ovtools 0.0.0-stage → 1.0.1

package/assets/common/config.sh

@@ -0,0 +1,263 @@
+#!/usr/bin/env bash
+# ===================================================================
+# config.sh — shared configuration for Octra lite_node scripts
+# Source this file from other scripts:  source "$(dirname "$0")/config.sh"
+# ===================================================================
+
+set -euo pipefail
+
+# --- Node identity -------------------------------------------------
+NODE_REPO="https://github.com/octra-labs/lite_node.git"
+NODE_BRANCH="main"
+NODE_SRC_DIR="/opt/octra/libv_litecore"
+NODE_DATA_ROOT="/var/lib/octra"
+NODE_DATA_DIR="${NODE_DATA_ROOT}/devnet"
+NODE_SYNC_STAGE="${NODE_DATA_ROOT}/devnet.state_sync"
+NODE_USER="octra"
+
+# --- Network / API ports (from official config_val.sh defaults) ---
+API_PORT="8080"          # REST API (dashboard reads from here)
+CONSENSUS_PORT="19000"   # consensus
+P2P_PORT="9000"          # peer-to-peer
+
+# --- Disk / swap ---------------------------------------------------
+SWAP_FILE="/swapfile"
+# Swap size in GB. This kit is deployed for several projects, so the operator
+# sets it in Project settings (console) or with SWAP_GB=<n> bash pre-run.sh.
+SWAP_GB="${SWAP_GB:-8}"
+SWAP_SIZE="${SWAP_SIZE:-${SWAP_GB}G}"     # 8 GB swap by default
+MOUNT_POINT="${NODE_DATA_ROOT}"
+
+# Node data store: the chain lives here (~40 GB today, grows over time), so the
+# target wants ~1 TB. pre-run.sh is fully automatic:
+#   * /dev/sdb (or BLOCK_DEVICE) when present and not the system disk
+#   * otherwise the largest non-system whole disk >= DATA_MIN_GB
+#   * otherwise the largest filesystem >= DATA_MIN_GB (main disk, no formatting)
+BLOCK_DEVICE="${BLOCK_DEVICE:-/dev/sdb}"
+DATA_MIN_GB="${DATA_MIN_GB:-1000}"
+DATA_LABEL="${DATA_LABEL:-octra-data}"
+DATA_MARKER="${DATA_MARKER:-.octra-data-volume}"
+
+# --- Build profile ---
+BUILD_PROFILE="release"
+
+# --- Helpers -------------------------------------------------------
+log()  { echo -e "\033[1;32m[octra]\033[0m $*"; }
+warn() { echo -e "\033[1;33m[warn]\033[0m  $*"; }
+err()  { echo -e "\033[1;31m[err]\033[0m   $*" >&2; }
+
+# --- tools on the host: check -> install -> continue ------------------
+# A VPS that was just re-installed is a bare image: `jq`, `rsync` or even
+# `curl` may simply not be there yet, and a step that calls them dies half way
+# through with "command not found". Every step therefore asks for the tool it
+# needs instead of assuming it: the check is free, apt only runs when something
+# is really missing, and a retry after a dropped SSH does not re-run a full
+# `apt-get update`/install for tools that are already present.
+OCTRA_APT_STAMP="${OCTRA_APT_STAMP:-/root/.octra-apt-update}"
+OCTRA_APT_TTL="${OCTRA_APT_TTL:-900}"        # seconds an apt-get update stays fresh
+
+octra_have() { command -v "$1" >/dev/null 2>&1; }
+
+octra_pkg_installed() {
+  dpkg-query -W -f='${Status}' "$1" 2>/dev/null | grep -q 'install ok installed'
+}
+
+# apt-get update at most once per OCTRA_APT_TTL seconds (checkpoint: a retry of a
+# failed step must not re-sync the package lists).
