestRateRules);
                 Assert.Equal(2, rateVm.TestRateRules.Count);
                 Assert.False(rateVm.TestRateRules[0].Error);
-                Assert.StartsWith("(bitflyer(BTC_JPY)) * 1.10 =", rateVm.TestRateRules[0].Rule, StringComparison.OrdinalIgnoreCase);
+                Assert.StartsWith("(bitflyer(BTC_JPY)) * (0.9, 1.1) =", rateVm.TestRateRules[0].Rule, StringComparison.OrdinalIgnoreCase);
                 Assert.True(rateVm.TestRateRules[1].Error);
                 Assert.IsType<RedirectToActionResult>(store.Rates(rateVm, "Save").Result);
 
@@ -1107,19 +1127,19 @@ namespace BTCPayServer.Tests
                 rateVm.ScriptTest = "BTC_JPY";
                 rateVm = Assert.IsType<RatesViewModel>(Assert.IsType<ViewResult>(store.Rates(rateVm, "Test").Result).Model);
                 Assert.True(rateVm.ShowScripting);
-                Assert.Contains("(bitflyer(BTC_JPY)) * 1.10 = ", rateVm.TestRateRules[0].Rule, StringComparison.OrdinalIgnoreCase);
+                Assert.Contains("(bitflyer(BTC_JPY)) * (0.9, 1.1) = ", rateVm.TestRateRules[0].Rule, StringComparison.OrdinalIgnoreCase);
 
                 rateVm.ScriptTest = "BTC_USD,BTC_CAD,DOGE_USD,DOGE_CAD";
                 rateVm.Script = "DOGE_X = bittrex(DOGE_BTC) * BTC_X;\n" +
                                 "X_CAD = quadrigacx(X_CAD);\n" +
                                  "X_X = gdax(X_X);";
-                rateVm.RateMultiplier = 0.5;
+                rateVm.Spread = 50;
                 rateVm = Assert.IsType<RatesViewModel>(Assert.IsType<ViewResult>(store.Rates(rateVm, "Test").Result).Model);
                 Assert.True(rateVm.TestRateRules.All(t => !t.Error));
                 Assert.IsType<RedirectToActionResult>(store.Rates(rateVm, "Save").Result);
                 store = user.GetController<StoresController>();
                 rateVm = Assert.IsType<RatesViewModel>(Assert.IsType<ViewResult>(store.Rates()).Model);
-                Assert.Equal(0.5, rateVm.RateMultiplier);
+                Assert.Equal(50, rateVm.Spread);
                 Assert.True(rateVm.ShowScripting);
                 Assert.Contains("DOGE_X", rateVm.Script, StringComparison.OrdinalIgnoreCase);
             }
@@ -1331,7 +1351,8 @@ namespace BTCPayServer.Tests
                 var derivationVM = (DerivationSchemeViewModel)Assert.IsType<ViewResult>(controller.AddDerivationScheme(user.StoreId, "BTC")).Model;
                 Assert.True(derivationVM.Enabled);
                 derivationVM.Enabled = false;
-                derivationVM = (DerivationSchemeViewModel)Assert.IsType<ViewResult>(controller.AddDerivationScheme(user.StoreId, derivationVM, "BTC").GetAwaiter().GetResult()).Model;
+                Assert.IsType<RedirectToActionResult>(controller.AddDerivationScheme(user.StoreId, derivationVM, "BTC").GetAwaiter().GetResult());
+                derivationVM = (DerivationSchemeViewModel)Assert.IsType<ViewResult>(controller.AddDerivationScheme(user.StoreId, "BTC")).Model;
                 // Confirmation
                 controller.AddDerivationScheme(user.StoreId, derivationVM, "BTC").GetAwaiter().GetResult();
                 Assert.False(derivationVM.Enabled);

BTCPayServer/BTCPayServer.csproj

@@ -2,7 +2,7 @@
   <PropertyGroup>
     <OutputType>Exe</OutputType>
     <TargetFramework>netcoreapp2.1</TargetFramework>
-		<Version>1.0.2.82</Version>
+		<Version>1.0.2.90</Version>
     <NoWarn>NU1701,CA1816,CA1308,CA1810,CA2208</NoWarn>
   </PropertyGroup>
   <ItemGroup>
@@ -116,6 +116,9 @@
 	</ItemGroup>
 
 	<ItemGroup>
+	  <Content Update="Views\Server\SSHService.cshtml">
+	    <Pack>$(IncludeRazorContentInPack)</Pack>
+	  </Content>
 	  <Content Update="Views\Server\LNDGRPCServices.cshtml">
 	    <Pack>$(IncludeRazorContentInPack)</Pack>
 	  </Content>

BTCPayServer/Configuration/BTCPayServerOptions.cs

@@ -11,6 +11,9 @@ using StandardConfiguration;
 using Microsoft.Extensions.Configuration;
 using NBXplorer;
 using BTCPayServer.Payments.Lightning;
+using Renci.SshNet;
+using NBitcoin.DataEncoders;
+using BTCPayServer.SSH;
 
 namespace BTCPayServer.Configuration
 {
@@ -117,6 +120,45 @@ namespace BTCPayServer.Configuration
             BundleJsCss = conf.GetOrDefault<bool>("bundlejscss", true);
             ExternalUrl = conf.GetOrDefault<Uri>("externalurl", null);
 
+            var sshSettings = ParseSSHConfiguration(conf);
+            if ((!string.IsNullOrEmpty(sshSettings.Password) || !string.IsNullOrEmpty(sshSettings.KeyFile)) && !string.IsNullOrEmpty(sshSettings.Server))
+            {
+                int waitTime = 0;
+                while (!string.IsNullOrEmpty(sshSettings.KeyFile) && !File.Exists(sshSettings.KeyFile))
+                {
+                    if(waitTime++ < 5)
+                        System.Threading.Thread.Sleep(1000);
+                    else
+                        throw new ConfigException($"sshkeyfile does not exist");
+                }
+                    
+                if (sshSettings.Port > ushort.MaxValue ||
+                   sshSettings.Port < ushort.MinValue)
+                    throw new ConfigException($"ssh port is invalid");
+                if (!string.IsNullOrEmpty(sshSettings.Password) && !string.IsNullOrEmpty(sshSettings.KeyFile))
+                    throw new ConfigException($"sshpassword or sshkeyfile should be provided, but not both");
+                try
+                {
+                    sshSettings.CreateConnectionInfo();
+                }
+                catch
+                {
+                    throw new ConfigException($"sshkeyfilepassword is invalid");
+                }
+                SSHSettings = sshSettings;
+            }
+
+            var fingerPrints = conf.GetOrDefault<string>("sshtrustedfingerprints", "");
+            if (!string.IsNullOrEmpty(fingerPrints))
+            {
+                foreach (var fingerprint in fingerPrints.Split(';', StringSplitOptions.RemoveEmptyEntries))
+                {
+                    if (!SSHFingerprint.TryParse(fingerprint, out var f))
+                        throw new ConfigException($"Invalid ssh fingerprint format {fingerprint}");
+                    TrustedFingerprints.Add(f);
+                }
+            }
+
             RootPath = conf.GetOrDefault<string>("rootpath", "/");
             if (!RootPath.StartsWith("/", StringComparison.InvariantCultureIgnoreCase))
                 RootPath = "/" + RootPath;
@@ -124,6 +166,53 @@ namespace BTCPayServer.Configuration
             if (old != null)
                 throw new ConfigException($"internallightningnode should not be used anymore, use btclightning instead");
         }
+
+        private SSHSettings ParseSSHConfiguration(IConfiguration conf)
+        {
+            var externalUrl = conf.GetOrDefault<Uri>("externalurl", null);
+            var settings = new SSHSettings();
+            settings.Server = conf.GetOrDefault<string>("sshconnection", null);
+            if (settings.Server != null)
+            {
+                var parts = settings.Server.Split(':');
+                if (parts.Length == 2 && int.TryParse(parts[1], out int port))
+                {
+                    settings.Port = port;
+                    settings.Server = parts[0];
+                }
+                else
+                {
+                    settings.Port = 22;
+                }
+
+                parts = settings.Server.Split('@');
+                if (parts.Length == 2)
+                {
+                    settings.Username = parts[0];
+                    settings.Server = parts[1];
+                }
+                else
+                {
+                    settings.Username = "root";
+                }
+            }
+            else if (externalUrl != null)
+            {
+                settings.Port = 22;
+                settings.Username = "root";
+                settings.Server = externalUrl.DnsSafeHost;
+            }
+            settings.Password = conf.GetOrDefault<string>("sshpassword", "");
+            settings.KeyFile = conf.GetOrDefault<string>("sshkeyfile", "");
+            settings.KeyFilePassword = conf.GetOrDefault<string>("sshkeyfilepassword", "");
+            return settings;
+        }
+
+        internal bool IsTrustedFingerprint(byte[] fingerPrint, byte[] hostKey)
+        {
+            return TrustedFingerprints.Any(f => f.Match(fingerPrint, hostKey));
+        }
+
         public string RootPath { get; set; }
         public Dictionary<string, LightningConnectionString> InternalLightningByCryptoCode { get; set; } = new Dictionary<string, LightningConnectionString>();
         public ExternalServices ExternalServicesByCryptoCode { get; set; } = new ExternalServices();
@@ -144,6 +233,12 @@ namespace BTCPayServer.Configuration
             get;
             set;
         }
+        public List<SSHFingerprint> TrustedFingerprints { get; set; } = new List<SSHFingerprint>();
+        public SSHSettings SSHSettings
+        {
+            get;
+            set;
+        }
 
