config.yml

#cloud-config

hostname: node01

locale: en_US.UTF-8

system_info:
  default_user:
    name: satoshi

users:
  - name: bitcoin
    gecos: bitcoin system user
    shell: /bin/bash

  - name: electrs
    gecos: Rust Electrum Server system user
    groups: bitcoin
    shell: /bin/bash

  - name: btcexp
    gecos: BTC-RPC-Explorer system user
    groups: bitcoin
    shell: /bin/bash

  - name: cln
    gecos: Core Lightning system user
    groups: bitcoin
    shell: /bin/bash

  - name: rtl
    gecos: Ride The Lightning system user
    groups: cln
    shell: /bin/bash

  - name: satoshi
    gecos: Node operator account
    groups: adm, bitcoin, cdrom, cln, dip, lxd, plugdev, sudo
    shell: /bin/bash
    ssh_import_id:
      - gh:1ma
    sudo: ALL=(ALL) NOPASSWD:ALL

apt:
  sources:
    nginx:
      source: "deb https://nginx.org/packages/mainline/ubuntu noble nginx"
      keyid: 573B FD6B 3D8F BC64 1079 A6AB ABF5 BD82 7BD9 BF62
    nodejs:
      source: "deb https://deb.nodesource.com/node_20.x nodistro main"
      keyid: 6F71 F525 2828 41EE DAF8  51B4 2F59 B5F9 9B1B E0B4
    tor:
      source: "deb https://deb.torproject.org/torproject.org noble main"
      keyid: A3C4 F0F9 79CA A22C DBA8 F512 EE8C BC9E 886D DD89
    i2pd:
      source: "ppa:purplei2p/i2pd"

package_update: true
package_upgrade: true

packages:
  - apt-transport-https
  - autoconf
  - automake
  - build-essential
  - clang
  - cmake
  - curl
  - deb.torproject.org-keyring
  - fail2ban
  - gettext
  - git
  - i2pd
  - libgmp-dev
  - libsodium-dev
  - libsqlite3-dev
  - libssl-dev
  - libtool
  - net-tools
  - nginx-full
  - nodejs
  - npm
  - pkg-config
  - protobuf-compiler
  - python3-dev
  - python3-mako
  - qrencode
  - smem
  - tmux
  - tor
  - tree
  - ufw
  - wireguard
  - zlib1g-dev

runcmd:
  - su -c "bash -x /home/bitcoin/bitcoin-setup.sh" - bitcoin
  - su -c "bash -x /home/electrs/electrs-setup.sh" - electrs
  - su -c "bash -x /home/btcexp/btcexp-setup.sh" - btcexp
  - su -c "bash -x /home/cln/cln-setup.sh" - cln
  - su -c "bash -x /home/rtl/rtl-setup.sh" - rtl
  - su -c "bash -x /home/satoshi/superuser-setup.sh" - satoshi

power_state:
  mode: reboot

write_files:
  - path: /etc/sysctl.d/99-swap-optimizations.conf
    owner: root:root
    permissions: '0644'
    content: |
      # https://www.digitalocean.com/community/tutorials/how-to-add-swap-space-on-ubuntu-22-04

      vm.swappiness=5
      vm.vfs_cache_pressure=50
  - path: /etc/tor/torrc
    owner: root:root
    defer: true
    append: true
    permissions: '0644'
    content: |
      ControlPort 9051
      CookieAuthentication 1
      CookieAuthFileGroupReadable 1

      HiddenServiceDir /var/lib/tor/sshd/
      HiddenServicePort 22 127.0.0.1:22

      HiddenServiceDir /var/lib/tor/electrs/
      HiddenServicePort 50001 127.0.0.1:50001

      HiddenServiceDir /var/lib/tor/btcexp/
      HiddenServicePort 80 127.0.0.1:3002

      HiddenServiceDir /var/lib/tor/cln-rest/
      HiddenServicePort 3001 127.0.0.1:3001

      HiddenServiceDir /var/lib/tor/cln-rest-doc/
      HiddenServicePort 4001 127.0.0.1:4001

