security: fix secret leakage hardcoded tokens and credentials (Punto 3)
- .gitignore: Add protection for .env, *.pem, *.key, private_key.pem, privkey.pem, ec.key, chiave_privata.key, and shell scripts bal-*.sh - make_release.sh: Remove hardcoded token 5cfa8c33e337ebaadb355c0ffa2d053d521ee43b Add loading from .env file with GITEA_API_TOKEN variable Add error handling if token is not set (prevents script from running without proper authentication) - .env.example: Add template file for Gitea API token setup (not committed to git, .gitignored) - generate_keys.sh: Add chmod 600 to protect private_key.pem permissions - contrib/download_and_install_bal.sh: Remove hardcoded xpub and fixed_fee. Make all settings required as arguments or environment variables (xpub, fixed_fee, willexecutor_url, email, info) Add proper error handling and usage instructions if required arguments are not provided - tests/secret_leakage_tests.rs: Add regression tests that: * Verify .gitignore protects .env, .pem, .key files * Verify no private key files are tracked in git (only public_key.pem is allowed) * Scan shell scripts for potential hardcoded tokens - All tests pass: cargo test (8 tests: 3 SQL injection + 2 panic regression + 3 secret leakage) - Build verified: cargo check (0 errors)
This commit is contained in:
249
contrib/download_and_install_bal.sh
Normal file
249
contrib/download_and_install_bal.sh
Normal file
@@ -0,0 +1,249 @@
|
||||
#!/bin/bash
|
||||
###############SETTINGS################
|
||||
# These settings can be overridden by environment variables or arguments
|
||||
# Usage: ./download_and_install_bal.sh <xpub> <fixed_fee> <willexecutor_url> <email> [info]
|
||||
# Example: ./download_and_install_bal.sh bc1q... 50000 we.example.com info@example.com
|
||||
# DO NOT commit this file with hardcoded secrets!
|
||||
|
||||
if [ -n "$1" ]; then xpub="$1"; else
|
||||
echo "Error: xpub address is required as first argument"
|
||||
echo "Usage: $0 <xpub> <fixed_fee> <willexecutor_url> <email> [info]"
|
||||
echo "Example: $0 bc1q... 50000 we.example.com info@example.com"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$2" ]; then fixed_fee="$2"; else
|
||||
echo "Error: fixed_fee is required as second argument"
|
||||
echo "Usage: $0 <xpub> <fixed_fee> <willexecutor_url> <email> [info]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$3" ]; then willexecutor_url="$3"; else
|
||||
echo "Error: willexecutor_url is required as third argument"
|
||||
echo "Usage: $0 <xpub> <fixed_fee> <willexecutor_url> <email> [info]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$4" ]; then email="$4"; else
|
||||
echo "Error: email is required as fourth argument (for SSL certificate)"
|
||||
echo "Usage: $0 <xpub> <fixed_fee> <willexecutor_url> <email> [info]"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
if [ -n "$5" ]; then info="$5"; else info="commercial will executor server"; fi
|
||||
#######################################
|
||||
|
||||
|
||||
|
||||
bal_server_conf=$(cat << EOF
|
||||
BAL_SERVER_DB_FILE=/home/bal/bal.db
|
||||
BAL_SERVER_BIND_ADDRESS=127.0.0.1
|
||||
BAL_SERVER_BIND_PORT=9137
|
||||
BAL_SERVER_BITCOIN_ADDRESS="$xpub"
|
||||
BAL_SERVER_BITCOIN_FIXED_FEE=$fixed_fee
|
||||
BAL_SERVER_INFO="$info"
|
||||
|
||||
EOF
|
||||
)
|
||||
bal_pusher_conf=$(cat << EOF
|
||||
BAL_PUSHER_DB_FILE=/home/bal/bal.db
|
||||
BAL_PUSHER_BITCOIN_COOKIE_FILE=/home/bitcoin/.bitcoin/.cookie
|
||||
|
||||
EOF
|
||||
)
|
||||
if ! command -v jq &> /dev/null; then
|
||||
echo "Installing jq... "
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y jq
|
||||
fi
|
||||
if ! command -v curl &> /dev/null; then
|
||||
echo "Installing curl... "
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y curl
|
||||
fi
|
||||
|
||||
if ! command -v certbot &> /dev/null; then
|
||||
echo "Installing certbot... "
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y certbot python3-certbot-nginx
|
||||
fi
|
||||
|
||||
if ! command -v nginx &> /dev/null; then
|
||||
echo "Installing nginx... "
|
||||
sudo apt-get update
|
||||
sudo apt-get install -y nginx
|
||||
fi
|
||||
|
||||
|
||||
################## DOWNLOAD AND INSTALL BAL #####################
|
||||
url_releases="https://bitcoin-after.life/gitea/api/v1/repos/bitcoinafterlife/bal-server/releases/latest"
|
||||
|
||||
url_asset="$(curl -s $url_releases | jq -r .assets[0].browser_download_url)"
|
||||
tempdir=$(mktemp -d)
|
||||
cd $tempdir
|
||||
|
||||
curl -s -O $url_asset
|
||||
echo $url_asset
|
||||
filename=$(basename $url_asset)
|
||||
tar -xzf $filename
|
||||
|
||||