         internal string GetRootUri()
         {
@@ -154,7 +249,7 @@ namespace BTCPayServer.Configuration
             return builder.ToString();
         }
     }
-    
+
     public class ExternalServices : MultiValueDictionary<string, ExternalService>
     {
         public IEnumerable<T> GetServices<T>(string cryptoCode) where T : ExternalService

BTCPayServer/Configuration/DefaultConfiguration.cs

@@ -34,6 +34,11 @@ namespace BTCPayServer.Configuration
             app.Option("--externalurl", $"The expected external URL of this service, to use if BTCPay is behind a reverse proxy (default: empty, use the incoming HTTP request to figure out)", CommandOptionType.SingleValue);
             app.Option("--bundlejscss", $"Bundle JavaScript and CSS files for better performance (default: true)", CommandOptionType.SingleValue);
             app.Option("--rootpath", "The root path in the URL to access BTCPay (default: /)", CommandOptionType.SingleValue);
+            app.Option("--sshconnection", "SSH server to manage BTCPay under the form user@server:port (default: root@externalhost or empty)", CommandOptionType.SingleValue);
+            app.Option("--sshpassword", "SSH password to manage BTCPay (default: empty)", CommandOptionType.SingleValue);
+            app.Option("--sshkeyfile", "SSH private key file to manage BTCPay (default: empty)", CommandOptionType.SingleValue);
+            app.Option("--sshkeyfilepassword", "Password of the SSH keyfile (default: empty)", CommandOptionType.SingleValue);
+            app.Option("--sshtrustedfingerprints", "SSH Host public key fingerprint or sha256 (default: empty, it will allow untrusted connections)", CommandOptionType.SingleValue);
             foreach (var network in provider.GetAll())
             {
                 var crypto = network.CryptoCode.ToLowerInvariant();

BTCPayServer/Controllers/AccountController.cs

@@ -17,6 +17,7 @@ using BTCPayServer.Services.Mails;
 using BTCPayServer.Services.Stores;
 using BTCPayServer.Logging;
 using BTCPayServer.Security;
+using System.Globalization;
 
 namespace BTCPayServer.Controllers
 {
@@ -236,23 +237,25 @@ namespace BTCPayServer.Controllers
 
         [HttpGet]
         [AllowAnonymous]
-        public async Task<IActionResult> Register(string returnUrl = null)
+        public async Task<IActionResult> Register(string returnUrl = null, bool logon = true)
         {
             var policies = await _SettingsRepository.GetSettingAsync<PoliciesSettings>() ?? new PoliciesSettings();
-            if (policies.LockSubscription)
+            if (policies.LockSubscription && !User.IsInRole(Roles.ServerAdmin))
                 return RedirectToAction(nameof(HomeController.Index), "Home");
             ViewData["ReturnUrl"] = returnUrl;
+            ViewData["Logon"] = logon.ToString(CultureInfo.InvariantCulture).ToLowerInvariant();
             return View();
         }
 
         [HttpPost]
         [AllowAnonymous]
         [ValidateAntiForgeryToken]
-        public async Task<IActionResult> Register(RegisterViewModel model, string returnUrl = null)
+        public async Task<IActionResult> Register(RegisterViewModel model, string returnUrl = null, bool logon = true)
         {
             ViewData["ReturnUrl"] = returnUrl;
+            ViewData["Logon"] = logon.ToString(CultureInfo.InvariantCulture).ToLowerInvariant();
             var policies = await _SettingsRepository.GetSettingAsync<PoliciesSettings>() ?? new PoliciesSettings();
-            if (policies.LockSubscription)
+            if (policies.LockSubscription && !User.IsInRole(Roles.ServerAdmin))
                 return RedirectToAction(nameof(HomeController.Index), "Home");
             if (ModelState.IsValid)
             {
@@ -274,7 +277,8 @@ namespace BTCPayServer.Controllers
                     await _emailSender.SendEmailConfirmationAsync(model.Email, callbackUrl);
                     if (!policies.RequiresConfirmedEmail)
                     {
-                        await _signInManager.SignInAsync(user, isPersistent: false);
+                        if(logon)
+                            await _signInManager.SignInAsync(user, isPersistent: false);
                         return RedirectToLocal(returnUrl);
                     }
                     else

BTCPayServer/Controllers/AppsController.PointOfSale.cs

@@ -19,6 +19,7 @@ using BTCPayServer.Services.Rates;
 using System.Globalization;
 using System.Text;
 using System.Text.Encodings.Web;
+using Microsoft.AspNetCore.Cors;
 
 namespace BTCPayServer.Controllers
 {
@@ -208,6 +209,7 @@ namespace BTCPayServer.Controllers
         [HttpPost]
         [Route("{appId}/pos")]
         [IgnoreAntiforgeryToken]
+        [EnableCors(CorsPolicies.All)]
         public async Task<IActionResult> ViewPointOfSale(string appId,
                                                         decimal amount,
                                                         string email,

BTCPayServer/Controllers/InvoiceController.UI.cs

@@ -231,7 +231,11 @@ namespace BTCPayServer.Controllers
             {
                 if (!isDefaultCrypto)
                     return null;
-                var paymentMethodTemp = invoice.GetPaymentMethods(_NetworkProvider).First();
+                var paymentMethodTemp = invoice.GetPaymentMethods(_NetworkProvider)
+                                               .Where(c=> paymentMethodId.CryptoCode == c.GetId().CryptoCode)
+                                               .FirstOrDefault();
+                if (paymentMethodTemp == null)
+                    paymentMethodTemp = invoice.GetPaymentMethods(_NetworkProvider).First();
                 network = paymentMethodTemp.Network;
                 paymentMethodId = paymentMethodTemp.GetId();
                 paymentMethodIdStr = paymentMethodId.ToString();

