#!/usr/bin/bash
# Все команды выполняются от Root
# Внешние переменные Terraform следует начинать с TEMPLATE_

cat <<EOF
##########
# SSH
##########
EOF
# Ключи
echo "start ${TEMPLATE_PROVIDER} node index ${TEMPLATE_INSTANCE_INDEX}" >>/var/log/cloud-init-output.log
FLAG_FILE="/var/cloud-init.flag"

if [ -f "$FLAG_FILE" ]; then
  echo "Already run. Exit" >>/var/log/cloud-init-output.log
  exit 0
fi

if [[ "$TEMPLATE_PROVIDER" == "aws" ]]; then
  echo 'add ssh keys' >>/var/log/cloud-init-output.log
  rm -f /root/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDeKp5kCtVOAeOb0BtexF5DKTb8QTnxXadiyRdDLdmSA6qv6tFIqPwvJ//8TRp4gvuLbDF+zPMTi3nW2Rf4iAkxIKP9clhap8IS33CXW1VqJi8ynEF7aFVvK1Fcq8XezZnarzbwXDmTuTt7l115MXdOEYrWoSew8NnxHC3wAia2GLyYbCrHmqJca/N0BvgoLK1LhQ3O882Xr5ZXktKNgYRD/kAz/rHMLc/2XST5c/TPo/bq/AmwrdqaBxTG3pM1ntRJxB2M4StpitlH2PTtjNSrmXIFA+KGsA5IlYbGNyi6Z3Jz0fKLdUNNMnFagU1ODU5t9A0y4gmye3Rx56DnsSTw4hyFpG9qC3Kz8E4rbDL5n5WzBXTkO/qTP1HTJ8vNCN2gF4JaJVBDTU3HsVISFiEgmsgEJ5TgwyEEYH4BzpGMeU7YcgNqhSYl/ZnztbWrfH3S72nV7uYWyZnAJRHQiGFxg+oYGsc4tM0Lqszv9/Z/TfnJ/qfJcHBhYugCV44p1nn/UULP8Nfv2oochYyYmMEy2iWJKcDB0E4ooAfTelpr/UtWnPjV9OES2tD9+/IZkSGjhtJYkk0jfRrIL02MDtoX9rLvXSevWB33YHoRIZ4bkA8TyHtKEl17ZQp58A48p6MdFGiqaXLCe41VOVwGcPjyDLtuN4jxtSdoOjcdcv9y3Q== alex@Oleksandrs-MBP" >>/home/ec2-user/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDeKp5kCtVOAeOb0BtexF5DKTb8QTnxXadiyRdDLdmSA6qv6tFIqPwvJ//8TRp4gvuLbDF+zPMTi3nW2Rf4iAkxIKP9clhap8IS33CXW1VqJi8ynEF7aFVvK1Fcq8XezZnarzbwXDmTuTt7l115MXdOEYrWoSew8NnxHC3wAia2GLyYbCrHmqJca/N0BvgoLK1LhQ3O882Xr5ZXktKNgYRD/kAz/rHMLc/2XST5c/TPo/bq/AmwrdqaBxTG3pM1ntRJxB2M4StpitlH2PTtjNSrmXIFA+KGsA5IlYbGNyi6Z3Jz0fKLdUNNMnFagU1ODU5t9A0y4gmye3Rx56DnsSTw4hyFpG9qC3Kz8E4rbDL5n5WzBXTkO/qTP1HTJ8vNCN2gF4JaJVBDTU3HsVISFiEgmsgEJ5TgwyEEYH4BzpGMeU7YcgNqhSYl/ZnztbWrfH3S72nV7uYWyZnAJRHQiGFxg+oYGsc4tM0Lqszv9/Z/TfnJ/qfJcHBhYugCV44p1nn/UULP8Nfv2oochYyYmMEy2iWJKcDB0E4ooAfTelpr/UtWnPjV9OES2tD9+/IZkSGjhtJYkk0jfRrIL02MDtoX9rLvXSevWB33YHoRIZ4bkA8TyHtKEl17ZQp58A48p6MdFGiqaXLCe41VOVwGcPjyDLtuN4jxtSdoOjcdcv9y3Q== alex@Oleksandrs-MBP" >>/root/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSE7hc9cVvWSLE2x0obvn/4a+sQ9SNHCkThbDy6Z32XyxnEFPkkWbZZd99oKKhbdBknVQA79C8hKu74lMFjTiGrxU4hMvLuJYSy9rTFXrjpjHEWHa/IjgAp87FygB/9Z7QgwHP0qaMk77MYp79tClTD+LeQAKKYOYCS1rv7VgolLYw58DCDqzIKOBIUaO9wKwUVLs1yktJl0P5pMaC1rr1HykiK96hO6rZvqkR6YXXvzRTLOsJmL5gW+emqlFrYocf3qkwGSYbzyg22/suJ/LY5jKh4iP4+g53sXRgJO70esrOv+3BEPpqRaZyedNXEUhc7Jr47IXS8Wj3y7xaRTmx tech-key" >>/root/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUzcGDGh6IUEHMhnoR0gjw6itvXNnWHtjwDyiIe0W9+Dq1vE7HJmPYNjeeM9QbbG1F4pTwI7qunXyvdJQUgGt/Zyc9UhK03u2YoNrhpJe+u+gHSwP0TBXogausFjzL/9C0K1CCsWhDwho8Vw+PqAHmgfzGXgoP5tFfd53lrk8EE/I2JremLhTriz4dAAVoAb+lqV+zurI1SSkLR/FHjg6zSFqqGe8OVC66yFZ51Wm6pMVkUeHPlzs6KigtgMCD17KSfRzeJMaodmcXsBAXQrcoZ+YZEMulXFhcLlNOkwqcsayyYLoXpy8FZRmm1sahPS34Y8G8zcECUeTDiEckZTCJ mezin@mezin" >>/home/ec2-user/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUzcGDGh6IUEHMhnoR0gjw6itvXNnWHtjwDyiIe0W9+Dq1vE7HJmPYNjeeM9QbbG1F4pTwI7qunXyvdJQUgGt/Zyc9UhK03u2YoNrhpJe+u+gHSwP0TBXogausFjzL/9C0K1CCsWhDwho8Vw+PqAHmgfzGXgoP5tFfd53lrk8EE/I2JremLhTriz4dAAVoAb+lqV+zurI1SSkLR/FHjg6zSFqqGe8OVC66yFZ51Wm6pMVkUeHPlzs6KigtgMCD17KSfRzeJMaodmcXsBAXQrcoZ+YZEMulXFhcLlNOkwqcsayyYLoXpy8FZRmm1sahPS34Y8G8zcECUeTDiEckZTCJ mezin@mezin" >>/root/.ssh/authorized_keys
  echo ${TEMPLATE_SSH_KEY} >>/root/.ssh/authorized_keys
  echo 'PermitRootLogin yes' >>/etc/ssh/sshd_config
  USER=ec2-user
elif [[ "$TEMPLATE_PROVIDER" == "digitalocean" || "$TEMPLATE_PROVIDER" == "hcloud" || "$TEMPLATE_PROVIDER" == "google" || "$TEMPLATE_PROVIDER" == "ovh" ]]; then
  echo 'add ssh keys' >>/var/log/cloud-init-output.log
  mkdir -pv /root/.ssh -m 600
  echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4XwxlyDb1vQNZGa3OKYPPwNtg/eVKwo3+Afo9UfOV3" >>/root/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSE7hc9cVvWSLE2x0obvn/4a+sQ9SNHCkThbDy6Z32XyxnEFPkkWbZZd99oKKhbdBknVQA79C8hKu74lMFjTiGrxU4hMvLuJYSy9rTFXrjpjHEWHa/IjgAp87FygB/9Z7QgwHP0qaMk77MYp79tClTD+LeQAKKYOYCS1rv7VgolLYw58DCDqzIKOBIUaO9wKwUVLs1yktJl0P5pMaC1rr1HykiK96hO6rZvqkR6YXXvzRTLOsJmL5gW+emqlFrYocf3qkwGSYbzyg22/suJ/LY5jKh4iP4+g53sXRgJO70esrOv+3BEPpqRaZyedNXEUhc7Jr47IXS8Wj3y7xaRTmx tech-key" >>/root/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUzcGDGh6IUEHMhnoR0gjw6itvXNnWHtjwDyiIe0W9+Dq1vE7HJmPYNjeeM9QbbG1F4pTwI7qunXyvdJQUgGt/Zyc9UhK03u2YoNrhpJe+u+gHSwP0TBXogausFjzL/9C0K1CCsWhDwho8Vw+PqAHmgfzGXgoP5tFfd53lrk8EE/I2JremLhTriz4dAAVoAb+lqV+zurI1SSkLR/FHjg6zSFqqGe8OVC66yFZ51Wm6pMVkUeHPlzs6KigtgMCD17KSfRzeJMaodmcXsBAXQrcoZ+YZEMulXFhcLlNOkwqcsayyYLoXpy8FZRmm1sahPS34Y8G8zcECUeTDiEckZTCJ mezin@mezin" >>/root/.ssh/authorized_keys
  sed -i 's/PermitRootLogin no/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
  echo 'PermitRootLogin yes' >>/etc/ssh/sshd_config
  echo 'add sshd restart' >>/var/log/cloud-init-output.log
  service sshd restart
  USER=root
elif [[ "$TEMPLATE_PROVIDER" == "azure" ]]; then
  echo 'add ssh keys for azure' >>/var/log/cloud-init-output.log
  mkdir -pv /root/.ssh -m 600
  mkdir -pv /home/info/.ssh -m 600
  chown info:info /home/info/.ssh

  echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4XwxlyDb1vQNZGa3OKYPPwNtg/eVKwo3+Afo9UfOV3" >>/root/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSE7hc9cVvWSLE2x0obvn/4a+sQ9SNHCkThbDy6Z32XyxnEFPkkWbZZd99oKKhbdBknVQA79C8hKu74lMFjTiGrxU4hMvLuJYSy9rTFXrjpjHEWHa/IjgAp87FygB/9Z7QgwHP0qaMk77MYp79tClTD+LeQAKKYOYCS1rv7VgolLYw58DCDqzIKOBIUaO9wKwUVLs1yktJl0P5pMaC1rr1HykiK96hO6rZvqkR6YXXvzRTLOsJmL5gW+emqlFrYocf3qkwGSYbzyg22/suJ/LY5jKh4iP4+g53sXRgJO70esrOv+3BEPpqRaZyedNXEUhc7Jr47IXS8Wj3y7xaRTmx tech-key" >>/root/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUzcGDGh6IUEHMhnoR0gjw6itvXNnWHtjwDyiIe0W9+Dq1vE7HJmPYNjeeM9QbbG1F4pTwI7qunXyvdJQUgGt/Zyc9UhK03u2YoNrhpJe+u+gHSwP0TBXogausFjzL/9C0K1CCsWhDwho8Vw+PqAHmgfzGXgoP5tFfd53lrk8EE/I2JremLhTriz4dAAVoAb+lqV+zurI1SSkLR/FHjg6zSFqqGe8OVC66yFZ51Wm6pMVkUeHPlzs6KigtgMCD17KSfRzeJMaodmcXsBAXQrcoZ+YZEMulXFhcLlNOkwqcsayyYLoXpy8FZRmm1sahPS34Y8G8zcECUeTDiEckZTCJ mezin@mezin" >>/root/.ssh/authorized_keys

