qvm-bitcoin

#!/bin/bash

## qvm-bitcoin: Qubes dom0 tool for install and setup of isolated Bitcoin tools using Whonix.
## An attempt at automating these guides: https://github.com/qubenix/qubes-whonix-bitcoin.
##
## *NOT TO BE USED BY ANYONE, EVER. ALMOST COMPLETELY UNTESTED CODE AT THIS POINT.*

set -e

createvm_bitcoind () {
## Check for existence of 'whonix-ws-14-bitcoin' VM.
if [[ $(qvm-ls --no-spinner whonix-ws-14-bitcoin 2>/dev/null) && ! $(qvm-tags whonix-ws-14-bitcoin | grep "created_by_qvm-bitcoin") ]]; then
  printf "Cannot continue with an existing VM named 'whonix-ws-14-bitcoin'.\n"
  read -p "Remove it and continue? (y/n) " remove_whonix_ws_14_bitcoin
  if [[ "${remove_whonix_ws_14_bitcoin}" = [Yy] ]]; then
    qvm-remove whonix-ws-14-bitcoin
  else
    printf "Exiting.\n"
    exit 1
  fi
fi

## Check for existence of 'sys-bitcoin' VM.
if [[ $(qvm-ls --no-spinner sys-bitcoin 2>/dev/null) && ! $(qvm-tags sys-bitcoin | grep "created_by_qvm-bitcoin") ]]; then
  printf "Cannot continue with an existing VM named 'sys-bitcoin'.\n"
  read -p "Remove it and continue? (y/n) " remove_sys_bitcoin
  if [[ "${remove_sys_bitcoin}" = [Yy] ]]; then
    qvm-remove sys-bitcoin
  else
    printf "Exiting.\n"
    exit 1
  fi
fi

## Check for existence of 'bitcoind' VM.
if [[ $(qvm-ls --no-spinner bitcoind 2>/dev/null) && ! $(qvm-tags bitcoind | grep "created_by_qvm-bitcoin") ]]; then
  printf "Cannot continue with an existing VM named 'bitcoind'.\n"
  read -p "Remove it and continue? (y/n) " remove_bitcoind
  if [[ "${remove_bitcoin}" = [Yy] ]]; then
    qvm-remove bitcoind
  else
    printf "Exiting.\n"
    exit 1
  fi
fi

## Clone and setup TemplateVM: 'whonix-ws-14-bitcoin' from the default Whonix
## workstation TemplateVM, if it doesn't already exist.
if [[ ! $(qvm-ls --no-spinner whonix-ws-14-bitcoin 2>/dev/null) ]]; then
  ## Get the name of a Whonix workstation TemplateVM.
  default_workstation_template="whonix-ws-14"
  while [[ ! $(qvm-ls --no-spinner "${default_workstation_template}" 2>/dev/null) ]]; do
    printf "The default Whonix workstation TemplateVM, "${default_workstation_template}", does not exist.\n"
    read -p "What is the name of your Whonix workstation TemplateVM? " default_workstation_template
  done

  ## Clone the  default Whonix workstation VM.
  printf '%s\n' "- Cloning "${default_workstation_template}"..."
  sleep 1s
  qvm-clone "${default_workstation_template}" whonix-ws-14-bitcoin

  ## Make sure the TemplateVM has networking.
  if [[ $(qvm-ls --no-spinner -O netvm --raw-data whonix-ws-14-bitcoin) = "-" ]]; then
    printf "The TemplateVM, whonix-ws-14-bitcoin, has no NetVM.\n"
    read -p "What is the name of your Whonix update VM? " template_update_vm
    while [[ ! $(qvm-ls --no-spinner "${template_update_vm}" 2>/dev/null) || $(qvm-ls --no-spinner -O netvm --raw-data "${template_update_vm}") = "-" ]]; do
      printf "The Whonix update VM, "${template_update_vm}", does not exist or has no NetVM.\n"
      read -p "What is the name of the VM used to update your Whonix TemplateVMs? " template_update_vm
    done
  fi

  ## Update and install dependencies to 'whonix-ws-14-bitcoin' VM.
  printf '%s\n' '- Updating and installing dependencies to whonix-ws-14-bitcoin...'
  sleep 1s
  qvm-run --no-gui -p -u root whonix-ws-14-bitcoin 'export DEBIAN_FRONTEND="noninteractive" TERM="vt100"; \
  apt update && apt install -y automake autotools-dev build-essential git libboost-chrono-dev libboost-filesystem-dev \
  libboost-system-dev libboost-test-dev libboost-thread-dev libevent-dev libprotobuf-dev libqrencode-dev libssl-dev \
  libtool libzmq3-dev pkg-config protobuf-compiler qttools5-dev qttools5-dev-tools'

  printf '%s\n' '- Setting up TemplateVM: whonix-ws-14-bitcoin...'
  sleep 1s

  ## Create system user on 'whonix-ws-14-bitcoin' VM.
  qvm-run --no-gui -q -u root whonix-ws-14-bitcoin 'adduser --system bitcoin'

