Full node interface for standard banking software via FinTS

[ghost]

A full node is the equivalent of a private bank.

It has different bank accounts depending on which wallets or programs are used on the node, e.g:
1 wallet bitcoin core
1 wallet lightning lnd onchain
1 wallet lightning lnd offchain
1 wallet btcpayserver internal
etc.

Especially for merchants easy bookkeeping is essential if they want to use bitcoin payments, but also as a private user it´s easy to get lost with different wallets and balances.

BTCPay server has options to export invoices (manual actions most bookkeepers charge expensive) or to connect to QuickBooks Online, which is quite nice:
https://docs.btcpayserver.org/Accounting/

But there are lots of different home banking and accounting programs (e.g. https://shop.lexware.de/persoenliche-finanzen or https://shop.lexware.de/buchhaltung). In Europe all of these use a standard protocol FinTS to connect to the bank and accounts, manage transfers, get balances etc.:
https://en.wikipedia.org/wiki/FinTS
https://www.hbci-zka.de/spec/4_1.htm (sorry it´s in german)

To give merchants, bookkeepers and normal end users the same user experience like they have with their ordinary bank accounts they should be able to connect to their private bank (full node) via FinTS get a list of accounts and be able to import all movements from these accounts into their finance software (sending transfers would be even better, but we leave that for later).

So what is needed is a server side integration of FinTS (normally done by banks), which connects to the different application like bitcoin core, BTCPay or lnd.

On the client side there are different open source projects of the FinTS protocol available:
https://python-fints.readthedocs.io/en/latest/
https://github.com/mrklintscher/libfintx
https://github.com/nemiah/phpFinTS

But on the server side there doesn´t seem to be an open source solutions, only commercial ones like this: https://subsembly.com/fints-server.html

Something like this could be implemented maybe in a hackathon?
Supported applications on the server side could be added step by step, maybe starting with lnd and btcpayserver?

A FinTS protocol interface for full nodes would be huge step to better integrate Bitcoin/Lightning in standard finance software.

[rootzoll]

It would really be great to be able to manage your node within your standard bookkeeping software just like a normal foreign currency account by supporting the FinTS. For merchants that want to make Bitcoin on Lightning a normal part of their business - such interfaces are highly needed, so that accounting can be automated as much as possible.

@INSG2020 I marked this issue for the next lightning hacksprint in june. Will you be available to mentor on this project? And is anybody interested in attaching a bounty to this?

[rootzoll]

I would recommend to implement such a FinTS interface on a node wrapper API like Lighter https://gitlab.com/inbitcoin/lighter or as a plugin on LNbits https://github.com/lnbits/lnbits ... this way it can be used with all major Lightning implementations - not just LND and not just for the RaspiBlitz - but happy to have it on the Blitz first :)

[ghost]

Yes, it´s possible to mentor the project on a project management level, less on technical details :-)
Which date is the hacksprint in June?

How does the bounty work? Please send a quick DM on Twitter, also regarding other questions, which are off-topic here.

[ghost]

Compatibility with https://github.com/BlueWallet/LndHub would be also nice.
But maybe in a later version, because this adds the complexity of the private bank having different "customers" with different accounts, not only different bank accounts (wallets).

[ghost]

On the client side open source programs like the following might be used for testing:
https://gnucash.org/index.phtml?lang=en_US
https://www.aquamaniac.de/rdm/
https://kmymoney.org/

There are also 30 days free versions of the programs from Lexware, which are widely used, for example: FinanzManager
https://shop.lexware.de/persoenliche-finanzen

[drmartinberger]

@rootzoll interested in this bounty!

[rootzoll]

OK :) So this challenge/bounty is for now reserved for @drmartinberger.

If someone else is also interested - please contact me (write on this issue) and coordinate.

[drmartinberger]

Latest version of FinTS protocol is 4.1.

Mentioned open source client libraries support the following FinTS versions:

1. python-fints supports 3.0 only.
2. libfintx is build for 3.0.
3. phpFinTS aims to be compatible with 3.0

Question: What protocol version should be supported by Raspiblitz? 4.1 seems not to be wide-spread.

Additionally researched open source client libraries:

4. hbci4java (Java)
5. fints4k (Kotlin)
6. fints (Typescript)

Additionally researched open source server libraries:

7. FueliFinTS seems to implement the server part (Java)
8. Open-Fin-TS-JS-Client has a demo/test FinTS server (Javascript)

[rootzoll]

Question: What protocol version should be supported by Raspiblitz? 4.1 seems not to be wide-spread.

Basically what gets accepted by a common bookkeeping program - if 3.0 still wortks thats fine.
Lastinfo I got is that https://shop.lexware.de/persoenliche-finanzen has a 30 day free trial - but havent checked.

[rootzoll]

@INSG2020 are you still around to help on testing?

