bal-server

bitcoinafterlife/bal-server

Fork 1

Commit Graph

Author	SHA1	Message	Date
svatantrya	da2124031e	fix(install-scripts): correct critical bugs in contrib scripts - download_and_install_bitcoincore.sh: - Fix apt install with single-quoted string (was treating all deps as one package) - Add sudo to apt install commands - Fix tar extraction: now finds extracted dir and copies bitcoind/bitcoin-cli to /usr/local/bin - Fix zmqpubrawblock -> zmqpubhashblock (pusher expects hashblock topic) - Fix install check (0 was testing cd, not tar) with explicit extraction check - Handle existing user in adduser - Fix source lib.sh path - download_and_install_bal.sh: - Use curl -sfL (fail on 404, follow redirects) for Gitea download - Add null/empty check after jq download URL extraction - Change certbot --standalone to --nginx (avoids port 80 conflict) - Enable nginx site symlink (was commented out) - Handle existing 'bal' user in adduser - install_tor.sh: - Add sudo to all root-requiring commands (apt, tee, cp, sed, systemctl) - Backup torrc with timestamp before modifying - Add DisableDebuggerAttachment hardening	2026-07-16 19:39:10 -04:00
svatantrya	538e72f806	fix(install-scripts): harden contrib scripts and fix critical bugs - download_and_install_bal.sh: add set -euo pipefail, fix sudo sudo typo, fix nginx path (etc/nginx/etc/nginx -> etc/nginx), add chmod 600 for env files, reduce RestartSec to 5s, fix concatenated echo line, add systemctl daemon-reload - download_and_install_bitcoincore.sh: add set -euo pipefail, fix source lib.sh path to use script directory - install_tor.sh: add set -euo pipefail, detect architecture dynamically (dpkg --print-architecture), detect distro dynamically (lsb_release -cs), bind ControlPort to 127.0.0.1:9051, add DisableDebuggerAttachment	2026-07-16 19:07:15 -04:00
svatantrya	237e62d4be	security: fix secret leakage hardcoded tokens and credentials (Punto 3) - .gitignore: Add protection for .env, .pem, .key, private_key.pem, privkey.pem, ec.key, chiave_privata.key, and shell scripts bal-.sh - make_release.sh: Remove hardcoded token 5cfa8c33e337ebaadb355c0ffa2d053d521ee43b Add loading from .env file with GITEA_API_TOKEN variable Add error handling if token is not set (prevents script from running without proper authentication) - .env.example: Add template file for Gitea API token setup (not committed to git, .gitignored) - generate_keys.sh: Add chmod 600 to protect private_key.pem permissions - contrib/download_and_install_bal.sh: Remove hardcoded xpub and fixed_fee. Make all settings required as arguments or environment variables (xpub, fixed_fee, willexecutor_url, email, info) Add proper error handling and usage instructions if required arguments are not provided - tests/secret_leakage_tests.rs: Add regression tests that: Verify .gitignore protects .env, .pem, .key files * Verify no private key files are tracked in git (only public_key.pem is allowed) * Scan shell scripts for potential hardcoded tokens - All tests pass: cargo test (8 tests: 3 SQL injection + 2 panic regression + 3 secret leakage) - Build verified: cargo check (0 errors)	2026-07-16 15:25:23 -04:00

Author

SHA1

Message

Date

svatantrya

da2124031e

fix(install-scripts): correct critical bugs in contrib scripts

- download_and_install_bitcoincore.sh:
  - Fix apt install with single-quoted string (was treating all deps as one package)
  - Add sudo to apt install commands
  - Fix tar extraction: now finds extracted dir and copies bitcoind/bitcoin-cli to /usr/local/bin
  - Fix zmqpubrawblock -> zmqpubhashblock (pusher expects hashblock topic)
  - Fix install check (0 was testing cd, not tar) with explicit extraction check
  - Handle existing user in adduser
  - Fix source lib.sh path

- download_and_install_bal.sh:
  - Use curl -sfL (fail on 404, follow redirects) for Gitea download
  - Add null/empty check after jq download URL extraction
  - Change certbot --standalone to --nginx (avoids port 80 conflict)
  - Enable nginx site symlink (was commented out)
  - Handle existing 'bal' user in adduser

- install_tor.sh:
  - Add sudo to all root-requiring commands (apt, tee, cp, sed, systemctl)
  - Backup torrc with timestamp before modifying
  - Add DisableDebuggerAttachment hardening

2026-07-16 19:39:10 -04:00

svatantrya

538e72f806

fix(install-scripts): harden contrib scripts and fix critical bugs

- download_and_install_bal.sh: add set -euo pipefail, fix sudo sudo typo, fix nginx path (etc/nginx/etc/nginx -> etc/nginx), add chmod 600 for env files, reduce RestartSec to 5s, fix concatenated echo line, add systemctl daemon-reload
- download_and_install_bitcoincore.sh: add set -euo pipefail, fix source lib.sh path to use script directory
- install_tor.sh: add set -euo pipefail, detect architecture dynamically (dpkg --print-architecture), detect distro dynamically (lsb_release -cs), bind ControlPort to 127.0.0.1:9051, add DisableDebuggerAttachment

2026-07-16 19:07:15 -04:00

svatantrya

237e62d4be

security: fix secret leakage hardcoded tokens and credentials (Punto 3)

- .gitignore: Add protection for .env, *.pem, *.key, private_key.pem, privkey.pem, ec.key, chiave_privata.key, and shell scripts bal-*.sh
- make_release.sh: Remove hardcoded token 5cfa8c33e337ebaadb355c0ffa2d053d521ee43b
  Add loading from .env file with GITEA_API_TOKEN variable
  Add error handling if token is not set (prevents script from running without proper authentication)
- .env.example: Add template file for Gitea API token setup (not committed to git, .gitignored)
- generate_keys.sh: Add chmod 600 to protect private_key.pem permissions
- contrib/download_and_install_bal.sh: Remove hardcoded xpub and fixed_fee.
  Make all settings required as arguments or environment variables (xpub, fixed_fee, willexecutor_url, email, info)
  Add proper error handling and usage instructions if required arguments are not provided
- tests/secret_leakage_tests.rs: Add regression tests that:
  * Verify .gitignore protects .env, .pem, .key files
  * Verify no private key files are tracked in git (only public_key.pem is allowed)
  * Scan shell scripts for potential hardcoded tokens
- All tests pass: cargo test (8 tests: 3 SQL injection + 2 panic regression + 3 secret leakage)
- Build verified: cargo check (0 errors)

2026-07-16 15:25:23 -04:00

3 Commits