Add proper user creation to install script

nginx.conf

@@ -1,11 +1,13 @@
-user www-data;
+user nobody;
-worker_processes auto;
+pid /var/run/nginx.pid;
-pid /run/nginx.pid;
 include /etc/nginx/modules-enabled/*.conf;
 
+worker_processes auto;
+worker_rlimit_nofile 9999;
+
 events {
-	worker_connections 768;
+	worker_connections 9000;
-	# multi_accept on;
+	multi_accept on;
 }
 
 http {
@@ -18,7 +20,7 @@ http {
 	include /etc/nginx/mime.types;
 	default_type application/octet-stream;
 
-	ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # Dropping SSLv3, ref: POODLE
+	ssl_protocols TLSv1.2 TlSv1.3;
 	ssl_prefer_server_ciphers on;
 
 	access_log /var/log/nginx/access.log;
@@ -37,45 +39,119 @@ http {
 	server {
 		listen 80;
 		listen [::]:80;
-		server_name example.com;
+		server_name __HOSTNAME_FQDN__;
 
-		if ($host = example.com) {
+		if ($host = __HOSTNAME_FQDN__) {
 			return 301 https://$host$request_uri;
-		} # managed by Certbot
+		}
 
-		return 404; # managed by Certbot
+		return 404;
 	}
 
 	server {
-		listen [::]:443 ssl http2; # managed by Certbot
+		listen 127.0.0.1:81;
-		listen 443 ssl http2; # managed by Certbot
+		listen [::]:443 ssl default http2;
-		ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem; # managed by Certbot
+		listen 443 ssl default http2;
-		ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem; # managed by Certbot
-		include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
-		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
 
-		server_name example.com; # managed by Certbot
+		ssl_certificate /etc/letsencrypt/live/__HOSTNAME_FQDN__/fullchain.pem;
+		ssl_certificate_key /etc/letsencrypt/live/__HOSTNAME_FQDN__/privkey.pem;
+		include /etc/letsencrypt/options-ssl-nginx.conf;
+		ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 
-		index index.html;
+		root /mempool/public_html/mainnet/;
-		root /var/www/html;
+		index index.html index.htm index.nginx-debian.html;
+
+		server_name __HOSTNAME_FQDN__;
+
+		set $frameOptions "DENY";
+		set $contentSecurityPolicy "frame-ancestors 'none'";
+		if ($http_referer ~ ^https://__HOSTNAME_FQDN__/)
+		{
+			set $frameOptions "ALLOW-FROM https://__HOSTNAME_FQDN__";
+			set $contentSecurityPolicy "frame-ancestors https://__HOSTNAME_FQDN__";
+		}
+
+		add_header X-Frame-Options $frameOptions;
+		add_header Content-Security-Policy $contentSecurityPolicy;
+		add_header Link "<https://__HOSTNAME_FQDN__$request_uri>; rel=\"canonical\"";
+		add_header Onion-Location http://__HOSTNAME_ONION__$request_uri;
+		add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload";
 
 		location / {
 			try_files $uri $uri/ /index.html =404;
 		}
 
-		location /api {
+		location /explorer {
-			proxy_pass http://127.0.0.1:8999/api;
+			rewrite /explorer/(.*) https://$host/$1 permanent;
 		}
 
-		location /electrs/ {
+		location /webhook {
-			proxy_pass http://127.0.0.1:3000/;
+			proxy_pass http://127.0.0.1:2222/;
 		}
 
