#!/usr/bin/bash
# Все команды выполняются от Root
# Внешние переменные Terraform следует начинать с TEMPLATE_

echo "start ${TEMPLATE_PROVIDER} rpc node" >>/var/log/cloud-init-output.log
# Root-доступ по ключу. Облачные образы OVH кладут ключ из keypair пользователю debian,
# а в /root/.ssh/authorized_keys оставляют запись с forced command: login as the user debian.
# Просто дописать ключ ниже нельзя: sshd берёт первое совпадение по ключу, и снова
# сработала бы та запись. Поэтому список root-ключей пересобирается заново — только строки
# с самими ключами, без командных записей.
#
# Root нужен потому, что deploy.sh ходит на роли именно как root (userdata читает enode и enr
# с bootnode, update_nginx выкладывает конфиги). На mainnode такой блок уже есть; здесь его
# не было, и после переезда контура в OVH доступ пропал. Заведено 16 сентября 2026.
install -d -m 700 /root/.ssh
: >/root/.ssh/authorized_keys.new
for cloud_user in debian ubuntu cloud-user admin; do
  if [ -f "/home/$cloud_user/.ssh/authorized_keys" ]; then
    grep -hE '^(ssh|ecdsa)-' "/home/$cloud_user/.ssh/authorized_keys" >>/root/.ssh/authorized_keys.new || true
  fi
done
grep -hE '^(ssh|ecdsa)-' /root/.ssh/authorized_keys >>/root/.ssh/authorized_keys.new 2>/dev/null || true
sort -u /root/.ssh/authorized_keys.new -o /root/.ssh/authorized_keys
rm -f /root/.ssh/authorized_keys.new
chmod 600 /root/.ssh/authorized_keys
sed -i 's/^#\?PermitRootLogin.*/PermitRootLogin prohibit-password/' /etc/ssh/sshd_config
systemctl restart ssh 2>/dev/null || systemctl restart sshd 2>/dev/null || true

FLAG_FILE="/var/cloud-init.flag"

if [ -f "$FLAG_FILE" ]; then
  echo "Already run. Exit" >>/var/log/cloud-init-output.log
  exit 0
fi

cat <<EOF
##########
# SSH
##########
EOF
# Ключи
echo 'add ssh keys' >>/var/log/cloud-init-output.log
mkdir -pv /root/.ssh -m 600
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAACAQDeKp5kCtVOAeOb0BtexF5DKTb8QTnxXadiyRdDLdmSA6qv6tFIqPwvJ//8TRp4gvuLbDF+zPMTi3nW2Rf4iAkxIKP9clhap8IS33CXW1VqJi8ynEF7aFVvK1Fcq8XezZnarzbwXDmTuTt7l115MXdOEYrWoSew8NnxHC3wAia2GLyYbCrHmqJca/N0BvgoLK1LhQ3O882Xr5ZXktKNgYRD/kAz/rHMLc/2XST5c/TPo/bq/AmwrdqaBxTG3pM1ntRJxB2M4StpitlH2PTtjNSrmXIFA+KGsA5IlYbGNyi6Z3Jz0fKLdUNNMnFagU1ODU5t9A0y4gmye3Rx56DnsSTw4hyFpG9qC3Kz8E4rbDL5n5WzBXTkO/qTP1HTJ8vNCN2gF4JaJVBDTU3HsVISFiEgmsgEJ5TgwyEEYH4BzpGMeU7YcgNqhSYl/ZnztbWrfH3S72nV7uYWyZnAJRHQiGFxg+oYGsc4tM0Lqszv9/Z/TfnJ/qfJcHBhYugCV44p1nn/UULP8Nfv2oochYyYmMEy2iWJKcDB0E4ooAfTelpr/UtWnPjV9OES2tD9+/IZkSGjhtJYkk0jfRrIL02MDtoX9rLvXSevWB33YHoRIZ4bkA8TyHtKEl17ZQp58A48p6MdFGiqaXLCe41VOVwGcPjyDLtuN4jxtSdoOjcdcv9y3Q== alex@Oleksandrs-MBP" >>/root/.ssh/authorized_keys
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDSE7hc9cVvWSLE2x0obvn/4a+sQ9SNHCkThbDy6Z32XyxnEFPkkWbZZd99oKKhbdBknVQA79C8hKu74lMFjTiGrxU4hMvLuJYSy9rTFXrjpjHEWHa/IjgAp87FygB/9Z7QgwHP0qaMk77MYp79tClTD+LeQAKKYOYCS1rv7VgolLYw58DCDqzIKOBIUaO9wKwUVLs1yktJl0P5pMaC1rr1HykiK96hO6rZvqkR6YXXvzRTLOsJmL5gW+emqlFrYocf3qkwGSYbzyg22/suJ/LY5jKh4iP4+g53sXRgJO70esrOv+3BEPpqRaZyedNXEUhc7Jr47IXS8Wj3y7xaRTmx tech-key" >>/root/.ssh/authorized_keys
echo "ssh-rsa AAAAB3NzaC1yc2EAAAADAQABAAABAQDUzcGDGh6IUEHMhnoR0gjw6itvXNnWHtjwDyiIe0W9+Dq1vE7HJmPYNjeeM9QbbG1F4pTwI7qunXyvdJQUgGt/Zyc9UhK03u2YoNrhpJe+u+gHSwP0TBXogausFjzL/9C0K1CCsWhDwho8Vw+PqAHmgfzGXgoP5tFfd53lrk8EE/I2JremLhTriz4dAAVoAb+lqV+zurI1SSkLR/FHjg6zSFqqGe8OVC66yFZ51Wm6pMVkUeHPlzs6KigtgMCD17KSfRzeJMaodmcXsBAXQrcoZ+YZEMulXFhcLlNOkwqcsayyYLoXpy8FZRmm1sahPS34Y8G8zcECUeTDiEckZTCJ mezin@mezin" >>/root/.ssh/authorized_keys
sed -i 's/PermitRootLogin no/PermitRootLogin prohibit-password/g' /etc/ssh/sshd_config
echo 'PermitRootLogin yes' >>/etc/ssh/sshd_config
echo 'add sshd restart' >>/var/log/cloud-init-output.log
service sshd restart

