Empeiria

set -euo pipefail
sudo apt-get update
sudo apt-get install -y ca-certificates curl git jq make build-essential

GO_VERSION="1.22.3"
case "$(uname -m)" in
  x86_64) GO_ARCH="amd64" ;;
  aarch64|arm64) GO_ARCH="arm64" ;;
  *) echo "Unsupported CPU architecture: $(uname -m)" >&2; exit 1 ;;
esac

WORK_DIR=$(mktemp -d)
trap 'rm -rf "$WORK_DIR"' EXIT
GO_FILE="go1.22.3.linux-$GO_ARCH.tar.gz"
GO_META_URL="https://go.dev/dl/?mode=json&include=all"
GO_SHA256=$(curl --fail --silent --show-error --proto '=https'   --max-filesize 5242880 --max-time 30 "$GO_META_URL"   | jq -er --arg file "$GO_FILE" '.[] | .files[] | select(.filename == $file) | .sha256'   | head -n 1)
test -n "$GO_SHA256"

curl --fail --location --show-error --retry 3   --proto '=https' --proto-redir '=https'   --max-filesize 268435456 --max-time 900   "https://go.dev/dl/$GO_FILE" -o "$WORK_DIR/$GO_FILE"
printf '%s  %s\n' "$GO_SHA256" "$WORK_DIR/$GO_FILE" | sha256sum --check -
tar -tzf "$WORK_DIR/$GO_FILE" >/dev/null

if [ -d /usr/local/go ]; then
  sudo mv /usr/local/go "/usr/local/go.backup.$(date -u +%Y%m%dT%H%M%SZ)"
fi
sudo tar -C /usr/local -xzf "$WORK_DIR/$GO_FILE"
grep -qxF 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' "$HOME/.profile" 2>/dev/null   || printf '%s\n' 'export PATH=$PATH:/usr/local/go/bin:$HOME/go/bin' >> "$HOME/.profile"
export PATH="$PATH:/usr/local/go/bin:$HOME/go/bin"
mkdir -p "$HOME/go/bin"
go version | grep -F "go1.22.3"

set -euo pipefail
BIN="emped"
CHAIN_ID="empe-testnet-2"
MONIKER='validator-name'
NODE_HOME="$HOME/.empe-chain"

command -v "$BIN"
test ! -e "$NODE_HOME" || { echo "Stop: $NODE_HOME already exists; back it up and review it first." >&2; exit 1; }
"$BIN" init "$MONIKER" --chain-id "$CHAIN_ID" --home "$NODE_HOME"
test -f "$NODE_HOME/config/genesis.json"

set -euo pipefail
CHAIN_ID="empe-testnet-2"
NODE_HOME="$HOME/.empe-chain"
GENESIS_URL='https://testnet-files.bonynode.online/empeiria/genesis.json'
GENESIS_DOWNLOAD="$NODE_HOME/config/genesis.json.download"

test -d "$NODE_HOME/config"
test ! -e "$GENESIS_DOWNLOAD" || { echo "Stop: review the existing $GENESIS_DOWNLOAD first." >&2; exit 1; }
curl --fail --show-error --location --proto "=https" --max-time 120   --output "$GENESIS_DOWNLOAD" "$GENESIS_URL"
jq -e --arg chain "$CHAIN_ID" '.chain_id == $chain' "$GENESIS_DOWNLOAD" >/dev/null
# No published checksum is recorded; the JSON and configured chain ID are validated before replacement.
cp --no-clobber "$NODE_HOME/config/genesis.json" "$NODE_HOME/config/genesis.json.init-backup" || true
install -m 0644 "$GENESIS_DOWNLOAD" "$NODE_HOME/config/genesis.json"
jq -r '.chain_id' "$NODE_HOME/config/genesis.json"

