@le-space/rootfs 0.1.52 → 0.2.0

package/reference/orbitdb-relay-pinner/rootfs/orbitdb-relay-pinner-autotls-refresh.py

@@ -0,0 +1,224 @@
+#!/usr/bin/env python3
+import json
+import os
+import subprocess
+import time
+import urllib.error
+import urllib.request
+from typing import Iterable
+
+
+ENV_FILE = os.environ.get("ENV_FILE", "/etc/default/orbitdb-relay-pinner")
+READY_FILE = os.environ.get("READY_FILE", "/etc/default/orbitdb-relay-pinner.ready")
+AUTOTLS_READY_FILE = os.environ.get(
+    "AUTOTLS_READY_FILE", "/etc/default/orbitdb-relay-pinner.autotls-ready"
+)
+AUTOTLS_ZONE_FILE = os.environ.get("AUTOTLS_ZONE_FILE", "/etc/default/orbitdb-relay-pinner.autotls-zone")
+AUTOTLS_HOSTS_FILE = os.environ.get("AUTOTLS_HOSTS_FILE", "/etc/default/orbitdb-relay-pinner.autotls-hosts")
+AUTOTLS_CADDY_READY_FILE = os.environ.get(
+    "AUTOTLS_CADDY_READY_FILE", "/etc/default/orbitdb-relay-pinner.caddy-ready"
+)
+SERVICE_NAME = os.environ.get("SERVICE_NAME", "orbitdb-relay-pinner.service")
+CADDY_SERVICE = os.environ.get("CADDY_SERVICE", "caddy.service")
+CADDYFILE = os.environ.get("CADDYFILE", "/etc/caddy/Caddyfile")
+METRICS_PORT = int(os.environ.get("METRICS_PORT", "9090"))
+WAIT_TIMEOUT_SECONDS = int(os.environ.get("AUTOTLS_WAIT_TIMEOUT_SECONDS", "900"))
+WAIT_INTERVAL_SECONDS = float(os.environ.get("AUTOTLS_WAIT_INTERVAL_SECONDS", "5"))
+
+
+def fetch_json(path: str) -> dict:
+    url = f"http://127.0.0.1:{METRICS_PORT}{path}"
+    with urllib.request.urlopen(url, timeout=5) as response:
+        return json.loads(response.read().decode("utf-8"))
+
+
+def parse_env_file(path: str) -> dict[str, str]:
+    values: dict[str, str] = {}
+    if not os.path.exists(path):
+        return values
+
+    with open(path, encoding="utf-8") as handle:
+        for line in handle:
+            stripped = line.strip()
+            if not stripped or stripped.startswith("#") or "=" not in stripped:
+                continue
+            key, value = stripped.split("=", 1)
+            values[key.strip()] = value.strip()
+    return values
+
+
+def write_env_var(path: str, key: str, value: str) -> None:
+    lines: list[str] = []
+    replaced = False
+
+    if os.path.exists(path):
+        with open(path, encoding="utf-8") as handle:
+            lines = handle.readlines()
+
+    with open(path, "w", encoding="utf-8") as handle:
+        for line in lines:
+            stripped = line.lstrip()
+            if stripped.startswith(f"{key}=") or stripped.startswith(f"#{key}="):
+                handle.write(f"{key}={value}\n")
+                replaced = True
+            else:
+                handle.write(line)
+
+        if not replaced:
+            handle.write(f"{key}={value}\n")
+
+
+def normalize_addr(addr: str) -> str:
+    parts = addr.strip().split("/")
+    if len(parts) >= 3 and parts[-2] == "p2p":