USER=root


cat <<EOF
###########
# Workspace
###########
EOF


echo 'update package' >>/var/log/cloud-init-output.log
apt-get update -y
echo 'install package' >>/var/log/cloud-init-output.log
apt install -y nginx htop mc logrotate tar wget nano unzip

echo 'create dirs' >>/var/log/cloud-init-output.log
mkdir -pv /opt/wf -m 775
mkdir -pv /opt/wf/bin -m 775
mkdir -pv /opt/wf/systemd -m 775
mkdir -pv /opt/wf/data -m 775


if [[ "$TEMPLATE_PROVIDER" == "google" ]]; then
  SYMLINK="/dev/disk/by-id/google-data"
  DEVICE=$(readlink -f $SYMLINK)
  if [ ! -e "$DEVICE" ]; then
      echo "Device doesn't found: $DEVICE" >>/var/log/cloud-init-output.log
  else
    mkfs -t ext4 $DEVICE
    UUID=$(blkid -s UUID -o value $DEVICE)
    if [ -z "$UUID" ]; then
        echo "Can't get UUID for $DEVICE" >>/var/log/cloud-init-output.log
    else
      MOUNT_DIR="/opt/wf/data"
      echo "UUID=$UUID $MOUNT_DIR ext4 rw 0 2" | tee -a /etc/fstab
      mount -v $MOUNT_DIR
    fi
  fi

#  lsblk -a
#  mkfs -V -t ext4 /dev/sdb
#  echo '/dev/sdb /opt/wf/data ext4 rw 0 2' >>/etc/fstab
#  systemctl daemon-reload
#  mount -v /dev/sdb
fi

mkdir -pv /opt/wf/data/logs -m 775
mkdir -pv /opt/wf/data/gwat -m 775
mkdir -pv /opt/wf/data/coordinator -m 775
touch /opt/wf/data/logs/gwat.log
touch /opt/wf/data/logs/coordinator-beacon.log
chown -Rv $USER:$USER /opt/wf/

# swap
echo 'create swap' >>/var/log/cloud-init-output.log
SWAP_FILE_SIZE=4096M
SWAPPINESS=10
fallocate -l $SWAP_FILE_SIZE /swapfile
chmod 600 /swapfile
mkswap /swapfile
swapon /swapfile
echo '/swapfile none swap sw 0 0' >>/etc/fstab
sysctl vm.swappiness=$SWAPPINESS
echo "vm.swappiness=$SWAPPINESS" >>/etc/sysctl.conf