  ## Set up `systemd` service on 'whonix-ws-14-bitcoin' VM.
  qvm-run --no-gui -q -u root whonix-ws-14-bitcoin "printf '%s\n' '[Unit]
Description=Bitcoin daemon
ConditionPathExists=/var/run/qubes-service/bitcoind
After=qubes-sysinit.service

[Service]
ExecStart=/home/bitcoin/bin/bitcoind -daemon -pid=/run/bitcoind/bitcoind.pid
ExecStop=/home/bitcoin/bin/bitcoin-cli stop

RuntimeDirectory=bitcoind
User=bitcoin
Type=forking
PIDFile=/run/bitcoind/bitcoind.pid
Restart=on-failure

PrivateTmp=true
ProtectSystem=full
NoNewPrivileges=true
PrivateDevices=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target' > /lib/systemd/system/bitcoind.service"
  qvm-run --no-gui -q -u root whonix-ws-14-bitcoin 'chmod 0644 /lib/systemd/system/bitcoind.service'
  qvm-run --no-gui -q -u root whonix-ws-14-bitcoin 'systemctl enable bitcoind.service'
  qvm-service --enable bitcoind bitcoind

  ## Shutdown 'whonix-ws-14-bitcoin' VM.
  qvm-shutdown whonix-ws-14-bitcoin

  ## Add a tag.
  qvm-tags whonix-ws-14-bitcoin add created_by_qvm-bitcoin
fi

## Create 'sys-bitcoin' gateway VM, if it doesn't already exist.
if [[ ! $(qvm-ls --no-spinner sys-bitcoin 2>/dev/null) ]]; then

  ## Get names of NetVM and TemplateVM of the gateway.
  gateway_netvm="sys-firewall"
  while [[ ! $(qvm-ls --no-spinner "${gateway_netvm}" 2>/dev/null) ]]; do
    printf "The NetVM, "${gateway_netvm}", does not exist.\n"
    read -p "What is the name of the NetVM that your gateway should use? " gateway_netvm
  done
  gateway_template="whonix-gw-14"
  while [[ ! $(qvm-ls --no-spinner "${gateway_template}" 2>/dev/null) ]]; do
    printf "The TemplateVM, "${gateway_template}", does not exist.\n"
    read -p "What is the name of your Whonix gateway TemplateVM? " gateway_template
  done

  ## Create the 'sys-bitcoin' VM.
  printf '%s\n' '- Creating gateway VM: sys-bitcoin...'
  sleep 1s
  qvm-create --label purple --prop maxmem='400' --prop netvm="${gateway_netvm}" --prop provides_network='True' \
  --prop vcpus='1' --template "${gateway_template}" sys-bitcoin

  ## Set up `onion-grater` on 'sys-bitcoin' VM.
  printf '%s\n' '- Setting up gateway VM: sys-bitcoin...'
  sleep 1s
  qvm-run --no-gui -q -u root sys-bitcoin 'install -D -t /usr/local/etc/onion-grater-merger.d/ \
  /usr/share/onion-grater-merger/examples/40_bitcoind.yml'
  qvm-run --no-gui -q -u root sys-bitcoin 'systemctl restart onion-grater.service'
  ## Add a tag.
  qvm-tags sys-bitcoin add created_by_qvm-bitcoin
fi

## Create 'bitcoind' VM, if it doesn't already exist.
if [[ ! $(qvm-ls --no-spinner sys-bitcoin 2>/dev/null) ]]; then
  printf '%s\n' '- Creating AppVM: bitcoind...'
  sleep 1s
  qvm-create --label red --prop netvm='sys-bitcoin' --template whonix-ws-14-bitcoin bitcoind

  ## Increase private volume size of 'bitcoind' VM.
  qvm-volume resize bitcoind:private 250G

  printf '%s\n' '- Setting up AppVM: bitcoind...'
  sleep 1s

  ## Start 'bitcoind' VM.
  qvm-start bitcoind

  ## Stop `bitcoind` service.
  qvm-run --no-gui -q -u root bitcoind 'systemctl stop bitcoind.service'

  ## Clone the Bitcoin repository on the 'bitcoind' VM.
  printf '%s\n' '- Getting the bitcoin source code...'
  sleep 1s
  qvm-run --no-gui -p -u bitcoin bitcoind 'git clone --branch 0.17 --progress https://github.com/bitcoin/bitcoin ~/bitcoin'