      HiddenServiceDir /var/lib/tor/rtl/
      HiddenServicePort 3000 127.0.0.1:3000
  - path: /home/bitcoin/bitcoin-setup.sh
    owner: bitcoin:bitcoin
    defer: true
    permissions: '0755'
    content: |
      #!/usr/bin/env bash

      set -euo pipefail

      export BITCOIN_VERSION=23.2
      export CFLAGS="-O2 --static -static -fPIC"
      export CXXFLAGS="-O2 --static -static -fPIC"
      export LDFLAGS="-s -static-libgcc -static-libstdc++"

      mkdir data

      curl -OL https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS
      curl -OL https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/SHA256SUMS.asc
      curl -OL https://bitcoincore.org/bin/bitcoin-core-${BITCOIN_VERSION}/bitcoin-${BITCOIN_VERSION}.tar.gz

      # TODO that's trashy, rethink approach
      curl https://raw.githubusercontent.com/1ma/dockertronics/master/bitcoin/developer_pubkeys.pem | gpg --import -

      gpg --verify SHA256SUMS.asc SHA256SUMS
      sha256sum --ignore-missing -c SHA256SUMS

      tar zxf bitcoin-${BITCOIN_VERSION}.tar.gz
      mv bitcoin-${BITCOIN_VERSION} code

      cd code
      make -C depends -j$(nproc) NO_QT=1 NO_NATPMP=1 NO_UPNP=1 NO_USDT=1
      ./autogen.sh
      ./configure \
        CONFIG_SITE=$(pwd)/depends/x86_64-pc-linux-gnu/share/config.site \
        --disable-bench \
        --disable-gui-tests \
        --disable-maintainer-mode \
        --disable-man \
        --disable-tests \
        --enable-lto \
        --with-daemon=yes \
        --with-gui=no \
        --with-libmultiprocess=no \
        --with-libs=no \
        --with-miniupnpc=no \
        --with-mpgen=no \
        --with-natpmp=no \
        --with-qrencode=no \
        --with-utils=yes

      curl -OL https://gist.githubusercontent.com/luke-jr/4c022839584020444915c84bdd825831/raw/555c8a1e1e0143571ad4ff394221573ee37d9a56/filter-ordinals.patch
      git apply filter-ordinals.patch

      make -j$(nproc)
  - path: /home/bitcoin/bitcoin.conf
    owner: bitcoin:bitcoin
    defer: true
    permissions: '0640'
    content: |
      datadir=/home/bitcoin/data
      pid=/run/bitcoin/bitcoind.pid
      nodebuglogfile=1

      startupnotify=chmod g+r /home/bitcoin/data/.cookie

      assumevalid=0

      # Bitcoin daemon
      server=1
      txindex=1

      # Network
      listen=1
      proxy=127.0.0.1:9050
      bind=127.0.0.1
      i2psam=127.0.0.1:7656

      # Initial block download optimizations
      # Comment them out and restart after full sync
      dbcache=12288
      blocksonly=1

      # Barcelona Bitcoin Only community node
      addnode=ots6ud7ovx6furs4sxlm7aze5q44qtoeapwcukelcxc3i2r5tkxgdlqd.onion:8333
  - path: /etc/systemd/system/bitcoin.service
    owner: root:root
    permissions: '0644'
    content: |
      [Unit]
      Description=Bitcoin Core
      Documentation=https://github.com/bitcoin/bitcoin/blob/master/doc/init.md

      # https://www.freedesktop.org/wiki/Software/systemd/NetworkTarget/
      After=network-online.target
      Wants=network-online.target electrs.service btcexp.service

      [Service]
      ExecStart=/usr/local/bin/bitcoind -conf=/home/bitcoin/bitcoin.conf

      # Process management
      ####################

      Type=exec
      PIDFile=/run/bitcoin/bitcoind.pid
      Restart=on-failure
      TimeoutStartSec=infinity
      TimeoutStopSec=600