#systemctl stop ntpd
#ntpdate -bv pool.ntp.org
#systemctl start ntpd


cat <<EOF
#################
# logs
#################
EOF

echo 'create logrotate' >>/var/log/cloud-init-output.log

cat <<EOF >/etc/logrotate.d/wf.conf
/opt/wf/data/logs/*.log {
  su root root
  daily
  rotate 5
  compress
  delaycompress
  copytruncate
}
EOF

#if [ ! -f "/etc/cron.daily/logrotate" ]; then
#cat <<EOF >/etc/cron.daily/logrotate
##!/bin/sh
#
#/usr/sbin/logrotate -s /var/lib/logrotate/logrotate.status /etc/logrotate.conf
#EXITVALUE=$?
#if [ \$EXITVALUE != 0 ]; then
#  /usr/bin/logger -t logrotate "ALERT exited abnormally with [\$EXITVALUE]"
#fi
#exit 0
#EOF
#fi

#if [[ "$TEMPLATE_PROVIDER" == "digitalocean" ]]; then
#  semanage fcontext -a -t var_log_t /opt/wf/data/logs/
#  restorecon -v /opt/wf/data/logs/
#fi



cat <<EOF
#################
# выкачиваем бинарники
#################
EOF





# Файлы с других сереверов
echo 'download bins' >>/var/log/cloud-init-output.log

wget ${TEMPLATE_ARTIFACT_URL}/gwat-tracing -P /opt/wf/bin/
mv /opt/wf/bin/gwat-tracing /opt/wf/bin/gwat
chmod -v +x /opt/wf/bin/gwat

wget ${TEMPLATE_ARTIFACT_URL}/coordinator-beacon -P /opt/wf/bin/
chmod -v +x /opt/wf/bin/coordinator-beacon


cat <<EOF
#################
# Get data from bootnode
#################
EOF

while true; do
  if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
    GWAT_BOOTNODE_ENODE=$(curl --fail --silent --show-error "http://${TEMPLATE_BOOTNODE_PUBLIC_IP}/gwat-bootnode.txt" || true)
  else
    GWAT_BOOTNODE_ENODE=$(ssh -o "StrictHostKeyChecking=no" root@${TEMPLATE_BOOTNODE_PUBLIC_IP} "cat /opt/wf/data/logs/gwat-bootnode.log | grep 'enode://' | sed \"s/127.0.0.1:0?discport=30301/${TEMPLATE_BOOTNODE_PUBLIC_IP}:30301/\"")
  fi
  if ! echo $GWAT_BOOTNODE_ENODE | grep 'enode://'; then
    echo "Waiting for 10 seconds..."
    sleep 10
  else
    break
  fi
done

while true; do
  if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
    COORDINATOR_BOOTNODE_ENODE=$(curl --fail --silent --show-error "http://${TEMPLATE_BOOTNODE_PUBLIC_IP}/coordinator-bootnode.txt" || true)
  else
    COORDINATOR_BOOTNODE_ENODE=$(ssh -o "StrictHostKeyChecking=no" root@${TEMPLATE_BOOTNODE_PUBLIC_IP} "cat /opt/wf/data/logs/coordinator-bootnode.log | egrep -o 'enr(.*)\s' | tr -d '\"'")
  fi
  if ! echo $COORDINATOR_BOOTNODE_ENODE | grep 'enr:'; then
    echo "Waiting for 10 seconds..."
    sleep 10
  else
    break
  fi
done

cat <<EOF
#################
# GWAT
#################
EOF

if [[ "${TEMPLATE_ARTIFACT_BOOTSTRAP}" == "true" ]]; then
  wget "${TEMPLATE_ARTIFACT_URL}/gwat-genesis.json" -O /opt/wf/data/gwat/genesis.json
else
  scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/gwat/genesis.json /opt/wf/data/gwat/genesis.json
fi
#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/coordinator/genesis/genesis-deposit_data.json /opt/wf/data/gwat/genesis-deposit_data.json

#scp -o "StrictHostKeyChecking no" ${TEMPLATE_DEPLOY_SERVER}:/opt/network/.data/${TEMPLATE_NETWORK}/coordinator/genesis/genesis-deposit_data.zip /opt/wf/data/gwat/genesis-deposit_data.zip
#wget -O /opt/wf/data/gwat/genesis-deposit_data.zip ${TEMPLATE_ARTIFACT_URL}/genesis-deposit_data.zip
#unzip /opt/wf/data/gwat/genesis-deposit_data.zip -d /opt/wf/data/gwat/

