How I almost created a constellation of Bitcoin nodes

Originally I intended to bring up a half dozen boxes or so using alf's well advertised ssh tunneling scheme, and I started this article as a reference for that. Meanwhile we ran into various minor bugs ; and the major wtf whereby my box sits with a bunch of connections in TIME_WAIT state and nothing useful happens past that -- the tunnel evidently dun work.

The process was slower than it needs to be, certainly, but what actually put the kibosh on the idea was the twin discovery that a) nodes can still be blackholed with this arrangement, and if they are they will happily drop their ssh pipes and b) even when this doesn't happen there is no advantage whateverⁱ to the piped node, it is still treated exactly like an all-comers node in all respects. These two factors combined make it both unfeasible and unappealing to eat the significant materiel and management costs of maintaining the proposed constellation, at least from my point of view.

Evidently, a solution to both a) and b) is expected to emerge from the eventual implementation of the TRB.N / TRB.B wallet split. The TRB.N could be run as servlets, one dedicated for tunneling peers, another dedicated to allcomers, which would make the peered one both immune to blackholing and passible of being priviledged in whatever other manner.

That said, I will be preserving the recipe I was preparing while doing all this so I can just pick up from here in half year or so when I try again.

We will be broadly relying on the Bitcoin Foundation's most recent release : thebitcoin.foundation/trb-howto.html. The item is curated by mod6, who is doing an absolutely fabulous job of it. To watch the whole process unravel, safely and correctly, is one of those extremely rare pleasures in the *nix world, notwithstanding their promise was why we even got into nixen in the first place.

We will be however making some adjustments to it, so as to serve our own purposes (the introduction of an experimental patchⁱⁱ in the press). For convenience the whole thing is reproduced below :

1. Log into a box, such as for instance via ssh root@wherever
2. Install autossh.ⁱⁱⁱ
3. Create fuckoff.c, to contain :

   #include <stdio.h>
   #include <unistd.h>
   #include <stdlib.h>

   int main() {
   printf("OK\n");
   while(1) { sleep(1); }
   exit(0);
   }

4. gcc fuckoff.c -o fuckoff
5. cp fuckoff /sbin/fuckoff
6. useradd -d /home/tbnode -s /sbin/fuckoff^iv
7. su tbnode^v
8. mkdir trb-ssh^vi
9. cd trb-ssh
10. curl -s http://thebitcoin.foundation/v/V-20160220.tar.gz -o V-20160220.tar.gz^vii
11. curl -s http://thebitcoin.foundation/v/V-20160220.tar.gz.mod6.sig -o V-20160220.tar.gz.mod6.sig
12. mkdir .wot^viii
13. curl http://wot.deedbot.org/4F7907942CA8B89B01E25A762AFA1A9FD2D031DA.asc -o ben_vulpes.asc
14. curl http://wot.deedbot.org/FC66C0C5D98C42A1D4A98B6B42F9985AFAB953C4.asc -o trinque.asc
15. curl http://wot.deedbot.org/17215D118B7239507FAFED98B98228A001ABFFC7.asc -o asciilifeform.asc
16. curl http://wot.deedbot.org/6160E1CAC8A3C52966FD76998A736F0E2FB7B452.asc -o mircea_popescu.asc
17. curl http://wot.deedbot.org/027A8D7C0FB8A16643720F40721705A8B71EADAF.asc -o mod6.asc
18. gpg --verify V-20160220.tar.gz.mod6.sig V-20160220.tar.gz^ix
19. tar -xf V-20160220.tar.gz^x
20. ./v.pl i http://thebitcoin.foundation^xi
21. curl http://btcbase.org/patches/asciilifeform_wires_rev1/file -o ~/trb-ssh/patches/asciilifeform_wires_rev1.vpatch^xii
22. curl http://btcbase.org/patches/asciilifeform_wires_rev1/seal/asciilifeform -o ~/trb-ssh/.seals/asciilifeform_wires_rev1.vpatch.asciilifeform.sig
23. ./v.pl p v trb54 asciilifeform_wires_rev1.vpatch^xiii
24. cd trb54/bitcoin
25. make ONLINE=1^xiv
26. Create a ssh key^xv
27. cat ~/.ssh/id_rsa.pub^xvi
28. echo "autossh -f -M 0 -L 9000:127.0.0.1:8333 name@master" > do_tunnel.sh^xvii
29. chmod +x do_tunnel.sh^xviii
30. ./do_tunnel.sh^xix
31. LC_ALL="C" nohup ./bitcoind -myip=46.166.160.36 -addwire=127.0.0.1:9000 -wirerefresh=3600 -verifyall 2>&1 &^xx