  echo "ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIB4XwxlyDb1vQNZGa3OKYPPwNtg/eVKwo3+Afo9UfOV3" >>/home/info/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSE7hc9cVvWSLE2x0obvn/4a+sQ9SNHCkThbDy6Z32XyxnEFPkkWbZZd99oKKhbdBknVQA79C8hKu74lMFjTiGrxU4hMvLuJYSy9rTFXrjpjHEWHa/IjgAp87FygB/9Z7QgwHP0qaMk77MYp79tClTD+LeQAKKYOYCS1rv7VgolLYw58DCDqzIKOBIUaO9wKwUVLs1yktJl0P5pMaC1rr1HykiK96hO6rZvqkR6YXXvzRTLOsJmL5gW+emqlFrYocf3qkwGSYbzyg22/suJ/LY5jKh4iP4+g53sXRgJO70esrOv+3BEPpqRaZyedNXEUhc7Jr47IXS8Wj3y7xaRTmx tech-key" >>/home/info/.ssh/authorized_keys
  echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUzcGDGh6IUEHMhnoR0gjw6itvXNnWHtjwDyiIe0W9+Dq1vE7HJmPYNjeeM9QbbG1F4pTwI7qunXyvdJQUgGt/Zyc9UhK03u2YoNrhpJe+u+gHSwP0TBXogausFjzL/9C0K1CCsWhDwho8Vw+PqAHmgfzGXgoP5tFfd53lrk8EE/I2JremLhTriz4dAAVoAb+lqV+zurI1SSkLR/FHjg6zSFqqGe8OVC66yFZ51Wm6pMVkUeHPlzs6KigtgMCD17KSfRzeJMaodmcXsBAXQrcoZ+YZEMulXFhcLlNOkwqcsayyYLoXpy8FZRmm1sahPS34Y8G8zcECUeTDiEckZTCJ mezin@mezin" >>/home/info/.ssh/authorized_keys

  sed -i 's/PermitRootLogin no/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
  echo 'PermitRootLogin yes' >>/etc/ssh/sshd_config
  echo 'add sshd restart' >>/var/log/cloud-init-output.log
  service sshd restart
  USER=info
fi

cat <<EOF
###########
# Workspace
###########
EOF

echo 'update package' >>/var/log/cloud-init-output.log
apt-get update -y
echo 'install package' >>/var/log/cloud-init-output.log
apt-get install -y nginx htop mc logrotate tar wget nano unzip

if [[ "$TEMPLATE_PROVIDER" == "google" ]]; then
  restorecon -rv /usr/sbin/nginx
  setsebool -P httpd_can_network_connect 1
fi


echo 'create dirs' >>/var/log/cloud-init-output.log
mkdir -pv /opt/wf -m 775
mkdir -pv /opt/wf/bin -m 775
mkdir -pv /opt/wf/systemd -m 775
mkdir -pv /opt/wf/data -m 775
mkdir -pv /opt/wf/data/logs -m 775

mount_disk() {
  local SYMLINK="$1"
  local MOUNT_DIR="$2"
  mkdir -pv $MOUNT_DIR -m 775
  echo "start mount $SYMLINK to $MOUNT_DIR" >>/var/log/cloud-init-output.log
  while [ ! -e "$SYMLINK" ]; do
      echo "Waiting for $SYMLINK to appear..."
      sleep 5
  done
  DEVICE=$(readlink -f $SYMLINK)
  if [ ! -e "$DEVICE" ]; then
        echo "Device doesn't found: $DEVICE" >>/var/log/cloud-init-output.log
    else
      mkfs -t ext4 $DEVICE
      UUID=$(blkid -s UUID -o value $DEVICE)
      if [ -z "$UUID" ]; then
          echo "Can't get UUID for $DEVICE" >>/var/log/cloud-init-output.log
      else
        echo "UUID=$UUID $MOUNT_DIR ext4 rw 0 2" | tee -a /etc/fstab
        mount -v $MOUNT_DIR
      fi
    fi

}

if [[ "$TEMPLATE_PROVIDER" == "google" ]]; then
  mount_disk "/dev/disk/by-id/google-waterfall-testnet5-node-${TEMPLATE_INSTANCE_INDEX}-logs-disk" "/opt/wf/data/logs"

elif [[ "$TEMPLATE_PROVIDER" == "digitalocean"  ]]; then
  mount_disk "/dev/disk/by-id/scsi-0DO_Volume_waterfall-testnet5-node-${TEMPLATE_INSTANCE_INDEX}-logs-disk" "/opt/wf/data/logs"