  ## Get signing keys. Verify fingerprints:
  ## https://github.com/bitcoin/bitcoin/blob/0.17/contrib/verify-commits/trusted-keys.
  ## Fallback to sks-keyservers.net onion address if the default keyserver fails.
  printf '%s\n' '- Getting the bitcoin signing keys...'
  sleep 1s
  qvm-run --no-gui -p -u bitcoin bitcoind 'gpg --recv-keys \
  71A3B16735405025D447E8F274810B012346C9A6 133EAC179436F14A5CF1B794860FEB804E669320 \
  32EE5C4C3FA15CCADB46ABE529D4BCB6416F53EC B8B3F1C0E58C15DB6A81D30C3648A882F4316B9B
  while [[ "${?}" -ne "0" ]]; do
    gpg --keyserver hkp://jirk5u4osbsr34t5.onion --recv-keys \
    71A3B16735405025D447E8F274810B012346C9A6 133EAC179436F14A5CF1B794860FEB804E669320 \
    32EE5C4C3FA15CCADB46ABE529D4BCB6416F53EC B8B3F1C0E58C15DB6A81D30C3648A882F4316B9B
  done'

  printf '%s\n' '- Verifying the bitcoin source code...'
  sleep 1s

  ## Verify downloaded source code.
  verify_bitcoin=$(qvm-run --no-gui -p -q -u bitcoin bitcoind 'cd ~/bitcoin; git verify-commit HEAD 2>&1 | grep -c BAD')
  while [[ "${verify_bitcoin}" -ne "0" ]]; do
    printf "%s\n" "Bitcoin source code failed verification!
Removing, downloading, and verifying again."
    qvm-run --no-gui -q -u bitcoin bitcoind 'rm -rf ~/bitcoin'
    qvm-run --no-gui -p -u bitcoin bitcoind 'git clone --branch 0.17 --progress https://github.com/bitcoin/bitcoin ~/bitcoin'
    verify_bitcoin=$(qvm-run --no-gui -p -q -u bitcoin bitcoind 'cd ~/bitcoin; git verify-commit HEAD 2>&1 | grep -c BAD')
  done

  ## Build Berkeley DB.
  printf '%s\n' '- Building Berkeley database...'
  sleep 1s
  qvm-run --no-gui -p -u bitcoin bitcoind 'cd ~/bitcoin; ~/bitcoin/contrib/install_db4.sh ~/bitcoin'

  ## Prepare to build Bitcoin Core.
  printf '%s\n' '- Configuring bitcoind source code for build...'
  sleep 1s
  qvm-run --no-gui -p -u bitcoin bitcoind 'cd ~/bitcoin; export BDB_PREFIX="/home/bitcoin/bitcoin/db4"; \
  ~/bitcoin/autogen.sh && ~/bitcoin/configure BDB_LIBS="-L${BDB_PREFIX}/lib -ldb_cxx-4.8" \
  BDB_CFLAGS="-I${BDB_PREFIX}/include" --bindir=/home/bitcoin/bin --prefix=/home/bitcoin/bin'

  ## Build and install Bitcoin Core.
  printf '%s\n' '- Building and installing bitcoind...'
  sleep 1s
  qvm-run --no-gui -p -u bitcoin bitcoind 'cd ~/bitcoin; make check && make install'

  ## Configure Bitcoin Core.
  printf '%s\n' '- Configuring bitcoind...'
  sleep 1s
  qvm-run --no-gui -q -u bitcoin bitcoind 'mkdir -m 0700 ~/.bitcoin'
  sys_bitcoin_ip=$(qvm-prefs sys-bitcoin ip)
  qvm-run --no-gui -q -u bitcoin bitcoind "printf '%s\n' 'listen=1
onion="${sys_bitcoin_ip}":9111
onlynet=onion
proxy="${sys_bitcoin_ip}":9111
txindex=1' > ~/.bitcoin/bitcoin.conf" 
  qvm-run --no-gui -q -u bitcoin bitcoind 'chmod 0600 ~/.bitcoin/bitcoin.conf'

  ## Configure `qubes-rpc`.
  qvm-run --no-gui -q -u root bitcoind 'mkdir -m 0755 /rw/usrlocal/etc/qubes-rpc'
  qvm-run --no-gui -q -u root bitcoind "printf '%s\n' \
  'socat STDIO TCP:127.0.0.1:8332' > /rw/usrlocal/etc/qubes-rpc/qubes.bitcoind"
  qvm-run --no-gui -q -u root bitcoind 'chmod 0644 /rw/usrlocal/etc/qubes-rpc/qubes.bitcoind'

  ## Configure Whonix firewall for `bitcoind` onion service.
  qvm-run --no-gui -q -u root bitcoind 'mkdir -m 0755 /rw/config/whonix_firewall.d'
  qvm-run --no-gui -q -u root bitcoind "printf '%s\n' 'EXTERNAL_OPEN_PORTS+=\" 8333 \"' >> /rw/config/whonix_firewall.d/50_user.conf"
  qvm-run --no-gui -q -u root bitcoind 'systemctl restart whonix-firewall.service'