+apt_refresh() {
+  local now last
+  now=$(date +%s)
+  last=0
+  if [[ -f "${OCTRA_APT_STAMP}" ]]; then
+    last=$(tr -dc '0-9' < "${OCTRA_APT_STAMP}" 2>/dev/null || true)
+  fi
+  last="${last:-0}"
+  if (( now - last < OCTRA_APT_TTL )); then
+    log "apt lists are $(( now - last ))s old - skipping apt-get update"
+    return 0
+  fi
+  log "apt-get update"
+  if DEBIAN_FRONTEND=noninteractive apt-get update; then
+    echo "${now}" > "${OCTRA_APT_STAMP}" 2>/dev/null || true
+    return 0
+  fi
+  warn "apt-get update failed - trying once more in 10s"
+  sleep 10
+  DEBIAN_FRONTEND=noninteractive apt-get update || { err "apt-get update failed (network or mirror)"; return 1; }
+  echo "${now}" > "${OCTRA_APT_STAMP}" 2>/dev/null || true
+}
+
+# install_packages <pkg> ... - only the missing ones, with an apt-lock retry
+# (unattended-upgrades holds the dpkg lock on a freshly booted VPS).
+install_packages() {
+  local pkg missing=() attempt out
+  for pkg in "$@"; do
+    octra_pkg_installed "${pkg}" || missing+=("${pkg}")
+  done
+  if (( ${#missing[@]} == 0 )); then
+    return 0
+  fi
+  log "apt-get install: ${missing[*]}"
+  apt_refresh || return 1
+  for attempt in 1 2 3; do
+    if out=$(DEBIAN_FRONTEND=noninteractive apt-get install -y "${missing[@]}" 2>&1); then
+      printf '%s\n' "${out}"
+      return 0
+    fi
+    printf '%s\n' "${out}"
+    if [[ "${out}" == *"Could not get lock"* || "${out}" == *"dpkg frontend lock"* ]]; then
+      warn "dpkg is locked (another apt run) - retrying in $(( attempt * 10 ))s"
+      sleep $(( attempt * 10 ))
+      continue
+    fi
+    break
+  done
+  err "could not install: ${missing[*]}"
+  return 1
+}
+
+# ensure_package <pkg> - present, or installed now
+ensure_package() {
+  local pkg="$1"
+  if octra_pkg_installed "${pkg}"; then
+    log "package ${pkg}: present"
+    return 0
+  fi
+  log "package ${pkg}: missing - installing"
+  install_packages "${pkg}" || return 1
+  octra_pkg_installed "${pkg}" && log "package ${pkg}: installed"
+}
+
+# ensure_tool <binary> [package] - check -> install -> continue
+#   returns 0 when the binary answers, 1 when it still does not exist
+ensure_tool() {
+  local bin="$1" pkg="${2:-$1}"
+  if octra_have "${bin}"; then
+    log "tool ${bin}: present ($(command -v "${bin}"))"
+    return 0
+  fi
+  log "tool ${bin}: missing - installing package ${pkg}"
+  install_packages "${pkg}" || return 1
+  if octra_have "${bin}"; then
+    log "tool ${bin}: installed"
+    return 0
+  fi
+  err "tool ${bin} is still missing after installing ${pkg}"
+  return 1
+}
+
+# ensure_tools <bin[:package]> ... - the whole set or a non-zero return
+ensure_tools() {
+  local spec bin pkg rc=0
+  for spec in "$@"; do
+    bin="${spec%%:*}"
+    pkg="${spec#*:}"
+    [[ "${pkg}" == "${bin}" ]] && pkg="${bin}"
+    ensure_tool "${bin}" "${pkg}" || rc=1
+  done
+  return "${rc}"
+}
+
+# --- Host hardening (MANDATORY, both programs) ----------------------
+# MPTCP is dead weight on a node host and pure attack surface: the node, the
+# dashboard and the SSH pull all speak plain TCP, nothing ever negotiates
+# multipath. So every machine this toolkit prepares must come up with the knob
+# off, persisted for the reboot:
+#
+#   net.mptcp.enabled = 0     -> /etc/sysctl.d/99-disable-mptcp.conf
+#
+# Idempotent, and harmless on a kernel without MPTCP (the knob is absent and
+# there is nothing to disable). Verify with:  sysctl net.mptcp.enabled
+# Both paths are overridable so the dev harness can drive every branch.
