Harden onion boot flow and deepen site surfaces

Add persistent onion key backup and restore, improve startup resilience, and flesh out the major site verticals with richer navigation, search coverage, and operator documentation.

Made-with: Cursor

scripts/install-tor-onion.sh

@@ -0,0 +1,124 @@
+#!/bin/bash
+# Run with sudo: sudo bash scripts/install-tor-onion.sh
+# Regenerates Tor + nginx from scripts/onion-nodes.json, installs configs only when
+# they changed, restores backed-up onion keys if any service dirs are missing, and
+# starts/restarts nginx + Tor only when required.
+
+set -euo pipefail
+[[ "${EUID}" -eq 0 ]] || { echo "Run as root (sudo)."; exit 1; }
+
+REPO="$(cd "$(dirname "$0")/.." && pwd)"
+TORRC="/etc/tor/torrc"
+TOR_INCLUDE="/etc/tor/cyberlux-nodes.conf"
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "node is required to run scripts/generate-onion-config.cjs"
+  exit 1
+fi
+
+install_if_changed() {
+  local src="$1" dest="$2" mode="$3"
+  if [[ -f "${dest}" ]] && cmp -s "${src}" "${dest}"; then
+    return 1
+  fi
+  install -m "${mode}" "${src}" "${dest}"
+  return 0
+}
+
+tor_is_active() {
+  systemctl is-active --quiet tor@default.service 2>/dev/null || systemctl is-active --quiet tor 2>/dev/null
+}
+
+nginx_is_active() {
+  systemctl is-active --quiet nginx 2>/dev/null
+}
+
+restart_tor() {
+  systemctl restart tor@default.service 2>/dev/null || systemctl restart tor
+}
+
+start_tor() {
+  systemctl start tor@default.service 2>/dev/null || systemctl start tor
+}
+
+node "${REPO}/scripts/generate-onion-config.cjs"
+
+mkdir -p /etc/tor /etc/nginx/sites-available /etc/nginx/sites-enabled
+touch "${TORRC}"
+
+tor_changed=0
+nginx_changed=0
+
+if install_if_changed "${REPO}/tor/cyberlux-nodes.conf" "${TOR_INCLUDE}" 0644; then
+  tor_changed=1
+fi
+
+if grep -qF '%include /etc/tor/cyberlux-onion.conf' "${TORRC}"; then
+  sed -i '\|%include /etc/tor/cyberlux-onion.conf|d' "${TORRC}"
+  tor_changed=1
+fi
+
+if ! grep -qF "${TOR_INCLUDE}" "${TORRC}"; then
+  printf '\n%%include %s\n' "${TOR_INCLUDE}" >> "${TORRC}"
+  tor_changed=1
+fi
+
+if install_if_changed "${REPO}/nginx/cyberlux-server-common.inc" /etc/nginx/cyberlux-server-common.inc 0644; then
+  nginx_changed=1
+fi
+if install_if_changed "${REPO}/nginx/cyberlux-onion-servers.inc" /etc/nginx/cyberlux-onion-servers.inc 0644; then
+  nginx_changed=1
+fi
+if install_if_changed "${REPO}/nginx.example.conf" /etc/nginx/sites-available/cyberlux-onion 0644; then
+  nginx_changed=1
+fi
+ln -sf /etc/nginx/sites-available/cyberlux-onion /etc/nginx/sites-enabled/cyberlux-onion
+
+if [[ -x "${REPO}/scripts/restore-onion-keys.sh" ]]; then
+  bash "${REPO}/scripts/restore-onion-keys.sh"
+fi
+
+nginx -t
+if command -v tor >/dev/null 2>&1; then
+  tor --verify-config -f "${TORRC}" >/dev/null
+fi
+
+if (( nginx_changed )); then
+  systemctl reload nginx 2>/dev/null || systemctl restart nginx
+elif ! nginx_is_active; then
+  systemctl start nginx
+fi
+
+if (( tor_changed )); then
+  restart_tor
+elif ! tor_is_active; then
+  start_tor
+fi
+
+if [[ "${CYBERLUX_INSTALL_QUIET:-}" == "1" ]]; then
+  exit 0
+fi
+
+echo ""
+echo "CyberLux Tor nodes (see hostname files):"
+while IFS= read -r dir || [[ -n "${dir}" ]]; do
+  [[ -z "${dir}" ]] && continue
+  f="/var/lib/tor/${dir}/hostname"
+  if [[ -f "$f" ]]; then
+    echo "  ${dir}: http://$(tr -d '\n' < "$f")"
+  else
+    echo "  ${dir}: (generating…) sudo cat $f"
+  fi
+done < "${REPO}/scripts/generated/tor-dirs.txt"
+echo ""
+echo "Config status:"
+echo "  • Tor:   $([[ ${tor_changed} -eq 1 ]] && echo changed || echo unchanged)"
+echo "  • nginx: $([[ ${nginx_changed} -eq 1 ]] && echo changed || echo unchanged)"
+echo ""
+echo "Host hardening:"
+echo "  • Next: npm run start:onion (127.0.0.1:3000)"
+echo "  • Do not expose 3000 or nginx loopback ports to the public internet."
+echo "  • Onion key backup set: /var/backups/cyberlux-onion-keys/current"
+echo "  • Optional: sudo bash ${REPO}/scripts/classroom-ufw.sh"
+echo ""
+echo "Start app: cd ${REPO} && ./start.sh   or   npm run build && npm run start:onion"