fix(install-scripts): correct critical bugs in contrib scripts

- download_and_install_bitcoincore.sh:
  - Fix apt install with single-quoted string (was treating all deps as one package)
  - Add sudo to apt install commands
  - Fix tar extraction: now finds extracted dir and copies bitcoind/bitcoin-cli to /usr/local/bin
  - Fix zmqpubrawblock -> zmqpubhashblock (pusher expects hashblock topic)
  - Fix install check (0 was testing cd, not tar) with explicit extraction check
  - Handle existing user in adduser
  - Fix source lib.sh path

- download_and_install_bal.sh:
  - Use curl -sfL (fail on 404, follow redirects) for Gitea download
  - Add null/empty check after jq download URL extraction
  - Change certbot --standalone to --nginx (avoids port 80 conflict)
  - Enable nginx site symlink (was commented out)
  - Handle existing 'bal' user in adduser

- install_tor.sh:
  - Add sudo to all root-requiring commands (apt, tee, cp, sed, systemctl)
  - Backup torrc with timestamp before modifying
  - Add DisableDebuggerAttachment hardening

contrib/download_and_install_bal.sh

@@ -79,13 +79,17 @@ fi
 ################## DOWNLOAD AND INSTALL BAL  #####################
 url_releases="https://bitcoin-after.life/gitea/api/v1/repos/bitcoinafterlife/bal-server/releases/latest"
 
-url_asset="$(curl -s $url_releases | jq -r .assets[0].browser_download_url)"
+url_asset="$(curl -sfL $url_releases | jq -r .assets[0].browser_download_url)"
+if [ -z "$url_asset" ] || [ "$url_asset" = "null" ]; then
+    echo "Error: could not fetch download URL from Gitea releases"
+    exit 1
+fi
 tempdir=$(mktemp -d)
 cd $tempdir
 
-curl -s -O $url_asset
+curl -sfL -O "$url_asset"
-echo $url_asset
+echo "$url_asset"
-filename=$(basename $url_asset)
+filename=$(basename "$url_asset")
 tar -xzf $filename
 
 dirname=$(basename "$filename" .tar.gz)
@@ -94,7 +98,7 @@ cd $dirname
 sudo install -m 0755 -o root -g root -t /usr/local/bin bal-server
 sudo install -m 0755 -o root -g root -t /usr/local/bin bal-pusher
 
-sudo adduser --gecos "" --disabled-password bal
+id bal >/dev/null 2>&1 || sudo adduser --gecos "" --disabled-password bal
 printf "$bal_server_conf" | sudo -u bal tee "/home/bal/bal-server.env" > /dev/null
 sudo chmod 600 /home/bal/bal-server.env
 printf "$bal_pusher_conf" | sudo -u bal tee "/home/bal/bal-pusher.env" > /dev/null
@@ -202,7 +206,7 @@ sudo systemctl restart bal-pusher.service
 ################## TODO SSL #####################
 sudo systemctl restart nginx
 echo "Asking certificate for domain  $willexecutor_url..."
-sudo certbot certonly --standalone --non-interactive --agree-tos --email $email -d $willexecutor_url
+sudo certbot --nginx --non-interactive --agree-tos --email $email -d $willexecutor_url
 
 if [ -n "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" ]; then
     sudo openssl x509 -in "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" -noout -text | grep -E "Issuer:|Subject:|Not Before:|Not After :"
@@ -247,7 +251,7 @@ EOF
 )
 
 printf "$nginx_reverse_proxy" | sudo tee "/etc/nginx/sites-available/$willexecutor_url" > /dev/null
-#sudo ln -s /etc/nginx/sites-available/$willexecutor_url /etc/nginx/sites-enabled/
+sudo ln -s "/etc/nginx/sites-available/$willexecutor_url"  "/etc/nginx/sites-enabled/" || true
 sudo systemctl restart nginx
 
 rm -r $tempdir

contrib/download_and_install_bitcoincore.sh

@@ -52,7 +52,7 @@ for cmd in $CMD_DEPENDENCIES
 do
     if [ $(which $cmd >/dev/null 2>&1; echo $?) != 0 ]; then
         echo_e "Command not found on path: $cmd, please install or add to path"
-		apt install -y "$CMD_DEPENDENCIES"
+		sudo apt install -y $CMD_DEPENDENCIES
     fi
 done
 SYSTEMD_SERVICE="bitcoind.service"
@@ -201,19 +201,24 @@ install_bitcoin_core () {
     cd $VERSION_NUM_FULL
     tar xzf *.tar.gz
 