+MPTCP_KNOB="${MPTCP_KNOB:-/proc/sys/net/mptcp/enabled}"
+MPTCP_CONF="${MPTCP_CONF:-/etc/sysctl.d/99-disable-mptcp.conf}"
+
+disable_mptcp() {
+  if [[ ! -e "${MPTCP_KNOB}" ]]; then
+    log "this kernel has no net.mptcp.enabled knob - MPTCP is not built in (nothing to disable)"
+    return 0
+  fi
+  printf 'net.mptcp.enabled = 0\n' > "${MPTCP_CONF}"
+  chmod 644 "${MPTCP_CONF}"
+  log "wrote ${MPTCP_CONF} (net.mptcp.enabled = 0)"
+  # immediate value first, then reload every drop-in so the running kernel and
+  # the files on disk agree (a stale 50-*.conf would otherwise win)
+  sysctl -w net.mptcp.enabled=0 >/dev/null 2>&1 || true
+  sysctl --system >/dev/null 2>&1 || warn "sysctl --system reported an error - the value below decides"
+  local value
+  value=$(sysctl -n net.mptcp.enabled 2>/dev/null || echo unknown)
+  if [[ "${value}" == "0" ]]; then
+    log "MPTCP disabled: $(sysctl net.mptcp.enabled 2>/dev/null || echo 'net.mptcp.enabled = 0')"
+    return 0
+  fi
+  err "net.mptcp.enabled is '${value}' - disabling MPTCP is mandatory on a node host"
+  return 1
+}
+
+# --- the node repo's local OCaml switch ------------------------------
+# controls/install.sh --source-build builds the switch INSIDE the repo
+#   <repo>/runtime_data/toolchains/ocaml/_opam     (holds .opam-switch)
+# and links it as
+#   <repo>/_opam -> runtime_data/toolchains/ocaml/_opam
+#
+# opam 2.3 (Debian 13) CANNOT re-create that link: `opam switch link` calls
+# rmdir(2) on the existing symlink, dies with
+#   «"rmdir" failed on <repo>/_opam: Not a directory»
+# and the failed call leaves the switch prefix EMPTY - it throws away a 15-30
+# minute build. Proven on 2026-11-02 with a throw-away switch: the first
+# `switch link` creates the link, the second one destroys the switch.
+#
+# Both scripts of the node repo call `opam switch link` (controls/install.sh and
+# controls/config_val.sh), so this kit unlinks <repo>/_opam first and lets them
+# re-create it.
+OCAML_SWITCH_REL="runtime_data/toolchains/ocaml"
+
+ocaml_switch_root() { printf '%s/%s\n' "${NODE_SRC_DIR}" "${OCAML_SWITCH_REL}"; }
+
+ocaml_switch_built() { [[ -d "$(ocaml_switch_root)/_opam/.opam-switch" ]]; }
+
+unlink_ocaml_switch_link() {  # unlink_ocaml_switch_link [<why>]
+  local link="${NODE_SRC_DIR}/_opam"
+  if [[ -L "${link}" ]]; then
+    log "unlinking ${link} (${1:-opam 2.3 cannot relink an existing _opam})"
+    rm -f "${link}"
+  elif [[ -d "${link}" ]]; then
+    if rmdir "${link}" 2>/dev/null; then
+      log "removed the empty ${link} directory (${1:-opam needs a free path})"
+    else
+      warn "${link} is a non-empty directory, not a link - leaving it as it is"
+    fi
+  fi
+  return 0
+}
+
+# A cached "<unit>.rc == 0" is NOT proof the toolchain is usable: the failed
+# `opam switch link` above empties the switch prefix and leaves the exit code
+# untouched. Drop what is left, so the next run rebuilds instead of reporting a
+# cached success.