BTCPayServer/Controllers/ServerController.cs

@@ -32,6 +32,7 @@ namespace BTCPayServer.Controllers
     {
         private UserManager<ApplicationUser> _UserManager;
         SettingsRepository _SettingsRepository;
+        private readonly NBXplorerDashboard _dashBoard;
         private BTCPayRateProviderFactory _RateProviderFactory;
         private StoreRepository _StoreRepository;
         LightningConfigurationProvider _LnConfigProvider;
@@ -41,12 +42,14 @@ namespace BTCPayServer.Controllers
             Configuration.BTCPayServerOptions options,
             BTCPayRateProviderFactory rateProviderFactory,
             SettingsRepository settingsRepository,
+            NBXplorerDashboard dashBoard,
             LightningConfigurationProvider lnConfigProvider,
             Services.Stores.StoreRepository storeRepository)
         {
             _Options = options;
             _UserManager = userManager;
             _SettingsRepository = settingsRepository;
+            _dashBoard = dashBoard;
             _RateProviderFactory = rateProviderFactory;
             _StoreRepository = storeRepository;
             _LnConfigProvider = lnConfigProvider;
@@ -157,6 +160,7 @@ namespace BTCPayServer.Controllers
             MaintenanceViewModel vm = new MaintenanceViewModel();
             vm.UserName = "btcpayserver";
             vm.DNSDomain = this.Request.Host.Host;
+            vm.SetConfiguredSSH(_Options.SSHSettings);
             if (IPAddress.TryParse(vm.DNSDomain, out var unused))
                 vm.DNSDomain = null;
             return View(vm);
@@ -167,6 +171,7 @@ namespace BTCPayServer.Controllers
         {
             if (!ModelState.IsValid)
                 return View(vm);
+            vm.SetConfiguredSSH(_Options.SSHSettings);
             if (command == "changedomain")
             {
                 if (string.IsNullOrWhiteSpace(vm.DNSDomain))
@@ -253,7 +258,31 @@ namespace BTCPayServer.Controllers
         private IActionResult RunSSH(MaintenanceViewModel vm, string ssh)
         {
             ssh = $"sudo bash -c '. /etc/profile.d/btcpay-env.sh && nohup {ssh} > /dev/null 2>&1 & disown'";
-            var sshClient = vm.CreateSSHClient(this.Request.Host.Host);
+            var sshClient = _Options.SSHSettings == null ? vm.CreateSSHClient(this.Request.Host.Host)
+                                                         : new SshClient(_Options.SSHSettings.CreateConnectionInfo());
+
+            if (_Options.TrustedFingerprints.Count != 0)
+            {
+                sshClient.HostKeyReceived += (object sender, Renci.SshNet.Common.HostKeyEventArgs e) =>
+                {
+                    if (_Options.TrustedFingerprints.Count == 0)
+                    {
+                        Logs.Configuration.LogWarning($"SSH host fingerprint for {e.HostKeyName} is untrusted, start BTCPay with -sshtrustedfingerprints \"{Encoders.Hex.EncodeData(e.FingerPrint)}\"");
+                        e.CanTrust = true; // Not a typo, we want the connection to succeed with a warning
+                    }
+                    else
+                    {
+                        e.CanTrust = _Options.IsTrustedFingerprint(e.FingerPrint, e.HostKey);
+                        if(!e.CanTrust)
+                            Logs.Configuration.LogError($"SSH host fingerprint for {e.HostKeyName} is untrusted, start BTCPay with -sshtrustedfingerprints \"{Encoders.Hex.EncodeData(e.FingerPrint)}\"");
+                    }
+                };
+            }
+            else
+            {
+
+            }
+
             try
             {
                 sshClient.Connect();
@@ -401,12 +430,18 @@ namespace BTCPayServer.Controllers
                     }
                 }
             }
+            result.HasSSH = _Options.SSHSettings != null;
             return View(result);
         }
 
         [Route("server/services/lnd-grpc/{cryptoCode}/{index}")]
         public IActionResult LNDGRPCServices(string cryptoCode, int index, uint? nonce)
         {
+            if (!_dashBoard.IsFullySynched(cryptoCode, out var unusud))
+            {
+                StatusMessage = $"Error: {cryptoCode} is not fully synched";
+                return RedirectToAction(nameof(Services));
+            }
             var external = GetExternalLNDConnectionString(cryptoCode, index);
             if (external == null)
                 return NotFound();
@@ -462,6 +497,7 @@ namespace BTCPayServer.Controllers
             LightningConfigurations confs = new LightningConfigurations();
             LightningConfiguration conf = new LightningConfiguration();
             conf.Type = "grpc";
+            conf.ChainType = _Options.NetworkType.ToString();
             conf.CryptoCode = cryptoCode;
             conf.Host = external.BaseUri.DnsSafeHost;
             conf.Port = external.BaseUri.Port;
@@ -498,6 +534,27 @@ namespace BTCPayServer.Controllers
             return connectionString;
         }
 
+        [Route("server/services/ssh")]
+        public IActionResult SSHService(bool downloadKeyFile = false)
+        {
+            var settings = _Options.SSHSettings;
+            if (settings == null)
+                return NotFound();
+            if (downloadKeyFile)
+            {
+                if (!System.IO.File.Exists(settings.KeyFile))
+                    return NotFound();
+                return File(System.IO.File.ReadAllBytes(settings.KeyFile), "application/octet-stream", "id_rsa");
+            }
+            SSHServiceViewModel vm = new SSHServiceViewModel();
+            string port = settings.Port == 22 ? "" : $" -p {settings.Port}";
+            vm.CommandLine = $"ssh {settings.Username}@{settings.Server}{port}";
+            vm.Password = settings.Password;
+            vm.KeyFilePassword = settings.KeyFilePassword;
+            vm.HasKeyFile = !string.IsNullOrEmpty(settings.KeyFile);
+            return View(vm);
+        }
+
         [Route("server/theme")]
         public async Task<IActionResult> Theme()
         {

BTCPayServer/Controllers/StoresController.BTCLike.cs

@@ -79,6 +79,11 @@ namespace BTCPayServer.Controllers
             }
 
             PaymentMethodId paymentMethodId = new PaymentMethodId(network.CryptoCode, PaymentTypes.BTCLike);
+            var exisingStrategy = store.GetSupportedPaymentMethods(_NetworkProvider)
+                                       .Where(c => c.PaymentId == paymentMethodId)
+                                       .OfType<DerivationStrategy>()
+                                       .Select(c => c.DerivationStrategyBase.ToString())
+                                       .FirstOrDefault();
             DerivationStrategy strategy = null;
             try
             {
@@ -94,9 +99,33 @@ namespace BTCPayServer.Controllers
                 vm.Confirmation = false;
                 return View(vm);
             }
-            if (!vm.Confirmation && strategy != null)
-                return ShowAddresses(vm, strategy);
-            if (vm.Confirmation && !string.IsNullOrWhiteSpace(vm.HintAddress))
+
+            var showAddress = (vm.Confirmation && !string.IsNullOrWhiteSpace(vm.HintAddress)) || // Testing hint address
+                              (!vm.Confirmation && strategy != null && exisingStrategy != strategy.DerivationStrategyBase.ToString());  // Checking addresses after setting xpub
+
+            if (!showAddress)
+            {
+                try
+                {
+                    if (strategy != null)
+                        await wallet.TrackAsync(strategy.DerivationStrategyBase);
+                    store.SetSupportedPaymentMethod(paymentMethodId, strategy);
+
+                    var storeBlob = store.GetStoreBlob();
+                    storeBlob.SetExcluded(paymentMethodId, !vm.Enabled);
+                    store.SetStoreBlob(storeBlob);
+                }
+                catch
+                {
+                    ModelState.AddModelError(nameof(vm.DerivationScheme), "Invalid Derivation Scheme");
+                    return View(vm);
+                }
+
+                await _Repo.UpdateStore(store);
+                StatusMessage = $"Derivation scheme for {network.CryptoCode} has been modified.";
+                return RedirectToAction(nameof(UpdateStore), new { storeId = storeId });
+            }
+            else if (!string.IsNullOrEmpty(vm.HintAddress))
             {
                 BitcoinAddress address = null;
                 try
@@ -122,30 +151,8 @@ namespace BTCPayServer.Controllers
                 vm.StatusMessage = "Address successfully found, please verify that the rest is correct and click on \"Confirm\"";
                 ModelState.Remove(nameof(vm.HintAddress));
                 ModelState.Remove(nameof(vm.DerivationScheme));
-                return ShowAddresses(vm, strategy);
-            }
-            else
-            {
-                try
-                {
-                    if (strategy != null)
-                        await wallet.TrackAsync(strategy.DerivationStrategyBase);
-                    store.SetSupportedPaymentMethod(paymentMethodId, strategy);
-
-                    var storeBlob = store.GetStoreBlob();
-                    storeBlob.SetExcluded(paymentMethodId, !vm.Enabled);
-                    store.SetStoreBlob(storeBlob);
-                }
-                catch
-                {
-                    ModelState.AddModelError(nameof(vm.DerivationScheme), "Invalid Derivation Scheme");
-                    return View(vm);
-                }
-
-                await _Repo.UpdateStore(store);
-                StatusMessage = $"Derivation scheme for {network.CryptoCode} has been modified.";
-                return RedirectToAction(nameof(UpdateStore), new { storeId = storeId });
             }
+            return ShowAddresses(vm, strategy);
         }
 
         private IActionResult ShowAddresses(DerivationSchemeViewModel vm, DerivationStrategy strategy)

