feat: add OHTTP (NUT-26) support

Add Oblivious HTTP support for enhanced privacy between wallets and mints.

- Add ohttp-gateway crate: OHTTP gateway server that can be embedded in
  cdk-mintd or run standalone, handling BHTTP encapsulation/decapsulation
  and key management
- Add ohttp-client crate: client library for OHTTP key discovery and
  request encapsulation
- Add OHTTP transport layer in cdk wallet for routing requests through
  an OHTTP relay
- Add OhttpSettings (NUT-26) to MintInfo for advertising OHTTP support
- Add MintBuilder::with_ohttp() for configuring OHTTP on the mint side
- Add ohttp_gateway config section to cdk-mintd
- Add --ohttp-relay CLI flag to cdk-cli
- Wire OHTTP gateway router into cdk-mintd when enabled

Author: thesimplekid

Cargo.lock

@@ -60,7 +60,7 @@ pub use nut05::{
     MeltMethodSettings, MeltQuoteCustomRequest, MeltQuoteCustomResponse, MeltRequest,
     QuoteState as MeltQuoteState, Settings as NUT05Settings,
 };
-pub use nut06::{ContactInfo, MintInfo, MintVersion, Nuts};
+pub use nut06::{ContactInfo, MintInfo, MintVersion, Nuts, OhttpSettings};
 pub use nut07::{CheckStateRequest, CheckStateResponse, ProofState, State};
 pub use nut09::{RestoreRequest, RestoreResponse};
 pub use nut10::{

Cargo.lock.msrv

@@ -332,6 +332,10 @@ pub struct Nuts {
     #[serde(rename = "22")]
     #[serde(skip_serializing_if = "Option::is_none")]
     pub nut22: Option<BlindAuthSettings>,
+    /// NUT26 Settings
+    #[serde(rename = "26")]
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub nut26: Option<OhttpSettings>,
     /// NUT29 Settings
     #[serde(default)]
     #[serde(rename = "29")]
@@ -454,6 +458,14 @@ impl Nuts {
         }
     }
 
+    /// Nut26 OHTTP settings
+    pub fn nut26(self, ohttp_settings: OhttpSettings) -> Self {
+        Self {
+            nut26: Some(ohttp_settings),
+            ..self
+        }
+    }
+
     /// Nut29 settings
     pub fn nut29(self, settings: nut29::Settings) -> Self {
         Self {
@@ -485,6 +497,42 @@ impl Nuts {
     }
 }
 
+/// NUT-26 OHTTP Settings
+#[derive(Debug, Clone, PartialEq, Eq, Hash, Serialize, Deserialize)]
+pub struct OhttpSettings {
+    /// Ohttp is supported
+    pub supported: bool,
+    /// OHTTP gateway URL
+    #[serde(skip_serializing_if = "Option::is_none")]
+    pub gateway_url: Option<String>,
+}
+
+impl OhttpSettings {
+    /// Create new [`OhttpSettings`]
+    pub fn new(supported: bool, gateway_url: Option<String>) -> Self {
+        Self {
+            supported,
+            gateway_url,
+        }
+    }
+}
+
+impl MintInfo {
+    /// Check if mint supports OHTTP
+    pub fn supports_ohttp(&self) -> bool {
+        self.nuts
+            .nut26
+            .as_ref()
+            .map(|s| s.supported)
+            .unwrap_or_default()
+    }
+
+    /// Get OHTTP configuration if supported
+    pub fn ohttp_config(&self) -> Option<&OhttpSettings> {
+        self.nuts.nut26.as_ref()
+    }
+}
+
 /// Check state Settings
 #[derive(Debug, Clone, Copy, PartialEq, Eq, Default, Hash, Serialize, Deserialize)]
 pub struct SupportedSettings {

crates/cashu/src/nuts/mod.rs

@@ -17,6 +17,7 @@ sqlcipher = ["cdk-sqlite/sqlcipher"]
 redb = ["dep:cdk-redb"]
 tor = ["cdk/tor"]
 npubcash = ["cdk/npubcash"]
+ohttp = ["cdk/ohttp"]
 