elif [[ "$TEMPLATE_PROVIDER" == "hcloud"  ]]; then
  mount_disk "/dev/disk/by-id/scsi-0HC_Volume_${TEMPLATE_LOGS_VOLUME_ID}" "/opt/wf/data/logs"
elif [[ "$TEMPLATE_PROVIDER" == "azure"  ]]; then
  mount_disk "/dev/disk/azure/scsi1/lun0" "/opt/wf/data/logs"
elif [[ "$TEMPLATE_PROVIDER" == "ovh" ]]; then
  # OpenStack не гарантирует имя устройства, и транспорт зависит от flavor: том приходит
  # то как /dev/vdb (virtio-blk, ссылка virtio-<serial>), то как /dev/sdb (virtio-scsi,
  # ссылка scsi-0QEMU_QEMU_HARDDISK_<serial>). На b3-32-flex у mainnet — второй случай.
  # Serial в обоих вариантах один: первые 20 символов uuid тома. По нему и ищем.
  OVH_LOGS_SERIAL=${TEMPLATE_LOGS_VOLUME_ID:0:20}
  OVH_LOGS_LINK=""
  for _ in $(seq 1 60); do
    OVH_LOGS_LINK=$(find /dev/disk/by-id -maxdepth 1 -name "*${OVH_LOGS_SERIAL}*" ! -name '*-part*' 2>/dev/null | head -1)
    [ -n "$OVH_LOGS_LINK" ] && break
    sleep 5
  done
  if [ -z "$OVH_LOGS_LINK" ]; then
    echo "Logs volume $OVH_LOGS_SERIAL not found in /dev/disk/by-id" >>/var/log/cloud-init-output.log
    exit 1
  fi
  echo "logs volume: $OVH_LOGS_LINK" >>/var/log/cloud-init-output.log
  mount_disk "$OVH_LOGS_LINK" "/opt/wf/data/logs"
fi


mkdir -pv /opt/wf/data/logs -m 775
mkdir -pv /opt/wf/data/gwat -m 775
mkdir -pv /opt/wf/data/coordinator -m 775
touch /opt/wf/data/logs/gwat.log
touch /opt/wf/data/logs/coordinator-beacon.log
touch /opt/wf/data/logs/coordinator-validator.log
touch /opt/wf/data/logs/node-client.log

chown -Rv $USER:$USER /opt/wf/


# swap
echo 'create swap' >>/var/log/cloud-init-output.log
SWAP_FILE_SIZE=4096M
SWAPPINESS=10
fallocate -l $SWAP_FILE_SIZE /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >>/etc/fstab
sysctl vm.swappiness=$SWAPPINESS
echo "vm.swappiness=$SWAPPINESS" >>/etc/sysctl.conf

#systemctl stop ntpd
#ntpdate -bv pool.ntp.org
#systemctl start ntpd


cat <<EOF
#################
# logs
#################
EOF

echo 'create logrotate' >>/var/log/cloud-init-output.log

cat <<EOF >/etc/logrotate.d/wf
/opt/wf/data/logs/*.log {
  su root root
  daily
  rotate 5
  compress
  delaycompress
  copytruncate
}
EOF

#if [ ! -f "/etc/cron.daily/logrotate" ]; then
#cat <<EOF >/etc/cron.daily/logrotate
##!/bin/sh
#
#/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf
#EXITVALUE=$?
#if [ \$EXITVALUE != 0 ]; then
#  /usr/bin/logger -t logrotate "ALERT exited abnormally with [\$EXITVALUE]"
#fi
#exit 0
#EOF
#fi

#if [[ "$TEMPLATE_PROVIDER" == "digitalocean" ]]; then
#  semanage fcontext -a -t var_log_t /opt/wf/data/logs/
#  restorecon -v /opt/wf/data/logs/
#fi



#systemctl start logrotate

cat <<EOF
#################
# выкачиваем бинарники
#################
EOF

# Файлы с других сереверов
echo 'download bins' >>/var/log/cloud-init-output.log
#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/bin/gwat /opt/wf/bin/
#chmod -v +x /opt/wf/bin/gwat
wget ${TEMPLATE_ARTIFACT_URL}/gwat -P /opt/wf/bin/
chmod -v +x /opt/wf/bin/gwat

#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/bin/coordinator-beacon /opt/wf/bin/
#chmod -v +x /opt/wf/bin/coordinator-beacon
wget ${TEMPLATE_ARTIFACT_URL}/coordinator-beacon -P /opt/wf/bin/
chmod -v +x /opt/wf/bin/coordinator-beacon

#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/bin/coordinator-validator /opt/wf/bin/
#chmod -v +x /opt/wf/bin/coordinator-validator
wget ${TEMPLATE_ARTIFACT_URL}/coordinator-validator -P /opt/wf/bin/
chmod -v +x /opt/wf/bin/coordinator-validator

#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/bin/node-client /opt/wf/bin/
#chmod -v +x /opt/wf/bin/node-client
wget ${TEMPLATE_ARTIFACT_URL}/node-client -P /opt/wf/bin/
chmod -v +x /opt/wf/bin/node-client

mv /etc/nginx/sites-available/default  /opt/wf/nginx-default
if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
  wget -O /etc/nginx/sites-available/default "${TEMPLATE_ARTIFACT_URL}/nginx.conf"
else
  scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/sh/nginx.conf /etc/nginx/sites-available/default
fi

cat <<EOF
#################
# Get data from bootnode
#################
EOF
echo 'get gwat enode' >>/var/log/cloud-init-output.log
while true; do
  if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
    GWAT_BOOTNODE_ENODE=$(curl --fail --silent --show-error "http://${TEMPLATE_BOOTNODE_PUBLIC_IP}/gwat-bootnode.txt" || true)
  else
    GWAT_BOOTNODE_ENODE=$(ssh -o "StrictHostKeyChecking=no" root@${TEMPLATE_BOOTNODE_PUBLIC_IP} "cat /opt/wf/data/logs/gwat-bootnode.log | grep 'enode://' | sed \"s/127.0.0.1:0?discport=30301/${TEMPLATE_BOOTNODE_PUBLIC_IP}:30301/\"")
  fi
  if ! echo $GWAT_BOOTNODE_ENODE | grep 'enode://'; then
    echo "Waiting for 10 seconds..."
    sleep 10
  else
    break
  fi
done