+        return "/".join(parts[:-2])
+    return addr.strip()
+
+
+def dedupe(sequence: Iterable[str]) -> list[str]:
+    seen: set[str] = set()
+    values: list[str] = []
+    for item in sequence:
+        if item and item not in seen:
+            seen.add(item)
+            values.append(item)
+    return values
+
+
+def ipv4_domain(ipv4: str, zone: str) -> str:
+    return f"{ipv4.replace('.', '-')}.{zone}"
+
+
+def ipv6_domain(ipv6: str, zone: str) -> str:
+    subdomain = ipv6.replace(":", "-")
+    if subdomain.startswith("-"):
+        subdomain = f"0{subdomain}"
+    if subdomain.endswith("-"):
+        subdomain = f"{subdomain}0"
+    return f"{subdomain}.{zone}"
+
+
+def wait_for_autotls_zone() -> str:
+    deadline = time.monotonic() + WAIT_TIMEOUT_SECONDS
+    last_error = "metrics endpoint never became ready"
+
+    while time.monotonic() < deadline:
+        try:
+            health = fetch_json("/health")
+            payload = fetch_json("/multiaddrs")
+            zone = health.get("autoTlsServingZone")
+            all_addrs = payload.get("all")
+            if (
+                isinstance(zone, str)
+                and zone
+                and isinstance(all_addrs, list)
+                and any(isinstance(addr, str) and "/tls/ws" in addr for addr in all_addrs)
+            ):
+                return zone
+            last_error = "AutoTLS secure websocket multiaddrs not advertised yet"
+        except (urllib.error.URLError, TimeoutError, json.JSONDecodeError) as error:
+            last_error = str(error)
+
+        time.sleep(WAIT_INTERVAL_SECONDS)
+
+    raise RuntimeError(last_error)
+
+
+def build_secure_addrs(env_values: dict[str, str], zone: str) -> list[str]:
+    ws_port = env_values.get("EXTERNAL_RELAY_WS_PORT", "").strip()
+    if not ws_port:
+        raise RuntimeError("missing EXTERNAL_RELAY_WS_PORT in environment file")
+
+    addrs: list[str] = []
+
+    public_ipv4 = env_values.get("PUBLIC_IPV4", "").strip()
+    if public_ipv4:
+        host4 = ipv4_domain(public_ipv4, zone)
+        addrs.append(f"/ip4/{public_ipv4}/tcp/{ws_port}/tls/sni/{host4}/ws")
+        addrs.append(f"/dns4/{host4}/tcp/{ws_port}/tls/ws")
+
+    public_ipv6 = env_values.get("PUBLIC_IPV6", "").strip()
+    if public_ipv6:
+        host6 = ipv6_domain(public_ipv6, zone)
+        addrs.append(f"/ip6/{public_ipv6}/tcp/{ws_port}/tls/sni/{host6}/ws")
+        addrs.append(f"/dns6/{host6}/tcp/{ws_port}/tls/ws")
+
+    if not addrs:
+        raise RuntimeError("missing PUBLIC_IPV4/PUBLIC_IPV6 in environment file")
+
+    return addrs
+
+
+def secure_hosts(env_values: dict[str, str], zone: str) -> list[str]:
+    hosts: list[str] = []
+    public_ipv4 = env_values.get("PUBLIC_IPV4", "").strip()
+    if public_ipv4:
+        hosts.append(ipv4_domain(public_ipv4, zone))
