deploy

#!/usr/bin/env bash
#
# Generate fly.toml for a new app and deploy the bridge.

set -Eeuo pipefail

command -v jq >/dev/null || {
  echo "ERROR: 'jq' not found, please install it."
  exit 1
}
command -v flyctl >/dev/null || {
  echo "ERROR: 'flyctl' not found, please install it."
  exit 1
}

# EMAIL is mandatory.
export email="${EMAIL}"

# REGION is optional. See `flyctl platform regions` for the full list.
export region="${REGION:-fra}"

# fly.toml should not exist.
if [[ -e 'fly.toml' ]]; then
  echo 'ERROR: fly.toml already exists.'
  exit 1
fi

# Generate random app name.
export app="bridge-$(tr -dc '0-9a-z' </dev/urandom | dd bs=8 count=1 2>/dev/null)"
echo "If something goes wrong, run 'flyctl apps destroy ${app}' and start again."
echo

# Create app, allocate IP address, create volume.
flyctl launch --name "${app}" --region "${region}" --image thetorproject/obfs4-bridge:latest --no-deploy
config="${app}-fly.toml"
mv fly.toml "${config}"
flyctl ips allocate-v4 --config "${config}"
flyctl volumes create fly_obfs4 --region "${region}" --size 1 --config "${config}"

# Read IPv4 address.
export addr="$(flyctl ips list --json --config "${config}" |
  jq --raw-output '.[] | select(.Type == "v4") | .Address')"

# Generate both ports in one go to make sure they are not equal.
ports="$(shuf -i 1024-65535 -n 2)"
export or_port="$(echo "${ports}" | head -n1)"
export pt_port="$(echo "${ports}" | tail -n1)"

# References:
# https://community.torproject.org/relay/setup/bridge/docker/
# https://helpmanual.io/man5/torrc/
cat <<EOF >"${config}"
app = "${app}"

kill_signal = "SIGINT"
kill_timeout = 5

[build]
  image = "thetorproject/obfs4-bridge:latest"

[env]
  EMAIL = "${email}"
  OR_PORT = """${addr}:${or_port} NoListen
ORPort 0.0.0.0:${or_port} NoAdvertise"""
  PT_PORT = "${pt_port}"
  OBFS4_ENABLE_ADDITIONAL_VARIABLES = "1"
  OBFS4V_AccountingMax = "33 GBytes"
  OBFS4V_AccountingRule = "out"
  OBFS4V_AccountingStart = "month 1 00:00"

[mounts]
  source = "fly_obfs4"
  destination = "/var/lib/tor"

[[services]]
  internal_port = ${or_port}
  processes = ["app"]
  protocol = "tcp"

  [services.concurrency]
    hard_limit = 25
    soft_limit = 20
    type = "connections"

  [[services.ports]]
    port = ${or_port}

  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"

[[services]]
  # The PT port must be defined second for the get-bridge-line script to work.

  internal_port = ${pt_port}
  processes = ["app"]
  protocol = "tcp"

  [[services.ports]]
    port = ${pt_port}

  [[services.tcp_checks]]
    grace_period = "1s"
    interval = "15s"
    restart_limit = 0
    timeout = "2s"
EOF

# Deploy
flyctl deploy --config "${config}"
echo
echo "Run 'CONFIG="${config}" ./show-bridge-line' to display the client configuration."