      # Directory creation and permissions
      ####################################

      # Run as bitcoin:bitcoin
      User=bitcoin
      Group=bitcoin

      # /run/bitcoin
      RuntimeDirectory=bitcoin
      RuntimeDirectoryMode=0710

      # Hardening measures
      ####################

      # Provide a private /tmp and /var/tmp.
      PrivateTmp=true

      # Mount /usr, /boot/ and /etc read-only for the process.
      ProtectSystem=full

      # Disallow the process and all of its children to gain
      # new privileges through execve().
      NoNewPrivileges=true

      # Use a new /dev namespace only populated with API pseudo devices
      # such as /dev/null, /dev/zero and /dev/random.
      PrivateDevices=true

      # Deny the creation of writable and executable memory mappings.
      MemoryDenyWriteExecute=true

      [Install]
      WantedBy=multi-user.target
  - path: /etc/nginx/nginx.conf
    owner: root:root
    defer: true
    permissions: '0644'
    content: |
      user www-data;
      worker_processes auto;
      pid /run/nginx.pid;
      include /etc/nginx/modules-enabled/*.conf;

      events {
        worker_connections 768;
      }

      http {
        ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
        ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
        ssl_session_cache shared:HTTP-TLS:1m;
        ssl_session_timeout 4h;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        include /etc/nginx/sites-enabled/*.conf;
      }

      stream {
        ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
        ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
        ssl_session_cache shared:STREAM-TLS:1m;
        ssl_session_timeout 4h;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_prefer_server_ciphers on;
        include /etc/nginx/streams-enabled/*.conf;
      }
  - path: /etc/nginx/streams-enabled/electrs-reverse-proxy.conf
    owner: root:root
    defer: true
    permissions: '0644'
    content: |
      upstream electrs {
        server 127.0.0.1:50001;
      }

      server {
        listen 50011 ssl;
        proxy_pass electrs;
      }
  - path: /home/electrs/electrs-setup.sh
    owner: electrs:electrs
    defer: true
    permissions: '0755'
    content: |
      #!/usr/bin/env bash

      set -euo pipefail

      export ELECTRS_VERSION=v0.10.2

      git clone https://github.com/romanz/electrs.git code

      cd code
      curl https://sh.rustup.rs | sh -s -- -y --default-toolchain none
      source "$HOME/.cargo/env"

      curl https://romanzey.de/pgp.txt | gpg --import -
      git checkout ${ELECTRS_VERSION}
      git verify-tag ${ELECTRS_VERSION}

      cargo build --locked --release

      cd ..
      mkdir data
  - path: /home/electrs/electrs.conf
    owner: electrs:electrs
    defer: true
    permissions: '0644'
    content: |
      network = "bitcoin"
      daemon_dir= "/home/bitcoin/data"
      daemon_rpc_addr = "127.0.0.1:8332"
      daemon_p2p_addr = "127.0.0.1:8333"

      # Electrs settings
      electrum_rpc_addr = "127.0.0.1:50001"
      db_dir = "/home/electrs/data"

      # Logging
      log_filters = "INFO"
      timestamp = true
  - path: /etc/systemd/system/electrs.service
    owner: root:root
    permissions: '0644'
    content: |
      [Unit]
      Description=Rust Electrum Server
      After=bitcoin.service
      PartOf=bitcoin.service

      [Service]
      ExecStart=/usr/local/bin/electrs --conf /home/electrs/electrs.conf

      Type=simple
      Restart=always
      TimeoutSec=120
      RestartSec=30
      KillMode=process