+
+    public_ipv6 = env_values.get("PUBLIC_IPV6", "").strip()
+    if public_ipv6:
+        hosts.append(ipv6_domain(public_ipv6, zone))
+
+    return dedupe(hosts)
+
+
+def metrics_https_public_host(env_values: dict[str, str], zone: str) -> str | None:
+    public_ipv4 = env_values.get("PUBLIC_IPV4", "").strip()
+    if public_ipv4:
+        return ipv4_domain(public_ipv4, zone)
+
+    public_ipv6 = env_values.get("PUBLIC_IPV6", "").strip()
+    if public_ipv6:
+        return ipv6_domain(public_ipv6, zone)
+
+    return None
+
+
+def main() -> None:
+    if not os.path.exists(READY_FILE):
+        raise SystemExit(f"missing ready file: {READY_FILE}")
+
+    env_values = parse_env_file(ENV_FILE)
+    zone = wait_for_autotls_zone()
+    secure_addrs = build_secure_addrs(env_values, zone)
+    exact_hosts = secure_hosts(env_values, zone)
+    metrics_host = metrics_https_public_host(env_values, zone)
+    current_value = env_values.get("VITE_APPEND_ANNOUNCE", "")
+    current_metrics_host = env_values.get("METRICS_HTTPS_PUBLIC_HOST", "").strip()
+    merged = dedupe(
+        [normalize_addr(addr) for addr in current_value.split(",") if addr.strip()] + secure_addrs
+    )
+    announce_changed = current_value.split(",") != merged
+    metrics_host_changed = bool(metrics_host) and current_metrics_host != metrics_host
+
+    announce_value = ",".join(merged)
+    write_env_var(ENV_FILE, "VITE_APPEND_ANNOUNCE", announce_value)
+    write_env_var(ENV_FILE, "AUTOTLS_SERVING_ZONE", zone)
+    if metrics_host:
+        write_env_var(ENV_FILE, "METRICS_HTTPS_PUBLIC_HOST", metrics_host)
+
+    with open(AUTOTLS_HOSTS_FILE, "w", encoding="utf-8") as handle:
+        for host in exact_hosts:
+            handle.write(f"{host}\n")
+    with open(AUTOTLS_ZONE_FILE, "w", encoding="utf-8") as handle:
+        handle.write(f"{zone}\n")
+
+    if announce_changed or metrics_host_changed:
+        subprocess.run(["systemctl", "restart", SERVICE_NAME], check=True)
+    else:
+        print("AutoTLS secure external announce addresses already present")
+
+    if env_values.get("PROXY_HOSTNAME", "").strip():
+        open(AUTOTLS_CADDY_READY_FILE, "a", encoding="utf-8").close()
+        if os.path.exists(CADDYFILE):
+            subprocess.run(["systemctl", "enable", CADDY_SERVICE], check=False)
+            subprocess.run(["systemctl", "restart", CADDY_SERVICE], check=False)
+    elif os.path.exists(AUTOTLS_CADDY_READY_FILE):
+        os.remove(AUTOTLS_CADDY_READY_FILE)
+
+    open(AUTOTLS_READY_FILE, "a", encoding="utf-8").close()
+    print(f"Updated VITE_APPEND_ANNOUNCE={announce_value}")
+
+
+if __name__ == "__main__":
+    main()

package/reference/orbitdb-relay-pinner/rootfs/orbitdb-relay-pinner-autotls-refresh.service

@@ -0,0 +1,24 @@
+[Unit]
