forked from bitcoinafterlife/bal-server
fix(install-scripts): correct critical bugs in contrib scripts
- download_and_install_bitcoincore.sh: - Fix apt install with single-quoted string (was treating all deps as one package) - Add sudo to apt install commands - Fix tar extraction: now finds extracted dir and copies bitcoind/bitcoin-cli to /usr/local/bin - Fix zmqpubrawblock -> zmqpubhashblock (pusher expects hashblock topic) - Fix install check (0 was testing cd, not tar) with explicit extraction check - Handle existing user in adduser - Fix source lib.sh path - download_and_install_bal.sh: - Use curl -sfL (fail on 404, follow redirects) for Gitea download - Add null/empty check after jq download URL extraction - Change certbot --standalone to --nginx (avoids port 80 conflict) - Enable nginx site symlink (was commented out) - Handle existing 'bal' user in adduser - install_tor.sh: - Add sudo to all root-requiring commands (apt, tee, cp, sed, systemctl) - Backup torrc with timestamp before modifying - Add DisableDebuggerAttachment hardening
This commit is contained in:
@@ -79,13 +79,17 @@ fi
|
||||
################## DOWNLOAD AND INSTALL BAL #####################
|
||||
url_releases="https://bitcoin-after.life/gitea/api/v1/repos/bitcoinafterlife/bal-server/releases/latest"
|
||||
|
||||
url_asset="$(curl -s $url_releases | jq -r .assets[0].browser_download_url)"
|
||||
url_asset="$(curl -sfL $url_releases | jq -r .assets[0].browser_download_url)"
|
||||
if [ -z "$url_asset" ] || [ "$url_asset" = "null" ]; then
|
||||
echo "Error: could not fetch download URL from Gitea releases"
|
||||
exit 1
|
||||
fi
|
||||
tempdir=$(mktemp -d)
|
||||
cd $tempdir
|
||||
|
||||
curl -s -O $url_asset
|
||||
echo $url_asset
|
||||
filename=$(basename $url_asset)
|
||||
curl -sfL -O "$url_asset"
|
||||
echo "$url_asset"
|
||||
filename=$(basename "$url_asset")
|
||||
tar -xzf $filename
|
||||
|
||||
dirname=$(basename "$filename" .tar.gz)
|
||||
@@ -94,7 +98,7 @@ cd $dirname
|
||||
sudo install -m 0755 -o root -g root -t /usr/local/bin bal-server
|
||||
sudo install -m 0755 -o root -g root -t /usr/local/bin bal-pusher
|
||||
|
||||
sudo adduser --gecos "" --disabled-password bal
|
||||
id bal >/dev/null 2>&1 || sudo adduser --gecos "" --disabled-password bal
|
||||
printf "$bal_server_conf" | sudo -u bal tee "/home/bal/bal-server.env" > /dev/null
|
||||
sudo chmod 600 /home/bal/bal-server.env
|
||||
printf "$bal_pusher_conf" | sudo -u bal tee "/home/bal/bal-pusher.env" > /dev/null
|
||||
@@ -202,7 +206,7 @@ sudo systemctl restart bal-pusher.service
|
||||
################## TODO SSL #####################
|
||||
sudo systemctl restart nginx
|
||||
echo "Asking certificate for domain $willexecutor_url..."
|
||||
sudo certbot certonly --standalone --non-interactive --agree-tos --email $email -d $willexecutor_url
|
||||
sudo certbot --nginx --non-interactive --agree-tos --email $email -d $willexecutor_url
|
||||
|
||||
if [ -n "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" ]; then
|
||||
sudo openssl x509 -in "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" -noout -text | grep -E "Issuer:|Subject:|Not Before:|Not After :"
|
||||
@@ -247,7 +251,7 @@ EOF
|
||||
)
|
||||
|
||||
printf "$nginx_reverse_proxy" | sudo tee "/etc/nginx/sites-available/$willexecutor_url" > /dev/null
|
||||
#sudo ln -s /etc/nginx/sites-available/$willexecutor_url /etc/nginx/sites-enabled/
|
||||
sudo ln -s "/etc/nginx/sites-available/$willexecutor_url" "/etc/nginx/sites-enabled/" || true
|
||||
sudo systemctl restart nginx
|
||||
|
||||
rm -r $tempdir
|
||||
|
||||
@@ -52,7 +52,7 @@ for cmd in $CMD_DEPENDENCIES
|
||||
do
|
||||
if [ $(which $cmd >/dev/null 2>&1; echo $?) != 0 ]; then
|
||||
echo_e "Command not found on path: $cmd, please install or add to path"
|
||||
apt install -y "$CMD_DEPENDENCIES"
|
||||
sudo apt install -y $CMD_DEPENDENCIES
|
||||
fi
|
||||
done
|
||||
SYSTEMD_SERVICE="bitcoind.service"
|
||||
@@ -201,19 +201,24 @@ install_bitcoin_core () {
|
||||
cd $VERSION_NUM_FULL
|
||||
tar xzf *.tar.gz
|
||||
|
||||
# Copy binaries to /usr/local/bin
|
||||
extract_dir=$(find . -maxdepth 1 -type d -name 'bitcoin-*' | head -n1)
|
||||
if [ -d "$extract_dir/bin" ]; then
|
||||
sudo install -m 755 "$extract_dir/bin/bitcoind" /usr/local/bin/
|
||||
sudo install -m 755 "$extract_dir/bin/bitcoin-cli" /usr/local/bin/
|
||||
else
|
||||
echo_e "Installation aborted: binary directory not found in extracted archive"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ $(is_bitcoin_core_running) == 0 ]; then
|
||||
echo_i "Stopping bitcoind before installing"
|
||||
stop_bitcoin_core
|
||||
sleep 5
|
||||
fi
|
||||
|
||||
if [ $? == 0 ]; then
|
||||
echo_s "Bitcoin Core $VERSION_NUM successfully installed!"
