Harden transport and preserve profile identitiesHEADmain

3 files changed, 103 insertions, 0 deletions

diff --git a/deploy/n2usenet-gateway-watch b/deploy/n2usenet-gateway-watch
new file mode 100644
index 0000000..6390197
--- /dev/null
+++ b/deploy/n2usenet-gateway-watch
@@ -0,0 +1,74 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+client_home=/var/lib/n2usenet/nym
+client_bin=/opt/n2usenet/bin/nym-socks5-client
+check_bin=/opt/n2usenet/bin/n2u-check
+gateway_db="$client_home/.nym/socks5-clients/n2usenet/data/gateways_registrations.sqlite"
+backup_root=/var/lib/n2usenet-gateway-watch/backups
+renew_before_seconds=86400
+lock_file=/run/n2usenet-gateway-watch/lock
+
+exec 9>"$lock_file"
+if ! flock -n 9; then
+	exit 0
+fi
+
+for required in "$client_bin" "$check_bin" "$gateway_db" /etc/n2usenet/smtp-password; do
+	if [[ ! -e "$required" ]]; then
+		logger -t n2usenet-gateway-watch "required path is missing: $required"
+		exit 1
+	fi
+done
+
+expiry=$(sqlite3 "$gateway_db" "select d.expiration_timestamp from active_gateway a join remote_gateway_details d on d.gateway_id_bs58=a.active_gateway_id_bs58;")
+if [[ -n "$expiry" ]]; then
+	expiry_epoch=$(date -u -d "$expiry" +%s)
+	now_epoch=$(date -u +%s)
+	if (( expiry_epoch - now_epoch > renew_before_seconds )); then
+		exit 0
+	fi
+fi
+
+stamp=$(date -u +%Y%m%dT%H%M%SZ)
+backup_dir="$backup_root/$stamp"
+install -d -m 0700 "$backup_dir"
+
+restart_services() {
+	systemctl start n2usenet-socks.service || true
+	systemctl start n2usenet.service || true
+}
+trap restart_services EXIT
+
+systemctl stop n2usenet.service n2usenet-socks.service
+cp -a "$gateway_db" "$backup_dir/gateways_registrations.sqlite.before"
+
+if ! runuser -u n2usenet -- "$client_bin" add-gateway --id n2usenet --set-active -o json; then
+	cp -a "$backup_dir/gateways_registrations.sqlite.before" "$gateway_db"
+	chown n2usenet:n2usenet "$gateway_db"
+	logger -t n2usenet-gateway-watch "gateway registration failed; previous state restored"
+	exit 1
+fi
+
+chown -R n2usenet:n2usenet "$client_home/.nym"
+systemctl start n2usenet-socks.service
+sleep 5
+
+if ! "$check_bin" \
+	-socks 127.0.0.1:11080 \
+	-smtp 51.178.55.22:587 \
+	-tls-name mail.virebent.art \
+	-helo n2usenet.virebent.art \
+	-auth-user n2usenet@virebent.art \
+	-auth-password-file /etc/n2usenet/smtp-password \
+	-timeout 180s; then
+	systemctl stop n2usenet-socks.service
+	cp -a "$backup_dir/gateways_registrations.sqlite.before" "$gateway_db"
+	chown n2usenet:n2usenet "$gateway_db"
+	logger -t n2usenet-gateway-watch "new gateway failed transport verification; previous state restored"
+	exit 1
+fi
+
+systemctl start n2usenet.service
+trap - EXIT
+logger -t n2usenet-gateway-watch "gateway renewed and transport verification passed"
diff --git a/deploy/n2usenet-gateway-watch.service b/deploy/n2usenet-gateway-watch.service
new file mode 100644
index 0000000..9854ae0
--- /dev/null
+++ b/deploy/n2usenet-gateway-watch.service
@@ -0,0 +1,18 @@
+[Unit]
+Description=Renew and verify the N2Usenet Nym gateway registration
+After=network-online.target
+Wants=network-online.target
+
+[Service]
+Type=oneshot
+ExecStart=/usr/local/sbin/n2usenet-gateway-watch
+TimeoutStartSec=10min
+NoNewPrivileges=true
+PrivateTmp=true
+ProtectHome=true
+ProtectSystem=strict
+RuntimeDirectory=n2usenet-gateway-watch
+RuntimeDirectoryMode=0750
+StateDirectory=n2usenet-gateway-watch
+StateDirectoryMode=0700
+ReadWritePaths=/var/lib/n2usenet/nym
diff --git a/deploy/n2usenet-gateway-watch.timer b/deploy/n2usenet-gateway-watch.timer
new file mode 100644
index 0000000..d169872
--- /dev/null
+++ b/deploy/n2usenet-gateway-watch.timer
@@ -0,0 +1,11 @@
+[Unit]
+Description=Daily N2Usenet Nym gateway expiry check
+
+[Timer]
+OnCalendar=*-*-* 03:17:00 UTC
+RandomizedDelaySec=15m
+Persistent=true
+Unit=n2usenet-gateway-watch.service
+
+[Install]
+WantedBy=timers.target