d50286a9a5
Packages: core (BIP39/32/44/49/84/86 derivation, WIF), keystore (PBKDF2 + AES-GCM), psbt, p2p (BIP157/158 SPV daemon, Dandelion++ broadcast with relay-echo verification), blockbook, rpc, electrum, net, bns, web-ui (React/Vite), mobile (Expo). ops/ holds the nginx vhost, systemd unit and push.sh deploy script for digibyte.x/web.
192 lines
7 KiB
Bash
192 lines
7 KiB
Bash
#!/usr/bin/env bash
|
|
# Turnkey DGB VPS backend bootstrap — BNS/BCNR variant.
|
|
#
|
|
# Usage: sudo ./setup.sh rpc.dgb # BNS name, no ICANN domain
|
|
# sudo ./setup.sh rpc.dgb 12024 # optional custom P2P port
|
|
#
|
|
# Idempotent: safe to re-run. Skips already-completed steps.
|
|
# Tested on Debian 12 / Ubuntu 24.04. Requires root.
|
|
#
|
|
# Cert model: SELF-SIGNED. The BNS name's on-chain `tls` record pins
|
|
# the SHA-256 fingerprint of this cert, so the wallet trusts it
|
|
# without any CA involvement. The script prints the fingerprint at
|
|
# the end for you to paste into the BNS UPD.
|
|
|
|
set -euo pipefail
|
|
|
|
if [[ $EUID -ne 0 ]]; then
|
|
echo "Run as root (sudo)." >&2
|
|
exit 1
|
|
fi
|
|
|
|
if [[ $# -lt 1 ]]; then
|
|
echo "Usage: $0 <bns-name>" >&2
|
|
echo "Example: $0 rpc.dgb" >&2
|
|
exit 1
|
|
fi
|
|
|
|
BNS_NAME="$1"
|
|
# CN in the self-signed cert. Wallet doesn't validate CN (it pins the
|
|
# fingerprint) but browsers/curl for admin-debugging read it.
|
|
CERT_CN="$BNS_NAME"
|
|
DGB_VERSION="8.26.2"
|
|
DGB_TARBALL="digibyte-${DGB_VERSION}-x86_64-linux-gnu.tar.gz"
|
|
DGB_URL="https://github.com/DigiByte-Core/digibyte/releases/download/v${DGB_VERSION}/${DGB_TARBALL}"
|
|
DGB_SHA_URL="https://github.com/DigiByte-Core/digibyte/releases/download/v${DGB_VERSION}/SHA256SUMS"
|
|
|
|
OPS_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"
|
|
|
|
log() { echo -e "\n\033[1;36m>>> $*\033[0m"; }
|
|
|
|
log "Step 1/7: install prerequisites"
|
|
apt-get update -qq
|
|
apt-get install -y -qq \
|
|
curl wget gpg ca-certificates ufw \
|
|
debian-keyring debian-archive-keyring apt-transport-https
|
|
|
|
log "Step 2/7: create digibyte user"
|
|
if ! id -u digibyte >/dev/null 2>&1; then
|
|
useradd --system --home /var/lib/digibyte --shell /usr/sbin/nologin digibyte
|
|
fi
|
|
mkdir -p /var/lib/digibyte /etc/digibyte
|
|
chown digibyte:digibyte /var/lib/digibyte
|
|
|
|
log "Step 3/7: download & verify DigiByte Core ${DGB_VERSION}"
|
|
cd /tmp
|
|
if [[ ! -x /usr/local/bin/digibyted ]] || ! /usr/local/bin/digibyted -version 2>/dev/null | grep -q "${DGB_VERSION}"; then
|
|
wget -q --show-progress "${DGB_URL}"
|
|
wget -q "${DGB_SHA_URL}"
|
|
grep "${DGB_TARBALL}" SHA256SUMS | sha256sum -c -
|
|
tar -xzf "${DGB_TARBALL}"
|
|
install -m 0755 "digibyte-${DGB_VERSION}/bin/digibyted" /usr/local/bin/
|
|
install -m 0755 "digibyte-${DGB_VERSION}/bin/digibyte-cli" /usr/local/bin/
|
|
rm -rf "digibyte-${DGB_VERSION}" "${DGB_TARBALL}" SHA256SUMS
|
|
else
|
|
echo " digibyted ${DGB_VERSION} already installed"
|
|
fi
|
|
|
|
log "Step 4/7: write digibyte.conf (generating 40-char RPC password)"
|
|
if [[ ! -f /etc/digibyte/digibyte.conf ]]; then
|
|
RPC_USER="dgb_$(openssl rand -hex 4)"
|
|
RPC_PASSWORD="$(openssl rand -base64 40 | tr -d '/+=\n' | cut -c1-40)"
|
|
sed \
|
|
-e "s|__RPC_USER__|${RPC_USER}|g" \
|
|
-e "s|__RPC_PASSWORD__|${RPC_PASSWORD}|g" \
|
|
"${OPS_DIR}/digibyte.conf" > /etc/digibyte/digibyte.conf
|
|
chown root:digibyte /etc/digibyte/digibyte.conf
|
|
chmod 640 /etc/digibyte/digibyte.conf
|
|
# Persist credentials in a root-only file for later reference
|
|
cat > /root/dgb-rpc-credentials.txt <<EOF
|
|
DGB RPC credentials — keep secret.