[rootzoll]

• create install script for v1.9.0 of this FinTS impelementaton: https://github.com/drmartinberger/FueliFinTS (see branch lnbits-via-mt940)

[rootzoll]

First version of install script done - still TODOS:

• use master branch when lnbits-via-mt940 is merged
• db is droped on every install/update - is that a problem?
• is nginx needed for HTTP-proxy/HTTPS? Removed for now

[rootzoll]

Thanks for the tutorial: https://medium.com/@martin.berger/a-tutorial-to-connect-gnucash-to-ln-fints-of-your-bitcoin-lightning-node-50ee803e9101

On testing on raspiblitz I could see that the SSL service was running on port 3111 - but but when i tried to connect with GNU cash I got the error:

10:30:59 TLS Handshake Error: -54 (Error in the pull function.)
10:30:59 Could not connect to server

Checking the /home/fints/log/fuelifints.log I could see:

2023-03-23 09:29:38,892 INFO  [Thread-1] [] net.petafuel.fuelifints.communication.BlockingSocketListenerThread - SocketServer listening on port 3110
2023-03-23 09:29:40,326 INFO  [Thread-2] [] net.petafuel.fuelifints.communication.BlockingSSLRequestListenerThread - SSLServer listening on port 3111
2023-03-23 09:29:40,328 INFO  [Thread-2] [] net.petafuel.fuelifints.communication.BlockingSSLRequestListenerThread - Accepting new incoming connection
2023-03-23 09:29:58,626 INFO  [Thread-4] [] net.petafuel.fuelifints.communication.BlockingSocketListenerThread - New socket connection thread
2023-03-23 09:29:58,713 ERROR [Thread-4] [] net.petafuel.fuelifints.communication.BlockingSocketListenerThread - Exception parsing responseSize as integer
java.lang.NumberFormatException: For input string: "�d`ø¶þ_X¿�¸"
	at java.lang.NumberFormatException.forInputString(NumberFormatException.java:65) ~[?:?]
	at java.lang.Integer.parseInt(Integer.java:638) ~[?:?]
	at java.lang.Integer.parseInt(Integer.java:770) ~[?:?]
	at net.petafuel.fuelifints.communication.BlockingSocketListenerThread$SocketRequestHandler.handle(BlockingSocketListenerThread.java:125) [fints-fat.jar:?]
	at net.petafuel.fuelifints.communication.BlockingSocketListenerThread$SocketRequestHandler.access$300(BlockingSocketListenerThread.java:90) [fints-fat.jar:?]
	at net.petafuel.fuelifints.communication.BlockingSocketListenerThread$SocketWorkerThread.run(BlockingSocketListenerThread.java:71) [fints-fat.jar:?]
2023-03-23 09:29:58,747 ERROR [Thread-4] [] net.petafuel.fuelifints.FinTSServer - UncaughtException in Thread[Thread-4,5,main]
java.lang.StringIndexOutOfBoundsException: offset 23, count 3, length 22
	at java.lang.String.checkBoundsOffCount(String.java:3304) ~[?:?]
	at java.lang.String.<init>(String.java:505) ~[?:?]
	at net.petafuel.fuelifints.FinTSVersionSwitch.checkFinTSVersion(FinTSVersionSwitch.java:42) ~[fints-fat.jar:?]
	at net.petafuel.fuelifints.FinTSVersionSwitch.selectController(FinTSVersionSwitch.java:24) ~[fints-fat.jar:?]
	at net.petafuel.fuelifints.communication.BlockingSocketListenerThread$SocketRequestHandler.handle(BlockingSocketListenerThread.java:133) ~[fints-fat.jar:?]
	at net.petafuel.fuelifints.communication.BlockingSocketListenerThread$SocketRequestHandler.access$300(BlockingSocketListenerThread.java:90) ~[fints-fat.jar:?]
	at net.petafuel.fuelifints.communication.BlockingSocketListenerThread$SocketWorkerThread.run(BlockingSocketListenerThread.java:71) ~[fints-fat.jar:?]

@drmartinberger any idea what is still missing?

[rootzoll]

I suspect SSL/Proxy problem: have you tried openssl s_client -connect :3111?