-		location /ws {
+		location /api/v1/ws {
-			proxy_pass http://127.0.0.1:8999/;
+			proxy_pass http://__MEMPOOL_MAINNET_HTTP_HOST__:__MEMPOOL_MAINNET_HTTP_PORT__/;
 			proxy_http_version 1.1;
 			proxy_set_header Upgrade $http_upgrade;
 			proxy_set_header Connection "Upgrade";
 		}
+		location /api/v1 {
+			proxy_pass http://__MEMPOOL_MAINNET_HTTP_HOST__:__MEMPOOL_MAINNET_HTTP_PORT__/api/v1;
+		}
+		location /api/ {
+			proxy_pass http://__ELECTRS_MAINNET_HTTP_HOST__:__ELECTRS_MAINNET_HTTP_PORT__/;
+		}
+
+		location /mainnet/api/v1/ws {
+			proxy_pass http://__MEMPOOL_MAINNET_HTTP_HOST__:__MEMPOOL_MAINNET_HTTP_PORT__/;
+			proxy_http_version 1.1;
+			proxy_set_header Upgrade $http_upgrade;
+			proxy_set_header Connection "Upgrade";
+		}
+		location /mainnet/api/v1 {
+			proxy_pass http://__MEMPOOL_MAINNET_HTTP_HOST__:__MEMPOOL_MAINNET_HTTP_PORT__/api/v1;
+		}
+		location /mainnet/api/ {
+			proxy_pass http://__ELECTRS_MAINNET_HTTP_HOST__:__ELECTRS_MAINNET_HTTP_PORT__/;
+		}
+
+		location /liquid/api/v1/ws {
+			proxy_pass http://__MEMPOOL_LIQUID_HTTP_HOST__:__MEMPOOL_LIQUID_HTTP_PORT__/;
+			proxy_http_version 1.1;
+			proxy_set_header Upgrade $http_upgrade;
+			proxy_set_header Connection "Upgrade";
+		}
+		location /liquid/api/v1 {
+			proxy_pass http://__MEMPOOL_LIQUID_HTTP_HOST__:__MEMPOOL_LIQUID_HTTP_PORT__/api/v1;
+		}
+		location /liquid/api/ {
+			proxy_pass http://__ELECTRS_LIQUID_HTTP_HOST__:__ELECTRS_LIQUID_HTTP_PORT__/;
+		}
+
+		location /testnet/api/v1/ws {
+			proxy_pass http://__MEMPOOL_TESTNET_HTTP_HOST__:__MEMPOOL_TESTNET_HTTP_PORT__/;
+			proxy_http_version 1.1;
+			proxy_set_header Upgrade $http_upgrade;
+			proxy_set_header Connection "Upgrade";
+		}
+		location /testnet/api/v1 {
+			proxy_pass http://__MEMPOOL_TESTNET_HTTP_HOST__:__MEMPOOL_TESTNET_HTTP_PORT__/api/v1;
+		}
+		location /testnet/api/ {
+			proxy_pass http://__ELECTRS_TESTNET_HTTP_HOST__:__ELECTRS_TESTNET_HTTP_PORT__/;
+		}
+
+		location /bisq/api/v1/ws {
+			proxy_pass http://__MEMPOOL_BISQ_HTTP_HOST__:__MEMPOOL_BISQ_HTTP_PORT__/;
+			proxy_http_version 1.1;
+			proxy_set_header Upgrade $http_upgrade;
+			proxy_set_header Connection "Upgrade";
+		}
+		location /bisq/api/v1 {
+			proxy_pass http://__MEMPOOL_BISQ_HTTP_HOST__:__MEMPOOL_BISQ_HTTP_PORT__/api/v1;
+		}
+		location /bisq/api {
+			proxy_pass http://__MEMPOOL_BISQ_HTTP_HOST__:__MEMPOOL_BISQ_HTTP_PORT__/api/v1/bisq;
+		}
 	}
 }

production/bitcoin.conf

@@ -0,0 +1,20 @@
+server=1
+daemon=1
+listen=1
+discover=1
+txindex=1
+par=16
+dbcache=3700
+maxconnections=1337
+onion=127.0.0.1:9050
+rpcallowip=127.0.0.1
+rpcuser=__BITCOIN_RPC_USER__
+rpcpassword=__BITCOIN_RPC_PASS__
+
+[main]
+bind=127.0.0.1:8333
+rpcbind=127.0.0.1:8332
+
+[test]
+bind=127.0.0.1:18333
+rpcbind=127.0.0.1:18332