      User=electrs
      Group=electrs

      RuntimeDirectory=electrs
      RuntimeDirectoryMode=0710

      PrivateTmp=true
      PrivateDevices=true
      MemoryDenyWriteExecute=true

      [Install]
      WantedBy=multi-user.target
  - path: /etc/nginx/sites-enabled/btcexp-reverse-proxy.conf
    owner: root:root
    defer: true
    permissions: '0644'
    content: |
      server {
        listen 3012 ssl;
        error_page 497 =301 https://$host:$server_port$request_uri;
        location / {
          proxy_pass http://127.0.0.1:3002;
        }
      }
  - path: /etc/nginx/sites-enabled/cln-rest-reverse-proxy.conf
    owner: root:root
    defer: true
    permissions: '0644'
    content: |
      server {
        listen 3011 ssl;
        error_page 497 =301 https://$host:$server_port$request_uri;
        location / {
          proxy_pass http://127.0.0.1:3001;
        }
      }

      server {
        listen 4011 ssl;
        error_page 497 =301 https://$host:$server_port$request_uri;
        location / {
          proxy_pass http://127.0.0.1:4001;
        }
      }
  - path: /home/btcexp/btcexp-setup.sh
    owner: btcexp:btcexp
    defer: true
    permissions: '0755'
    content: |
      #!/usr/bin/env bash

      set -euo pipefail

      export BTCEXP_VERSION=v3.4.0

      curl https://github.com/janoside.gpg | gpg --import -

      git clone https://github.com/janoside/btc-rpc-explorer.git code
      cd code
      git checkout ${BTCEXP_VERSION}
      git verify-commit ${BTCEXP_VERSION}

      cat <<'EOF' > .env
      BTCEXP_ADDRESS_API=electrum
      BTCEXP_BITCOIND_COOKIE=/home/bitcoin/data/.cookie
      BTCEXP_BITCOIND_HOST=127.0.0.1
      BTCEXP_BITCOIND_PORT=8332
      BTCEXP_BITCOIND_RPC_TIMEOUT=10000
      BTCEXP_ELECTRUM_SERVERS=tcp://127.0.0.1:50001
      BTCEXP_HOST=127.0.0.1
      BTCEXP_LOCAL_CURRENCY=eur
      BTCEXP_NO_RATES=false
      BTCEXP_PORT=3002
      BTCEXP_PRIVACY_MODE=false
      BTCEXP_SLOW_DEVICE_MODE=false
      BTCEXP_UI_HIDE_INFO_NOTES=true
      BTCEXP_UI_THEME=dark
      EOF

      npm install
  - path: /etc/systemd/system/btcexp.service
    owner: root:root
    permissions: '0644'
    content: |
      [Unit]
      Description=BTC RPC Explorer
      After=bitcoin.service electrs.service
      PartOf=bitcoin.service

      [Service]
      WorkingDirectory=/home/btcexp/code
      ExecStart=/usr/bin/npm start

      User=btcexp
      Group=btcexp

      Restart=always
      RestartSec=30

      [Install]
      WantedBy=multi-user.target
  - path: /home/cln/cln-setup.sh
    owner: cln:cln
    defer: true
    permissions: '0755'
    content: |
      #!/usr/bin/env bash

      set -euo pipefail

      mkdir .bitcoin
      echo "datadir=/home/bitcoin/data" > .bitcoin/bitcoin.conf

      export CLN_REST_VERSION=v0.10.7

      curl https://keybase.io/suheb/pgp_keys.asc | gpg --import -
      curl https://raw.githubusercontent.com/1ma/dockertronics/master/core-lightning/developer_pubkeys.pem | gpg --import -

      mkdir code
      cd code
      git clone https://github.com/Ride-The-Lightning/c-lightning-REST
      cd c-lightning-REST
      git checkout ${CLN_REST_VERSION}
      git verify-tag ${CLN_REST_VERSION}
      npm install

      export CLN_VERSION=v23.11.2
      export LDFLAGS="-s"

      cd ..
      git clone https://github.com/ElementsProject/lightning

      cd lightning
      git checkout ${CLN_VERSION}
      git verify-tag ${CLN_VERSION}

      ./configure \
        --disable-rust \
        --enable-static

      make -j$(nproc)

      export TEOS_COMMIT=a4accedfeecf46edb9c22738ac9787b80dc8af02

      curl https://sh.rustup.rs | sh -s -- -y
      source "$HOME/.cargo/env"

      cd ..
      git clone https://github.com/talaia-labs/rust-teos
      cd rust-teos
      git checkout ${TEOS_COMMIT}
      cargo install --path watchtower-plugin

      cd $HOME
      mkdir -p .lightning/bitcoin .lightning/plugins
      chmod 750 .lightning .lightning/bitcoin .lightning/plugins

