CKBunker

CKBunker turns a Coldcard hardware wallet into an automated signing service. Normally a Coldcard requires a person to physically approve each transaction; in HSM mode it signs according to a policy defined in advance, with nobody pressing a button.

The safety comes from that policy being locked. Before HSM mode starts you set the rules — spending limits, velocity controls governing how much may leave over a period, which destinations are allowed, which users may authorize what, and what gets logged. Once HSM mode is active those rules cannot be altered, so compromising the machine running CKBunker does not let an attacker rewrite them.

Day-to-day operation happens through a web interface: upload a partially signed transaction to be signed, and optionally broadcast the result. Users enroll by scanning a TOTP code onto the Coldcard, with password options as well, so a signature can be made to require a second factor from a specific person.

It can publish itself as a Tor hidden service using the Tor daemon already running on your MyNode, making the signer reachable remotely without opening a port. CKBunker encrypts its own settings, and the key protecting them — including the onion service private key — is held in the Coldcard's storage locker inside its secure element.