 [dependencies]
 anyhow.workspace = true

crates/cashu/src/nuts/nut06.rs

@@ -571,12 +571,105 @@ cdk-cli burn
 cdk-cli restore <MINT_URL>
 ```
 
+
 ## License
 
 Code is under the [MIT License](../../LICENSE)
 
-## Contribution
+## Contributing
 
 All contributions are welcome.
 
-Unless you explicitly state otherwise, any contribution intentionally submitted for inclusion in the work by you, shall be licensed as above, without any additional terms or conditions.
+### Basic Commands
+
+Check wallet balance:
+```bash
+cdk-cli balance
+```
+
+Send tokens:
+```bash
+cdk-cli send --amount 100
+```
+
+Receive tokens:
+```bash
+cdk-cli receive <TOKEN>
+```
+
+### OHTTP Support
+
+The CLI supports OHTTP (Oblivious HTTP) for enhanced privacy when communicating with mints. OHTTP is enabled by default and automatically used when:
+
+1. The mint supports OHTTP (advertised in mint info)
+2. You provide an OHTTP relay URL using `--ohttp-relay`
+
+#### OHTTP Usage
+
+To use OHTTP, simply provide a relay URL. The CLI will automatically detect if the mint supports OHTTP and configure the connection appropriately:
+
+```bash
+# Use OHTTP relay - CLI auto-detects OHTTP support and gateway URL from mint
+cdk-cli --ohttp-relay https://relay.example.com balance
+cdk-cli --ohttp-relay https://relay.example.com send --amount 100
+cdk-cli --ohttp-relay https://relay.example.com receive <TOKEN>
+```
+
+#### How OHTTP Works in CDK-CLI
+
+1. **Automatic Detection**: When `--ohttp-relay` is provided, the CLI checks if the mint supports OHTTP
+2. **Gateway Discovery**: The gateway URL is automatically discovered from the mint's OHTTP configuration, or falls back to using the mint URL directly
+3. **Transport Setup**: An OHTTP transport layer is created with the mint URL, relay, and gateway
+4. **Privacy Protection**: Requests are routed through the relay, providing privacy from both the relay and the gateway
+
+#### OHTTP Arguments
+
+- `--ohttp-relay <URL>`: OHTTP relay URL for routing requests through a privacy relay
+
+#### Example OHTTP Usage
+
+```bash
+# Standard OHTTP usage with relay
+cdk-cli --ohttp-relay https://ohttp-relay.example.com balance
+
+# All commands work with OHTTP
+cdk-cli --ohttp-relay https://relay.example.com send --amount 100
+cdk-cli --ohttp-relay https://relay.example.com receive <TOKEN>
+cdk-cli --ohttp-relay https://relay.example.com mint --amount 1000
+```
+
+#### OHTTP vs Regular Proxy
+
+OHTTP provides significantly better privacy compared to regular HTTP proxies:
+
+- **Regular proxy:** `cdk-cli --proxy https://proxy.example.com balance`
+  - Proxy can see all request content and your IP
+- **OHTTP relay:** `cdk-cli --ohttp-relay https://relay.example.com balance`
+  - Relay cannot see request content (cryptographically protected)
+  - Gateway cannot see your real IP address
+  - Provides true metadata protection
+
+#### Important Notes
+
+- OHTTP requires the mint to explicitly support it
+- If you specify `--ohttp-relay` but the mint doesn't support OHTTP, you'll see a warning and fall back to regular HTTP
+- Gateway URL is automatically determined from the mint's OHTTP configuration
+- When OHTTP is used, WebSocket subscriptions are automatically disabled in favor of HTTP polling
+
+## Building
+
+### Features
+
+- `ohttp`: Enables OHTTP support for enhanced privacy
+- `sqlcipher`: Enables SQLCipher support for encrypted databases
+- `redb`: Enables redb as an alternative database backend
+
+### Examples
+
+```bash
+# Build with all features
+cargo build --features "ohttp,sqlcipher,redb"
+
+# Build with just OHTTP
+cargo build --features ohttp
+```

crates/cdk-cli/Cargo.toml

@@ -70,6 +70,10 @@ struct Cli {
     #[cfg(all(feature = "tor", not(target_arch = "wasm32")))]
     #[arg(long = "tor", value_enum, default_value_t = TorToggle::On)]
     transport: TorToggle,
+    /// OHTTP Relay URL for proxying requests (advanced usage)
+    #[cfg(feature = "ohttp")]
+    #[arg(long)]
+    ohttp_relay: Option<Url>,
     /// Subcommand to run
     #[command(subcommand)]
     command: Commands,

crates/cdk-cli/README.md

@@ -572,6 +572,7 @@ impl TryFrom<Nuts> for cdk::nuts::Nuts {
             },
             nut21: n.nut21.map(|s| s.try_into()).transpose()?,
             nut22: n.nut22.map(|s| s.try_into()).transpose()?,
+            nut26: None,
             nut29: n.nut29.into(),
         })
     }
@@ -747,6 +748,7 @@ mod tests {
                     ),
                 )],
             }),
+            nut26: None,
             nut29: Default::default(),
         }
     }
@@ -887,6 +889,7 @@ mod tests {
             nut20: cdk::nuts::nut06::SupportedSettings { supported: false },
             nut21: None,
             nut22: None,
+            nut26: None,
             nut29: Default::default(),
         };
 
@@ -919,6 +922,7 @@ mod tests {
             nut20_supported: false,
             nut21: None,
             nut22: None,
+            nut26: None,
             nut29: Default::default(),
             mint_units: vec![],
             melt_units: vec![],

crates/cdk-cli/src/main.rs

@@ -333,6 +333,7 @@ fn create_ldk_settings(
         ldk_node: Some(ldk_config),
         fake_wallet: None,
         onchain: None,
+        ohttp_gateway: None,
         ..Default::default()
     }
 }

crates/cdk-ffi/src/types/mint.rs

@@ -227,6 +227,7 @@ pub fn create_fake_wallet_settings(
         mint_management_rpc: None,
         auth: None,
         prometheus: Some(Default::default()),
+        ohttp_gateway: None,
         ..Default::default()
     }
 }
@@ -285,6 +286,7 @@ pub fn create_cln_settings(
         mint_management_rpc: None,
         auth: None,
         prometheus: Some(Default::default()),
+        ohttp_gateway: None,
         ..Default::default()
     }
 }
@@ -338,6 +340,7 @@ pub fn create_lnd_settings(
         mint_management_rpc: None,
         auth: None,
         prometheus: Some(Default::default()),
+        ohttp_gateway: None,
         ..Default::default()
     }
 }