      # Install CLN plugins
      mv /home/cln/code/rust-teos/target/release/watchtower-client /home/cln/.lightning/plugins
      ln -s /home/cln/code/c-lightning-REST/clrest.js /home/cln/.lightning/plugins/
  - path: /home/cln/config.txt
    owner: cln:cln
    defer: true
    permissions: '0640'
    content: |
      alias=autonode
      rgb=009900

      network=bitcoin
      log-level=info

      rpc-file-mode=0660

      # default fees and channel min size
      fee-base=0
      fee-per-satoshi=0
      min-capacity-sat=1000000

      ## optional
      # wumbo channels
      large-channels
      # channel confirmations needed
      funding-confirms=2
      # autoclean (86400=daily)
      autocleaninvoice-cycle=86400
      autocleaninvoice-expired-by=86400

      wallet=sqlite3:///home/cln/lightning.sqlite3

      # network
      proxy=127.0.0.1:9050
      bind-addr=127.0.0.1:9735
      addr=statictor:127.0.0.1:9051/torport=9735
      always-use-proxy=true

      plugin-dir=/home/cln/.lightning/plugins

      # c-lightning-REST options
      rest-port=3001
      rest-docport=4001
      rest-protocol=http
      rest-bind=127.0.0.1
  - path: /etc/systemd/system/cln.service
    owner: root:root
    permissions: '0644'
    content: |
      [Unit]
      Description=Core Lightning
      Requires=bitcoin.service
      After=bitcoin.service
      Wants=network-online.target
      After=network-online.target

      [Service]
      ExecStart=/bin/sh -c 'lightningd --conf=/home/cln/config.txt'

      ExecStop=/bin/sh -c 'lightning-cli stop'

      RuntimeDirectory=lightningd

      User=cln
      Group=cln

      Type=exec
      PIDFile=/home/cln/.lightning/lightningd-bitcoin.pid
      Restart=on-failure
      TimeoutSec=240
      RestartSec=30

      # hardening measures
      PrivateTmp=true
      ProtectSystem=full
      NoNewPrivileges=true
      PrivateDevices=true

      [Install]
      WantedBy=multi-user.target
  - path: /etc/systemd/system/rtl.service
    owner: root:root
    permissions: '0644'
    content: |
      [Unit]
      Description=Ride The Lightning
      After=network.target cln.service

      [Service]
      Type=exec
      WorkingDirectory=/home/rtl/code
      ExecStart=node rtl.js

      User=rtl
      Group=rtl

      Restart=always
      RestartSec=30

      [Install]
      WantedBy=multi-user.target
  - path: /etc/nginx/sites-enabled/rtl-reverse-proxy.conf
    owner: root:root
    defer: true
    permissions: '0644'
    content: |
      server {
        listen 3010 ssl;
        error_page 497 =301 https://$host:$server_port$request_uri;
        location / {
          proxy_pass http://127.0.0.1:3000;
        }
      }
  - path: /home/rtl/RTL-Config.json
    owner: rtl:rtl
    defer: true
    permissions: '0640'
    content: |
      {
        "multiPass": "rtl",
        "port": "3000",
        "defaultNodeIndex": 1,
        "SSO": {
          "rtlSSO": 0,
          "rtlCookiePath": "",
          "logoutRedirectLink": ""
        },
        "nodes": [
          {
            "index": 1,
            "lnNode": "node01",
            "lnImplementation": "CLN",
            "Authentication": {
              "macaroonPath": "/home/cln/code/c-lightning-REST/certs",
              "configPath": "/home/cln/config.txt"
            },
            "Settings": {
              "userPersona": "OPERATOR",
              "themeMode": "NIGHT",
              "themeColor": "INDIGO",
              "channelBackupPath": "",
              "logLevel": "ERROR",
              "lnServerUrl": "http://localhost:3001",
              "fiatConversion": false
            }
          }
        ]
      }
  - path: /home/rtl/rtl-setup.sh
    owner: rtl:rtl
    defer: true
    permissions: '0755'
    content: |
      #!/usr/bin/env bash