#/opt/wf/bin/gwat --datadir /opt/wf/data/gwat init /opt/wf/data/gwat/genesis.json /opt/wf/data/gwat/genesis-deposit_data.json



wget -O /opt/wf/data/gwat/gwat-genesis.zip ${TEMPLATE_ARTIFACT_URL}/gwat-genesis.zip
unzip /opt/wf/data/gwat/gwat-genesis.zip -d /opt/wf/data/gwat/


echo 'generate gwat systemd' >>/var/log/cloud-init-output.log
DEBUG=""
#if  [[ "${TEMPLATE_NETWORK}" == "testnet5" ]]; then
#  DEBUG="--delegating-stake-fork-slot=0  "
#fi

VERBOSITY="--verbosity ${TEMPLATE_VERBOSITY}"


cat <<EOF >/opt/wf/systemd/gwat.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
SYSTEM_PATH=\$MAIN_PATH/system
DATA_PATH=\$MAIN_PATH/data
GWAT_DATA_PATH=\$DATA_PATH/gwat
LOGS_PATH=\$DATA_PATH/logs
maxpeers=32
if [[ "${TEMPLATE_PROVIDER}" == "aws" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
elif [[ "${TEMPLATE_PROVIDER}" == "digitalocean" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address)
elif [[ "${TEMPLATE_PROVIDER}" == "hcloud" ]]; then
  maxpeers=256
  PUBLIC_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
elif [[ "${TEMPLATE_PROVIDER}" == "google" ]]; then
  PUBLIC_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google")
  PRIVATE_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google")
fi

# Предохранитель: адрес обязан выглядеть как IPv4. Ветки ovh в цепочке выше нет, и на
# OVH переменная оставалась либо пустой, либо — в rpc.sh — со страницей 404 от чужого
# сервиса метаданных: HTML уезжал прямо в аргументы команд (unrecognized argument: head),
# gwat не поднимал порт 9545). Поймано 16 сентября 2026. На Ext-Net адрес интерфейса и есть
# публичный, поэтому запасной вариант верен для OVH и безопасен для остальных облаков.
echo "\$PUBLIC_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PUBLIC_IP=\$(ip -4 -o addr show scope global | awk '{print \$4}' | cut -d/ -f1 | head -1)
echo "\$PRIVATE_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PRIVATE_IP=\$(hostname -I | awk '{print \$1}')

#--cache 512 \
#--maxpeers=${TEMPLATE_COORDINATOR_MAX_PEERS} \

#--txpool.accountslots=1000000 \
#--txpool.globalslots=1000000 \
#--txpool.accountqueue=1000000 \
#--txpool.globalqueue=1000000 \
#--${TEMPLATE_NETWORK} \
start() {
\$BIN_PATH/gwat \
${DEBUG} \
${VERBOSITY} \
--${TEMPLATE_CHAIN_FLAG} \
${TEMPLATE_GWAT_EXTRA_ARGS} \
--allow-insecure-unlock \
--maxpeers=\$maxpeers \
--bootnodes="$GWAT_BOOTNODE_ENODE" \
--networkid="${TEMPLATE_GWAT_NETWORK_ID}" \
--datadir \$GWAT_DATA_PATH \
--ipcpath \$GWAT_DATA_PATH/gwat.ipc \
--syncmode=full \
--http \
--http.corsdomain "*" \
--http.vhosts "*" \
--http.addr "\$PUBLIC_IP" \
--http.port "9545" \
--http.api "eth,net,wat,web3" \
--ws \
--ws.origins "*" \
--ws.addr "\$PUBLIC_IP" \
--ws.port="9546" \
--ws.api "eth,net,wat,web3" \
&>> \$LOGS_PATH/gwat.log