production/compaction.patch

@@ -0,0 +1,26 @@
+diff --git a/src/new_index/db.rs b/src/new_index/db.rs
+index ef226d3..d9d51ba 100644
+--- a/src/new_index/db.rs
++++ b/src/new_index/db.rs
+@@ -87,10 +87,10 @@ impl DB {
+         db_opts.create_if_missing(true);
+         db_opts.set_max_open_files(100_000); // TODO: make sure to `ulimit -n` this process correctly
+         db_opts.set_compaction_style(rocksdb::DBCompactionStyle::Level);
+-        db_opts.set_compression_type(rocksdb::DBCompressionType::Snappy);
++        db_opts.set_compression_type(rocksdb::DBCompressionType::Lz4);
+         db_opts.set_target_file_size_base(1_073_741_824);
+         db_opts.set_write_buffer_size(256 << 20);
+-        db_opts.set_disable_auto_compactions(true); // for initial bulk load
++        db_opts.set_disable_auto_compactions(false); // for initial bulk load
+ 
+         // db_opts.set_advise_random_on_open(???);
+         db_opts.set_compaction_readahead_size(1 << 20);
+@@ -109,7 +109,7 @@ impl DB {
+     pub fn full_compaction(&self) {
+         // TODO: make sure this doesn't fail silently
+         debug!("starting full compaction on {:?}", self.db);
+-        self.db.compact_range(None::<&[u8]>, None::<&[u8]>);
++        //self.db.compact_range(None::<&[u8]>, None::<&[u8]>);
+         debug!("finished full compaction on {:?}", self.db);
+     }
+ 

production/electrs-build-bitcoin

@@ -0,0 +1,46 @@
+#!/usr/local/bin/zsh
+# add rust and llvm90 to rpi pkg
+
+# load rust cargo if installed from rustup
+if [ -f "${HOME}/.cargo/env" ];then
+	source "${HOME}/.cargo/env"
+	export PATH="${HOME}/.cargo/bin:${PATH}"
+fi
+
+# detect architecture
+case `uname -m` in
+	amd64)
+		TARGET=x86_64-unknown-freebsd
+		;;
+	arm64) # rpi4
+		TARGET=aarch64-unknown-freebsd
+		;;
+	*)
+		echo "Error: Unknown Architecture!"
+		exit 1
+esac
+
+# run electrs in a loop
+until false
+do
+	# patch electrs source if necessary
+	cd "${HOME}"/.cargo/registry/src/github.com-*/sysconf-0.3.*/
+	patch -p1 < "$HOME/sysconf.patch"
+
+	# go home
+	cd "${HOME}/electrs"
+	cargo build \
+		--target "${TARGET}" \
+		--release \
+		--bin electrs \
+		-- \
+		-vvvv \
+		--address-search \
+		--daemon-dir "${HOME}" \
+		--http-addr '[::]:3000' \
+		--cookie "${BITCOIN_MAINNET_RPC_USER}:${BITCOIN_MAINNET_RPC_PASS}" \
+		--precache-scripts "${HOME}/electrs/contrib/popular-scripts.txt"
+	sleep 1
+done
+
+exit 0

production/electrs-start-bitcoin

@@ -0,0 +1,58 @@
+#!/usr/local/bin/zsh
+
+# TODO: add rust and llvm90 to installer pkg list if rpi4 arch detected
+# TODO: add network as argument
+# TODO: get env vars from global settings file for RPC, etc.
+# TODO: patch to disable compaction if settings wants that
+
+# load rust cargo if installed from rustup
+if [ -f "${HOME}/.cargo/env" ];then
+	source "${HOME}/.cargo/env"
+	export PATH="${HOME}/.cargo/bin:${PATH}"
+fi
+
+# detect architecture
+case `uname -m` in
+	amd64)
+		export TARGET=x86_64-unknown-freebsd
+		;;
+
+	arm64)
+		# need to compile rustc with target set for rpi4 etc.
+		export TARGET=aarch64-unknown-freebsd
+
+		# NB: need to load libgcc_s.so from gcc9 instead of /lib !!
+		export LD_LIBRARY_PATH=/usr/local/lib/gcc9
+		;;
+	*)
+		echo "Error: Unknown Architecture!"
+		exit 1
+esac
+
+# run electrs in a loop
+until false
+do
+	# patch electrs source
+	# if file exists and grep contains strings, patch it
+	cd "${HOME}"/.cargo/registry/src/github.com-*/sysconf-0.3.*/
+	patch -p1 < sysconf.patch
+
+	# go home
+	cd "${HOME}/electrs"
+	cargo run \
+		--target "${TARGET}" \
+		--release \
+		--bin electrs \
+		-- \
+		-vvvv \
+		--light-mode \
+		--address-search \
+		--db-dir /electrs \
+		--daemon-dir "${HOME}" \
+		--http-addr '[::]:3000' \
+		--cookie "${BITCOIN_MAINNET_RPC_USER}:${BITCOIN_MAINNET_RPC_PASS}" \
+		--precache-scripts "${HOME}/electrs/contrib/popular-scripts.txt"
+	sleep 1
+done
+
+exit 0

