69 lines
2.4 KiB
Bash
Executable File
69 lines
2.4 KiB
Bash
Executable File
#!/bin/bash
|
|
#
|
|
# setup_signer_qube.sh — install nsigner v0.0.34+ and the qrexec bridge service
|
|
# in the nostr_signer qube.
|
|
#
|
|
# Run this in the nostr_signer qube (as the regular user, not root).
|
|
# It will:
|
|
# 1. Run install_nsigner.sh to download the latest nsigner release (v0.0.34+)
|
|
# 2. Install the qubes.NsignerRpc qrexec service (bridge mode)
|
|
# 3. Print instructions for starting the persistent signer
|
|
#
|
|
# Usage:
|
|
# bash setup_signer_qube.sh
|
|
|
|
set -euo pipefail
|
|
|
|
NSIGNER_BIN="${HOME}/.local/bin/nsigner"
|
|
SERVICE_DST="/etc/qubes-rpc/qubes.NsignerRpc"
|
|
|
|
echo "=== n_signer qube setup ==="
|
|
echo
|
|
|
|
# Step 1: Update nsigner binary
|
|
if [ -f "${HOME}/install_nsigner.sh" ]; then
|
|
echo "Step 1: Running install_nsigner.sh to update nsigner..."
|
|
bash "${HOME}/install_nsigner.sh"
|
|
else
|
|
echo "Step 1: install_nsigner.sh not found in ${HOME}."
|
|
echo " Make sure install_nsigner.sh is in your home directory first."
|
|
exit 1
|
|
fi
|
|
echo
|
|
|
|
# Verify the bridge subcommand exists
|
|
echo "Verifying bridge subcommand..."
|
|
if ! "${NSIGNER_BIN}" bridge --help > /dev/null 2>&1; then
|
|
echo "ERROR: nsigner does not have the 'bridge' subcommand."
|
|
echo " The installed version may be too old. Expected v0.0.34 or later."
|
|
"${NSIGNER_BIN}" --version
|
|
exit 1
|
|
fi
|
|
echo "OK: bridge subcommand available."
|
|
"${NSIGNER_BIN}" --version
|
|
echo
|
|
|
|
# Step 2: Install the qrexec service
|
|
echo "Step 2: Installing qrexec service to ${SERVICE_DST}..."
|
|
echo '#!/bin/sh' | sudo tee "${SERVICE_DST}" > /dev/null
|
|
echo '# qubes.NsignerRpc — stateless bridge to persistent nsigner unix socket' | sudo tee -a "${SERVICE_DST}" > /dev/null
|
|
echo '# No mnemonic, no secrets. Relays QREXEC_REMOTE_DOMAIN as source-qube preamble.' | sudo tee -a "${SERVICE_DST}" > /dev/null
|
|
echo "exec ${NSIGNER_BIN} bridge --to nsigner" | sudo tee -a "${SERVICE_DST}" > /dev/null
|
|
sudo chmod 0755 "${SERVICE_DST}"
|
|
|
|
echo "Service installed. Contents:"
|
|
cat "${SERVICE_DST}"
|
|
echo
|
|
|
|
echo "=== Signer qube setup complete ==="
|
|
echo
|
|
echo "To start the persistent signer (mnemonic entered at terminal, in mlock'd RAM):"
|
|
echo
|
|
echo " ${NSIGNER_BIN} --listen unix --socket-name nsigner --bridge-source-trusted"
|
|
echo
|
|
echo "The signer will prompt you for the mnemonic. It stays running with the"
|
|
echo "mnemonic in RAM only — nothing on disk. Leave it running in a terminal."
|
|
echo
|
|
echo "Then from a caller qube (e.g. 'ai'):"
|
|
echo " node examples/n_signer_qube_example_qrexec.js nostr_signer"
|