BTCPayServer/Controllers/StoresController.LightningLike.cs

@@ -135,14 +135,14 @@ namespace BTCPayServer.Controllers
                     CryptoCode = paymentMethodId.CryptoCode
                 };
                 paymentMethod.SetLightningUrl(connectionString);
-                var storeBlob = store.GetStoreBlob();
-                storeBlob.SetExcluded(paymentMethod.PaymentId , !vm.Enabled);
-                store.SetStoreBlob(storeBlob);
             }
 
             switch (command)
             {
                 case "save":
+                    var storeBlob = store.GetStoreBlob();
+                    storeBlob.SetExcluded(paymentMethodId, !vm.Enabled);
+                    store.SetStoreBlob(storeBlob);
                     store.SetSupportedPaymentMethod(paymentMethodId, paymentMethod);
                     await _Repo.UpdateStore(store);
                     StatusMessage = $"Lightning node modified ({network.CryptoCode})";

BTCPayServer/Controllers/StoresController.cs

@@ -179,7 +179,7 @@ namespace BTCPayServer.Controllers
             var storeBlob = StoreData.GetStoreBlob();
             var vm = new RatesViewModel();
             vm.SetExchangeRates(GetSupportedExchanges(), storeBlob.PreferredExchange ?? CoinAverageRateProvider.CoinAverageName);
-            vm.RateMultiplier = (double)storeBlob.GetRateMultiplier();
+            vm.Spread = (double)(storeBlob.Spread * 100m);
             vm.Script = storeBlob.GetRateRules(_NetworkProvider).ToString();
             vm.DefaultScript = storeBlob.GetDefaultRateRules(_NetworkProvider).ToString();
             vm.AvailableExchanges = GetSupportedExchanges();
@@ -204,7 +204,7 @@ namespace BTCPayServer.Controllers
             model.AvailableExchanges = GetSupportedExchanges();
 
             blob.PreferredExchange = model.PreferredExchange;
-            blob.SetRateMultiplier(model.RateMultiplier);
+            blob.Spread = (decimal)model.Spread / 100.0m;
 
             if (!model.ShowScripting)
             {

BTCPayServer/Controllers/WalletsController.cs

@@ -150,7 +150,7 @@ namespace BTCPayServer.Controllers
 
             var storeData = store.GetStoreBlob();
             var rateRules = store.GetStoreBlob().GetRateRules(_NetworkProvider);
-            rateRules.GlobalMultiplier = 1.0m;
+            rateRules.Spread = 0.0m;
             var currencyPair = new Rating.CurrencyPair(paymentMethod.PaymentId.CryptoCode, GetCurrencyCode(storeData.DefaultLang) ?? "USD");
             WalletModel model = new WalletModel();
             model.ServerUrl = GetLedgerWebsocketUrl(this.HttpContext, walletId.CryptoCode, paymentMethod.DerivationStrategyBase);

BTCPayServer/CorsPolicies.cs

@@ -0,0 +1,12 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace BTCPayServer
+{
+    public static class CorsPolicies
+    {
+        public const string All = "BTCPAY_ALL";
+    }
+}

BTCPayServer/Data/StoreData.cs

@@ -281,23 +281,9 @@ namespace BTCPayServer.Data
             set;
         }
 
-        public void SetRateMultiplier(double rate)
-        {
-            RateRules = new List<RateRule_Obsolete>();
-            RateRules.Add(new RateRule_Obsolete() { Multiplier = rate });
-        }
-        public decimal GetRateMultiplier()
-        {
-            decimal rate = 1.0m;
-            if (RateRules == null || RateRules.Count == 0)
-                return rate;
-            foreach (var rule in RateRules)
-            {
-                rate = rule.Apply(null, rate);
-            }
-            return rate;
-        }
+        public decimal Spread { get; set; } = 0.0m;
 
+        [Obsolete]
         public List<RateRule_Obsolete> RateRules { get; set; } = new List<RateRule_Obsolete>();
         public string PreferredExchange { get; set; }
 
@@ -344,7 +330,7 @@ namespace BTCPayServer.Data
             }
             else
             {
-                rules.GlobalMultiplier = GetRateMultiplier();
+                rules.Spread = Spread;
                 return rules;
             }
         }
@@ -370,7 +356,7 @@ namespace BTCPayServer.Data
             builder.AppendLine($"X_X = {preferredExchange}(X_X);");
 
             BTCPayServer.Rating.RateRules.TryParse(builder.ToString(), out var rules);
-            rules.GlobalMultiplier = GetRateMultiplier();
+            rules.Spread = Spread;
             return rules;
         }
 

BTCPayServer/Extensions.cs

@@ -137,6 +137,23 @@ namespace BTCPayServer
                         request.PathBase.ToUriComponent());
         }
 
+        public static string GetCurrentUrl(this HttpRequest request)
+        {
+            return string.Concat(
+                        request.Scheme,
+                        "://",
+                        request.Host.ToUriComponent(),
+                        request.PathBase.ToUriComponent(),
+                        request.Path.ToUriComponent());
+        }
+
+        public static string GetCurrentPath(this HttpRequest request)
+        {
+            return string.Concat(
+                        request.PathBase.ToUriComponent(),
+                        request.Path.ToUriComponent());
+        }
+
         public static string GetAbsoluteUri(this HttpRequest request, string redirectUrl)
         {
             bool isRelative =

BTCPayServer/HostedServices/CheckConfigurationHostedService.cs

@@ -0,0 +1,76 @@
+using System;
+using Microsoft.Extensions.Logging;
+using Microsoft.EntityFrameworkCore;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using BTCPayServer.Data;
+using BTCPayServer.Services;
+using Microsoft.Extensions.Hosting;
+using System.Threading;
+using BTCPayServer.Configuration;
+using BTCPayServer.Logging;
+using NBitcoin.DataEncoders;
+
+namespace BTCPayServer.HostedServices
+{
+    public class CheckConfigurationHostedService : IHostedService
+    {
+        private readonly BTCPayServerOptions _options;
+
+        public CheckConfigurationHostedService(BTCPayServerOptions options)
+        {
+            _options = options;
+        }
+
+        public Task StartAsync(CancellationToken cancellationToken)
+        {
+            new Thread(() =>
+            {
+                if (_options.SSHSettings != null)
+                {
+                    Logs.Configuration.LogInformation($"SSH settings detected, testing connection to {_options.SSHSettings.Username}@{_options.SSHSettings.Server} on port {_options.SSHSettings.Port} ...");
+                    var connection = new Renci.SshNet.SshClient(_options.SSHSettings.CreateConnectionInfo());
+                    connection.HostKeyReceived += (object sender, Renci.SshNet.Common.HostKeyEventArgs e) =>
+                    {
+                        e.CanTrust = true;
+                        if (!_options.IsTrustedFingerprint(e.FingerPrint, e.HostKey))
+                        {
+                            Logs.Configuration.LogWarning($"SSH host fingerprint for {e.HostKeyName} is untrusted, start BTCPay with -sshtrustedfingerprints \"{Encoders.Hex.EncodeData(e.FingerPrint)}\"");
+                        }
+                    };
+                    try
+                    {
+                        connection.Connect();
+                        connection.Disconnect();
+                        Logs.Configuration.LogInformation($"SSH connection succeeded");
+                    }
+                    catch (Renci.SshNet.Common.SshAuthenticationException)
+                    {
+                        Logs.Configuration.LogWarning($"SSH invalid credentials");
+                    }
+                    catch (Exception ex)
+                    {
+                        var message = ex.Message;
+                        if (ex is AggregateException aggrEx && aggrEx.InnerException?.Message != null)
+                        {
+                            message = aggrEx.InnerException.Message;
+                        }
+                        Logs.Configuration.LogWarning($"SSH connection issue: {message}");
+                    }
+                    finally
+                    {
+                        connection.Dispose();
+                    }
+                }
+            })
+            { IsBackground = true }.Start();
+            return Task.CompletedTask;
+        }
+
+        public Task StopAsync(CancellationToken cancellationToken)
+        {
+            return Task.CompletedTask;
+        }
+    }
+}