production/electrs-start-mainnet

@@ -1,19 +0,0 @@
-#!/usr/local/bin/zsh
-cd /electrs
-source $HOME/.cargo/env
-export PATH=$HOME/.cargo/bin:$PATH
-
-until false
-do
-	cargo run \
-		--release \
-		--bin electrs \
-		-- \
-		-vvvv \
-		--address-search \
-		--daemon-dir /bitcoin \
-		--http-addr '[::]:3000' \
-		--cookie 'user:pass' \
-		--precache-scripts /electrs/contrib/popular-scripts.txt
-	sleep 1
-done

production/electrs-start-testnet

@@ -1,19 +0,0 @@
-#!/usr/local/bin/zsh
-cd /electrs
-source $HOME/.cargo/env
-export PATH=$HOME/.cargo/bin:$PATH
-
-until false
-do
-	cargo run \
-		--release \
-		--bin electrs \
-		-- \
-		-vv \
-		--network testnet \
-		--daemon-dir /bitcoin \
-		--http-addr '[::]:3002' \
-		--cookie 'user:pass' \
-		--precache-scripts /electrs/contrib/popular-scripts.txt
-	sleep 1
-done

production/rc.conf

@@ -0,0 +1,39 @@
+zfs_enable="YES"
+sendmail_enable="NONE"
+clear_tmp_enable="YES"
+syslogd_flags="-b 127.0.0.1"
+dumpdev="NO"
+
+hostname="mempool.local"
+ifconfig_genet0="DHCP"
+local_unbound_enable="YES"
+
+ntpdate_enable="YES"
+ntpdate_hosts="time.nist.gov"
+
+sshd_enable="NO"
+openssh_enable="YES"
+openssh_flags=" \
+-o 'Port 22' \
+-o 'UseDNS no' \
+-o 'KexAlgorithms curve25519-sha256@libssh.org,diffie-hellman-group-exchange-sha256' \
+-o 'AuthenticationMethods publickey,keyboard-interactive' \
+-o 'PermitRootLogin no' \
+"
+
+firewall_enable="YES"
+firewall_quiet="YES"
+firewall_type="workstation"
+firewall_myservices="8333/tcp"
+firewall_allowservices="any"
+firewall_logdeny="YES"
+firewall_trusted="192.168.0.0/16,172.16.0.0/12,10.0.0.0/8"
+
+bitcoin_enable="YES"
+bitcoin_testnet_enable="YES"
+
+nginx_enable="YES"
+tor_enable="YES"
+
+mysql_enable="YES"
+mysql_dbdir="/mysql"