+drop_broken_ocaml_switch() {  # drop_broken_ocaml_switch [<rc file to forget>]
+  local root rc="${1:-}"
+  if ocaml_switch_built; then
+    return 0                       # never touch a real switch
+  fi
+  unlink_ocaml_switch_link "the switch has to be rebuilt"
+  root=$(ocaml_switch_root)
+  if [[ -d "${root}" ]]; then
+    warn "dropping the incomplete switch prefix ${root} (no .opam-switch)"
+    rm -rf "${root}"
+  fi
+  if [[ -n "${rc}" ]]; then
+    rm -f "${rc}"
+  fi
+  return 0
+}
+
+# Run a command as the octra user
+as_octra() {
+  sudo -iu "${NODE_USER}" "$@"
+}
+
+# Run a command inside the node source directory as octra
+in_src() {
+  sudo -iu "${NODE_USER}" bash -c "cd '${NODE_SRC_DIR}' && $*"
+}

package/assets/common/extract-data.sh

@@ -0,0 +1,197 @@
+#!/usr/bin/env bash
+# ===================================================================
+# extract-data.sh — collect validator node data into a JSON file
+#
+# Gathers all critical files needed for migration to a new machine:
+#   - wallet.json     (validator wallet + keys)
+#   - node.env        (node configuration)
+#   - network.env     (network parameters)
+#   - SOURCE_COMMIT   (exact build commit)
+#   - node status     (consensus head, sync state, peer count)
+#   - system info     (hostname, IP, OS, kernel, uptime)
+#
+# Output: /tmp/octra-node-data.json (also printed to stdout)
+#
+# Usage:  sudo bash extract-data.sh
+# ===================================================================
+
+set -euo pipefail
+source "$(dirname "$0")/config.sh"
+
+if [[ $EUID -ne 0 ]]; then
+  err "Run as root:  sudo bash $0"
+  exit 1
+fi
+
+# --- Collect file contents -----------------------------------------
+get_file() {
+  local f="$1"
+  if [[ -f "$f" ]]; then
+    cat "$f" 2>/dev/null || echo ""
+  else
+    echo ""
+  fi
+}
+
+# Helper: base64-encode a file (for binary or sensitive content)
+get_file_b64() {
+  local f="$1"
+  if [[ -f "$f" ]]; then
+    base64 -w0 "$f" 2>/dev/null || echo ""
+  else
+    echo ""
+  fi
+}
+
+# --- Gather node status (best-effort, may fail if node not running) -
+STAT_OUTPUT=""
+STAT_LOGS=""
+if su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/stat.sh" >/tmp/octra_stat.txt 2>&1; then
+  STAT_OUTPUT=$(cat /tmp/octra_stat.txt)
+else
+  STAT_OUTPUT="$(cat /tmp/octra_stat.txt 2>/dev/null || echo 'node not running')"
+fi
+
+# --- Gather system info --------------------------------------------
+HOSTNAME=$(hostname)
+PUBLIC_IP=$(curl -s --max-time 5 https://api.ipify.org 2>/dev/null || echo "")
+LOCAL_IP=$(hostname -I 2>/dev/null | awk '{print $1}' || echo "")
+OS_INFO=$(. /etc/os-release 2>/dev/null && echo "${PRETTY_NAME:-unknown}" || echo "unknown")
+KERNEL=$(uname -r)
+UPTIME=$(uptime -p 2>/dev/null || echo "")
+CPU_COUNT=$(nproc 2>/dev/null || echo 0)
+MEM_TOTAL=$(free -h 2>/dev/null | awk '/^Mem:/ {print $2}' || echo "")
+DISK_USAGE=$(df -h "${NODE_DATA_ROOT}" 2>/dev/null | tail -1 | awk '{print $3 "/" $2 " (" $5 " used)"}' || echo "")
+
+# --- Gather storage info -------------------------------------------
+STORAGE_INFO=""
+if su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/storage.sh" >/tmp/octra_storage.txt 2>&1; then
+  STORAGE_INFO=$(cat /tmp/octra_storage.txt)
+fi
+
+# --- Gather enroll status -----------------------------------------
+ENROLL_STATUS=""
+if su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh status" >/tmp/octra_enroll.txt 2>&1; then
+  ENROLL_STATUS=$(cat /tmp/octra_enroll.txt)
+fi
+
+# --- Source commit -------------------------------------------------
+SOURCE_COMMIT=$(get_file "${NODE_SRC_DIR}/SOURCE_COMMIT")
+
+# --- Wallet (base64-encoded for safe transport) --------------------
+WALLET_PATH="${NODE_SRC_DIR}/.keys/validator/wallet.json"
+if [[ ! -f "${WALLET_PATH}" ]]; then
+  WALLET_PATH="${NODE_DATA_DIR}/wallet.json"
+fi
+WALLET_B64=$(get_file_b64 "${WALLET_PATH}")
+
+# --- node.env (base64-encoded) ------------------------------------
+NODE_ENV_PATH="${NODE_SRC_DIR}/.keys/validator/node.env"
+if [[ ! -f "${NODE_ENV_PATH}" ]]; then
+  NODE_ENV_PATH="${NODE_SRC_DIR}/config/node.env"
+fi
+NODE_ENV_B64=$(get_file_b64 "${NODE_ENV_PATH}")
+
+# --- network.env (base64-encoded) --------------------------------
+NETWORK_ENV_PATH="${NODE_SRC_DIR}/config/network.env"
+NETWORK_ENV_B64=$(get_file_b64 "${NETWORK_ENV_PATH}")
+
+# --- network.env.sha256 -------------------------------------------
+NETWORK_SHA256=$(get_file "${NETWORK_ENV_PATH}.sha256")
+
+# --- Gather file list in data dir (for inventory) -----------------
+DATA_DIR_FILES=""
+if [[ -d "${NODE_DATA_DIR}" ]]; then
+  # NOTE: `| head -50` would SIGPIPE the find under `set -o pipefail` (rc 141)
+  # as soon as the data dir holds more than 50 files, so use sed instead.