+Description=Persist AutoTLS secure announce addresses for orbitdb-relay-pinner
+After=orbitdb-relay-pinner.service
+Wants=orbitdb-relay-pinner.service
+ConditionPathExists=/etc/default/orbitdb-relay-pinner.ready
+ConditionPathExists=!/etc/default/orbitdb-relay-pinner.autotls-ready
+
+[Service]
+Type=oneshot
+Environment=ENV_FILE=/etc/default/orbitdb-relay-pinner
+Environment=READY_FILE=/etc/default/orbitdb-relay-pinner.ready
+Environment=AUTOTLS_READY_FILE=/etc/default/orbitdb-relay-pinner.autotls-ready
+Environment=AUTOTLS_ZONE_FILE=/etc/default/orbitdb-relay-pinner.autotls-zone
+Environment=AUTOTLS_HOSTS_FILE=/etc/default/orbitdb-relay-pinner.autotls-hosts
+Environment=AUTOTLS_CADDY_READY_FILE=/etc/default/orbitdb-relay-pinner.caddy-ready
+Environment=SERVICE_NAME=orbitdb-relay-pinner.service
+Environment=CADDY_SERVICE=caddy.service
+Environment=CADDYFILE=/etc/caddy/Caddyfile
+ExecStart=/usr/bin/python3 /usr/local/sbin/orbitdb-relay-pinner-autotls-refresh.py
+StandardOutput=journal
+StandardError=journal
+
+[Install]
+WantedBy=multi-user.target

package/reference/orbitdb-relay-pinner/rootfs/orbitdb-relay-pinner-bootstrap.conf

@@ -0,0 +1,2 @@
+[Unit]
+ConditionPathExists=/etc/default/orbitdb-relay-pinner.ready

package/reference/orbitdb-relay-pinner/rootfs/orbitdb-relay-pinner-bootstrap.service

@@ -0,0 +1,21 @@
+[Unit]
+Description=Temporary orbitdb-relay-pinner setup endpoint
+Wants=network-online.target
+After=network-online.target
+ConditionPathExists=!/etc/default/orbitdb-relay-pinner.ready
+
+[Service]
+Environment=ENV_FILE=/etc/default/orbitdb-relay-pinner
+Environment=READY_FILE=/etc/default/orbitdb-relay-pinner.ready
+Environment=SERVICE_NAME=orbitdb-relay-pinner.service
+Environment=BOOTSTRAP_SERVICE=orbitdb-relay-pinner-bootstrap.service
+Environment=METADATA_FILE=/run/orbitdb-relay-pinner-setup-metadata.json
+Environment=METADATA_ERROR_FILE=/run/orbitdb-relay-pinner-setup-metadata.error
+ExecStart=/usr/bin/python3 /usr/local/sbin/orbitdb-relay-pinner-setup-server.py
+StandardOutput=journal
+StandardError=journal
+Restart=on-failure
+RestartSec=2s
+
+[Install]
+WantedBy=multi-user.target

package/reference/orbitdb-relay-pinner/rootfs/orbitdb-relay-pinner-bootstrap.sh

@@ -0,0 +1,121 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+INSTALL_DIR="${INSTALL_DIR:-/opt/orbitdb-relay-pinner}"
+SERVICE_USER="${SERVICE_USER:-orbitdb-relay}"
+DATA_DIR="${DATA_DIR:-/var/lib/orbitdb-relay-pinner}"
+ENV_FILE="${ENV_FILE:-/etc/default/orbitdb-relay-pinner}"
+NODE_MIN_MAJOR="${NODE_MIN_MAJOR:-22}"
+CADDY_READY_FILE="${CADDY_READY_FILE:-/etc/default/orbitdb-relay-pinner.caddy-ready}"
+
+if [ ! -d "${INSTALL_DIR}" ]; then
+  echo "Missing ${INSTALL_DIR}; the rootfs build did not copy orbitdb-relay-pinner."
+  exit 1
+fi
+
+export DEBIAN_FRONTEND=noninteractive
+apt-get update