  ## Set up aliases.
  qvm-run --no-gui -q -u user bitcoind "printf '%s\n' 'alias bitcoin-cli=\"sudo -u bitcoin /home/bitcoin/bin/bitcoin-cli\"' >> ~/.bashrc"
  qvm-run --no-gui -q -u user bitcoind "printf '%s\n' 'alias bitcoind=\"sudo -u bitcoin /home/bitcoin/bin/bitcoind\"' >> ~/.bashrc"
  qvm-run --no-gui -q -u user bitcoind "printf '%s\n' 'alias bitcoin-qt=\"sudo -u bitcoin /home/bitcoin/bin/bitcoin-qt\"' >> ~/.bashrc"

  ## Add a tag.
  qvm-tags bitcoind add created_by_qvm-bitcoin
fi
}

createvm_electrum-personal-server () {
## Check for existence of 'sys-electrum-personal-server' VM.
if [[ $(qvm-ls --no-spinner sys-electrum-personal-server 2>/dev/null) && ! $(qvm-tags sys-electrum-personal-server | grep "created_by_qvm-bitcoin") ]]; then
  printf "Cannot continue with an existing VM named 'sys-electrum-personal-server'.\n"
  read -p "Remove it and continue? (y/n) " remove_sys_electrum_personal_server
  if [[ "${remove_sys_electrum_personal_server}" = [Yy] ]]; then
    qvm-remove sys-electrum-personal-server
  else
    printf "Exiting.\n"
    exit 1
  fi
fi

## Check for existence of 'electrum-personal-server' VM.
if [[ $(qvm-ls --no-spinner electrum-personal-server 2>/dev/null) && ! $(qvm-tags electrum-personal-server | grep "created_by_qvm-bitcoin") ]]; then
  printf "Cannot continue with an existing VM named 'electrum-personal-server'.\n"
  read -p "Remove it and continue? (y/n) " remove_electrum_personal_server
  if [[ "${remove_electrum_personal_server}" = [Yy] ]]; then
    qvm-remove electrum-personal-server
  else
    printf "Exiting.\n"
    exit 1
  fi
fi

## Check for existence of the prerequisite VM: 'bitcoind'.
## Create it if it doesn't exist.
if [[ ! $(qvm-ls --no-spinner bitcoind 2>/dev/null) ]]; then
  createvm_bitcoind
else
  if [[ ! $(qvm-tags bitcoind | grep "created_by_qvm-bitcoin") ]]; then
    printf "Cannot continue with an existing VM named 'bitcoind'.\n"
    read -p "Remove it and continue? (y/n) " remove_bitcoind
    if [[ "${remove_bitcoind}" = [Yy] ]]; then
      qvm-remove bitcoind
      createvm_bitcoind
    else
      printf "Exiting.\n"
      exit 1
    fi
  fi
fi

## Create 'sys-electrum-personal-server' gateway VM, if it doesn't already exist.
if [[ ! $(qvm-ls --no-spinner sys-electrum-personal-server 2>/dev/null) ]]; then
  ## Get names of NetVM and TemplateVM of the gateway.
  gateway_netvm="sys-firewall"
  while [[ ! $(qvm-ls --no-spinner "${gateway_netvm}" 2>/dev/null) ]]; do
    printf "The NetVM, "${gateway_netvm}", does not exist.\n"
    read -p "What is the name of the NetVM that your gateway should use? " gateway_netvm
  done
  gateway_template="whonix-gw-14"
  while [[ ! $(qvm-ls --no-spinner "${gateway_template}" 2>/dev/null) ]]; do
    printf "The TemplateVM, "${gateway_template}", does not exist.\n"
    read -p "What is the name of your Whonix gateway TemplateVM? " gateway_template
  done

  ## Create the 'sys-electrum-personal-server' VM.
  printf '%s\n' '- Creating gateway VM: sys-electrum-personal-server...'
  sleep 1s
  qvm-create --label purple --prop maxmem='400' --prop netvm="${gateway_netvm}" --prop provides_network='True' \
  --prop vcpus='1' --template "${gateway_template}" sys-electrum-personal-server

  ## Add a tag.
  qvm-tags sys-electrum-personal-server add created_by_qvm-bitcoin
fi

## Create 'electrum-personal-server' VM, if it doesn't already exist.
if [[ ! $(qvm-ls --no-spinner electrum-personal-server 2>/dev/null) ]]; then
  printf '%s\n' '- Setting up TemplateVM: whonix-ws-14-bitcoin...'
  sleep 1s
  ## Update and install dependencies to 'whonix-ws-14-bitcoin' VM.
  qvm-run --no-gui -p -u root whonix-ws-14-bitcoin 'if [[ ! $(dpkg -s python-virtualenv 2>/dev/null) ]]; then \
  export DEBIAN_FRONTEND="noninteractive" TERM="vt100"; apt update && apt install -y python-virtualenv; fi'

  ## Add system user to 'whonix-ws-14-bitcoin' VM.
  qvm-run --no-gui -p -u root whonix-ws-14-bitcoin 'if [[ ! $(id -u electrum-personal-server 2>/dev/null) ]]; then \
  adduser --system electrum-personal-server; fi'