BTCPayServer/HostedServices/MigratorHostedService.cs

@@ -53,6 +53,12 @@ namespace BTCPayServer.HostedServices
                     settings.UnreachableStoreCheck = true;
                     await _Settings.UpdateSetting(settings);
                 }
+                if (!settings.ConvertMultiplierToSpread)
+                {
+                    await ConvertMultiplierToSpread();
+                    settings.ConvertMultiplierToSpread = true;
+                    await _Settings.UpdateSetting(settings);
+                }
             }
             catch (Exception ex)
             {
@@ -61,6 +67,31 @@ namespace BTCPayServer.HostedServices
             }
         }
 
+        private async Task ConvertMultiplierToSpread()
+        {
+            using (var ctx = _DBContextFactory.CreateContext())
+            {
+                foreach (var store in await ctx.Stores.ToArrayAsync())
+                {
+                    var blob = store.GetStoreBlob();
+#pragma warning disable CS0612 // Type or member is obsolete
+                    decimal multiplier = 1.0m;
+                    if (blob.RateRules != null && blob.RateRules.Count != 0)
+                    {
+                        foreach (var rule in blob.RateRules)
+                        {
+                            multiplier = rule.Apply(null, multiplier);
+                        }
+                    }
+                    blob.RateRules = null;
+                    blob.Spread = Math.Min(1.0m, Math.Max(0m, -(multiplier - 1.0m)));
+                    store.SetStoreBlob(blob);
+#pragma warning restore CS0612 // Type or member is obsolete
+                }
+                await ctx.SaveChangesAsync();
+            }
+        }
+
         private Task UnreachableStoreCheck()
         {
             return _StoreRepository.CleanUnreachableStores();

BTCPayServer/Hosting/BTCPayServerServices.cs

@@ -118,6 +118,8 @@ namespace BTCPayServer.Hosting
             services.AddSingleton<Payments.IPaymentMethodHandler<DerivationStrategy>, Payments.Bitcoin.BitcoinLikePaymentHandler>();
             services.AddSingleton<IHostedService, Payments.Bitcoin.NBXplorerListener>();
 
+            services.AddSingleton<IHostedService, HostedServices.CheckConfigurationHostedService>();
+
             services.AddSingleton<Payments.IPaymentMethodHandler<Payments.Lightning.LightningSupportedPaymentMethod>, Payments.Lightning.LightningLikePaymentHandler>();
             services.AddSingleton<IHostedService, Payments.Lightning.LightningListener>();
 
@@ -157,6 +159,10 @@ namespace BTCPayServer.Hosting
                 return bundle;
             });
 
+            services.AddCors(options=> 
+            {
+                options.AddPolicy(CorsPolicies.All, p=>p.AllowAnyHeader().AllowAnyMethod().AllowAnyOrigin());
+            });
             return services;
         }
 

BTCPayServer/Hosting/Startup.cs

@@ -155,6 +155,7 @@ namespace BTCPayServer.Hosting
                 app.UseDeveloperExceptionPage();
             }
 
+            app.UseCors();
             app.UsePayServer();
             app.UseStaticFiles();
             app.UseAuthentication();

BTCPayServer/Models/ServerViewModels/MaintenanceViewModel.cs

@@ -3,12 +3,15 @@ using System.Collections.Generic;
 using System.ComponentModel.DataAnnotations;
 using System.Linq;
 using System.Threading.Tasks;
+using BTCPayServer.Configuration;
+using BTCPayServer.SSH;
 using Renci.SshNet;
 
 namespace BTCPayServer.Models.ServerViewModels
 {
     public class MaintenanceViewModel
     {
+        public bool ExposedSSH { get; set; }
         [Required]
         public string UserName { get; set; }
         [Required]
@@ -20,5 +23,15 @@ namespace BTCPayServer.Models.ServerViewModels
         {
             return new SshClient(host, UserName, Password);
         }
+
+        internal void SetConfiguredSSH(SSHSettings settings)
+        {
+            if(settings != null)
+            {
+                ExposedSSH = true;
+                UserName = "unknown";
+                Password = "unknown";
+            }
+        }
     }
 }

BTCPayServer/Models/ServerViewModels/SSHServiceViewModel.cs

@@ -0,0 +1,15 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+
+namespace BTCPayServer.Models.ServerViewModels
+{
+    public class SSHServiceViewModel
+    {
+        public string CommandLine { get; set; }
+        public string Password { get; set; }
+        public string KeyFilePassword { get; set; }
+        public bool HasKeyFile { get; set; }
+    }
+}

BTCPayServer/Models/ServerViewModels/ServicesViewModel.cs

@@ -14,5 +14,6 @@ namespace BTCPayServer.Models.ServerViewModels
             public int Index { get; set; }
         }
         public List<LNDServiceViewModel> LNDServices { get; set; } = new List<LNDServiceViewModel>();
+        public bool HasSSH { get; set; }
     }
 }

BTCPayServer/Models/StoreViewModels/RatesViewModel.cs

@@ -44,9 +44,9 @@ namespace BTCPayServer.Models.StoreViewModels
         public string ScriptTest { get; set; }
         public CoinAverageExchange[] AvailableExchanges { get; set; }
 
-        [Display(Name = "Multiply the rate by... (Setting to 1.01 would apply a discount of 1% to the purchase)")]
-        [Range(0.01, 10.0)]
-        public double RateMultiplier
+        [Display(Name = "Add a spread on exchange rate of ... %")]
+        [Range(0.0, 100.0)]
+        public double Spread
         {
             get;
             set;

BTCPayServer/Properties/launchSettings.json

@@ -3,18 +3,18 @@
     "Docker-Regtest": {
       "commandName": "Project",
       "launchBrowser": true,
-        "environmentVariables": {
-            "BTCPAY_NETWORK": "regtest",
-            "BTCPAY_LTCEXPLORERURL": "http://127.0.0.1:32838/",
-            "BTCPAY_BTCEXPLORERURL": "http://127.0.0.1:32838/",
-            "ASPNETCORE_ENVIRONMENT": "Development",
-            "BTCPAY_CHAINS": "btc,ltc",
-            "BTCPAY_BTCLIGHTNING": "type=charge;server=http://127.0.0.1:54938/;api-token=foiewnccewuify",
-            "BTCPAY_BTCEXTERNALLNDGRPC": "type=lnd-grpc;server=https://lnd:lnd@127.0.0.1:53280/;allowinsecure=true",
-            "BTCPAY_POSTGRES": "User ID=postgres;Host=127.0.0.1;Port=39372;Database=btcpayserver",
-            "BTCPAY_BUNDLEJSCSS": "false"
-        },
+      "environmentVariables": {
+        "BTCPAY_NETWORK": "regtest",
+        "BTCPAY_BUNDLEJSCSS": "false",
+        "BTCPAY_LTCEXPLORERURL": "http://127.0.0.1:32838/",
+        "BTCPAY_BTCLIGHTNING": "type=charge;server=http://127.0.0.1:54938/;api-token=foiewnccewuify",
+        "BTCPAY_BTCEXTERNALLNDGRPC": "type=lnd-grpc;server=https://lnd:lnd@127.0.0.1:53280/;allowinsecure=true",
+        "BTCPAY_BTCEXPLORERURL": "http://127.0.0.1:32838/",
+        "ASPNETCORE_ENVIRONMENT": "Development",
+        "BTCPAY_CHAINS": "btc,ltc",
+        "BTCPAY_POSTGRES": "User ID=postgres;Host=127.0.0.1;Port=39372;Database=btcpayserver"
+      },
       "applicationUrl": "http://127.0.0.1:14142/"
     }
   }
-}
+}