admin@192.168.178.61:~ ₿ openssl s_client -connect 127.0.0.1:3111
CONNECTED(00000003)
Can't use SSL_get_servername
depth=0 C = BZ, ST = world, L = world, O = raspiblitz, OU = IT, CN = raspiblitz
verify error:num=18:self signed certificate
verify return:1
depth=0 C = BZ, ST = world, L = world, O = raspiblitz, OU = IT, CN = raspiblitz
verify return:1
---
Certificate chain
 0 s:C = BZ, ST = world, L = world, O = raspiblitz, OU = IT, CN = raspiblitz
   i:C = BZ, ST = world, L = world, O = raspiblitz, OU = IT, CN = raspiblitz
---
Server certificate
-----BEGIN CERTIFICATE-----
MIIDZzCCAk+gAwIBAgIEVwt1izANBgkqhkiG9w0BAQsFADBkMQswCQYDVQQGEwJC
WjEOMAwGA1UECBMFd29ybGQxDjAMBgNVBAcTBXdvcmxkMRMwEQYDVQQKEwpyYXNw
aWJsaXR6MQswCQYDVQQLEwJJVDETMBEGA1UEAxMKcmFzcGlibGl0ejAeFw0yMzAz
MTAxMDMyMTNaFw0yMzA2MDgxMDMyMTNaMGQxCzAJBgNVBAYTAkJaMQ4wDAYDVQQI
EwV3b3JsZDEOMAwGA1UEBxMFd29ybGQxEzARBgNVBAoTCnJhc3BpYmxpdHoxCzAJ
BgNVBAsTAklUMRMwEQYDVQQDEwpyYXNwaWJsaXR6MIIBIjANBgkqhkiG9w0BAQEF
AAOCAQ8AMIIBCgKCAQEAh6APyHOUsJK5YA+y2VldbDQEvKnRHzXI4naXCp7vlob6
amsJyWkHQLBwh9rseVAdxcnNpxTyoeX5h5REOQ6WwWqYYsWS8ZNzDNJEy3zs4BQc
igUYj/d+yy+fkVlHRJNBX2/VTZ4GenOvxg/+QBgUZ5A+Ry0n9HbuOv2JdI9e4m70
rV7EVgyJX56T+g3rW4gxnsdJGpkOtB2vgHtYZrWw/3ISZP3HImvAvwJRWfBgCy1a
KF0yo3F7X74iUYsiUQdhEzGj4X7/SEzSc/kPzaZt8aM8pfxF6pQWKNWstMufohhT
pd3IxhCQwLRZjSLtHqECh9KlO0e6N5WYERcMOqITHwIDAQABoyEwHzAdBgNVHQ4E
FgQU3JNYx+v3JAaGYTZaNX37FfaBhs8wDQYJKoZIhvcNAQELBQADggEBAH4DsnVO
+QFG7/Dpp5hnam2XG9Otgd66MduwZyegA4qO6XmK0ZP+3uH5zX1ZATklHYAGL6es
8aEt4A8HGQnlHRTl5w8h8HjjU5Khsd5qlhlNMl22ESduMzisVQzW+c37h7lttSF8
hHTKQ5UQ0yzMAzEJbg/uG3lw7W+MMQntKCt+TYey+xIutVYydeQFZ56CLiRgl5U2
P0nxb8UP4ZhXTmQcTBKMbbmVPzl2jno9cU6oTUO7jqSTptf9nXn6BzbyY/oYs8W3
xmKykU69v+9O2k7PtN67UaeuLPXAFEaiJ/wPDksvZluzIPtqkz8piij5iYKJ13+l
0S1liw9cHiMNiiw=
-----END CERTIFICATE-----
subject=C = BZ, ST = world, L = world, O = raspiblitz, OU = IT, CN = raspiblitz

issuer=C = BZ, ST = world, L = world, O = raspiblitz, OU = IT, CN = raspiblitz

---
No client certificate CA names sent
Peer signing digest: SHA256
Peer signature type: RSA-PSS
Server Temp Key: X25519, 253 bits
---
SSL handshake has read 1385 bytes and written 416 bytes
Verification error: self signed certificate
---
New, TLSv1.2, Cipher is ECDHE-RSA-AES128-SHA256
Server public key is 2048 bit
Secure Renegotiation IS supported
Compression: NONE
Expansion: NONE
No ALPN negotiated
SSL-Session:
    Protocol  : TLSv1.2
    Cipher    : ECDHE-RSA-AES128-SHA256
    Session-ID: 553A45A799B21CF4591620B71DA903FDC94CDB27C80019E4FF5770D9C7C8094F
    Session-ID-ctx:
    Master-Key: BF954CA52EBBCFE449258C7927E951315E6EC0F71D4344EF31E6B03CA6267D2F7FD4447E38B060E000CDB4A9FBCDAC15
    PSK identity: None
    PSK identity hint: None
    SRP username: None
    Start Time: 1679578991
    Timeout   : 7200 (sec)
    Verify return code: 18 (self signed certificate)
    Extended master secret: yes
---
closed

[rootzoll]

We will ship the FinTS install script with RaspiBlitz v1.9.0 as it is at the moment. It always pulls the latest code on install from the fints github repo - so that can be used as a after-v1.9.0 release patch mechanism.

Just as an TODO I push this to milestone v1.10.0 for now to recheck if there is anything still to fix on the install script and to improve documentation with next release.