echo 'get coordinator enr' >>/var/log/cloud-init-output.log
while true; do
#  COORDINATOR_BOOTNODE_ENODE=$(ssh -o "StrictHostKeyChecking=no" ec2-user@${TEMPLATE_BOOTNODE_PUBLIC_IP} "cat /opt/wf/data/coordinator-bootnode-public.enr")
#  COORDINATOR_BOOTNODE_ENODE=$(ssh -o "StrictHostKeyChecking=no" ec2-user@${TEMPLATE_BOOTNODE_PUBLIC_IP} "cat /opt/wf/data/coordinator-bootnode-private.enr")
  if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
    COORDINATOR_BOOTNODE_ENODE=$(curl --fail --silent --show-error "http://${TEMPLATE_BOOTNODE_PUBLIC_IP}/coordinator-bootnode.txt" || true)
  else
    COORDINATOR_BOOTNODE_ENODE=$(ssh -o "StrictHostKeyChecking=no" root@${TEMPLATE_BOOTNODE_PUBLIC_IP} "cat /opt/wf/data/logs/coordinator-bootnode.log | egrep -o 'enr(.*)\s' | tr -d '\"'")
  fi
  if ! echo $COORDINATOR_BOOTNODE_ENODE | grep 'enr:'; then
    echo "Waiting for 10 seconds..."
    sleep 10
  else
    break
  fi
done

cat <<EOF
#################
# GWAT
#################
EOF
echo 'gwat genesis and keys' >>/var/log/cloud-init-output.log
if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
  BOOTSTRAP_PATH=/tmp/wf-bootstrap
  BOOTSTRAP_ARCHIVE=/tmp/wf-bootstrap.tar.gz
  install -d -m 700 "$BOOTSTRAP_PATH"
  wget --https-only --secure-protocol=TLSv1_2 \
    --tries=12 --timeout=30 --waitretry=10 \
    -O "$BOOTSTRAP_ARCHIVE" \
    "${TEMPLATE_ARTIFACT_URL}/keys/node${TEMPLATE_INSTANCE_INDEX}.tar.gz"
  tar -xzf "$BOOTSTRAP_ARCHIVE" -C "$BOOTSTRAP_PATH"
  rm -f "$BOOTSTRAP_ARCHIVE"
  cp -r "$BOOTSTRAP_PATH/keystore" /opt/wf/data/gwat/verifiers-keystore
  install -m 600 "$BOOTSTRAP_PATH/password.txt" /opt/wf/data/gwat/verifiers-password.txt
  install -m 600 "$BOOTSTRAP_PATH/address.txt" /opt/wf/data/gwat/address.txt
else
  scp -r -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/node${TEMPLATE_INSTANCE_INDEX}/gwat/keystore /opt/wf/data/gwat/verifiers-keystore
  scp -r -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/node${TEMPLATE_INSTANCE_INDEX}/gwat/password.txt /opt/wf/data/gwat/verifiers-password.txt
  scp -r -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/node${TEMPLATE_INSTANCE_INDEX}/gwat/address.txt /opt/wf/data/gwat/address.txt
fi
wget "${TEMPLATE_ARTIFACT_URL}/gwat-genesis.json" -O /opt/wf/data/gwat/genesis.json
#wget ${TEMPLATE_ARTIFACT_URL}/gwat-genesis.json -O /opt/wf/data/gwat/genesis.json
#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/coordinator/genesis/genesis-deposit_data.json /opt/wf/data/gwat/genesis-deposit_data.json


#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/coordinator/genesis/genesis-deposit_data.zip /opt/wf/data/gwat/genesis-deposit_data.zip
#wget -O /opt/wf/data/gwat/genesis-deposit_data.zip ${TEMPLATE_ARTIFACT_URL}/genesis-deposit_data.zip
#unzip /opt/wf/data/gwat/genesis-deposit_data.zip -d /opt/wf/data/gwat/
#/opt/wf/bin/gwat --datadir /opt/wf/data/gwat init /opt/wf/data/gwat/genesis.json /opt/wf/data/gwat/genesis-deposit_data.json

wget -O /opt/wf/data/gwat/gwat-genesis.zip ${TEMPLATE_ARTIFACT_URL}/gwat-genesis.zip
unzip /opt/wf/data/gwat/gwat-genesis.zip -d /opt/wf/data/gwat/


echo 'generate gwat systemd' >>/var/log/cloud-init-output.log
DEBUG=""
#if  [[ "${TEMPLATE_INSTANCE_INDEX}" == "4" ]]; then
#  DEBUG="--pprof --metrics"
#fi

VERBOSITY="--verbosity ${TEMPLATE_VERBOSITY}"