+apt-get install -y ca-certificates curl gnupg python3 build-essential caddy
+
+if ! command -v node >/dev/null 2>&1 || [ "$(node -p "process.versions.node.split('.')[0]" 2>/dev/null || echo 0)" -lt "${NODE_MIN_MAJOR}" ]; then
+  curl -fsSL https://deb.nodesource.com/setup_22.x | bash -
+  apt-get install -y nodejs
+fi
+
+rm -rf /var/lib/apt/lists/*
+
+if ! command -v node >/dev/null 2>&1; then
+  echo "Node.js ${NODE_MIN_MAJOR}+ installation failed." >&2
+  exit 1
+fi
+
+if ! command -v npm >/dev/null 2>&1; then
+  echo "npm is unavailable after installing Node.js." >&2
+  exit 1
+fi
+
+mkdir -p "${DATA_DIR}" "$(dirname "${ENV_FILE}")"
+
+if ! id "${SERVICE_USER}" >/dev/null 2>&1; then
+  useradd --system --home "${DATA_DIR}" --create-home --shell /usr/sbin/nologin "${SERVICE_USER}"
+fi
+
+chown -R "${SERVICE_USER}:${SERVICE_USER}" "${DATA_DIR}" "${INSTALL_DIR}"
+
+install_command="cd '${INSTALL_DIR}' && npm install --omit=dev"
+if [ -f "${INSTALL_DIR}/pnpm-lock.yaml" ] && command -v corepack >/dev/null 2>&1; then
+  package_manager="$(
+    node -e "const fs=require('fs'); const pkg=JSON.parse(fs.readFileSync(process.argv[1], 'utf8')); process.stdout.write(pkg.packageManager || '')" \
+      "${INSTALL_DIR}/package.json" 2>/dev/null || true
+  )"
+  if [ -n "${package_manager}" ]; then
+    install_command="cd '${INSTALL_DIR}' && export COREPACK_HOME='${DATA_DIR}/.cache/corepack' && mkdir -p \"\$COREPACK_HOME\" && corepack prepare '${package_manager}' --activate && corepack pnpm install --prod --frozen-lockfile"
+  fi
+fi
+
+if command -v runuser >/dev/null 2>&1; then
+  runuser -u "${SERVICE_USER}" -- env HOME="${DATA_DIR}" bash -lc "${install_command}"
+elif command -v sudo >/dev/null 2>&1; then
+  sudo -u "${SERVICE_USER}" env HOME="${DATA_DIR}" bash -lc "${install_command}"
+else
+  echo "Need runuser or sudo to install dependencies as ${SERVICE_USER}." >&2
+  exit 1
+fi
+
+# Drop toolchains and caches after dependency installation so the prebaked
+# qcow2 reflects the runtime footprint rather than the build footprint.
+apt-get purge -y build-essential
+apt-get autoremove -y
+apt-get clean
+rm -rf /var/lib/apt/lists/*
+rm -rf "${DATA_DIR}/.cache/corepack" "${DATA_DIR}/.npm" "${DATA_DIR}/.cache/npm"
+rm -rf "${INSTALL_DIR}/node_modules/.cache"
+
+mkdir -p "${INSTALL_DIR}/node_modules"
+ln -sfn "${INSTALL_DIR}" "${INSTALL_DIR}/node_modules/orbitdb-relay-pinner"
+
+cat > /usr/local/bin/orbitdb-relay-pinner <<'EOF'
+#!/usr/bin/env bash
+set -euo pipefail
+exec /usr/bin/node /opt/orbitdb-relay-pinner/dist/cli.js "$@"
+EOF
+chmod 0755 /usr/local/bin/orbitdb-relay-pinner
+
+if [ -f "${INSTALL_DIR}/deploy/orbitdb-relay-pinner.env.example" ] && [ ! -f "${ENV_FILE}" ]; then
+  cp "${INSTALL_DIR}/deploy/orbitdb-relay-pinner.env.example" "${ENV_FILE}"
+fi
+
+touch "${ENV_FILE}"
+chmod 0640 "${ENV_FILE}"