#!/usr/bin/env bash
set -euo pipefail

CHAIN_ID="empe-testnet-2"
LOCAL_RPC="http://127.0.0.1:38657"
REFERENCE_RPC="https://empeiria-testnet-rpc.bonynode.online"

read_height() {
  local endpoint="$1"
  curl --fail --silent --show-error --max-time 10 "$endpoint/status"     | jq -er --arg chain "$CHAIN_ID" '
        select(.result.node_info.network == $chain)
        | .result.sync_info.latest_block_height
        | select(test("^[0-9]+$"))
      '
}

while true; do
  if LOCAL_HEIGHT=$(read_height "$LOCAL_RPC") && NETWORK_HEIGHT=$(read_height "$REFERENCE_RPC"); then
    BLOCKS_LEFT=$((NETWORK_HEIGHT - LOCAL_HEIGHT))
    [ "$BLOCKS_LEFT" -ge 0 ] || BLOCKS_LEFT=0
    printf 'Local: %s | Network: %s | Blocks left: %s\n'       "$LOCAL_HEIGHT" "$NETWORK_HEIGHT" "$BLOCKS_LEFT"
  else
    printf 'Unable to validate one of the chain-ID checked RPC heights; retrying...\n' >&2
  fi
  sleep 5
done

set -euo pipefail
BIN="emped"
WALLET='wallet'
[[ "$WALLET" =~ ^[a-zA-Z0-9_-]{1,64}$ ]] || { echo "Invalid wallet name" >&2; exit 1; }

# Create a new key. Store the mnemonic offline; it cannot be recovered by BonyNode.
"$BIN" keys add "$WALLET"

# To restore an existing key, run this separately:
# "$BIN" keys add "$WALLET" --recover

WALLET_ADDRESS=$("$BIN" keys show "$WALLET" -a)
"$BIN" query bank balances "$WALLET_ADDRESS"

BIN="emped"
CHAIN_ID="empe-testnet-2"
WALLET='wallet'
MONIKER='validator-name'
IDENTITY=''
WEBSITE=''
DETAILS='Independent validator'
AMOUNT="1000000uempe"
MIN_SELF_DELEGATION="1"
COMMISSION_RATE="0.10"
COMMISSION_MAX_RATE="0.20"
COMMISSION_MAX_CHANGE="0.01"

"$BIN" tx staking create-validator   --amount "$AMOUNT"   --from "$WALLET"   --commission-rate "$COMMISSION_RATE"   --commission-max-rate "$COMMISSION_MAX_RATE"   --commission-max-change-rate "$COMMISSION_MAX_CHANGE"   --min-self-delegation "$MIN_SELF_DELEGATION"   --pubkey "$("$BIN" tendermint show-validator)"   --moniker "$MONIKER"   --identity "$IDENTITY"   --website "$WEBSITE"   --details "$DETAILS"   --chain-id "$CHAIN_ID"   --gas auto --gas-adjustment 1.4 --fees 30uempe   -y

set -euo pipefail

P2P_PORT="38656"
sudo ufw default allow outgoing
sudo ufw default deny incoming
sudo ufw allow OpenSSH
sudo ufw allow "$P2P_PORT/tcp"
sudo ufw enable
sudo ufw status verbose

# RPC/API/gRPC remain private unless you deliberately add authenticated
# reverse-proxy rules. Never expose validator signing services publicly.

set -euo pipefail

SERVICE="emped"
NODE_HOME="$HOME/.empe-chain"
STAMP=$(date -u +%Y%m%dT%H%M%SZ)
RETIRED_HOME="$NODE_HOME.retired.$STAMP"
KEY_BACKUP="$HOME/emped-validator-keys-$STAMP.tar.gz"
NODE_STOPPED=0

rollback() {
  trap - ERR INT TERM
  if [ "$NODE_STOPPED" -eq 1 ]; then sudo systemctl start "$SERVICE" || true; fi
  exit 1
}
trap rollback ERR INT TERM

test -d "$NODE_HOME"
test ! -e "$RETIRED_HOME"
test -s "$NODE_HOME/config/priv_validator_key.json"
test -s "$NODE_HOME/data/priv_validator_state.json"
sudo systemctl stop "$SERVICE"
NODE_STOPPED=1

# Back up validator identity/state before moving anything.
tar -czf "$KEY_BACKUP" -C "$NODE_HOME"   config/priv_validator_key.json config/node_key.json data/priv_validator_state.json
test -s "$KEY_BACKUP"
mv "$NODE_HOME" "$RETIRED_HOME"
sudo systemctl disable "$SERVICE"
NODE_STOPPED=0
trap - ERR INT TERM

echo "Node home was retained at: $RETIRED_HOME"
echo "Critical key backup: $KEY_BACKUP"
echo "No binary, service file or node data was deleted."