#if [[ "${TEMPLATE_INSTANCE_INDEX}" == "0" ]] || [[ "${TEMPLATE_INSTANCE_INDEX}" == $((TEMPLATE_INSTANCE_COUNT - 1)) ]]; then
#  VERBOSITY="--verbosity 0 --maxpeers=256"
#fi


cat <<EOF >/opt/wf/systemd/gwat.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
SYSTEM_PATH=\$MAIN_PATH/system
DATA_PATH=\$MAIN_PATH/data
GWAT_DATA_PATH=\$DATA_PATH/gwat
LOGS_PATH=\$DATA_PATH/logs
if [[ "${TEMPLATE_PROVIDER}" == "aws" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
elif [[ "${TEMPLATE_PROVIDER}" == "digitalocean" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address)
elif [[ "${TEMPLATE_PROVIDER}" == "hcloud" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
elif [[ "${TEMPLATE_PROVIDER}" == "google" ]]; then
  PUBLIC_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google")
  PRIVATE_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google")
elif [[ "${TEMPLATE_PROVIDER}" == "azure" ]]; then
  PUBLIC_IP=\$(curl -s -H "Metadata: true" "http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2021-02-01&format=text")
  PRIVATE_IP=\$(curl -s -H "Metadata: true" "http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/privateIpAddress?api-version=2021-02-01&format=text")
  [ -z "\$PUBLIC_IP" ] && PUBLIC_IP=\$(curl -s --connect-timeout 2 --max-time 3 https://api.ipify.org)
  [ -z "\$PUBLIC_IP" ] && PUBLIC_IP=\$(curl -s --connect-timeout 2 --max-time 3 ifconfig.me)
  [ -z "\$PRIVATE_IP" ] && PRIVATE_IP=\$(hostname -I | awk '{print \$1}')
  [ -z "\$PUBLIC_IP" ] && PUBLIC_IP=\$PRIVATE_IP
fi

# Предохранитель: адрес обязан выглядеть как IPv4. Ветки ovh в цепочке выше нет, и на
# OVH переменная оставалась либо пустой, либо — в rpc.sh — со страницей 404 от чужого
# сервиса метаданных: HTML уезжал прямо в аргументы команд (unrecognized argument: head),
# gwat не поднимал порт 9545). Поймано 16 сентября 2026. На Ext-Net адрес интерфейса и есть
# публичный, поэтому запасной вариант верен для OVH и безопасен для остальных облаков.
echo "\$PUBLIC_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PUBLIC_IP=\$(ip -4 -o addr show scope global | awk '{print \$4}' | cut -d/ -f1 | head -1)
echo "\$PRIVATE_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PRIVATE_IP=\$(hostname -I | awk '{print \$1}')

#--cache 512 \
#--pprof --metrics \
#--verbosity 0 \
#--unlock="${TEMPLATE_GWAT_ADDRESS}" \
#--maxpeers=${TEMPLATE_COORDINATOR_MAX_PEERS} \

#--unlock="\$GWAT_ADDRESS" \
#--password \$GWAT_DATA_PATH/password.txt \

#--txpool.accountslots=1000000 \
#--txpool.globalslots=1000000 \
#--txpool.accountqueue=1000000 \
#--txpool.globalqueue=1000000 \
#--${TEMPLATE_NETWORK} \

if [ -f "/opt/wf/data/gwat/address.txt" ]; then
  GWAT_ADDRESS=\$(cat /opt/wf/data/gwat/address.txt)
fi

start() {
\$BIN_PATH/gwat \
${DEBUG} \
${VERBOSITY} \
--${TEMPLATE_CHAIN_FLAG} \
${TEMPLATE_GWAT_EXTRA_ARGS} \
--bootnodes="$GWAT_BOOTNODE_ENODE" \
--creator \
--creator.gaslimit="${TEMPLATE_GWAT_GAS_LIMIT}" \
--networkid="${TEMPLATE_GWAT_NETWORK_ID}" \
--datadir \$GWAT_DATA_PATH \
--ipcpath \$GWAT_DATA_PATH/gwat.ipc \
--syncmode=full \
--http \
--http.corsdomain "*" \
--http.vhosts "*" \
--http.addr "127.0.0.1" \
--http.port "9545" \
--http.api "eth,net,wat" \
--unlock-verifiers \
--verifiers-keystore=\$GWAT_DATA_PATH/verifiers-keystore \
--verifiers-passwords \$GWAT_DATA_PATH/verifiers-password.txt \
&>> \$LOGS_PATH/gwat.log

}

stop() {
  kill -s SIGKILL \$(ps aux | grep '\$BIN_PATH/gwat' | awk '{print \$2}')
}

case \$1 in
  start|stop) "\$1" ;;
esac
EOF

chmod +x /opt/wf/systemd/gwat.sh

cat <<EOF >/opt/wf/systemd/gwat.service
[Unit]
Description=Gwat Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/gwat.sh start
ExecStop=/opt/wf/systemd/gwat.sh stop
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF

cat <<EOF
#################
# Coordinator
#################
EOF

echo 'generate coordinator genesis and keys' >>/var/log/cloud-init-output.log
if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
  cp -r "$BOOTSTRAP_PATH/validator_keys" /opt/wf/data/coordinator/validator_keys
  # Кошелёк, собранный на контроллере, если он есть в архиве. Импорт ключей стоит около
  # полусекунды за ключ и идёт до создания служб: на 10 240 ключах это больше часа простоя
  # ноды. Сети, где кошелёк не собирают, этой папки в архиве не имеют и импортируют сами.
  if [ -d "$BOOTSTRAP_PATH/wallet" ]; then
    cp -r "$BOOTSTRAP_PATH/wallet" /opt/wf/data/coordinator/wallet
  fi
  rm -rf "$BOOTSTRAP_PATH"
else
  scp -r -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/node${TEMPLATE_INSTANCE_INDEX}/coordinator/deposit/validator_keys /opt/wf/data/coordinator/validator_keys
fi
#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/coordinator/genesis/genesis.ssz /opt/wf/data/coordinator/genesis.ssz
wget ${TEMPLATE_ARTIFACT_URL}/coordinator-genesis.ssz -O /opt/wf/data/coordinator/genesis.ssz