1. This is disputed ; there exists the to my eyes entirely negligible advantage that the node won't forget about the piped node. Leaving aside this theory hasn't been tested at all, this forgetting (which does happen, glory be to the genius of the original author) nevertheless isn't a major problem in the field for operational reasons. [↩]
2. Consequently significant portions borrowed from asciilifeform's own instructions. [↩]
3. On the system we used (2.6.32-573.12.1.el6.x86_64) this works as

   yum autossh

   but your system might use apt or whatever it uses. [↩]

4. Create a user (here "tbnode") that will be doing the node work, with fuckoff shell. [↩]
5. We're done with root stuff. [↩]
6. Simply creates a new directory. [↩]
7. These two steps acquire the current pressing mechanism as well as its signature. It will be verified later. [↩]
8. These six steps procure the public keys that you need in order to verify the patches as well as the V version you obtained in steps 3 and 4. [↩]
9. We are now in a position to verify the Vtron we're about to use. [↩]
10. Assuming the above step yielded

    gpg: Signature made Sat 20 Feb 2016 06:26:52 PM UTC using RSA key ID B71EADAF
    gpg: Good signature from "mod6 (mod6) "
    gpg: WARNING: This key is not certified with a trusted signature!
    gpg: There is no indication that the signature belongs to the owner.
    Primary key fingerprint: 027A 8D7C 0FB8 A166 4372 0F40 7217 05A8 B71E ADAF

    If it didn't please report. [↩]

11. The i flag inits, in this case on the basis of the mirror kept by the foundation. This will populate your /.seals and /patches directories with the standard TRB tree as of the date of issuance (22 February 2017, in this case).

    See the description of the Vtron's functioning via ./v.pl --help by the way. [↩]

12. This step and the next add the relevant portions of the experimental patch we wish to use (asciilifeform_wires_rev1) to the patches and seals directories respectively.

    If adding other patches, repeat the process for all of them. [↩]

13. Press a TRB tree. [↩]
14. Compile the press, loading the dependencies from deedbot's central repository. [↩]
15. If your user already has a ssh key, simply use its pubkey (it may be a good idea to create a separate user for this entire process).

    It is a horrendously bad idea to use ssh-keygen for this process, as you won't really obtain a key. [↩]

16. You will give this to people you connect via ssh tunnel to. [↩]
17. If you are connecting to master hurr @ 1.2.3.4 the "name@master" part will read hurr@1.2.3.4. Do not mess with the 9000:127.0.0.1:8333 part, that's good as it is. [↩]
18. We do want to run it. [↩]
19. Might also put it in cron for good measure, @boot or something. [↩]
20. We are done, our node at 46.166.160.36 will create a resilient ssh tunnel to the master specified, and accept incoming tunnels from whichever slaves you allowed via authorized_keys. Should you wish to tunnel towards more than one masters, make sure you increment the port, 9001 etc.

    Mind that the original patch has the complaint timeout set at one second, which results in four lines per second per dead connection being spit into your debug.log. This is excessive, for which reason we have the above switch. It however doesn't actually work in the original, to quote

    mircea_popescu one a second. why does it ignore the setting ?
    asciilifeform this, i figured out last night. tardoshi did the disconnect routine in a very 'special' way, where it slowly sits and drools and 'waits for any references to expire'

    mircea_popescu ahahaha
    asciilifeform i oughta have throttled the eggog, it gets printed continuously during this idiocy

    mircea_popescu because if he did it like he thinks he should it crashes right
    asciilifeform aha.

    but I understand will be fixed in a future development. [↩]