  ## Set up `systemd` service on 'whonix-ws-14-bitcoin' VM.
  qvm-run --no-gui -q -u root whonix-ws-14-bitcoin "printf '%s\n' '[Unit]
Description=Electrum Personal Server
ConditionPathExists=/var/run/qubes-service/electrum-personal-server
After=qubes-sysinit.service

[Service]
ExecStart=/home/electrum-personal-server/epsvenv/bin/electrum-personal-server \
-l /home/electrum-personal-server/.eps/debug.log --loglevel DEBUG /home/electrum-personal-server/.eps/config.cfg

User=electrum-personal-server
Restart=on-failure

PrivateTmp=true
ProtectSystem=full
NoNewPrivileges=true
PrivateDevices=true
MemoryDenyWriteExecute=true

[Install]
WantedBy=multi-user.target' > /lib/systemd/system/electrum-personal-server.service"
  qvm-run --no-gui -q -u root whonix-ws-14-bitcoin 'chmod 0644 /lib/systemd/system/electrum-personal-server.service'
  qvm-run --no-gui -p -u root whonix-ws-14-bitcoin 'systemctl enable electrum-personal-server.service'
  qvm-service --enable electrum-personal-server electrum-personal-server

  ## Shutdown the 'whonix-ws-14-bitcoin' VM.
  qvm-shutdown whonix-ws-14-bitcoin

  ## Create the 'electrum-personal-server' VM.
  printf '%s\n' '- Creating AppVM: electrum-personal-server...'
  sleep 1s
  qvm-create --label red --prop maxmem='400' --prop netvm='sys-electrum-personal-server' --prop vcpus='1' \
  --template whonix-ws-14-bitcoin electrum-personal-server

  ## Create rpc credentials for electrum-personal-server VM to `bitcoind`.
  eps_bitcoind_rpc_user=$(head -c 15 /dev/urandom | base 64)
  eps_bitcoind_rpc_pass=$(head -c 30 /dev/urandom | base 64)

  ## Use bitcoin's provided tool to get the rpcauth line for the config file.
  eps_bitcoind_rpc_auth=$(qvm-run --no-gui -p -q -u bitcoin bitcoind "~/bitcoin/share/rpcauth/rpcauth.py \
  "${eps_bitcoind_rpc_user}" "${eps_bitcoind_rpc_pass}"" | grep rpcauth)

  ## Configure `bitcoind` on the 'bitcoind' VM.
  qvm-run --no-gui -q -u bitcoin bitcoind "printf '%s\n' '## Electrum Personal Server Auth
"${eps_bitcoind_rpc_auth}"
## Electrum Personal Server Wallet
wallet=electrum-personal-server' >> ~/.bitcoin/bitcoin.conf"

  ## Restart `bitcoind` service on the 'bitcoind' VM.
  qvm-run --no-gui -q -u root bitcoin 'systemctl restart bitcoind.service'

  ## Download `electrum-personal-server` and signature on the 'electrum-personal-server VM.
  printf '%s\n' '- Getting electrum-personal-server v0.1.6 and signature file...'
  sleep 1s
  qvm-run --no-gui -p -q -u electrum-personal-server electrum-personal-server 'curl -LO \
  "https://github.com/chris-belcher/electrum-personal-server/archive/eps-v0.1.6.tar.gz" -O \
  "https://github.com/chris-belcher/electrum-personal-server/releases/download/eps-v0.1.6/eps-v0.1.6.tar.gz.asc"'

  ## Get signing keys on 'electrum-personal-server' VM. Verify fingerprint:
  ## https://github.com/chris-belcher/electrum-personal-server/releases.
  ## Fallback to sks-keyservers.net onion address if the default keyserver fails.
  printf '%s\n' '- Getting the electrum-personal-server signing key...'
  sleep 1s
  qvm-run --no-gui -p -u electrum-personal-server electrum-personal-server 'gpg --recv-keys 0A8B038F5E10CC2789BFCFFFEF734EA677F31129
  while [[ "${?}" -ne "0" ]]; do
    gpg --keyserver hkp://jirk5u4osbsr34t5.onion \
    --recv-keys 0A8B038F5E10CC2789BFCFFFEF734EA677F31129
  done'

  ## Verify downloaded `electrum-personal-server` source code.
  verify_electrum_personal_server=$(qvm-run --no-gui -p -q -u electrum-personal-server electrum-personal-server 'gpg --verify \
  ~/eps-v0.1.6.tar.gz.asc ~/eps-v0.1.6.tar.gz | grep -c BAD')
  while [[ "${verify_electrum_personal_server}" -ne "0" ]]; do
    printf "%s\n" "Electrum Personal Server source code failed verification!
Removing, downloading, and verifying again."
    qvm-run --no-gui -q -u electrum-personal-server electrum-personal-server 'rm ~/eps-v0.1.6.tar.gz.asc ~/eps-v0.1.6.tar.gz'
    qvm-run --no-gui -p -q -u electrum-personal-server electrum-personal-server 'curl -LO \
  "https://github.com/chris-belcher/electrum-personal-server/archive/eps-v0.1.6.tar.gz" -O \
  "https://github.com/chris-belcher/electrum-personal-server/releases/download/eps-v0.1.6/eps-v0.1.6.tar.gz.asc"'
    verify_electrum_personal_server=$(qvm-run --no-gui -p -q -u electrum-personal-server electrum-personal-server 'gpg --verify \
  eps-v0.1.6.tar.gz.asc eps-v0.1.6.tar.gz | grep -c BAD')
  done