+  DATA_DIR_FILES=$(find "${NODE_DATA_DIR}" -maxdepth 2 -type f 2>/dev/null | sed -n '1,50p' | while read -r f; do
+    SIZE=$(stat -c%s "$f" 2>/dev/null || echo 0)
+    echo "$(basename "$f"):${SIZE}"
+  done | tr '\n' ',' | sed 's/,$//')
+fi
+
+# --- Build the JSON ------------------------------------------------
+# Using jq for proper JSON construction
+TIMESTAMP=$(date -u +"%Y-%m-%dT%H:%M:%SZ")
+
+jq -n \
+  --arg timestamp "$TIMESTAMP" \
+  --arg hostname "$HOSTNAME" \
+  --arg public_ip "$PUBLIC_IP" \
+  --arg local_ip "$LOCAL_IP" \
+  --arg os "$OS_INFO" \
+  --arg kernel "$KERNEL" \
+  --arg uptime "$UPTIME" \
+  --arg cpu "$CPU_COUNT" \
+  --arg mem "$MEM_TOTAL" \
+  --arg disk "$DISK_USAGE" \
+  --arg source_commit "$SOURCE_COMMIT" \
+  --arg wallet_b64 "$WALLET_B64" \
+  --arg node_env_b64 "$NODE_ENV_B64" \
+  --arg network_env_b64 "$NETWORK_ENV_B64" \
+  --arg network_sha256 "$NETWORK_SHA256" \
+  --arg stat_output "$STAT_OUTPUT" \
+  --arg storage_info "$STORAGE_INFO" \
+  --arg enroll_status "$ENROLL_STATUS" \
+  --arg data_dir "$NODE_DATA_DIR" \
+  --arg src_dir "$NODE_SRC_DIR" \
+  --arg api_port "$API_PORT" \
+  --arg consensus_port "$CONSENSUS_PORT" \
+  --arg p2p_port "$P2P_PORT" \
+  --arg data_files "$DATA_DIR_FILES" \
+  '{
+    meta: {
+      extracted_at: $timestamp,
+      script_version: "1.0"
+    },
+    system: {
+      hostname: $hostname,
+      public_ip: $public_ip,
+      local_ip: $local_ip,
+      os: $os,
+      kernel: $kernel,
+      uptime: $uptime,
+      cpu_cores: ($cpu | tonumber),
+      memory_total: $mem,
+      disk_usage: $disk
+    },
+    node: {
+      source_dir: $src_dir,
+      source_commit: $source_commit,
+      data_dir: $data_dir,
+      ports: {
+        api: ($api_port | tonumber),
+        consensus: ($consensus_port | tonumber),
+        p2p: ($p2p_port | tonumber)
+      },
+      status_raw: $stat_output,
+      storage_raw: $storage_info,
+      enroll_status_raw: $enroll_status
+    },
+    migration_data: {
+      wallet_json_b64: $wallet_b64,
+      node_env_b64: $node_env_b64,
+      network_env_b64: $network_env_b64,
+      network_env_sha256: $network_sha256
+    },
+    data_files: ($data_files | split(",") | map(split(":") | {(.[0]): (.[1] | tonumber)}) | add // {})
+  }' > /tmp/octra-node-data.json
+
+# Print summary
+echo
+log "Data extracted to /tmp/octra-node-data.json"
+log "Summary:"
+jq '{
+  hostname: .system.hostname,
+  public_ip: .system.public_ip,
+  source_commit: .node.source_commit,
+  has_wallet: (.migration_data.wallet_json_b64 | length > 0),
+  has_node_env: (.migration_data.node_env_b64 | length > 0),
+  has_network_env: (.migration_data.network_env_b64 | length > 0)
+}' /tmp/octra-node-data.json
+
+# Also copy to the source dir for easy access
+cp /tmp/octra-node-data.json "${NODE_SRC_DIR}/config/node-data.json" 2>/dev/null || true
+chown "${NODE_USER}:${NODE_USER}" "${NODE_SRC_DIR}/config/node-data.json" 2>/dev/null || true
+
+log "Done. Copy it locally with scp if needed."