dirname=$(basename "$filename" .tar.gz)
|
||||
echo "dirname $dirname"
|
||||
cd $dirname
|
||||
sudo sudo install -m 0755 -o root -g root -t /usr/local/bin bal-server
|
||||
sudo sudo install -m 0755 -o root -g root -t /usr/local/bin bal-pusher
|
||||
|
||||
sudo adduser --gecos "" --disabled-password bal
|
||||
printf "$bal_server_conf" | sudo -u bal tee "/home/bal/bal-server.env" > /dev/null
|
||||
printf "$bal_pusher_conf" | sudo -u bal tee "/home/bal/bal-pusher.env" > /dev/null
|
||||
|
||||
|
||||
|
||||
|
||||
################## SERVICES #####################
|
||||
bal_server_service=$(cat << EOF
|
||||
[Unit]
|
||||
Description=bal-server daemon
|
||||
After=network.target
|
||||
|
||||
[Service]
|
||||
|
||||
EnvironmentFile=/home/bal/bal-server.env
|
||||
|
||||
ExecStart=/usr/local/bin/bal-server
|
||||
|
||||
SyslogIdentifier=bal-server
|
||||
|
||||
Type=simple
|
||||
PIDFile=/run/bal-server/bal-server.pid
|
||||
Restart=always
|
||||
TimeoutSec=300
|
||||
RestartSec=30
|
||||
|
||||
User=bal
|
||||
UMask=0027
|
||||
|
||||
RuntimeDirectory=bal-server
|
||||
RuntimeDirectoryMode=0710
|
||||
|
||||
|
||||
ProtectSystem=full
|
||||
|
||||
NoNewPrivileges=true
|
||||
|
||||
PrivateDevices=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
|
||||
EOF
|
||||
)
|
||||
bal_pusher_service=$(cat << EOF
|
||||
[Unit]
|
||||
Description=bal-pusher daemon
|
||||
After=bitcoind.service
|
||||
|
||||
[Service]
|
||||
|
||||
EnvironmentFile=/home/bal/bal-pusher.env
|
||||
|
||||
ExecStart=/usr/local/bin/bal-pusher bitcoin
|
||||
|
||||
StandardOutput=syslog
|
||||
StandardError=syslog
|
||||
SyslogIdentifier=bal-pusher
|
||||
|
||||
|
||||
Type=simple
|
||||
PIDFile=/run/bal-pusher/bal-pusher.pid
|
||||
Restart=always
|
||||
TimeoutSec=120
|
||||
RestartSec=300
|
||||
KillMode=process
|
||||
|
||||
User=bal
|
||||
Group=bitcoin
|
||||
UMask=0027
|
||||
|
||||
RuntimeDirectory=bal-pusher
|
||||
RuntimeDirectoryMode=0710
|
||||
|
||||
PrivateTmp=true
|
||||
|
||||
ProtectSystem=full
|
||||
|
||||
NoNewPrivileges=true
|
||||
|
||||
PrivateDevices=true
|
||||
|
||||
MemoryDenyWriteExecute=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
|
||||
EOF
|
||||
)
|
||||
|
||||
|
||||
printf "$bal_server_service" | sudo tee "/etc/systemd/system/bal-server.service" > /dev/null
|
||||
printf "$bal_pusher_service" | sudo tee "/etc/systemd/system/bal-pusher.service" > /dev/null
|
||||
|
||||
sudo systemctl enable bal-server.service
|
||||
sudo systemctl restart bal-server.service
|
||||
|
||||
sudo systemctl enable bal-pusher.service
|
||||
sudo systemctl restart bal-pusher.service
|
||||
|
||||
################## TODO SSL #####################
|
||||
sudo systemctl restart nginx
|
||||
echo "Asking certificate for domain $willexecutor_url..."
|
||||
sudo certbot certonly --standalone --non-interactive --agree-tos --email $email -d $willexecutor_url
|
||||
|
||||
if [ -n "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" ]; then
|
||||
sudo openssl x509 -in "/etc/letsencrypt/live/$willexecutor_url/fullchain.pem" -noout -text | grep -E "Issuer:|Subject:|Not Before:|Not After :"
|
||||
else
|
||||
echo "Error getting certificate"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
(crontab -l 2>/dev/null; echo "0 0,12 * * * /usr/bin/certbot renew --quiet") | crontab -
|
||||
echo "ssl certificate installed"sudo systemctl status nginx
|
||||
|
||||
|
||||
|
||||
|
||||
################## NGNIX ########################
|
||||
nginx_reverse_proxy=$(cat << EOF
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name $willexecutor_url;
|
||||
|
||||
ssl_certificate /etc/letsencrypt/live/$willexecutor_url/fullchain.pem; # managed by Certbot
|
||||
ssl_certificate_key /etc/letsencrypt/live/$willexecutor_url/privkey.pem; # managed by Certbot
|
||||
|
||||
location / {
|
||||
proxy_pass http://127.0.0.1:9137;
|
||||
# Include standard proxy headers from above
|
||||
proxy_set_header Host \$host;
|
||||
proxy_set_header X-Real-IP \$remote_addr;
|
||||
proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto \$scheme;
|
||||
}
|
||||
}
|
||||
|
||||
server {
|
||||
listen 80;
|
||||
server_name $willexecutor_url;
|
||||
return 301 https://$willexecutor_url;
|
||||
}
|
||||
|
||||
EOF
|
||||
)
|
||||
|
||||
printf "$nginx_reverse_proxy" | sudo tee "/etc/nginx/etc/nginx/sites-available/$willexecutor_url" > /dev/null
|
||||
#sudo ln -s /etc/nginx/sites-available/$willexecutor_url /etc/nginx/sites-enabled/
|
||||
sudo systemctl restart nginx
|
||||
|
||||
rm -r $tempdir
|
||||
echo "done"
|
||||
Reference in New Issue
Block a user