|
|
URL: https://${DOMAIN}/
|
|
username: ${RPC_USER}
|
|
password: ${RPC_PASSWORD}
|
|
EOF
|
|
chmod 600 /root/dgb-rpc-credentials.txt
|
|
else
|
|
echo " /etc/digibyte/digibyte.conf already exists — leaving in place"
|
|
RPC_USER="$(grep -oP '^rpcuser=\K.*' /etc/digibyte/digibyte.conf)"
|
|
RPC_PASSWORD="$(grep -oP '^rpcpassword=\K.*' /etc/digibyte/digibyte.conf)"
|
|
fi
|
|
|
|
log "Step 5/7: install systemd unit and start digibyted"
|
|
install -m 0644 "${OPS_DIR}/digibyte.service" /etc/systemd/system/digibyted.service
|
|
systemctl daemon-reload
|
|
systemctl enable digibyted.service
|
|
systemctl restart digibyted.service
|
|
sleep 3
|
|
if ! systemctl is-active --quiet digibyted; then
|
|
echo "digibyted failed to start. Check: journalctl -u digibyted -e" >&2
|
|
exit 1
|
|
fi
|
|
|
|
log "Step 6a/7: generate self-signed TLS cert"
|
|
CERT_DIR=/etc/digibyte/tls
|
|
mkdir -p "${CERT_DIR}"
|
|
CERT_FILE="${CERT_DIR}/server.crt"
|
|
KEY_FILE="${CERT_DIR}/server.key"
|
|
if [[ ! -f "${CERT_FILE}" ]]; then
|
|
openssl req -x509 -newkey rsa:4096 -sha256 -nodes \
|
|
-keyout "${KEY_FILE}" -out "${CERT_FILE}" \
|
|
-subj "/CN=${CERT_CN}" \
|
|
-days 3650 \
|
|
-addext "subjectAltName=DNS:${BNS_NAME},DNS:localhost,IP:127.0.0.1" >/dev/null 2>&1
|
|
chmod 640 "${KEY_FILE}"
|
|
chown root:caddy "${KEY_FILE}" 2>/dev/null || chown root:root "${KEY_FILE}"
|
|
echo " new self-signed cert at ${CERT_FILE} (10-year validity)"
|
|
else
|
|
echo " reusing existing cert at ${CERT_FILE}"
|
|
fi
|
|
CERT_FINGERPRINT=$(openssl x509 -in "${CERT_FILE}" -noout -fingerprint -sha256 \
|
|
| sed 's/^SHA256 Fingerprint=//' | tr -d ':' | tr '[:upper:]' '[:lower:]')
|
|
|
|
log "Step 6b/7: install and configure Caddy"
|
|
if ! command -v caddy >/dev/null; then
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/gpg.key' \
|
|
| gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
|
|
curl -1sLf 'https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt' \
|
|
> /etc/apt/sources.list.d/caddy-stable.list
|
|
apt-get update -qq
|
|
apt-get install -y -qq caddy
|
|
fi
|
|
# Use the BNS-variant Caddyfile that reads the on-disk cert (no ACME).
|
|
sed -e "s|@BNS_NAME@|${BNS_NAME}|g" \
|
|
-e "s|@CERT_FILE@|${CERT_FILE}|g" \
|
|
-e "s|@KEY_FILE@|${KEY_FILE}|g" \
|
|
"${OPS_DIR}/Caddyfile.bns" > /etc/caddy/Caddyfile
|
|
systemctl restart caddy
|
|
|
|
log "Step 7/7: firewall"
|
|
ufw --force default deny incoming
|
|
ufw --force default allow outgoing
|
|
ufw allow 22/tcp comment "SSH"
|
|
ufw allow 443/tcp comment "HTTPS (RPC)"
|
|
ufw allow 12024/tcp comment "DGB P2P"
|
|
ufw --force enable
|
|
|
|
log "Setup complete."
|
|
|
|
# Determine this VPS's public IPv4 for the BNS record snippet.
|
|
PUBLIC_IP=$(curl -sSL --max-time 5 https://api.ipify.org 2>/dev/null \
|
|
|| curl -sSL --max-time 5 https://ifconfig.me 2>/dev/null \
|
|
|| echo "<detect-manually>")
|
|
|
|
cat <<EOF
|
|
|
|
--------------------------------------------------------------------
|
|
DGB backend deployed. Now register the BNS name on BCH:
|
|
|
|
1. Open your BNS registrar (silentmode.st/register.html or your CLI)
|
|
2. Register the name and set records:
|
|
|
|
name: ${BNS_NAME}
|
|
ip: ${PUBLIC_IP}
|
|
tls: sha256/${CERT_FINGERPRINT}
|
|
u: https://${BNS_NAME}/ (optional, gateway redirect)
|
|
|
|
3. Confirm the UPD tx and wait <60s for indexers to pick it up.
|
|
|
|
Once the record is live, wallet connects with:
|
|
|
|
const client = new RpcClient({
|
|
bnsName: '${BNS_NAME}',
|
|
username: '${RPC_USER}',
|
|
password: '${RPC_PASSWORD}',
|
|
});
|
|
|
|
Credentials also saved to /root/dgb-rpc-credentials.txt (mode 600).
|
|
|
|
--- Node health ---
|
|
Status: systemctl status digibyted
|
|
Sync progress: journalctl -u digibyted -f
|
|
digibyte-cli -conf=/etc/digibyte/digibyte.conf getblockchaininfo | head
|
|
|
|
Initial pruned sync takes ~1-2 days; RPC is available during sync,
|
|
but scantxoutset results are incomplete until sync reaches tip.
|
|
|
|
--- Fingerprint (also above) ---
|
|
Cert file: ${CERT_FILE}
|
|
SHA-256: ${CERT_FINGERPRINT}
|
|
(regenerate cert → new fingerprint → one BNS UPD to rotate.)
|
|
--------------------------------------------------------------------
|
|
EOF
|