package/assets/common/harden-host.sh

@@ -0,0 +1,37 @@
+#!/usr/bin/env bash
+# ===================================================================
+# harden-host.sh - mandatory baseline hardening for an Octra node host
+#
+#   net.mptcp.enabled = 0
+#
+# MPTCP is not used by the node, the dashboard or the SSH pull, and a host that
+# answers on the MPTCP stack is an avoidable vector of attack on a public VPS.
+# Disabling it is part of this project's baseline, so every program that
+# prepares a machine applies it:
+#
+#   * scripts/pre-run.sh        (both programs, via disable_mptcp)
+#   * deploy/migrate/manage phases (every run, so a resumed run repairs the host)
+#   * migrate target, before anything is copied
+#
+# The three operator steps are the ones documented in the runbook:
+#
+#   sudo sysctl -w net.mptcp.enabled=0
+#   echo "net.mptcp.enabled = 0" | sudo tee /etc/sysctl.d/99-disable-mptcp.conf
+#   sudo sysctl --system
+#   sysctl net.mptcp.enabled            -> net.mptcp.enabled = 0
+#
+# Idempotent. Exits 1 when the kernel offers the knob but it stays enabled.
+#
+# Usage:  sudo bash harden-host.sh
+# ===================================================================
+
+set -euo pipefail
+source "$(dirname "$0")/config.sh"
+
+if [[ $EUID -ne 0 ]]; then
+  err "run as root:  sudo bash $0"
+  exit 1
+fi
+
+log "=== hardening $(hostname) (MPTCP off) ==="
+disable_mptcp

package/assets/common/install-deps.sh

@@ -0,0 +1,93 @@
+#!/usr/bin/env bash
+# ===================================================================
+# install-deps.sh — install system build dependencies for Octra lite_node
+#
+# Installs: git, ca-certificates, build-essential, GMP, SQLite3, libev,
+#           Rust toolchain, OCaml/opam (via install.sh --source-build).
+#
+# Usage:  sudo bash install-deps.sh
+# Idempotent — apt skips packages already installed.
+# ===================================================================
+
+set -euo pipefail
+source "$(dirname "$0")/config.sh"
+
+if [[ $EUID -ne 0 ]]; then
+  err "Run as root:  sudo bash $0"
+  exit 1
+fi
+
+log "Updating package lists…"
+apt-get update -qq
+
+log "Installing base packages…"
+apt-get install -y -qq \
+  ca-certificates \
+  git \
+  curl \
+  wget \
+  build-essential \
+  pkg-config \
+  libgmp-dev \
+  libsqlite3-dev \
+  libev-dev \
+  cmake \
+  jq \
+  htop \
+  > /dev/null
+
+log "Base packages installed"
+
+# NOTE: Do NOT install Rust separately. The official install.sh
+# --source-build installs a pinned Rust 1.88.0 toolchain into
+# runtime_data/toolchains/ for the octra user. A separate rustup
+# install in /root/.cargo causes permission conflicts.