BTCPayServer/Rating/RateRules.cs

@@ -99,7 +99,20 @@ namespace BTCPayServer.Rating
         SyntaxNode root;
         RuleList ruleList;
 
-        public decimal GlobalMultiplier { get; set; } = 1.0m;
+        decimal _Spread;
+        public decimal Spread
+        {
+            get
+            {
+                return _Spread;
+            }
+            set
+            {
+                if (value > 1.0m || value < 0.0m)
+                    throw new ArgumentOutOfRangeException(paramName: nameof(value), message: "The spread should be between 0 and 1");
+                _Spread = value;
+            }
+        }
 
         RateRules(SyntaxNode root)
         {
@@ -136,9 +149,9 @@ namespace BTCPayServer.Rating
             if (currencyPair.Left == currencyPair.Right)
                 return new RateRule(this, currencyPair, CreateExpression("1.0"));
             var candidate = FindBestCandidate(currencyPair);
-            if (GlobalMultiplier != decimal.One)
+            if (Spread != decimal.Zero)
             {
-                candidate = CreateExpression($"({candidate}) * {GlobalMultiplier.ToString(CultureInfo.InvariantCulture)}");
+                candidate = CreateExpression($"({candidate}) * ({(1.0m - Spread).ToString(CultureInfo.InvariantCulture)}, {(1.0m + Spread).ToString(CultureInfo.InvariantCulture)})");
             }
             return new RateRule(this, currencyPair, candidate);
         }
@@ -257,7 +270,7 @@ namespace BTCPayServer.Rating
                 {
                     case SyntaxKind.UnaryMinusExpression:
                         var v = Values.Pop();
-                        if(v.Bid == v.Ask)
+                        if (v.Bid == v.Ask)
                         {
                             Values.Push(-v);
                         }
@@ -338,7 +351,7 @@ namespace BTCPayServer.Rating
             {
                 _TupleValues = new Stack<decimal>();
                 base.VisitTupleExpression(node);
-                if(_TupleValues.Count != 2)
+                if (_TupleValues.Count != 2)
                 {
                     Errors.Add(RateRulesErrors.MissingArgument);
                 }

BTCPayServer/SSH/SSHFingerprint.cs

@@ -0,0 +1,98 @@
+using System;
+using System.Collections.Generic;
+using System.Globalization;
+using System.Linq;
+using System.Text;
+using System.Threading.Tasks;
+using NBitcoin;
+using NBitcoin.DataEncoders;
+
+namespace BTCPayServer.SSH
+{
+    public class SSHFingerprint
+    {
+        public static bool TryParse(string str, out SSHFingerprint fingerPrint)
+        {
+            if (str == null)
+                throw new ArgumentNullException(nameof(str));
+            fingerPrint = null;
+            str = str.Trim();
+            try
+            {
+                var shortFingerprint = str.Replace(":", "", StringComparison.OrdinalIgnoreCase);
+                if (HexEncoder.IsWellFormed(shortFingerprint))
+                {
+                    var hash = Encoders.Hex.DecodeData(shortFingerprint);
+                    if (hash.Length == 16)
+                    {
+                        fingerPrint = new SSHFingerprint(hash);
+                        return true;
+                    }
+                    return false;
+                }
+            }
+            catch
+            {
+            }
+
+            if (str.StartsWith("SHA256:", StringComparison.OrdinalIgnoreCase))
+                str = str.Substring("SHA256:".Length).Trim();
+            if (str.Contains(':', StringComparison.OrdinalIgnoreCase))
+                return false;
+            if (!str.EndsWith('='))
+                str = str + "=";
+            try
+            {
+                var hash = Encoders.Base64.DecodeData(str);
+                if (hash.Length == 32)
+                {
+                    fingerPrint = new SSHFingerprint(hash);
+                    return true;
+                }
+            }
+            catch
+            {
+            }
+            return false;
+        }
+
+        public SSHFingerprint(byte[] hash)
+        {
+            if (hash.Length == 16)
+            {
+                _ShortFingerprint = hash;
+                _Original = string.Join(':', hash.Select(b => b.ToString("x2", CultureInfo.InvariantCulture))
+                    .ToArray());
+            }
+            else if (hash.Length == 32)
+            {
+                _FullHash = hash;
+                _Original = "SHA256:" + Encoders.Base64.EncodeData(hash);
+                if (_Original.EndsWith("=", StringComparison.OrdinalIgnoreCase))
+                    _Original = _Original.Substring(0, _Original.Length - 1);
+            }
+            else
+                throw new ArgumentException(paramName:nameof(hash), message: "Invalid length, expected 16 or 32");
+        }
+
+        byte[] _ShortFingerprint;
+        byte[] _FullHash;
+
+        public bool Match(byte[] shortFingerprint, byte[] hostKey)
+        {
+            if (shortFingerprint == null)
+                throw new ArgumentNullException(nameof(shortFingerprint));
+            if (hostKey == null)
+                throw new ArgumentNullException(nameof(hostKey));
+            if (_ShortFingerprint != null)
+                return Utils.ArrayEqual(shortFingerprint, _ShortFingerprint);
+            return Utils.ArrayEqual(_FullHash, NBitcoin.Crypto.Hashes.SHA256(hostKey));
+        }
+
+        string _Original;
+        public override string ToString()
+        {
+            return _Original;
+        }
+    }
+}

BTCPayServer/SSH/SSHSettings.cs

@@ -0,0 +1,31 @@
+using System;
+using System.Collections.Generic;
+using System.Linq;
+using System.Threading.Tasks;
+using Microsoft.Extensions.Configuration;
+using Renci.SshNet;
+
+namespace BTCPayServer.SSH
+{
+    public class SSHSettings
+    {
+        public string Server { get; set; }
+        public int Port { get; set; } = 22;
+        public string KeyFile { get; set; }
+        public string KeyFilePassword { get; set; }
+        public string Username { get; set; }
+        public string Password { get; set; }
+
+        public ConnectionInfo CreateConnectionInfo()
+        {
+            if (!string.IsNullOrEmpty(KeyFile))
+            {
+                return new ConnectionInfo(Server, Port, Username, new[] { new PrivateKeyAuthenticationMethod(Username, new PrivateKeyFile(KeyFile, KeyFilePassword)) });
+            }
+            else
+            {
+                return new ConnectionInfo(Server, Port, Username, new[] { new PasswordAuthenticationMethod(Username, Password) });
+            }
+        }
+    }
+}

BTCPayServer/Services/LightningConfigurationProvider.cs

@@ -43,6 +43,7 @@ namespace BTCPayServer.Services
     }
     public class LightningConfiguration
     {
+        public string ChainType { get; set; }
         public string Type { get; set; }
         public string CryptoCode { get; set; }
         public string Host { get; set; }

BTCPayServer/Services/MigrationSettings.cs

@@ -9,5 +9,6 @@ namespace BTCPayServer.Services
     {
         public bool UnreachableStoreCheck { get; set; }
         public bool DeprecatedLightningConnectionStringCheck { get; set; }
+        public bool ConvertMultiplierToSpread { get; set; }
     }
 }

