git / moonbite-network / install-autostart.sh · raw

#!/usr/bin/env bash# OPERATOR-ONLY, OPT-IN (requires --i-am-the-operator; see the gate below).# Install a systemd unit so the read-only RPC proxy comes back automatically on# every WSL/systemd start (and auto-restarts if it dies). Self-contained: copies# a proxy copy into the Linux fs so it does not depend on the /mnt mount being# ready at boot.## The proxy binds LOOPBACK ONLY (127.0.0.1:9350). This script intentionally does# NOT expose it to the internet: an earlier version started an anonymous# Cloudflare quick tunnel that published the node's RPC proxy on a public# *.trycloudflare.com URL with no authentication — that is removed. If you ever# need remote read-only access, put the proxy behind an authenticated reverse# proxy you control, not a throwaway tunnel.set -e# ---------------------------------------------------------------------------# OPT-IN ONLY. This is OPERATOR tooling for a seed / explorer host. It installs# a systemd unit that starts at boot and auto-restarts. It is NOT part of any# user download, it is never run by the miner or the wallet, and nothing in# MoonBite's shipped software installs persistence of any kind# (docs/ADR-013-miner-distribution-policy.md). The miner runs only while the# user keeps it running.## To make sure this is never run by accident (or by a script that happens to# find it), it refuses to proceed unless you pass --i-am-the-operator on the# command line AND run it as root on the host you intend to change.# ---------------------------------------------------------------------------if [ "${1:-}" != "--i-am-the-operator" ]; then  cat >&2 <<'WARN'  install-autostart.sh installs a systemd service (boot persistence) for the  read-only RPC proxy on a MoonBite seed/explorer HOST. It is operator-only.  It is NOT for mining PCs, NOT for wallet users, and nothing in the MoonBite  downloads ever runs it. If you are a user who just wants to mine, close  this and run mine.sh / Mine-MoonBite.bat instead; they install nothing.  If you really are the operator of this host, re-run as root with:      sudo bash install-autostart.sh --i-am-the-operatorWARN  exit 2fishiftif [ "$(id -u)" != "0" ]; then  echo "error: must run as root on the target host (systemd unit install)." >&2  exit 1fi# Repo path is derived from this script's own location (or MOONBITE_REPO), so no# machine- or user-specific absolute path is baked in.SCRIPT_DIR="$(cd "$(dirname "${BASH_SOURCE[0]}")" && pwd)"REPO="${MOONBITE_REPO:-$SCRIPT_DIR}"CONF="${MOONBITE_CONF:-/root/moonbite_main/moonbite.conf}"APP="${MOONBITE_APP:-/root/moonbite-app}"PROXY_SRC="$REPO/explorer/rpc_readonly_proxy.py"if [ ! -f "$PROXY_SRC" ]; then  echo "error: proxy source not found at $PROXY_SRC" >&2  echo "set MOONBITE_REPO to the repository path and re-run." >&2  exit 1fi# 0) Stop any manually-started proxy so systemd can own the port. Also stop and#    disable the retired tunnel unit if a previous install left it behind.pkill -f rpc_readonly_proxy.py 2>/dev/null || trueif systemctl list-unit-files 2>/dev/null | grep -q '^moonbite-tunnel\.service'; then  systemctl disable --now moonbite-tunnel.service 2>/dev/null || true  rm -f /etc/systemd/system/moonbite-tunnel.servicefipkill -f "cloudflared tunnel" 2>/dev/null || truesleep 1# 1) Place a self-contained (LF-normalised) copy of the proxy in the Linux fs.mkdir -p "$APP"tr -d '\r' < "$PROXY_SRC" > "$APP/rpc_readonly_proxy.py"# Ensure proxy creds exist (generate once if missing; keep existing otherwise).if [ ! -f "$APP/.roproxy.env" ]; then  PP=$(head -c 24 /dev/urandom | base64 | tr -d '/+=' | head -c 32)  umask 077  printf 'PROXY_USER=%s\nPROXY_PASSWORD=%s\n' "explorer_ro" "$PP" > "$APP/.roproxy.env"fi# 2) Proxy runner: assembles env from node config, execs python as main PID.cat > "$APP/roproxy-run.sh" <<EOF#!/usr/bin/env bashset -eAPP="$APP"CONF="$CONF". "\$APP/.roproxy.env"export PROXY_BIND=127.0.0.1 PROXY_PORT=9350export NODE_RPC_URL=http://127.0.0.1:9332/export NODE_RPC_USER="\$(grep -E '^rpcuser=' "\$CONF" | head -1 | cut -d= -f2-)"export NODE_RPC_PASSWORD="\$(grep -E '^rpcpassword=' "\$CONF" | head -1 | cut -d= -f2-)"export PROXY_USER PROXY_PASSWORDexec python3 "\$APP/rpc_readonly_proxy.py"EOFchmod +x "$APP/roproxy-run.sh"# 3) systemd unit (loopback proxy only — no public tunnel).cat > /etc/systemd/system/moonbite-roproxy.service <<EOF[Unit]Description=MoonBite read-only RPC proxy (loopback 9350)After=network-online.targetWants=network-online.target[Service]Type=execExecStart=$APP/roproxy-run.shRestart=alwaysRestartSec=3[Install]WantedBy=multi-user.targetEOF# 4) Enable + start now.systemctl daemon-reloadsystemctl enable --now moonbite-roproxy.servicesleep 4echo "=== roproxy status (loopback 127.0.0.1:9350) ==="systemctl --no-pager --lines=2 status moonbite-roproxy.service | head -6 || true