production/rc.d/bitcoin

@@ -0,0 +1,179 @@
+#!/bin/sh
+# PROVIDE: bitcoin
+# REQUIRE: LOGIN cleanvar
+# KEYWORD: shutdown
+
+#
+# Add the following lines to /etc/rc.conf to enable :
+# bitcoin_enable (bool):	Set to "NO" by default.
+#				Set it to "YES" to enable bitcoin
+# bitcoin_user (str)		Set to "bitcoin" by default.
+# bitcoin_group (str)		Set to "bitcoin" by default.
+# bitcoin_conf (str)		Set to "/bitcoin/bitcoin.conf" by default.
+# bitcoin_data_dir (str)	Set to "/bitcoin" by default.
+# bitcoin_syslog_facility(str)	Set to "local0" by default.
+# bitcoin_syslog_priority(str)	Set to "info" by default.
+# bitcoinlimits_enable (bool)	Set to "NO" by default.
+#				Set it to "YES" to enable bitcoinlimits
+# bitcoinlimits_args		Set to "-e -U ${bitcoin_user}" by default
+
+
+. /etc/rc.subr
+
+name="bitcoin"
+rcvar=bitcoin_enable
+
+start_precmd="bitcoin_precmd"
+start_cmd="bitcoin_start"
+restart_precmd="bitcoin_checkconfig"
+reload_precmd="bitcoin_checkconfig"
+configtest_cmd="bitcoin_checkconfig"
+status_cmd="bitcoin_status"
+stop_cmd="bitcoin_stop"
+stop_postcmd="bitcoin_wait"
+command="/usr/local/bin/bitcoind"
+daemon_command="/usr/sbin/daemon"
+extra_commands="configtest"
+pidfile="/bitcoin/bitcoind.pid"
+
+: ${bitcoin_enable:="NO"}
+: ${bitcoinlimits_enable:="NO"}
+
+load_rc_config ${name}
+
+: ${bitcoin_user:="bitcoin"}
+: ${bitcoin_group:="bitcoin"}
+: ${bitcoin_data_dir:="/bitcoin"}
+: ${bitcoin_config_file:="/bitcoin/bitcoin.conf"}
+: ${bitcoin_syslog_facility:="local0"}
+: ${bitcoin_syslog_priority:="info"}
+: ${bitcoin_syslog_tag:="bitcoin"}
+: ${bitcoin_kill_after:="300"}
+: ${bitcoinlimits_args:="-e -U ${bitcoin_user}"}
+
+# set up dependant variables
+procname="${command}"
+required_files="${bitcoin_config_file}"
+pidfile="${bitcoin_data_dir}/bitcoind.pid"
+
+bitcoin_checkconfig()
+{
+  echo "Performing sanity check on bitcoin configuration:"
+  if [ ! -d "${bitcoin_data_dir}" ]
+  then
+    echo "Missing data directory: ${bitcoin_data_dir}"
+    exit 1
+  fi
+  chown -R "${bitcoin_user}:${bitcoin_group}" "${bitcoin_data_dir}"
+
+  if [ ! -f "${bitcoin_config_file}" ]
+  then
+    echo "Missing configuration file: ${bitcoin_config_file}"
+    exit 1
+  fi
+  if [ ! -x "${command}" ]
+  then
+    echo "Missing executable: ${command}"
+    exit 1
+  fi
+  return 0
+}
+
+bitcoin_cleanup()
+{
+  rm -f "${pidfile}"
+}
+
+bitcoin_precmd()
+{
+  bitcoin_checkconfig
+
+  pid=$(check_pidfile "${pidfile}" "${procname}")
+  if [ -z "${pid}" ]
+  then
+    echo "Bitcoind is not running"
+    rm -f "${pidfile}"
+  fi
+
+  if checkyesno bitcoinlimits_enable
+  then
+    eval $(/usr/bin/limits ${bitcoinlimits_args}) 2>/dev/null
+  else
+    return 0
+  fi
+}
+
+bitcoin_status()
+{
+  local pid
+  pid=$(check_pidfile "${pidfile}" "${procname}")
+  if [ -z "${pid}" ]
+  then
+    echo "Bitcoind is not running"
+    return 1
+  else
+    echo "Bitcoind running, pid: ${pid}"
+  fi
+}
+
+bitcoin_start()
+{
+  echo "Starting bitcoin:"
+  cd "${bitcoin_data_dir}" || return 1
+  ${daemon_command} \
+    -u "${bitcoin_user}" \
+    -l "${bitcoin_syslog_facility}" \
+    -s "${bitcoin_syslog_priority}" \
+    -T "${bitcoin_syslog_tag}" \
+    ${command} \
+    -printtoconsole=1 \
+    -conf="${bitcoin_config_file}" \
+    -datadir="${bitcoin_data_dir}"
+}
+
+bitcoin_stop()
+{
+  echo "Stopping bitcoin:"
+  pid=$(check_pidfile "${pidfile}" "${procname}")
+  if [ -z "${pid}" ]
+  then
+    echo "Bitcoind is not running"
+    return 1
+  else
+    kill ${pid}
+  fi
+}
+
+bitcoin_wait()
+{
+  local n="${bitcoin_kill_after}"
+  echo "Waiting for bitcoin shutdown:"
+  while :
+  do
+    printf '.'
+    pid=$(check_pidfile "${pidfile}" "${procname}")
+    if [ -z "${pid}" ]
+    then
+      printf '\n'
+      break
+    fi
+    sleep 1
+    n=$((${n} - 1))
+    if [ ${n} -eq 0 -a -f "${pidfile}" ]
+    then
+      printf "\nForce shutdown"
+      kill -9 $(cat "${pidfile}")
+      for n in 1 2 3
+      do
+        printf '.'
+        sleep 1
+      done
+      printf '\n'
+      break
+    fi
+  done
+  rm -f "${pidfile}"
+  echo "Shutdown complete"
+}
+
+run_rc_command "$1"