+
+# --- Create the octra system user --------------------------------
+if ! id "${NODE_USER}" &>/dev/null; then
+  log "Creating system user '${NODE_USER}'…"
+  useradd -r -m -d "/home/${NODE_USER}" -s /bin/bash "${NODE_USER}"
+  log "User '${NODE_USER}' created"
+else
+  log "User '${NODE_USER}' already exists"
+fi
+
+# --- Create the node source directory ------------------------------
+log "Creating ${NODE_SRC_DIR}…"
+mkdir -p "$(dirname "${NODE_SRC_DIR}")"
+chown -R "${NODE_USER}:${NODE_USER}" "$(dirname "${NODE_SRC_DIR}")"
+
+# --- Clone the lite_node repo (if not already present) ------------
+if [[ ! -d "${NODE_SRC_DIR}/.git" ]]; then
+  log "Cloning lite_node repository…"
+  git clone --branch "${NODE_BRANCH}" --single-branch "${NODE_REPO}" "${NODE_SRC_DIR}"
+  chown -R "${NODE_USER}:${NODE_USER}" "${NODE_SRC_DIR}"
+  log "Repository cloned"
+else
+  log "Repository already present at ${NODE_SRC_DIR}"
+fi
+
+# --- Run the official install.sh --source-build -------------------
+# install.sh calls `opam switch link` itself, and opam 2.3 wipes the switch when
+# <repo>/_opam already exists (see config.sh) - so clear the link first.
+unlink_ocaml_switch_link "install.sh runs opam switch link next"
+# This installs OCaml, Dune, builds all dependencies from source
+log "Running official install.sh --source-build (this compiles OCaml + deps)…"
+log "This may take 15–30 minutes on a 4-core VPS…"
+
+cd "${NODE_SRC_DIR}"
+export OCTRA_OPERATOR_USER="${NODE_USER}"
+export OCTRA_DATA_ROOT="${NODE_DATA_ROOT}"
+
+sh controls/install.sh --source-build
+
+# --- Verify the build ---------------------------------------------
+log "Running check.sh to verify the build…"
+if su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/check.sh"; then
+  log "Build verification passed"
+else
+  warn "check.sh reported issues — review the output above"
+fi
+
+echo
+log "Dependencies installed. Next: run node-setup.sh to configure the node."

package/assets/common/node-enroll.sh

@@ -0,0 +1,65 @@
+#!/usr/bin/env bash
+# ===================================================================
+# node-enroll.sh — join the Octra network as a validator
+#
+# Steps:
+#   1. Join the active set (stake OCTRA tokens)
+#   2. Check enrollment status
+#   3. Show node status
+#
+# Usage:
+#   sudo bash node-enroll.sh               # default stake (1000000)
+#   sudo bash node-enroll.sh 500000         # custom stake amount
+#   sudo bash node-enroll.sh exit          # leave active set
+#   sudo bash node-enroll.sh withdraw       # withdraw stake
+#
+# IMPORTANT: The node must be fully synced before enrolling.
+# ===================================================================
+
+set -euo pipefail
+source "$(dirname "$0")/config.sh"
+
+if [[ $EUID -ne 0 ]]; then
+  err "Run as root:  sudo bash $0"
+  exit 1
+fi
+
+ACTION="${1:-join}"
+STAKE_AMOUNT="${2:-1000000}"
+
+case "${ACTION}" in
+  join)
+    log "Joining the network with stake ${STAKE_AMOUNT}…"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh join --amount ${STAKE_AMOUNT}"
+    log "Checking enrollment status…"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh status"
+    echo
+    log "Node status:"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/stat.sh"
+    ;;
+
+  status)
+    log "Enrollment status:"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh status"
+    ;;
+
+  exit)
+    warn "Leaving the active validator set…"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh exit"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh status"
+    log "Exited active set."
+    ;;
+
+  withdraw)
+    warn "Withdrawing stake…"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh withdraw"
+    su - "${NODE_USER}" -c "cd ${NODE_SRC_DIR} && sh controls/enroll.sh status"
+    log "Stake withdrawn."
+    ;;
+
+  *)
+    err "Unknown action: ${ACTION}"
+    echo "Usage: sudo bash node-enroll.sh [join|status|exit|withdraw] [amount]"
+    exit 1
+    ;;
+esac