git / moonbite-network / deploy/harden-droplet.sh · raw

#!/bin/bash# Infrastructure hardening: persistent SECRET_KEY, and a firewall.set -euDROPIN=/etc/systemd/system/moonbite-dashboard.service.d/persistence.confecho "step: SECRET_KEY"if grep -q "SECRET_KEY=" "$DROPIN" 2>/dev/null; then    echo "  already set, leaving it alone"else    # Without this the app falls back to a random key per start, so every    # deploy silently invalidates all session cookies.    KEY=$(python3 -c 'import secrets; print(secrets.token_hex(32))')    # Append inside the existing [Service] section.    printf '\n# Signs session cookies. Generated once; a random per-start key\n# invalidates every session on each restart.\nEnvironment=SECRET_KEY=%s\n' "$KEY" >> "$DROPIN"    chmod 600 "$DROPIN"    systemctl daemon-reload    systemctl restart moonbite-dashboard    sleep 10    echo "  set (64 hex chars), service restarted"fiecho "step: firewall"if ! command -v ufw >/dev/null 2>&1; then    echo "  ufw not installed; skipping (install manually if wanted)"else    # Allow SSH first — locking ourselves out would be worse than the risk.    ufw allow 22/tcp   >/dev/null 2>&1 || true    ufw allow 80/tcp   >/dev/null 2>&1 || true    ufw allow 443/tcp  >/dev/null 2>&1 || true    ufw allow 9444/tcp >/dev/null 2>&1 || true   # MoonBite P2P, intentionally public    ufw --force enable >/dev/null 2>&1 || true    echo "  rules:"    ufw status | sed -n '1,12p' | sed 's/^/    /'fiecho "step: verify"echo -n "  dashboard: "; systemctl is-active moonbite-dashboardecho -n "  moonbited: "; systemctl is-active moonbitedecho -n "  local /wallet: "curl -s -o /dev/null -w '%{http_code}\n' http://127.0.0.1:8050/wallet --max-time 15echo -n "  SECRET_KEY present in env: "systemctl show -p Environment --value moonbite-dashboard | grep -q 'SECRET_KEY=' && echo yes || echo NOecho "HARDEN-OK"