}

stop() {
  kill -s SIGINT \$(ps aux | grep '\$BIN_PATH/gwat' | awk '{print \$2}')
}

case \$1 in
  start|stop) "\$1" ;;
esac
EOF

chmod +x /opt/wf/systemd/gwat.sh

cat <<EOF >/opt/wf/systemd/gwat.service
[Unit]
Description=Gwat Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/gwat.sh start
ExecStop=/opt/wf/systemd/gwat.sh stop
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF

cat <<EOF
#################
# Coordinator
#################
EOF

echo 'generate coordinator genesis and keys' >>/var/log/cloud-init-output.log

wget ${TEMPLATE_ARTIFACT_URL}/coordinator-genesis.ssz -O /opt/wf/data/coordinator/genesis.ssz

DEBUG=""
#if  [[ "${TEMPLATE_NETWORK}" == "testnet5" ]]; then
#  DEBUG="--delegating-stake-fork-slot=0  "
#fi


case ${TEMPLATE_VERBOSITY} in
0) VERBOSITY="--verbosity panic";;
1) VERBOSITY="--verbosity error";;
2) VERBOSITY="--verbosity warn";;
3) VERBOSITY="--verbosity info";;
4) VERBOSITY="--verbosity debug";;
5) VERBOSITY="--verbosity trace";;
*) VERBOSITY="";;
esac


cat <<EOF > /opt/wf/systemd/coordinator-beacon.sh
#!/bin/bash
MAIN_PATH=/opt/wf
BIN_PATH=\$MAIN_PATH/bin
SYSTEM_PATH=\$MAIN_PATH/system
DATA_PATH=\$MAIN_PATH/data
GWAT_DATA_PATH=\$DATA_PATH/gwat
COORDINATOR_DATA_PATH=\$DATA_PATH/coordinator
LOGS_PATH=\$DATA_PATH/logs
#PUBLIC_IP=\$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
#PRIVATE_IP=\$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)

PUBLIC_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
PRIVATE_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)

if [[ "${TEMPLATE_PROVIDER}" == "aws" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
  if [[ "${TEMPLATE_PROVIDER}" -gt 3 ]]; then
    P2P_IP=\$PRIVATE_IP
  else
    P2P_IP=\$PUBLIC_IP
  fi
elif [[ "${TEMPLATE_PROVIDER}" == "digitalocean" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address)
  P2P_IP=\$PUBLIC_IP
elif [[ "${TEMPLATE_PROVIDER}" == "hcloud" ]]; then
  PUBLIC_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  PRIVATE_IP=\$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  P2P_IP=\$PUBLIC_IP
elif [[ "${TEMPLATE_PROVIDER}" == "google" ]]; then
  PUBLIC_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google")
  PRIVATE_IP=\$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google")
  P2P_IP=\$PUBLIC_IP
fi

# Предохранитель: адрес обязан выглядеть как IPv4. Ветки ovh в цепочке выше нет, и на
# OVH переменная оставалась либо пустой, либо — в rpc.sh — со страницей 404 от чужого
# сервиса метаданных: HTML уезжал прямо в аргументы команд (unrecognized argument: head),
# gwat не поднимал порт 9545). Поймано 16 сентября 2026. На Ext-Net адрес интерфейса и есть
# публичный, поэтому запасной вариант верен для OVH и безопасен для остальных облаков.
echo "\$PUBLIC_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PUBLIC_IP=\$(ip -4 -o addr show scope global | awk '{print \$4}' | cut -d/ -f1 | head -1)
echo "\$PRIVATE_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}\$' || PRIVATE_IP=\$(hostname -I | awk '{print \$1}')



#  --find-nodes-bucket-length=4 \
#   --contract-deployment-block=0 \
#   --p2p-max-peers=${TEMPLATE_COORDINATOR_MAX_PEERS} \
#  --disable-peer-scorer \
#   --prevoting-disable \


#  --${TEMPLATE_NETWORK} \

start() {
  \$BIN_PATH/coordinator-beacon \
  ${DEBUG} \
  ${VERBOSITY} \
  --${TEMPLATE_CHAIN_FLAG} \
  ${TEMPLATE_COORDINATOR_EXTRA_ARGS} \
  --contract-deployment-block=0 \
  --accept-terms-of-use \
  --bootstrap-node=$COORDINATOR_BOOTNODE_ENODE \
  --http-web3provider=\$GWAT_DATA_PATH/gwat.ipc \
  --genesis-state=\$COORDINATOR_DATA_PATH/genesis.ssz \
  --deposit-contract="${TEMPLATE_DEPOSIT_CONTRACT}" \
  --chain-id="${TEMPLATE_GWAT_NETWORK_ID}" \
  --network-id="${TEMPLATE_GWAT_NETWORK_ID}" \
  --datadir=\$COORDINATOR_DATA_PATH \
  --p2p-host-ip=\$PUBLIC_IP \
  --grpc-gateway-host="\$PUBLIC_IP" \
  &>> \$LOGS_PATH/coordinator-beacon.log