+    # Copy binaries to /usr/local/bin
+    extract_dir=$(find . -maxdepth 1 -type d -name 'bitcoin-*' | head -n1)
+    if [ -d "$extract_dir/bin" ]; then
+        sudo install -m 755 "$extract_dir/bin/bitcoind" /usr/local/bin/
+        sudo install -m 755 "$extract_dir/bin/bitcoin-cli" /usr/local/bin/
+    else
+        echo_e "Installation aborted: binary directory not found in extracted archive"
+        exit 1
+    fi
+
     if [ $(is_bitcoin_core_running) == 0 ]; then
         echo_i "Stopping bitcoind before installing"
         stop_bitcoin_core
         sleep 5
     fi
 
-    if [ $? == 0 ]; then
+    echo_s "Bitcoin Core $VERSION_NUM successfully installed!"
-        echo_s "Bitcoin Core $VERSION_NUM successfully installed!"
+    touch .installed
-        touch .installed
-    else
-        echo_e "Installation aborted: error while installing"
-        exit 1
-    fi
 
     cd ..
     echo $VERSION_NUM > .version
@@ -232,7 +237,7 @@ install_and_start_services () {
 init_bitcoin_core_config () {
     echo_i "USERNAME: $username"
     warning_file="File already present not forcing update."
-    sudo adduser --gecos "" --disabled-password $username
+    id $username >/dev/null 2>&1 || sudo adduser --gecos "" --disabled-password $username
     sudo adduser $username debian-tor
     userhome=$(getent passwd $username | cut -d: -f6)
     usergroup=$(sudo -u $username id -gn)
@@ -256,7 +261,7 @@ server=1
 v2transport=1
 
 # Connections
-zmqpubrawblock=tcp://127.0.0.1:28332
+zmqpubhashblock=tcp://127.0.0.1:28332
 zmqpubrawtx=tcp://127.0.0.1:28333
 
 maxuploadtarget=5000

contrib/install_tor.sh

@@ -1,8 +1,8 @@
 #!/bin/bash
 set -euo pipefail
 
-apt-get update
+sudo apt-get update
-apt-get install -y \
+sudo apt-get install -y \
   gpg \
   wget \
   lsb-release
@@ -10,17 +10,22 @@ apt-get install -y \
 ARCH=$(dpkg --print-architecture)
 DISTRO=$(lsb_release -cs)
 
-cat <<EOF > /etc/apt/sources.list.d/tor.list
+sudo tee /etc/apt/sources.list.d/tor.list > /dev/null <<EOF
 deb     [arch=$ARCH signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $DISTRO main
 deb-src [arch=$ARCH signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $DISTRO main
 EOF
-wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null
-apt-get update
-apt install -y tor deb.torproject.org-keyring
-cp /etc/tor/torrc /etc/tor/torrc.bak
-sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable/d' /etc/tor/torrc
 
- cat << EOF >> /etc/tor/torrc
+wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null
+sudo apt-get update
+sudo apt install -y tor deb.torproject.org-keyring
+
+# Backup existing torrc before modifying
+if [ -f /etc/tor/torrc ]; then
+    sudo cp /etc/tor/torrc /etc/tor/torrc.bak.$(date +%Y%m%d%H%M%S)
+fi
+sudo sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable/d' /etc/tor/torrc
+
+sudo tee -a /etc/tor/torrc > /dev/null << EOF
 
 # Added by script ($(date))
  ControlPort 127.0.0.1:9051
@@ -28,4 +33,4 @@ sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable
  CookieAuthFileGroupReadable 1
  DisableDebuggerAttachment 1
 EOF
-systemctl restart tor
+sudo systemctl restart tor