production/rc.d/bitcoin_testnet

@@ -0,0 +1,180 @@
+#!/bin/sh
+# PROVIDE: bitcoin_testnet
+# REQUIRE: LOGIN cleanvar
+# KEYWORD: shutdown
+
+#
+# Add the following lines to /etc/rc.conf to enable :
+# bitcoin_testnet_enable (bool):	Set to "NO" by default.
+#				Set it to "YES" to enable bitcoin
+# bitcoin_testnet_user (str)		Set to "bitcoin" by default.
+# bitcoin_testnet_group (str)		Set to "bitcoin" by default.
+# bitcoin_testnet_conf (str)		Set to "/bitcoin/bitcoin.conf" by default.
+# bitcoin_testnet_data_dir (str)	Set to "/var/db/bitcoin" by default.
+# bitcoin_testnet_syslog_facility(str)	Set to "local0" by default.
+# bitcoin_testnet_syslog_priority(str)	Set to "info" by default.
+# bitcoinlimits_enable (bool)	Set to "NO" by default.
+#				Set it to "YES" to enable bitcoinlimits
+# bitcoinlimits_args		Set to "-e -U ${bitcoin_testnet_user}" by default
+
+
+. /etc/rc.subr
+
+name="bitcoin_testnet"
+rcvar=bitcoin_testnet_enable
+
+start_precmd="bitcoin_testnet_precmd"
+start_cmd="bitcoin_testnet_start"
+restart_precmd="bitcoin_testnet_checkconfig"
+reload_precmd="bitcoin_testnet_checkconfig"
+configtest_cmd="bitcoin_testnet_checkconfig"
+status_cmd="bitcoin_testnet_status"
+stop_cmd="bitcoin_testnet_stop"
+stop_postcmd="bitcoin_testnet_wait"
+command="/usr/local/bin/bitcoind"
+daemon_command="/usr/sbin/daemon"
+extra_commands="configtest"
+pidfile="/bitcoin/bitcoin.pid"
+
+: ${bitcoin_testnet_enable:="NO"}
+: ${bitcoinlimits_enable:="NO"}
+
+load_rc_config ${name}
+
+: ${bitcoin_testnet_user:="bitcoin"}
+: ${bitcoin_testnet_group:="bitcoin"}
+: ${bitcoin_testnet_data_dir:="/bitcoin"}
+: ${bitcoin_testnet_config_file:="/bitcoin/bitcoin.conf"}
+: ${bitcoin_testnet_syslog_facility:="local0"}
+: ${bitcoin_testnet_syslog_priority:="info"}
+: ${bitcoin_testnet_syslog_tag:="bitcoin"}
+: ${bitcoin_testnet_kill_after:="300"}
+: ${bitcoinlimits_args:="-e -U ${bitcoin_testnet_user}"}
+
+# set up dependant variables
+procname="${command}"
+required_files="${bitcoin_testnet_config_file}"
+pidfile="${bitcoin_testnet_data_dir}/testnet3/bitcoind.pid"
+
+bitcoin_testnet_checkconfig()
+{
+  echo "Performing sanity check on bitcoin configuration:"
+  if [ ! -d "${bitcoin_testnet_data_dir}" ]
+  then
+    echo "Missing data directory: ${bitcoin_testnet_data_dir}"
+    exit 1
+  fi
+  chown -R "${bitcoin_testnet_user}:${bitcoin_testnet_group}" "${bitcoin_testnet_data_dir}"
+
+  if [ ! -f "${bitcoin_testnet_config_file}" ]
+  then
+    echo "Missing configuration file: ${bitcoin_testnet_config_file}"
+    exit 1
+  fi
+  if [ ! -x "${command}" ]
+  then
+    echo "Missing executable: ${command}"
+    exit 1
+  fi
+  return 0
+}
+
+bitcoin_testnet_cleanup()
+{
+  rm -f "${pidfile}"
+}
+
+bitcoin_testnet_precmd()
+{
+  bitcoin_testnet_checkconfig
+
+  pid=$(check_pidfile "${pidfile}" "${procname}")
+  if [ -z "${pid}" ]
+  then
+    echo "Bitcoind is not running"
+    rm -f "${pidfile}"
+  fi
+
+  if checkyesno bitcoinlimits_enable
+  then
+    eval $(/usr/bin/limits ${bitcoinlimits_args}) 2>/dev/null
+  else
+    return 0
+  fi
+}
+
+bitcoin_testnet_status()
+{
+  local pid
+  pid=$(check_pidfile "${pidfile}" "${procname}")
+  if [ -z "${pid}" ]
+  then
+    echo "Bitcoind is not running"
+    return 1
+  else
+    echo "Bitcoind running, pid: ${pid}"
+  fi
+}
+
+bitcoin_testnet_start()
+{
+  echo "Starting bitcoin:"
+  cd "${bitcoin_testnet_data_dir}" || return 1
+  ${daemon_command} \
+    -u "${bitcoin_testnet_user}" \
+    -l "${bitcoin_testnet_syslog_facility}" \
+    -s "${bitcoin_testnet_syslog_priority}" \
+    -T "${bitcoin_testnet_syslog_tag}" \
+    ${command} \
+    -testnet \
+    -printtoconsole=1 \
+    -conf="${bitcoin_testnet_config_file}" \
+    -datadir="${bitcoin_testnet_data_dir}"
+}
+
+bitcoin_testnet_stop()
+{
+  echo "Stopping bitcoin:"
+  pid=$(check_pidfile "${pidfile}" "${procname}")
+  if [ -z "${pid}" ]
+  then
+    echo "Bitcoind is not running"
+    return 1
+  else
+    kill ${pid}
+  fi
+}
+
+bitcoin_testnet_wait()
+{
+  local n="${bitcoin_testnet_kill_after}"
+  echo "Waiting for bitcoin shutdown:"
+  while :
+  do
+    printf '.'
+    pid=$(check_pidfile "${pidfile}" "${procname}")
+    if [ -z "${pid}" ]
+    then
+      printf '\n'
+      break
+    fi
+    sleep 1
+    n=$((${n} - 1))
+    if [ ${n} -eq 0 -a -f "${pidfile}" ]
+    then
+      printf "\nForce shutdown"
+      kill -9 $(cat "${pidfile}")
+      for n in 1 2 3
+      do
+        printf '.'
+        sleep 1
+      done
+      printf '\n'
+      break
+    fi
+  done
+  rm -f "${pidfile}"
+  echo "Shutdown complete"
+}
+
+run_rc_command "$1"