  ## Extract verified source code on the 'electrum-personal-server' VM.
  qvm-run --no-gui -q -u electrum-personal-server electrum-personal-server 'tar -C ~ -xf ~/eps-v0.1.6.tar.gz'

  ## Create python virtual environment.
  printf '%s\n' '- Creating python virtual environment on AppVM: electrum-personal-server...'
  sleep 1s
  qvm-run --no-gui -p -q -u electrum-personal-server electrum-personal-server 'virtualenv -p python3 ~/epsvenv'

  ## Install `electrum-personal-server` to virtual environment.
  printf '%s\n' '- Installing electrum-personal-server to virtual environment...'
  sleep 1s
  qvm-run --no-gui -q -u electrum-personal-server electrum-personal-server 'cd ~/electrum-personal-server-eps-v0.1.6/; \
  ~/epsvenv/bin/python setup.py install'

  ## Configure `electrum-personal-server`.
  printf '%s\n' '- Configuring electrum-personal-server...'
  sleep 1s
  qvm-run --no-gui -q -u electrum-personal-server electrum-personal-server 'mkdir -m 0700 ~/.eps; mkdir -m 0700 ~/.eps/certs'
  qvm-run --no-gui -q -u electrum-personal-server electrum-personal-server "printf '%s\n' '## Electrum Personal Server configuration file

[master-public-keys]
## Add electrum master public keys to this section.
## Create a wallet in electrum then go Wallet -> Information to get the MPK.

# any_name_works = xpub661MyMwAqRbcFseXCwRdRVkhVuzEiskg4QUp5XpUdNf2uGXvQmnD4zcofZ1MN6Fo8PjqQ5cemJQ39f7RTwDVVputHMFjPUn8VRp2pJQMgEF

## Multiple master public keys maybe added by simply adding another line.
# my_second_wallet = xpubanotherkey

## Multisig wallets use format \`required-signatures [list of master pub keys]\`.
# multisig_wallet = 2 xpub661MyMwAqRbcFseXCwRdRVkhVuzEiskg4QUp5XpUdNf2uGXvQmnD4zcofZ1MN6Fo8PjqQ5cemJQ39f7RTwDVVputHMFjPUn8VRp2pJQMgEF xpub661MyMwAqRbcFseXCwRdRVkhVuzEiskg4QUp5XpUdNf2uGXvQmnD4zcofZ1MN6Fo8PjqQ5cemJQ39f7RTwDVVputHMFjPUn8VRp2pJQMgEF

[watch-only-addresses]
## Add addresses to this section, space separated list.
## Multiple \`addr =\` entries allowed.
# addr = 1DuqpoeTB9zLvVCXQG53VbMxvMkijk494n

[bitcoin-rpc]
host = 127.0.0.1
port = 8332
rpc_user = "${eps_bitcoind_rpc_user}"
rpc_password = "${eps_bitcoind_rpc_pass}"
poll_interval_listening = 30
poll_interval_connected = 5
initial_import_count = 1000
gap_limit = 25

[electrum-server]
host = 0.0.0.0
port = 50002
ip_whitelist = *
certfile = /home/electrum-personal-server/.eps/certs/server.crt
keyfile = /home/electrum-personal-server/.eps/certs/server.key' > ~/.eps/config.cfg"
  qvm-run --no-gui -q -u electrum-personal-server electrum-personal-server 'chmod 0600 ~/.eps/config.cfg'

  ## Create tls cert and key.
  qvm-run --no-gui -q -u electrum-personal-server electrum-personal-server 'openssl req -x509 -sha256 -newkey rsa:4096 \
  -keyout ~/.eps/certs/server.key -out ~/.eps/certs/server.crt -days 1825 -nodes -subj '/CN=localhost''

  ## Set up `socat` in `/rw/config/rc.local`.
  qvm-run --no-gui -q -u root electrum-personal-server "printf '%s\n' \
  'socat TCP-LISTEN:8332,fork,bind=127.0.0.1 EXEC:\"qrexec-client-vm bitcoind qubes.bitcoind\" &' >> /rw/config/rc.local"

  ## Configure `qubes-rpc`.
  qvm-run --no-gui -q -u root electrum-personal-server 'mkdir -m 0755 /rw/usrlocal/etc/qubes-rpc'
  qvm-run --no-gui -q -u root electrum-personal-server "printf '%s\n' \
  'socat STDIO TCP:127.0.0.1:50002' > /rw/usrlocal/etc/qubes-rpc/qubes.electrum-personal-server"
  qvm-run --no-gui -q -u root electrum-personal-server 'chmod 0644 /rw/usrlocal/etc/qubes-rpc/qubes.electrum-personal-server'