BTCPayServer/Views/Account/Register.cshtml

@@ -16,7 +16,7 @@
                 <hr class="primary">
             </div>
             <div class="col-md-4">
-                <form asp-route-returnUrl="@ViewData["ReturnUrl"]" method="post">
+                <form asp-route-returnUrl="@ViewData["ReturnUrl"]" asp-route-logon="@ViewData["Logon"]" method="post">
                     <h4>Create a new account.</h4>
                     <hr />
                     <div asp-validation-summary="All" class="text-danger"></div>

BTCPayServer/Views/Apps/UpdatePointOfSale.cshtml

@@ -56,8 +56,7 @@
                         <p><strong>Never</strong> trust anything but <code>id</code>, <strong>ignore</strong> the other fields completely, an attacker can spoof those, they are present only for backward compatibility reason:</p>
                         <p>
                             <ul>
-                                <li><strong>Build the invoice's url by yourself</strong> do not trust the <code>url</code> field, this can be spoofed to use attacker's server.</li>
-                                <li>Send a <code>GET</code> request to the invoice's url with <code>Content-Type: application/json</code></li>
+                                <li>Send a <code>GET</code> request to <code>https://btcpay.example.com/invoices/{invoiceId}</code> with <code>Content-Type: application/json</code></li>
                                 <li>Verify that the <code>orderId</code> is from your backend, that the <code>price</code> is correct and that <code>status</code> is either <code>confirmed</code> or <code>complete</code></li>
                                 <li>You can then ship your order</li>
                             </ul>

BTCPayServer/Views/Invoice/Checkout-Body.cshtml

@@ -33,45 +33,52 @@
     </div>
 </div>
 <div class="order-details">
-    @if (Model.AvailableCryptos.Count > 1)
-    {
-        <div class="currency-selection">
-            <div class="single-item-order__left">
-                <div style="font-weight: 600;">
-                    {{$t("Pay with")}}
-                </div>
-            </div>
-            <div class="single-item-order__right">
-                @if (Model.AvailableCryptos.Count > 1)
-                {
-                    <div class="payment__currencies" onclick="openPaymentMethodDialog()">
-                        <img v-bind:src="srvModel.cryptoImage" />
-                        <span class="clickable_underline">{{srvModel.paymentMethodName}} ({{srvModel.cryptoCode}})</span>
-                        <span v-show="srvModel.isLightning">&#9889;</span>
-                        <span class="clickable_indicator fa fa-angle-right"></span>
-                    </div>
-                    <div id="vexPopupDialog">
-                        <ul class="vexmenu">
-                            @foreach (var crypto in Model.AvailableCryptos)
-                            {
-                                <li class="vexmenuitem">
-                                    <a href="@crypto.Link" onclick="return closePaymentMethodDialog('@crypto.PaymentMethodId');">
-                                        <img alt="@crypto.PaymentMethodName" src="@crypto.CryptoImage" />
-                                        @crypto.PaymentMethodName
-                                        @(crypto.IsLightning ? Html.Raw("&#9889;") : null)
-                                        <span>@crypto.CryptoCode</span>
-                                    </a>
-                                </li>
-                            }
-                        </ul>
-                    </div>
-                }
-                <div class="payment__spinner">
-                    <partial name="Checkout-Spinner" />
-                </div>
+    <div class="currency-selection">
+        <div class="single-item-order__left">
+            <div style="font-weight: 600;">
+                {{$t("Pay with")}}
             </div>
         </div>
-    }
+        <div class="single-item-order__right">
+            @if (Model.AvailableCryptos.Count > 1)
+            {
+                <div class="payment__currencies cursorPointer" onclick="openPaymentMethodDialog()">
+                    <img v-bind:src="srvModel.cryptoImage" />
+                    <span class="clickable_underline">{{srvModel.paymentMethodName}} ({{srvModel.cryptoCode}})</span>
+                    <span v-show="srvModel.isLightning">&#9889;</span>
+                    <span class="clickable_indicator fa fa-angle-right"></span>
+                </div>
+                <div id="vexPopupDialog">
+                    <ul class="vexmenu">
+                        @foreach (var crypto in Model.AvailableCryptos)
+                        {
+                            <li class="vexmenuitem">
+                                <a href="@crypto.Link" onclick="return closePaymentMethodDialog('@crypto.PaymentMethodId');">
+                                    <img alt="@crypto.PaymentMethodName" src="@crypto.CryptoImage" />
+                                    @crypto.PaymentMethodName
+                                    @(crypto.IsLightning ? Html.Raw("&#9889;") : null)
+                                    <span>@crypto.CryptoCode</span>
+                                </a>
+                            </li>
+                        }
+                    </ul>
+                </div>
+            }
+            else
+            {
+                <div class="payment__currencies">
+                    <img v-bind:src="srvModel.cryptoImage" />
+                    <span>{{srvModel.paymentMethodName}} ({{srvModel.cryptoCode}})</span>
+                    <span v-show="srvModel.isLightning">&#9889;</span>
+                </div>
+
+            }
+            <div class="payment__spinner">
+                <partial name="Checkout-Spinner" />
+            </div>
+        </div>
+    </div>
+
     <div class="single-item-order buyerTotalLine">
         <div class="single-item-order__left">
             <div class="single-item-order__left__name">

BTCPayServer/Views/Server/ListUsers.cshtml

@@ -7,7 +7,7 @@
 <h4>@ViewData["Title"]</h4>
 <partial name="_StatusMessage" for="StatusMessage" />
 
-
+<a asp-controller="Account" asp-action="Register" asp-route-returnUrl="@Context.Request.GetCurrentPath()" asp-route-logon="false" class="btn btn-primary" role="button"><span class="fa fa-plus"></span> Create a new user</a>
 <table class="table table-sm table-responsive-md">
     <thead>
         <tr>

BTCPayServer/Views/Server/Maintenance.cshtml

@@ -11,22 +11,31 @@
 
     <div class="col-md-8">
         <form method="post">
-            <div class="form-group">
-                <h5>SSH Settings</h5>
-                <span>For changing any settings, you need to enter your SSH credentials:</span>
-            </div>
-            <div class="form-group">
-                <label asp-for="UserName"></label>
-                <input asp-for="UserName" class="form-control" />
-                <span asp-validation-for="UserName" class="text-danger"></span>
-            </div>
+            @if(!Model.ExposedSSH)
+            {
+                <div class="form-group">
+                    <h5>SSH Settings</h5>
+                    <span>For changing any settings, you need to enter your SSH credentials:</span>
+                </div>
+                <div class="form-group">
+                    <label asp-for="UserName"></label>
+                    <input asp-for="UserName" class="form-control" />
+                    <span asp-validation-for="UserName" class="text-danger"></span>
+                </div>
 
-            <div class="form-group">
-                <label asp-for="Password"></label>
-                <input asp-for="Password" class="form-control" />
+                <div class="form-group">
+                    <label asp-for="Password"></label>
+                    <input asp-for="Password" class="form-control" />
+                    <span asp-validation-for="Password" class="text-danger"></span>
+                </div>
+            }
+            else
+            {
+                <input asp-for="Password" type="hidden" class="form-control" />
                 <span asp-validation-for="Password" class="text-danger"></span>
-            </div>
-
+                <input asp-for="UserName" type="hidden" class="form-control" />
+                <span asp-validation-for="UserName" class="text-danger"></span>
+            }
             <div class="form-group">
                 <h5>Change domain name</h5>
                 <span>You can change the domain name of your server by following <a href="https://github.com/btcpayserver/btcpayserver-doc/blob/master/ChangeDomain.md">this guide</a></span>