production/sysconf.patch

@@ -0,0 +1,12 @@
+--- a/src/raw.rs	2020-10-22 05:59:43.747207000 +0000
++++ b/src/raw2.rs	2020-10-22 06:00:04.016688000 +0000
+@@ -82,9 +82,6 @@
+     Sc2CharTerm = sc!(_SC_2_CHAR_TERM),
+     Sc2CVersion = 96, // TODO(joshlf): Switch to a libc constant once it's added
+     Sc2Upe = sc!(_SC_2_UPE),
+-    ScXbs5Ilp32Off32 = sc!(_SC_XBS5_ILP32_OFF32),
+-    ScXbs5Ilp32Offbig = sc!(_SC_XBS5_ILP32_OFFBIG),
+-    ScXbs5LpbigOffbig = sc!(_SC_XBS5_LPBIG_OFFBIG),
+ }
+ 
+ /// Query the system's configuration.

production/syslog.d/bitcoin.conf

@@ -0,0 +1,3 @@
+local0.info /var/log/bitcoind.mainnet
+local1.info /var/log/bitcoind.testnet
+local2.info /var/log/elementsd.liquid

production/torrc

@@ -0,0 +1,13 @@
+RunAsDaemon 1
+SOCKSPort 9050
+ControlPort 9051
+Log notice syslog
+
+CookieAuthentication 1
+CookieAuthFileGroupReadable 1
+CookieAuthFile /var/db/tor/control_auth_cookie
+DataDirectoryGroupReadable 1
+
+HiddenServiceDir /var/db/tor/mempool
+HiddenServicePort 80 127.0.0.1:81
+HiddenServiceVersion 3