#!/bin/sh

cd /tmp
VERSION="25.1"
sudo wget https://bitcoincore.org/bin/bitcoin-core-$VERSION/bitcoin-$VERSION-x86_64-linux-gnu.tar.gz
sudo wget https://bitcoincore.org/bin/bitcoin-core-$VERSION/SHA256SUMS
sudo wget https://bitcoincore.org/bin/bitcoin-core-$VERSION/SHA256SUMS.asc
sudo sha256sum --ignore-missing --check SHA256SUMS
sudo curl -s "https://api.github.com/repositories/355107265/contents/builder-keys" | grep download_url | grep -oE "https://[a-zA-Z0-9./-]+" | while read url; do curl -s "$url" | gpg --import; done
gpg --verify SHA256SUMS.asc
sudo tar -xvf bitcoin-$VERSION-x86_64-linux-gnu.tar.gz
sudo install -m 0755 -o root -g root -t /usr/local/bin bitcoin-$VERSION/bin/*
sudo adduser admin bitcoin
sudo adduser bitcoin debian-tor
sudo mkdir /data
sudo chown admin:admin /data
sudo mkdir /data/bitcoin
sudo chown bitcoin:bitcoin /data/bitcoin
sudo apt install -y libssl-dev
sudo openssl req -x509 -nodes -newkey rsa:4096 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt -subj "/CN=localhost" -days 3650
sudo mkdir /etc/nginx/streams-enabled
sudo ln -s /data/bitcoin /home/admin/.bitcoin
sudo chown -R admin:admin /home/admin/.bitcoin
sudo usermod -a -G bitcoin,debian-tor lnd
sudo adduser admin lnd
sudo adduser thunderhub lnd

#nginxconfig

sudo mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.bak

sudo cat << EOF | sudo tee /etc/nginx/nginx.conf
user www-data;
worker_processes 1;
pid /run/nginx.pid;
include /etc/nginx/modules-enabled/*.conf;

events {
  worker_connections 768;
}

stream {
  ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
  ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
  ssl_session_cache shared:SSL:1m;
  ssl_session_timeout 4h;
  ssl_protocols TLSv1.2 TLSv1.3;
  ssl_prefer_server_ciphers on;

  include /etc/nginx/streams-enabled/*.conf;

}
EOF
##########################

sudo systemctl reload nginx

#sshd config

sudo sed -i 's/^#PasswordAuthentication.*/PasswordAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#PermitRootL.*/PermitRootLogin no/' /etc/ssh/sshd_config
sudo sed -i 's/^#ChallengeResponseAuthentication.*/ChallengeResponseAuthentication  no/' /etc/ssh/sshd_config
sudo sed -i 's/^#PermitEmptyPasswords.*/PermitEmptyPasswords no/' /etc/ssh/sshd_config
sudo sed -i 's/^#GSSAPIAuthentication.*/GSSAPIAuthentication no/' /etc/ssh/sshd_config
sudo sed -i 's/^#KerberosAuthentication.*/KerberosAuthentication no/' /etc/ssh/sshd_config
sudo systemctl restart sshd

#######################

#PAM LIMITS.SO

sudo sed -i 's/session required                        pam_permit.so/session required                        pam_limits.so/' /etc/pam.d/common-session
sudo sed -i 's/session required                        pam_permit.so/session required                        pam_limits.so/' /etc/pam.d/common-session-noninteractive


######################

sudo cat << EOF | sudo tee /boot/config.txt
dtoverlay=disable-bt
dtoverlay=disable-wifi
EOF
##########################

sudo cat <<EOF | sudo tee -a /etc/tor/torrc

ControlPort 9051
CookieAuthentication 1
CookieAuthFileGroupReadable 1
EOF


sudo systemctl start tor
sudo systemctl restart tor
sudo systemctl reload tor

#############################



sudo cat << EOF | sudo tee /etc/security/limits.d/90-limits.conf


*    soft nofile 128000
*    hard nofile 128000
root soft nofile 128000
root hard nofile 128000
EOF
###############################

sudo cat << EOF | sudo tee /etc/systemd/system/bitcoind.service
# RaspiBolt: systemd unit for bitcoind
# /etc/systemd/system/bitcoind.service

[Unit]
Description=Bitcoin daemon
After=network.target

[Service]

# Service execution
###################

ExecStart=/usr/local/bin/bitcoind -daemon \
                                  -pid=/run/bitcoind/bitcoind.pid \
                                  -conf=/home/bitcoin/.bitcoin/bitcoin.conf \
                                  -datadir=/home/bitcoin/.bitcoin \
                                  -startupnotify="chmod g+r /home/bitcoin/.bitcoin/.cookie"

# Process management
####################
Type=forking
PIDFile=/run/bitcoind/bitcoind.pid
Restart=on-failure
TimeoutSec=300
RestartSec=30

# Directory creation and permissions
####################################
User=bitcoin
UMask=0027

# /run/bitcoind
RuntimeDirectory=bitcoind
RuntimeDirectoryMode=0710

# Hardening measures
####################
# Provide a private /tmp and /var/tmp.
PrivateTmp=true

# Mount /usr, /boot/ and /etc read-only for the process.
ProtectSystem=full

# Disallow the process and all of its children to gain
# new privileges through execve().
NoNewPrivileges=true

# Use a new /dev namespace only populated with API pseudo devices
# such as /dev/null, /dev/zero and /dev/random.
PrivateDevices=true

# Deny the creation of writable and executable memory mappings.
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target
EOF


########################
cd
sudo cp bitcoin2.sh /home/bitcoin/bitcoin2.sh
sudo chmod +x /home/bitcoin/bitcoin2.sh
sudo chown bitcoin:bitcoin /home/bitcoin/bitcoin2.sh
cd && rm bitcoin.sh bitcoin2.sh
sudo su bitcoin