  ## Configure Whonix firewall for `electrum-personal-server` onion service.
  qvm-run --no-gui -q -u root bitcoind 'mkdir -m 0755 /rw/config/whonix_firewall.d'
  qvm-run --no-gui -q -u root bitcoind "printf '%s\n' 'EXTERNAL_OPEN_PORTS+=\" 50002 \"' >> /rw/config/whonix_firewall.d/50_user.conf"
  qvm-run --no-gui -q -u root bitcoind 'systemctl restart whonix-firewall.service'

  ## Allow comms from 'electrum-personal-server' VM to 'bitcoind' VM.
  sudo printf "%s\n" "electrum-personal-server bitcoind allow" >> /etc/qubes-rpc/policy/qubes.bitcoind

  ## Add a tag.
  qvm-tags electrum-personal-server add created_by_qvm-bitcoin

  ## Set up the `electrum-personal-server` onion service on the 'sys-electrum-personal-server' VM.
  electrum_personal_server_ip=$(qvm-prefs electrum-personal-server ip)
  qvm-run --no-gui -q -u root sys-electrum-personal-server "printf '%s\n' '
HiddenServiceDir /var/lib/tor/electrum-personal-server/
HiddenServicePort 50002 "${electrum_personal_server_ip}":50002' >> /rw/usrlocal/etc/torrc.d/50_user.conf"
  qvm-run --no-gui -q -u root sys-electrum-personal-server 'systemctl reload tor.service'
fi
}

createvm_electrum () {
## Check for existence of 'electrum' VM.
if [[ $(qvm-ls --no-spinner electrum 2>/dev/null) && ! $(qvm-tags electrum | grep "created_by_qvm-bitcoin") ]]; then
  printf "Cannot continue with an existing VM named 'electrum'.\n"
  read -p "Remove it and continue? (y/n) " remove_electrum
  if [[ "${remove_electrum}" = [Yy] ]]; then
    qvm-remove electrum
  else
    printf "Exiting.\n"
    exit 1
  fi
fi

## Check for existence of the prerequisite VM: 'electrum-personal-server'.
## Create it if it doesn't exist.
if [[ ! $(qvm-ls --no-spinner electrum-personal-server 2>/dev/null) ]]; then
  createvm_electrum-personal-server
else
  if [[ ! $(qvm-tags electrum-personal-server | grep "created_by_qvm-bitcoin") ]]; then
    printf "Cannot continue with an existing VM named 'electrum-personal-server'.\n"
    read -p "Remove it and continue? (y/n) " remove_electrum_personal_server
    if [[ "${remove_electrum_personal_server}" = [Yy] ]]; then
      qvm-remove electrum-personal-server
      createvm_electrum-personal-server
    else
      printf "Exiting.\n"
      exit 1
    fi
  fi
fi

## Create the 'electrum' VM, if it doesn't already exist.
if [[ ! $(qvm-ls --no-spinner electrum 2>/dev/null) ]]; then
  ## Get the name of the Whonix workstation TemplateVM.
  default_workstation_template="whonix-ws-14"
  while [[ ! $(qvm-ls --no-spinner "${default_workstation_template}" 2>/dev/null) ]]; do
    printf "The default Whonix workstation TemplateVM, "${default_workstation_template}", does not exist.\n"
    read -p "What is the name of your Whonix workstation TemplateVM? " default_workstation_template
  done

  ## Create the 'electrum' VM.
  qvm-create --label black --prop maxmem='800' --prop netvm='' --prop vcpus='1' --template \
  "${default_workstation_template}" electrum

  ## Allow comms from 'electrum' VM to 'electrum-personal-server' VM.
  sudo printf "%s\n" "electrum electrum-personal-server allow" >> /etc/qubes-rpc/policy/qubes.electrum-personal-server

  ## Set the download VM to a Whonix based disposable VM or the 'bitcoind' VM.
  if [[ $(qvm-ls --no-spinner -O name | grep "whonix-ws-14-dvm") ]]; then
    electrum_download_vm="--dispvm whonix-ws-14-dvm"
  else
    electrum_download_vm="bitcoind"
  fi

  ## Download and verify current `electrum` AppImage on the download VM.
  printf '%s\n' '- Downloading and verifying Electrum...
TO MOVE THE FILE FROM THE DOWNLOAD VM:
SELECT "electrum" FROM THE POP UP IN A FEW MINUTES!'

  qvm-run --no-gui -p -q -u user $(printf "%s" "${electrum_download_vm}") \
  '## Get latest `electrum` version number on the download VM.
  latest_electrum_version_number=`curl --retry 5 -s "https://electrum.org/version" | tr -d "\"\," \
  | cut -d":" -f 2 | sed "s/ signatures//"`