|
||||
touch .installed
|
||||
else
|
||||
echo_e "Installation aborted: error while installing"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
cd ..
|
||||
echo $VERSION_NUM > .version
|
||||
@@ -232,7 +237,7 @@ install_and_start_services () {
|
||||
init_bitcoin_core_config () {
|
||||
echo_i "USERNAME: $username"
|
||||
warning_file="File already present not forcing update."
|
||||
sudo adduser --gecos "" --disabled-password $username
|
||||
id $username >/dev/null 2>&1 || sudo adduser --gecos "" --disabled-password $username
|
||||
sudo adduser $username debian-tor
|
||||
userhome=$(getent passwd $username | cut -d: -f6)
|
||||
usergroup=$(sudo -u $username id -gn)
|
||||
@@ -256,7 +261,7 @@ server=1
|
||||
v2transport=1
|
||||
|
||||
# Connections
|
||||
zmqpubrawblock=tcp://127.0.0.1:28332
|
||||
zmqpubhashblock=tcp://127.0.0.1:28332
|
||||
zmqpubrawtx=tcp://127.0.0.1:28333
|
||||
|
||||
maxuploadtarget=5000
|
||||
|
||||
@@ -1,8 +1,8 @@
|
||||
#!/bin/bash
|
||||
set -euo pipefail
|
||||
|
||||
apt-get update
|
||||
apt-get install -y \
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y \
|
||||
gpg \
|
||||
wget \
|
||||
lsb-release
|
||||
@@ -10,17 +10,22 @@ apt-get install -y \
|
||||
ARCH=$(dpkg --print-architecture)
|
||||
DISTRO=$(lsb_release -cs)
|
||||
|
||||
cat <<EOF > /etc/apt/sources.list.d/tor.list
|
||||
sudo tee /etc/apt/sources.list.d/tor.list > /dev/null <<EOF
|
||||
deb [arch=$ARCH signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $DISTRO main
|
||||
deb-src [arch=$ARCH signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $DISTRO main
|
||||
EOF
|
||||
wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null
|
||||
apt-get update
|
||||
apt install -y tor deb.torproject.org-keyring
|
||||
cp /etc/tor/torrc /etc/tor/torrc.bak
|
||||
sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable/d' /etc/tor/torrc
|
||||
|
||||
cat << EOF >> /etc/tor/torrc
|
||||
wget -qO- https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor | sudo tee /usr/share/keyrings/tor-archive-keyring.gpg >/dev/null
|
||||
sudo apt-get update
|
||||
sudo apt install -y tor deb.torproject.org-keyring
|
||||
|
||||
# Backup existing torrc before modifying
|
||||
if [ -f /etc/tor/torrc ]; then
|
||||
sudo cp /etc/tor/torrc /etc/tor/torrc.bak.$(date +%Y%m%d%H%M%S)
|
||||
fi
|
||||
sudo sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable/d' /etc/tor/torrc
|
||||
|
||||
sudo tee -a /etc/tor/torrc > /dev/null << EOF
|
||||
|
||||
# Added by script ($(date))
|
||||
ControlPort 127.0.0.1:9051
|
||||
@@ -28,4 +33,4 @@ sed -i '/^ControlPort/d; /^CookieAuthentication/d; /^CookieAuthFileGroupReadable
|
||||
CookieAuthFileGroupReadable 1
|
||||
DisableDebuggerAttachment 1
|
||||
EOF
|
||||
systemctl restart tor
|
||||
sudo systemctl restart tor
|
||||
|
||||
Reference in New Issue
Block a user