      set -euo pipefail

      export RTL_VERSION=v0.15.0

      curl https://keybase.io/suheb/pgp_keys.asc | gpg --import -
      git clone https://github.com/Ride-The-Lightning/RTL.git code
      cd code
      git checkout ${RTL_VERSION}
      git verify-tag ${RTL_VERSION}
      npm install --omit=dev --legacy-peer-deps
      mv ../RTL-Config.json .
  - path: /home/satoshi/superuser-setup.sh
    owner: satoshi:satoshi
    defer: true
    permissions: '0755'
    content: |
      #!/usr/bin/env bash

      set -euo pipefail

      # Disable apt news
      sudo pro config set apt_news=false

      # Set up bitcoin-cli
      mkdir .bitcoin
      echo "datadir=/home/bitcoin/data" > .bitcoin/bitcoin.conf

      ln -s /home/cln/.lightning .lightning

      # Add bitcoin and cln users to the debian-tor group
      sudo usermod -aG debian-tor bitcoin
      sudo usermod -aG debian-tor cln

      # Install bitcoin binaries in /usr/local/bin
      sudo make -C /home/bitcoin/code install

      # Install electrs binary
      sudo install -m 0755 -o root -g root -t /usr/local/bin /home/electrs/code/target/release/electrs

      # Install Core Lightning binaries in /usr/local/bin
      sudo make -C /home/cln/code/lightning install

      # Create self-signed certificate for HTTPS sites and test nginx configuration
      sudo openssl req \
        -x509 \
        -nodes \
        -newkey rsa:4096 \
        -keyout /etc/ssl/private/nginx-selfsigned.key \
        -out /etc/ssl/certs/nginx-selfsigned.crt \
        -subj "/O=AutoNode" \
        -addext "basicConstraints=critical,CA:TRUE,pathlen:0" \
        -addext "subjectAltName = DNS:blackbox.lan,DNS:blackbox.vpn,IP:192.168.1.44,IP:192.168.21.1" \
        -days 36500
      sudo nginx -t

      # Set up firewall
      sudo ufw default deny incoming
      sudo ufw default allow outgoing
      sudo ufw allow 22/tcp comment 'allow SSH connections'
      sudo ufw allow 3010/tcp comment 'allow RTL SSL'
      sudo ufw allow 3012/tcp comment 'allow BTC RPC Explorer SSL'
      sudo ufw allow 50011/tcp comment 'allow Electrum SSL'
      sudo ufw allow 51820/udp comment 'allow WireGuard traffic'
      sudo ufw logging off
      sudo ufw enable

      # Enable systemd services
      sudo systemctl enable bitcoin.service
      sudo systemctl enable btcexp.service
      sudo systemctl enable electrs.service
      # sudo systemctl enable cln.service
      sudo systemctl enable rtl.service
      sudo systemctl enable i2pd.service

      export ARCH=$(dpkg --print-architecture)

      # Install Sparrow Server
      curl https://keybase.io/craigraw/pgp_keys.asc | gpg --import
      curl -OL https://github.com/sparrowwallet/sparrow/releases/download/1.8.1/sparrow-server_1.8.1-1_${ARCH}.deb
      curl -OL https://github.com/sparrowwallet/sparrow/releases/download/1.8.1/sparrow-1.8.1-manifest.txt
      curl -OL https://github.com/sparrowwallet/sparrow/releases/download/1.8.1/sparrow-1.8.1-manifest.txt.asc
      gpg --verify sparrow-1.8.1-manifest.txt.asc sparrow-1.8.1-manifest.txt
      sha256sum --ignore-missing --check sparrow-1.8.1-manifest.txt
      sudo dpkg -i sparrow-server_1.8.1-1_${ARCH}.deb
      sudo ln -s /opt/sparrow/bin/Sparrow /usr/local/bin/Sparrow