}

stop() {
  kill -s SIGINT \$(ps aux | grep '\$BIN_PATH/coordinator-beacon' | awk '{print \$2}')
}

case \$1 in
  start|stop) "\$1" ;;
esac
EOF


chmod +x /opt/wf/systemd/coordinator-beacon.sh

cat <<EOF > /opt/wf/systemd/coordinator-beacon.service
[Unit]
Description=Coordinator Beacon Service
After=network.target

[Service]
User=root
Group=root
Type=simple
WorkingDirectory=/opt/wf
ExecStart=/opt/wf/systemd/coordinator-beacon.sh start
ExecStop=/opt/wf/systemd/coordinator-beacon.sh stop
Restart=always
RestartSec=2s

[Install]
WantedBy=multi-user.target
EOF



cat <<EOF
##########
# Финализация
##########
EOF
#chown -Rv ec2-user:ec2-user /opt/wf

ln -s /opt/wf/systemd/gwat.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable gwat
systemctl start gwat

ln -s /opt/wf/systemd/coordinator-beacon.service /lib/systemd/system/
systemctl daemon-reload
systemctl enable coordinator-beacon
systemctl start coordinator-beacon



if [[ "${TEMPLATE_PROVIDER}" == "aws" ]]; then
  PUBLIC_IP=$(curl -s http://169.254.169.254/latest/meta-data/public-ipv4)
  PRIVATE_IP=$(curl -s http://169.254.169.254/latest/meta-data/local-ipv4)
elif [[ "${TEMPLATE_PROVIDER}" == "digitalocean" ]]; then
  PUBLIC_IP=$(curl -s http://169.254.169.254/metadata/v1/interfaces/public/0/ipv4/address)
  PRIVATE_IP=$(curl -s http://169.254.169.254/metadata/v1/interfaces/private/0/ipv4/address)
elif [[ "${TEMPLATE_PROVIDER}" == "hcloud" ]]; then
  PUBLIC_IP=$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
  PRIVATE_IP=$(curl -s http://169.254.169.254/hetzner/v1/metadata/public-ipv4)
elif [[ "${TEMPLATE_PROVIDER}" == "google" ]]; then
  PUBLIC_IP=$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/access-configs/0/external-ip" -H "Metadata-Flavor: Google")
  PRIVATE_IP=$(curl "http://metadata.google.internal/computeMetadata/v1/instance/network-interfaces/0/ip" -H "Metadata-Flavor: Google")
fi

# Предохранитель: адрес обязан выглядеть как IPv4. Ветки ovh в цепочке выше нет, и на
# OVH переменная оставалась либо пустой, либо — в rpc.sh — со страницей 404 от чужого
# сервиса метаданных: HTML уезжал прямо в аргументы команд (unrecognized argument: head),
# gwat не поднимал порт 9545). Поймано 16 сентября 2026. На Ext-Net адрес интерфейса и есть
# публичный, поэтому запасной вариант верен для OVH и безопасен для остальных облаков.
echo "$PUBLIC_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}$' || PUBLIC_IP=$(ip -4 -o addr show scope global | awk '{print $4}' | cut -d/ -f1 | head -1)
echo "$PRIVATE_IP" | grep -qE '^[0-9]+(\.[0-9]+){3}$' || PRIVATE_IP=$(hostname -I | awk '{print $1}')

cat <<EOF >/opt/wf/head.sh
#!/usr/bin/bash



watch -n 1 'curl --silent -X GET -d {} "http://$PUBLIC_IP:3500/eth/v1/beacon/states/head/finality_checkpoints" && echo "" && curl --silent -X GET -d {} "http://$PUBLIC_IP:3500/eth/v1/node/syncing" && echo "" && echo "" && /opt/wf/bin/gwat --exec "eth.syncing" attach /opt/wf/data/gwat/gwat.ipc && echo "" && /opt/wf/bin/gwat --exec "eth.blockNumber" attach /opt/wf/data/gwat/gwat.ipc'

EOF

chmod +x /opt/wf/head.sh