+chown "root:${SERVICE_USER}" "${ENV_FILE}"
+rm -f "${CADDY_READY_FILE}"
+
+mkdir -p /etc/caddy /etc/systemd/system/caddy.service.d
+cat > /etc/systemd/system/caddy.service.d/orbitdb-relay-pinner.conf <<EOF
+[Unit]
+ConditionPathExists=${CADDY_READY_FILE}
+EOF
+
+write_env_var() {
+  local key="$1"
+  local value="$2"
+
+  if grep -Eq "^[#[:space:]]*${key}=" "${ENV_FILE}"; then
+    sed -i "s|^[#[:space:]]*${key}=.*|${key}=${value}|" "${ENV_FILE}"
+  else
+    printf '%s=%s\n' "${key}" "${value}" >> "${ENV_FILE}"
+  fi
+}
+
+write_env_var "DATASTORE_PATH" "${DATA_DIR}"
+write_env_var "METRICS_PORT" "9090"
+write_env_var "METRICS_HTTPS_ENABLED" "0"
+write_env_var "RELAY_TCP_PORT" "9091"
+write_env_var "RELAY_WS_PORT" "9092"
+write_env_var "RELAY_WEBRTC_PORT" "9093"
+write_env_var "RELAY_QUIC_PORT" "9094"
+write_env_var "RELAY_DISABLE_WEBRTC" "1"
+write_env_var "RELAY_DISABLE_BOOTSTRAP" "1"
+write_env_var "disableAutoTLS" "1"
+write_env_var "ENABLE_GENERAL_LOGS" "1"
+write_env_var "DEBUG" "'libp2p:websockets:listener'"

package/reference/orbitdb-relay-pinner/rootfs/orbitdb-relay-pinner-configure.sh

@@ -0,0 +1,240 @@
+#!/usr/bin/env bash
+set -euo pipefail
+
+ENV_FILE="${ENV_FILE:-/etc/default/orbitdb-relay-pinner}"
+READY_FILE="${READY_FILE:-/etc/default/orbitdb-relay-pinner.ready}"
+AUTOTLS_READY_FILE="${AUTOTLS_READY_FILE:-/etc/default/orbitdb-relay-pinner.autotls-ready}"
+AUTOTLS_ZONE_FILE="${AUTOTLS_ZONE_FILE:-/etc/default/orbitdb-relay-pinner.autotls-zone}"
+AUTOTLS_HOSTS_FILE="${AUTOTLS_HOSTS_FILE:-/etc/default/orbitdb-relay-pinner.autotls-hosts}"
+SERVICE_NAME="${SERVICE_NAME:-orbitdb-relay-pinner.service}"
+CADDY_SERVICE="${CADDY_SERVICE:-caddy.service}"
+CADDY_READY_FILE="${CADDY_READY_FILE:-/etc/default/orbitdb-relay-pinner.caddy-ready}"
+CADDYFILE="${CADDYFILE:-/etc/caddy/Caddyfile}"
+CADDY_UPSTREAM_WSS_PORT="${CADDY_UPSTREAM_WSS_PORT:-9092}"
+CADDY_UPSTREAM_HOST="${CADDY_UPSTREAM_HOST:-127.0.0.1}"
+CADDY_UPSTREAM_METRICS_PORT="${CADDY_UPSTREAM_METRICS_PORT:-9090}"
+AUTOTLS_REFRESH_SERVICE="${AUTOTLS_REFRESH_SERVICE:-orbitdb-relay-pinner-autotls-refresh.service}"
+PUBLIC_IPV4=""
+PUBLIC_IPV6=""
+TCP_PORT=""
+WS_PORT=""
+PROXY_HOSTNAME=""
+METRICS_PORT=""
+METRICS_HTTPS_PORT=""
+WEBRTC_PORT=""
+QUIC_PORT=""
+START_SERVICE=1
+
+usage() {
+  cat <<'EOF'
+Usage:
+  orbitdb-relay-pinner-configure.sh \
+    --public-ipv4 <ip> \
+    [--public-ipv6 <ipv6>] \
+    --tcp-port <host-port> \
+    --ws-port <host-port> \
+    [--proxy-hostname <hostname>] \
+    [--metrics-port <host-port>] \
+    [--metrics-https-port <host-port>] \
+    [--webrtc-port <host-port>] \
+    [--quic-port <host-port>] \
+    [--no-start]
+
+Writes VITE_APPEND_ANNOUNCE for the externally assigned Aleph host ports,
+marks the relay as ready, and optionally starts the relay plus Caddy services.
