Add e2e tests and CI/CD pipeline with nigiri integration

Add comprehensive end-to-end testing:
- E2E test covering full L402 payment flow
- Test verifies proxy strips Authorization headers before upstream
- Tests use real LND backend via nigiri
- CLN tests skipped pending nigiri REST API fix

Improve nigiri network setup script:
- Add CI environment detection for --ci flag
- Wait for chopsticks (faucet) service readiness
- Wait for LND credentials to be written to volumes
- Generate and save CLN rune for test access

Set up GitHub Actions CI/CD:
- Create separate e2e.yml workflow for integration tests
- Install nigiri and start test network in CI
- Add tmate for interactive debugging on failures
- Keep main go.yml pipeline fast (unit tests + linting only)

This allows fast feedback on unit tests while running slower
e2e tests in parallel.

Signed-off-by: Gustavo Chain <me@qustavo.cc>

Author: qustavo

.github/workflows/e2e.yml

@@ -0,0 +1,34 @@
+# End-to-end tests using nigiri for Lightning Network integration
+
+name: E2E Tests
+
+on:
+  push:
+    branches: [ "main" ]
+  pull_request:
+    branches: [ "main" ]
+
+jobs:
+
+  e2e:
+    runs-on: ubuntu-latest
+    steps:
+    - uses: actions/checkout@v4
+
+    - name: Set up Go
+      uses: actions/setup-go@v4
+      with:
+        go-version: '1.24'
+
+    - name: Install nigiri
+      run: curl https://getnigiri.vulpem.com | bash
+
+    - name: Start test network
+      run: bash scripts/network.sh start
+
+    - name: Run e2e tests
+      run: go test -v ./tests/...
+
+    - name: Stop test network
+      if: always()
+      run: bash scripts/network.sh stop

pkg/lightning/cln.go

@@ -44,8 +44,6 @@ func NewCLNBackend(cfg CLNConfig) (*CLNBackend, error) {
 			return nil, fmt.Errorf("failed to add CLN cert to pool")
 		}
 		tlsConfig = &tls.Config{RootCAs: pool}
-	} else {
-		tlsConfig = &tls.Config{}
 	}
 
 	client := &http.Client{

scripts/network.sh

@@ -19,7 +19,12 @@ EOF
 
 cmd_start() {
 	echo "Starting l402 integration network..."
-	nigiri start --ln
+	local nigiri_flags="--ln"
+	if [[ -n "${CI:-}" ]]; then
+		nigiri_flags="$nigiri_flags --ci"
+	fi
+
+	nigiri start $nigiri_flags
 	echo
 
 	echo -n "✓ Waiting for LND to become active "
@@ -36,6 +41,15 @@ cmd_start() {
 	done
 	echo
 
+	# Wait for chopsticks (faucet service) to be ready before trying to fund wallets.
+	# Chopsticks may not respond to requests immediately after container starts.
+	echo -n "✓ Waiting for faucet service "
+	until curl -s http://localhost:3000 > /dev/null 2>&1; do
+		sleep 1
+		echo -n "."
+	done
+	echo
+
 	echo -n "✓ Funding onchain wallets"
 	nigiri faucet lnd 1 btc
 	nigiri faucet cln 1 btc
@@ -52,6 +66,22 @@ cmd_start() {
 	done
 	echo
 
+	# Wait for LND certificates and macaroons to be written to volumes.
+	# Containers may report "ready" before files are actually written to the host filesystem,
+	# causing tests to fail when trying to read credentials. This wait ensures files exist.
+	echo -n "✓ Waiting for LND credentials to be written "
+	until [[ -f ~/.nigiri/volumes/lnd/tls.cert && -f ~/.nigiri/volumes/lnd/data/chain/bitcoin/regtest/admin.macaroon ]]; do
+		sleep 1
+		echo -n "."
+	done
+	echo
+
+	# Generate and save CLN rune for authentication in tests
+	echo -n "✓ Generating CLN rune "
+	nigiri cln createrune | jq -r .rune > ~/.nigiri/volumes/lightningd/rune
+	echo
+	echo "✓ Rune saved to ~/.nigiri/volumes/lightningd/rune"
+
 	echo "Opening channels LND <-> CLN"
 	CLN_PUBKEY=$(nigiri cln getinfo | jq -r .id)
 	nigiri lnd connect $CLN_PUBKEY@cln:9935

tests/e2e_test.go

@@ -8,6 +8,7 @@ import (
 	"net/url"
 	"os"
 	"path/filepath"
+	"strings"
 	"testing"
 	"time"
 
@@ -26,9 +27,16 @@ func TestL402Flow(t *testing.T) {
 		t.Skipf("Could not create a LND backend (is nigiri running?): %v", err)
 	}
 
+	// Read CLN rune from file generated by network.sh
+	runeBytes, err := os.ReadFile(rootPath("lightningd/rune"))
+	if err != nil {
+		t.Skipf("Could not read CLN rune (is nigiri running?): %v", err)
+	}
+	rune := strings.TrimSpace(string(runeBytes))
+
 	cln, err := lightning.NewCLNBackend(lightning.CLNConfig{
 		BaseURL: "http://localhost:9835",
-		Rune:    "1MOhfL2S_VjoqFKG-erWqmB9Kt5WU_MyNor6IMa65BQ9MA==",
+		Rune:    rune,
 	})
 	if err != nil {
 		t.Skipf("Could not create a CLN backend (is nigiri running?): %v", err)
@@ -96,9 +104,9 @@ func newTestUpstream(t *testing.T) *httptest.Server {
 }
 
 func newTestProxy(t *testing.T, ln lightning.Backend, upstream string) *httptest.Server {
-	t.Log("Waiting for LND")
+	t.Log("Waiting for Proxy")
 	if err := ln.Wait(t.Context()); err != nil {
-		t.Skipf("Waiting for LND (is nigiri running?): %v", err)
+		t.Skipf("Waiting for proxy (is nigiri running?): %v", err)
 	}
 
 	srvURL, err := url.Parse(upstream)