echo "${TEMPLATE_COORDINATOR_PASSWORD}" >/opt/wf/data/coordinator/password.txt

if [ -s /opt/wf/data/coordinator/wallet/direct/accounts/all-accounts.keystore.json ]; then
  echo 'wallet prepared on controller, import skipped' >>/var/log/cloud-init-output.log
else
  /opt/wf/bin/coordinator-validator accounts import \
    --accept-terms-of-use \
    --keys-dir=/opt/wf/data/coordinator/validator_keys \
    --wallet-dir=/opt/wf/data/coordinator/wallet \
    --wallet-password-file=/opt/wf/data/coordinator/password.txt \
    --account-password-file=/opt/wf/data/coordinator/password.txt
fi

echo 'generate coordinator-beacon systemd' >>/var/log/cloud-init-output.log

DEBUG=""
#if  [[ "${TEMPLATE_INSTANCE_INDEX}" == "4" ]]; then
#  DEBUG="--pprof --pprofport=6061"
#fi

case ${TEMPLATE_VERBOSITY} in
0) VERBOSITY="--verbosity panic";;
1) VERBOSITY="--verbosity error";;
2) VERBOSITY="--verbosity warn";;
3) VERBOSITY="--verbosity info";;
4) VERBOSITY="--verbosity debug";;
5) VERBOSITY="--verbosity trace";;
*) VERBOSITY="";;
esac

#if [[ "${TEMPLATE_INSTANCE_INDEX}" == "0" ]] || [[ "${TEMPLATE_INSTANCE_INDEX}" == $((TEMPLATE_INSTANCE_COUNT - 1)) ]]; then
#  VERBOSITY="--verbosity error"
#fi

cat <<EOF >/opt/wf/systemd/coordinator-beacon.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
SYSTEM_PATH=\$MAIN_PATH/system
DATA_PATH=\$MAIN_PATH/data
GWAT_DATA_PATH=\$DATA_PATH/gwat
COORDINATOR_DATA_PATH=\$DATA_PATH/coordinator
LOGS_PATH=\$DATA_PATH/logs
if [[ "${TEMPLATE_PROVIDER}" == "aws" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
  if [[ "${TEMPLATE_PROVIDER}" -gt 3 ]]; then
    P2P_IP=\$PRIVATE_IP
  else
    P2P_IP=\$PUBLIC_IP
  fi
elif [[ "${TEMPLATE_PROVIDER}" == "digitalocean" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address)
  P2P_IP=\$PUBLIC_IP
elif [[ "${TEMPLATE_PROVIDER}" == "hcloud" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  P2P_IP=\$PUBLIC_IP
elif [[ "${TEMPLATE_PROVIDER}" == "google" ]]; then
  PUBLIC_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google")
  PRIVATE_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google")
  P2P_IP=\$PUBLIC_IP
elif [[ "${TEMPLATE_PROVIDER}" == "azure" ]]; then
  PUBLIC_IP=\$(curl -s -H "Metadata: true" "http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/publicIpAddress?api-version=2021-02-01&format=text")
  PRIVATE_IP=\$(curl -s -H "Metadata: true" "http://169.254.169.254/metadata/instance/network/interface/0/ipv4/ipAddress/0/privateIpAddress?api-version=2021-02-01&format=text")
  [ -z "\$PUBLIC_IP" ] && PUBLIC_IP=\$(curl -s --connect-timeout 2 --max-time 3 https://api.ipify.org)
  [ -z "\$PUBLIC_IP" ] && PUBLIC_IP=\$(curl -s --connect-timeout 2 --max-time 3 ifconfig.me)
  [ -z "\$PRIVATE_IP" ] && PRIVATE_IP=\$(hostname -I | awk '{print \$1}')
  [ -z "\$PUBLIC_IP" ] && PUBLIC_IP=\$PRIVATE_IP
  P2P_IP=\$PUBLIC_IP
fi

# Предохранитель: адрес обязан выглядеть как IPv4. Ветки ovh в цепочке выше нет, и на
# OVH переменная оставалась либо пустой, либо — в rpc.sh — со страницей 404 от чужого
# сервиса метаданных: HTML уезжал прямо в аргументы команд (unrecognized argument: head),
# gwat не поднимал порт 9545). Поймано 16 сентября 2026. На Ext-Net адрес интерфейса и есть
# публичный, поэтому запасной вариант верен для OVH и безопасен для остальных облаков.
echo "\$PUBLIC_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PUBLIC_IP=\$(ip -4 -o addr show scope global | awk '{print \$4}' | cut -d/ -f1 | head -1)
echo "\$PRIVATE_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PRIVATE_IP=\$(hostname -I | awk '{print \$1}')
# P2P_IP присваивается в цепочке выше, то есть ДО предохранителя, и мог остаться пустым.
echo "\$P2P_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || P2P_IP=\$PUBLIC_IP