+EOF
+}
+
+write_env_var() {
+  local key="$1"
+  local value="$2"
+
+  if grep -Eq "^[#[:space:]]*${key}=" "${ENV_FILE}"; then
+    sed -i "s|^[#[:space:]]*${key}=.*|${key}=${value}|" "${ENV_FILE}"
+  else
+    printf '%s=%s\n' "${key}" "${value}" >> "${ENV_FILE}"
+  fi
+}
+
+write_caddyfile() {
+  local hostname="$1"
+  mkdir -p "$(dirname "${CADDYFILE}")"
+  cat > "${CADDYFILE}" <<EOF
+{
+  auto_https disable_redirects
+}
+
+${hostname} {
+  # Proxy the full orbitdb-relay-pinner HTTP API surface to the metrics/HTTP port.
+  # Everything else falls through to the relay WebSocket backend for browser libp2p.
+  handle /health {
+    reverse_proxy 127.0.0.1:${CADDY_UPSTREAM_METRICS_PORT}
+  }
+
+  handle /multiaddrs {
+    reverse_proxy 127.0.0.1:${CADDY_UPSTREAM_METRICS_PORT}
+  }
+
+  handle /multiaddresses {
+    reverse_proxy 127.0.0.1:${CADDY_UPSTREAM_METRICS_PORT}
+  }
+
+  handle /metrics {
+    reverse_proxy 127.0.0.1:${CADDY_UPSTREAM_METRICS_PORT}
+  }
+
+  handle /pinning/* {
+    reverse_proxy 127.0.0.1:${CADDY_UPSTREAM_METRICS_PORT}
+  }
+
+  handle /ipfs/* {
+    reverse_proxy 127.0.0.1:${CADDY_UPSTREAM_METRICS_PORT}
+  }
+
+  reverse_proxy ${CADDY_UPSTREAM_HOST}:${CADDY_UPSTREAM_WSS_PORT}
+}
+EOF
+}
+
+while [ "$#" -gt 0 ]; do
+  case "$1" in
+    --public-ipv4)
+      PUBLIC_IPV4="${2:-}"
+      shift 2
+      ;;
+    --public-ipv6)
+      PUBLIC_IPV6="${2:-}"
+      shift 2
+      ;;
+    --tcp-port)
+      TCP_PORT="${2:-}"
+      shift 2
+      ;;
+    --ws-port)
+      WS_PORT="${2:-}"
+      shift 2
+      ;;
+    --proxy-hostname)
+      PROXY_HOSTNAME="${2:-}"
+      shift 2
+      ;;
+    --metrics-port)
+      METRICS_PORT="${2:-}"
+      shift 2
+      ;;
+    --metrics-https-port)
+      METRICS_HTTPS_PORT="${2:-}"
+      shift 2
+      ;;
+    --webrtc-port)
+      WEBRTC_PORT="${2:-}"
+      shift 2
+      ;;
+    --quic-port)
+      QUIC_PORT="${2:-}"
+      shift 2
+      ;;
+    --no-start)
+      START_SERVICE=0
+      shift
+      ;;
+    -h|--help)
+      usage
+      exit 0
+      ;;
+    *)
+      echo "Unknown argument: $1" >&2
+      usage >&2
+      exit 1
+      ;;
+  esac
+done
+
+if [ -z "${PUBLIC_IPV4}" ] || [ -z "${TCP_PORT}" ] || [ -z "${WS_PORT}" ]; then
+  usage >&2
+  exit 1
+fi
+
+touch "${ENV_FILE}"
+rm -f "${AUTOTLS_READY_FILE}" "${AUTOTLS_ZONE_FILE}" "${AUTOTLS_HOSTS_FILE}"
+
+announce=(
+  "/ip4/${PUBLIC_IPV4}/tcp/${TCP_PORT}"
+)
+