  ## Test that the received version number matches a regex, or set it to last known good version.
  if [[ ! "${latest_electrum_version_number}" =~ ([0-9].[0-9].[0-9]) ]]; then
    latest_electrum_version_number="3.3.4"
  fi

  ## Download latest version of `electrum` and detached signature.
  curl --retry 5 -O \
  "https://download.electrum.org/"${latest_electrum_version_number}"/electrum-"${latest_electrum_version_number}"-x86_64.AppImage" -O \
  "https://download.electrum.org/"${latest_electrum_version_number}"/electrum-"${latest_electrum_version_number}"-x86_64.AppImage.asc"

  ## Get signing key.
  ## Verify the key fingerprint of Thomas Voegtlin: https://electrum.org/#about.
  ## Fallback to sks-keyservers.net onion address if the default keyserver fails.
  gpg --recv-keys 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
  while [[ "${?}" -ne "0" ]]; do
    gpg --keyserver hkp://jirk5u4osbsr34t5.onion --recv-keys 6694D8DE7BE8EE5631BED9502BD5824B7F9470E6
  done

  ## Verify `electrum`. Remove and re-download if verification fails.
  verify_electrum=`gpg --verify \
  ~/electrum-"${latest_electrum_version_number}"-x86_64.AppImage.asc ~/electrum-"${latest_electrum_version_number}"-x86_64.AppImage \
  | grep -c "BAD"`
  while [[ "${verify_electrum}" -ne "0" ]]; do
    printf "%s\n" "Electrum source code failed verification!
Removing, downloading, and verifying again."
    rm ~/electrum-"${latest_electrum_version_number}"-x86_64.AppImage.asc ~/electrum-"${latest_electrum_version_number}"-x86_64.AppImage
    curl --retry 5 -O \
    "https://download.electrum.org/"${latest_electrum_version_number}"/electrum-"${latest_electrum_version_number}"-x86_64.AppImage" -O \
    "https://download.electrum.org/"${latest_electrum_version_number}"/electrum-"${latest_electrum_version_number}"-x86_64.AppImage.asc"
    verify_electrum=`gpg --verify \
    ~/electrum-"${latest_electrum_version_number}"-x86_64.AppImage.asc ~/electrum-"${latest_electrum_version_number}"-x86_64.AppImage \
    | grep -c "BAD"`
  done

  ## Move the verified `electrum` AppImage to the 'electrum' VM.
  qvm-move ~/electrum-"${latest_electrum_version_number}"-x86_64.AppImage'

  ## Set up `socat` in `/rw/config/rc.local` on the 'electrum' VM.
  qvm-run --no-gui -q -u root electrum "printf '%s\n' \
  'socat TCP-LISTEN:50002,fork,bind=127.0.0.1 EXEC:\"qrexec-client-vm electrum-personal-server qubes.electrum-personal-server \" &' \
  >> /rw/config/rc.local"

  ## Configure `electrum`: make datadir & config, fix permissions.
  qvm-run --no-gui -q -u user electrum 'mkdir -m 0700 ~/.electrum'
  qvm-run --no-gui -q -u user electrum "printf '%s\n' \
'{
    \"auto_connect\": true,
    \"check_updates\": false,
    \"oneserver\": true,
    \"server\": \"127.0.0.1:50002:s\",
}' > ~/.electrum/config"
  qvm-run --no-gui -q -u user electrum 'chmod 0600 ~/.electrum/config'

  ## Make execution easier.
  qvm-run --no-gui -q -u user electrum 'mkdir -m 0700 ~/bin'
  qvm-run --no-gui -q -u user electrum 'cp ~/QubesIncoming/disp*/electrum-*-x86_64.AppImage ~/bin/electrum'

  ## Add a tag.
  qvm-tags electrum add created_by_qvm-bitcoin
fi
}

print_help () {
printf "%s\n" "Usage: "${0}" [options]

Install and setup of isolated Bitcoin tools using Whonix.
Automation of these guides: https://github.com/qubenix/qubes-whonix-bitcoin.

Options:

--create-bitcoind, -cb                   = Create bitcoind gateway and workstation VMs.
--create-electrum, -ce                   = Create electrum workstation VM,
                                           and any dependent VMs.
--create-electrum-personal-server, -ceps = Create electrum-personal-server gateway and workstation VMs,
                                           and any dependent VMs.
--help, -h                               = This help menu."
}

if [[ "${#}" -gt "0" ]]; then
  case "${1}" in
    --create-bitcoind|-cb)
    createvm_bitcoind
    exit 0
    ;;
    --create-electrum|-ce)
    createvm_electrum
    exit 0
    ;;
    --create-electrum-personal-server|-ceps)
    createvm_electrum-personal-server
    exit 0
    ;;
    --help|-h)
    print_help
    exit 0
    ;;
    *)
    print_help    
    exit 1
    ;;
  esac
else
  print_help
  exit 0
fi