#  --p2p-priv-key=\$GWAT_DATA_PATH/gwat/nodekey \

# --pprof

#  --subscribe-all-subnets \

#  --verbosity panic \

#   --find-nodes-bucket-length=4 \
#    --p2p-max-peers=${TEMPLATE_COORDINATOR_MAX_PEERS} \
#   --contract-deployment-block=0 \
#  --${TEMPLATE_NETWORK} \

start() {
  \$BIN_PATH/coordinator-beacon \
  ${DEBUG} \
  ${VERBOSITY} \
  --${TEMPLATE_CHAIN_FLAG} \
  ${TEMPLATE_COORDINATOR_EXTRA_ARGS} \
  --accept-terms-of-use \
  --disable-peer-scorer \
  --bootstrap-node=$COORDINATOR_BOOTNODE_ENODE \
  --http-web3provider=\$GWAT_DATA_PATH/gwat.ipc \
  --genesis-state=\$COORDINATOR_DATA_PATH/genesis.ssz \
  --deposit-contract="${TEMPLATE_DEPOSIT_CONTRACT}" \
  --chain-id="${TEMPLATE_GWAT_NETWORK_ID}" \
  --network-id="${TEMPLATE_GWAT_NETWORK_ID}" \
  --p2p-max-peers=${TEMPLATE_COORDINATOR_MAX_PEERS} \
  --p2p-host-ip=\$P2P_IP \
  --datadir=\$COORDINATOR_DATA_PATH \
  &>> \$LOGS_PATH/coordinator-beacon.log

}

stop() {
  kill -s SIGINT \$(ps aux | grep '\$BIN_PATH/coordinator-beacon' | awk '{print \$2}')
}

case \$1 in
  start|stop) "\$1" ;;
esac
EOF

chmod +x /opt/wf/systemd/coordinator-beacon.sh

cat <<EOF >/opt/wf/systemd/coordinator-beacon.service
[Unit]
Description=Coordinator Beacon Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/coordinator-beacon.sh start
ExecStop=/opt/wf/systemd/coordinator-beacon.sh stop
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF

echo 'generate coordinator-validator systemd' >>/var/log/cloud-init-output.log
cat <<EOF >/opt/wf/systemd/coordinator-validator.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
SYSTEM_PATH=\$MAIN_PATH/system
DATA_PATH=\$MAIN_PATH/data
GWAT_DATA_PATH=\$DATA_PATH/gwat
COORDINATOR_DATA_PATH=\$DATA_PATH/coordinator
LOGS_PATH=\$DATA_PATH/logs

#  --verbosity panic \

start() {
\$BIN_PATH/coordinator-validator \
${TEMPLATE_VALIDATOR_EXTRA_ARGS} \
--accept-terms-of-use \
--grpc-max-msg-size=30000000 \
--beacon-rpc-provider=localhost:4000 \
--wallet-dir=\$COORDINATOR_DATA_PATH/wallet \
--wallet-password-file=\$COORDINATOR_DATA_PATH/password.txt \
&>> \$LOGS_PATH/coordinator-validator.log

}

stop() {
  kill -s SIGINT \$(ps aux | grep '\$BIN_PATH/coordinator-validator' | awk '{print \$2}')
}

case \$1 in
  start|stop) "\$1" ;;
esac
EOF

chmod +x /opt/wf/systemd/coordinator-validator.sh

cat <<EOF >/opt/wf/systemd/coordinator-validator.service
[Unit]
Description=Coordinator Validator Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/coordinator-validator.sh start
ExecStop=/opt/wf/systemd/coordinator-validator.sh stop
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

echo 'generate node-client systemd' >>/var/log/cloud-init-output.log
cat <<EOF >/opt/wf/systemd/node-client.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
DATA_PATH=\$MAIN_PATH/data
LOGS_PATH=\$DATA_PATH/logs

start() {

  \$BIN_PATH/node-client \
  &>> \$LOGS_PATH/node-client.log

}

stop() {
  kill -s SIGINT \$(ps aux | grep 'node-client' | awk '{print \$2}')
}

case \$1 in
   start|stop) "\$1" ;;
esac

EOF

chmod +x /opt/wf/systemd/node-client.sh

cat <<EOF >/opt/wf/systemd/node-client.service
[Unit]
Description=Node Client Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/node-client.sh start
ExecStop=/opt/wf/systemd/node-client.sh stop
Restart=always
RestartSec=5s

[Install]
WantedBy=multi-user.target
EOF

cat <<EOF
##########
# nginx
##########
EOF

echo 'setup nginx' >>/var/log/cloud-init-output.log
touch /etc/nginx/.htpasswd
echo -n "${TEMPLATE_NODE_NGINX_USERNAME}:" >>/etc/nginx/.htpasswd
openssl passwd -apr1 "${TEMPLATE_NODE_NGINX_PASSWORD}" >>/etc/nginx/.htpasswd

systemctl restart nginx

cat <<EOF
##########
# Финализация
##########
EOF
echo 'start services' >>/var/log/cloud-init-output.log


chown -Rv $USER:$USER /opt/wf/

ln -s /opt/wf/systemd/gwat.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable gwat
systemctl start gwat

ln -s /opt/wf/systemd/coordinator-beacon.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable coordinator-beacon
systemctl start coordinator-beacon

ln -s /opt/wf/systemd/coordinator-validator.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable coordinator-validator
systemctl start coordinator-validator

#ln -s /opt/wf/systemd/node-client.service /lib/systemd/system/
#systemctl daemon-reload
#systemctl enable node-client
#systemctl start node-client


cat <<EOF >/opt/wf/head.sh
#!/usr/bin/bash

watch -n 1 'curl --silent -X GET -d {} "http://localhost:3500/eth/v1/beacon/states/head/finality_checkpoints" && echo "" && curl --silent -X GET -d {} "http://localhost:3500/eth/v1/node/syncing" && echo "" && echo "" && /opt/wf/bin/gwat --exec "eth.syncing" attach /opt/wf/data/gwat/gwat.ipc && echo "" && /opt/wf/bin/gwat --exec "eth.blockNumber" attach /opt/wf/data/gwat/gwat.ipc'

EOF

chmod +x /opt/wf/head.sh

touch "$FLAG_FILE"