+if [ -n "${PUBLIC_IPV6}" ]; then
+  announce+=(
+    "/ip6/${PUBLIC_IPV6}/tcp/${TCP_PORT}"
+  )
+fi
+
+if [ -n "${PROXY_HOSTNAME}" ]; then
+  announce+=("/dns4/${PROXY_HOSTNAME}/tcp/443/tls/ws")
+  announce+=("/dns6/${PROXY_HOSTNAME}/tcp/443/tls/ws")
+else
+  announce+=("/ip4/${PUBLIC_IPV4}/tcp/${WS_PORT}/ws")
+  if [ -n "${PUBLIC_IPV6}" ]; then
+    announce+=("/ip6/${PUBLIC_IPV6}/tcp/${WS_PORT}/ws")
+  fi
+fi
+
+if [ -n "${WEBRTC_PORT}" ]; then
+  announce+=("/ip4/${PUBLIC_IPV4}/udp/${WEBRTC_PORT}/webrtc-direct")
+  if [ -n "${PUBLIC_IPV6}" ]; then
+    announce+=("/ip6/${PUBLIC_IPV6}/udp/${WEBRTC_PORT}/webrtc-direct")
+  fi
+fi
+
+if [ -n "${QUIC_PORT}" ]; then
+  announce+=("/ip4/${PUBLIC_IPV4}/udp/${QUIC_PORT}/quic-v1")
+  if [ -n "${PUBLIC_IPV6}" ]; then
+    announce+=("/ip6/${PUBLIC_IPV6}/udp/${QUIC_PORT}/quic-v1")
+  fi
+fi
+
+announce_value="$(IFS=,; printf '%s' "${announce[*]}")"
+write_env_var "VITE_APPEND_ANNOUNCE" "${announce_value}"
+write_env_var "PUBLIC_IPV4" "${PUBLIC_IPV4}"
+if [ -n "${PUBLIC_IPV6}" ]; then
+  write_env_var "PUBLIC_IPV6" "${PUBLIC_IPV6}"
+fi
+write_env_var "EXTERNAL_RELAY_TCP_PORT" "${TCP_PORT}"
+write_env_var "EXTERNAL_RELAY_WS_PORT" "${WS_PORT}"
+if [ -n "${PROXY_HOSTNAME}" ]; then
+  write_env_var "PROXY_HOSTNAME" "${PROXY_HOSTNAME}"
+else
+  write_env_var "PROXY_HOSTNAME" ""
+fi
+if [ -n "${METRICS_PORT}" ]; then
+  write_env_var "EXTERNAL_METRICS_PORT" "${METRICS_PORT}"
+fi
+if [ -n "${METRICS_HTTPS_PORT}" ]; then
+  write_env_var "EXTERNAL_METRICS_HTTPS_PORT" "${METRICS_HTTPS_PORT}"
+fi
+if [ -n "${WEBRTC_PORT}" ]; then
+  write_env_var "EXTERNAL_RELAY_WEBRTC_PORT" "${WEBRTC_PORT}"
+fi
+if [ -n "${QUIC_PORT}" ]; then
+  write_env_var "EXTERNAL_RELAY_QUIC_PORT" "${QUIC_PORT}"
+fi
+touch "${READY_FILE}"
+
+if [ "${START_SERVICE}" -eq 1 ]; then
+  systemctl daemon-reload
+  systemctl enable "${SERVICE_NAME}"
+  systemctl restart "${SERVICE_NAME}"
+  systemctl enable "${AUTOTLS_REFRESH_SERVICE}"
+  if [ -n "${PROXY_HOSTNAME}" ]; then
+    write_caddyfile "${PROXY_HOSTNAME}"
+    touch "${CADDY_READY_FILE}"
+    systemctl enable "${CADDY_SERVICE}"
+    systemctl restart "${CADDY_SERVICE}"
+  else
+    rm -f "${CADDY_READY_FILE}"
+    systemctl stop "${CADDY_SERVICE}" || true
+  fi
+  systemctl restart --no-block "${AUTOTLS_REFRESH_SERVICE}"
+fi
+
+printf 'Configured VITE_APPEND_ANNOUNCE=%s\n' "${announce_value}"
+printf 'Ready file: %s\n' "${READY_FILE}"