BTCPayServer/Views/Server/SSHService.cshtml

@@ -0,0 +1,50 @@
+@model BTCPayServer.Models.ServerViewModels.SSHServiceViewModel
+@{
+    ViewData.SetActivePageAndTitle(ServerNavPages.Services);
+}
+
+
+<h4>SSH settings</h4>
+<partial name="_StatusMessage" for="@TempData["StatusMessage"]" />
+<div class="row">
+    <div class="col-md-6">
+        <div asp-validation-summary="All" class="text-danger"></div>
+    </div>
+</div>
+
+<div class="row">
+
+    <div class="col-md-8">
+        <div class="form-group">
+            <p>
+                <span>SSH servies are used by the maintenance operations<br /></span>
+            </p>
+        </div>
+
+
+        <div class="form-group">
+            <div class="form-group">
+                <label asp-for="CommandLine"></label>
+                <input asp-for="CommandLine" readonly class="form-control" />
+            </div>
+            @if(!string.IsNullOrEmpty(Model.Password))
+            {
+                <div class="form-group">
+                    <label asp-for="Password"></label>
+                    <input asp-for="Password" readonly class="form-control" />
+                </div>
+            }
+            @if(!string.IsNullOrEmpty(Model.KeyFilePassword))
+            {
+                <div class="form-group">
+                    <label asp-for="KeyFilePassword"></label>
+                    <input asp-for="KeyFilePassword" readonly class="form-control" />
+                </div>
+            }
+            @if(Model.HasKeyFile)
+            {
+                <a class="btn btn-primary form-control" asp-action="SSHService" asp-route-downloadKeyFile="true">Download Key File</a>
+            }
+        </div>
+    </div>
+</div>

BTCPayServer/Views/Server/Services.cshtml

@@ -5,7 +5,7 @@
 
 
 <h4>@ViewData["Title"]</h4>
-<partial name="_StatusMessage" for="@TempData["StatusMessage"]" />
+<partial name="_StatusMessage" for="@TempData["TempDataProperty-StatusMessage"]" />
 <div class="row">
     <div class="col-md-6">
         <div asp-validation-summary="All" class="text-danger"></div>
@@ -41,6 +41,16 @@
                                 </td>
                             </tr>
                         }
+                        @if(Model.HasSSH)
+                        {
+                            <tr>
+                                <td>None</td>
+                                <td>SSH</td>
+                                <td style="text-align:right">
+                                    <a asp-action="SSHService">See information</a>
+                                </td>
+                            </tr>
+                        }
                     </tbody>
                 </table>
             </div>

BTCPayServer/Views/Stores/Rates.cshtml

@@ -93,18 +93,22 @@
                             X_X = gdax(X_X);
                         </code>
                     </pre>
-                    <p>With <code>DOGE_USD</code> will be expanded to <code>bittrex(DOGE_BTC) * gdax(BTC_USD)</code>. And <code>DOGE_CAD</code> will be expanded to <code>bittrex(DOGE_BTC) * quadrigacx(BTC_CAD)</code>. <br />
-                    However, we advise you to write it that way to increase coverage so that <code>DOGE_BTC</code> is also supported:</p>
+                    <p>
+                        With <code>DOGE_USD</code> will be expanded to <code>bittrex(DOGE_BTC) * gdax(BTC_USD)</code>. And <code>DOGE_CAD</code> will be expanded to <code>bittrex(DOGE_BTC) * quadrigacx(BTC_CAD)</code>. <br />
+                        However, we advise you to write it that way to increase coverage so that <code>DOGE_BTC</code> is also supported:
+                    </p>
                     <pre>
-                        <code>
+                    <code>
                             DOGE_X = DOGE_BTC * BTC_X
                             DOGE_BTC = bittrex(DOGE_BTC)
                             X_CAD = quadrigacx(X_CAD);
                             X_X = gdax(X_X);
                         </code>
                     </pre>
-                    <p>It is worth noting that the inverses of those pairs are automatically supported as well.<br />
-                    It means that the rule <code>USD_DOGE = 1 / DOGE_USD</code> implicitely exists.</p>
+                    <p>
+                        It is worth noting that the inverses of those pairs are automatically supported as well.<br />
+                        It means that the rule <code>USD_DOGE = 1 / DOGE_USD</code> implicitely exists.
+                    </p>
 
                 </div>
                 <div class="form-group">
@@ -132,9 +136,14 @@
                 </div>
             }
             <div class="form-group">
-                <label asp-for="RateMultiplier"></label>
-                <input asp-for="RateMultiplier" class="form-control" />
-                <span asp-validation-for="RateMultiplier" class="text-danger"></span>
+                <label asp-for="Spread"></label>
+                <div class="input-group">
+                    <input asp-for="Spread" class="form-control" />
+                    <div class="input-group-prepend">
+                        <span class="input-group-text">%</span>
+                    </div>
+                </div>
+                <span asp-validation-for="Spread" class="text-danger"></span>
             </div>
             <div class="form-group">
                 <h5>Testing</h5>

BTCPayServer/Views/Stores/UpdateStore.cshtml

@@ -5,6 +5,21 @@
     ViewData.AddActivePage(BTCPayServer.Views.Stores.StoreNavPages.Index);
 }
 
+
+
+<style type="text/css">
+    .smMaxWidth {
+        max-width: 150px;
+    }
+
+    @@media (min-width: 768px) {
+        .smMaxWidth {
+            max-width: 300px;
+        }
+    }
+</style>
+
+
 <h4>@ViewData["Title"]</h4>
 <partial name="_StatusMessage" for="@TempData["TempDataProperty-StatusMessage"]" />
 
@@ -70,8 +85,8 @@
                         <tr>
                             <th>Crypto</th>
                             <th>Derivation Scheme</th>
-                            <th>Enabled</th>
-                            <th style="text-align:right">Actions</th>
+                            <th style="text-align:center;">Enabled</th>
+                            <th style="text-align:right;">Actions</th>
                         </tr>
                     </thead>
                     <tbody>
@@ -79,9 +94,16 @@
                         {
                             <tr>
                                 <td>@scheme.Crypto</td>
-                                <td style="max-width:300px;overflow:hidden;">@scheme.Value</td>
-                                <td>
-                                        @(scheme.Enabled ? "Yes" : "No")
+                                <td class="smMaxWidth text-truncate">@scheme.Value</td>
+                                <td style="text-align:center;">
+                                    @if(scheme.Enabled)
+                                    {
+                                        <span class="fa fa-check"></span>
+                                    }
+                                    else
+                                    {
+                                        <span class="fa fa-times"></span>
+                                    }
                                 </td>
                                 <td style="text-align:right">
                                     @if(!string.IsNullOrWhiteSpace(scheme.Value))
@@ -110,7 +132,7 @@
                             <tr>
                                 <th>Crypto</th>
                                 <th>Address</th>
-                                <th>Enabled</th>
+                                <th style="text-align:center;">Enabled</th>
                                 <th style="text-align:right">Actions</th>
                             </tr>
                         </thead>
@@ -119,9 +141,16 @@
                             {
                                 <tr>
                                     <td>@scheme.CryptoCode</td>
-                                    <td>@scheme.Address</td>
-                                    <td>
-                                        @(scheme.Enabled ? "Yes" : "No")
+                                    <td class="smMaxWidth text-truncate">@scheme.Address</td>
+                                    <td style="text-align:center;">
+                                        @if(scheme.Enabled)
+                                        {
+                                            <span class="fa fa-check"></span>
+                                        }
+                                        else
+                                        {
+                                            <span class="fa fa-times"></span>
+                                        }
                                     </td>
                                     <td style="text-align:right"><a asp-action="AddLightningNode" asp-route-cryptoCode="@scheme.CryptoCode">Modify</a></td>
                                 </tr>

BTCPayServer/wwwroot/checkout/css/vex-extrastyles.css

@@ -40,9 +40,12 @@
     display: none;
 }
 
+.cursorPointer {
+    cursor: pointer;
+}
+
 .payment__currencies {
     font-size: 14px;
-    cursor: pointer;
 }
 
     .payment__currencies img {