Goracle Node SETUP INSTRUCTIONS【English & 日本語】

## Introduction
**はじめに**

This guide is intended to follow the official documentation for setting up a Goracle node, with a focus on security. I hope it will be helpful for the Goracle team and members of the GoraGang community.

:::note
This guide was created to enhance security and is recommended by the team. However, if you simply want to set up a node for now, you can skip to steps `1, 2, 5, 8, 9, and 10`. I hope you can learn about security gradually as you proceed.
:::

If you are interested in Goracle, please follow me on Twitter:
https://twitter.com/Moon1215i

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
このガイドは、Goracleノードの公式ドキュメントに沿って、セキュリティに焦点を当てて設定することを目的としています。このガイドがGoracleチームやGoraGangコミュニティのメンバーにとって役立つことを願っています。

:::note
このガイドはセキュリティを強化するために作成されたものであり、チームによって推奨されています。ただし、ノードを今すぐ設定するだけの場合は、手順を`1、2、5、8、9、10`だけを実行してもかまいません。徐々にセキュリティについて学んでいただければ幸いです。
:::

Goracleに興味がある場合は、Twitterでフォローしてください：
https://twitter.com/Moon1215i
</details>

![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/44dfe685-89aa-9466-edb3-5f26e2518848.png)



**My Guide recommended by official sources.**
* Goracleオフィシャルより推薦されました私のガイドです。

https://qiita.com/Moon1215i/items/eb4f40c2337ae9b7bf0f

**Official Site Reference 参照した公式サイト**

https://docs.goracle.io/technical-documentation/

https://youtu.be/sPrfGbYI8OA

**Unofficial Site Reference 参照した非公式サイト**

* [Goracle Node Guide](https://teletype.in/@ttimmatti/goracle-node "Goracle Node Guide")
* [Tutorial — How to install a Algorand node — Testnet and Config the Goracle On same VPS.](https://medium.com/@subhamgurjar21091995/tutorial-how-to-install-a-algorand-node-testnet-and-config-the-goracle-on-same-vps-f520420af73e "Tutorial — How to install a Algorand node — Testnet and Config the Goracle On same VPS.")
* [How to install Algorand Node in your VPS.](https://docs.singopedia.my.id/ "How to install Algorand Node in your VPS.")


## Setup Instructions:
**セットアップ手順**

:::note
Here is an example of how to do it. Please confirm the `IP address`, `password`, and `SSH port` with the provider you have contracted with. Also, when adding a `username` and `password`, and changing the `SSH port number`, be sure to **change them according to your own preferences**, rather than following the guide verbatim.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
以下は手順の例です。ご契約のプロバイダーから `IPアドレス`、`パスワード`、および `SSHポート`を確認してください。また、`ユーザー名`と`パスワード`の追加、および`SSHポート番号`の変更を行う場合は、**本ガイドの指示通りにではなく、ご自分の環境に合わせて変更するようにしてください。**
</details>


---
**This guide provides the following example:**
|LABEL|VALUE|
|:--|:--|
|IP Address	|12.34.56.78|
|User	|root|
|Password	|Provided by the provider|
|SSH Port	|22 (default port number)|

　
**The following will be added, created, or modified in this guide:**
|LABEL|VALUE|
|:--|:--|
|User|GoraGang|
|Password|AlgorandOracle|
|Hostname|Goracle|
|SSH Port|53814|
|SSH Key Type|ed25519|
|SSH Private Key|goracle_ed25519|
|SSH Public Key |goracle_ed25519.pub|
|SSH Comment|goracle_ed25519_key|

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
**このガイドでは、以下を例として操作します**
|LABEL|VALUE|
|:--|:--|
|IPアドレス	|12.34.56.78|
|ユーザー名	|root|
|パスワード	|プロバイダから提供されたもの|
|SSHポート	|22 (デフォルトのポート番号)|

　
**このガイドで追加、作成、または変更される内容は以下の通りです**
|LABEL|VALUE|
|:--|:--|
|ユーザー名|GoraGang|
|ユーザー名|AlgorandOracle|
|ホスト名|Goracle|
|ホスト名|53814|
|SSHキーの種類|ed25519|
|SSH秘密鍵|goracle_ed25519|
|SSH公開鍵|goracle_ed25519.pub|
|SSHコメント|goracle_ed25519_key|
</details>

---
**Setting Up Server Timezone to UTC**
Additionally the use of UTC(Coordinated Universal Time) is recommended as the system time used by Docker. Therefore, I recommend setting the server time to UTC. To change the server time to UTC, run the following command.
<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
**サーバータイムゾーンをUTCに設定する**
Dockerで使用されるシステム時間としてUTC（協定世界時）の使用をお勧めします。そのため、サーバーの時間をUTCに設定することをお勧めします。サーバーの時間をUTCに変更するには、次のコマンドを実行してください。
</details>

```sh:set-timezone UTC
sudo timedatectl set-timezone UTC
```
![9D52D582-12EF-46EE-BC96-320B8D8CEF9E.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/0128e922-5fa6-6310-6269-bfc1b8dc182c.png)
:::

## 1. Managing Packages on Linux with APT
**1.  APTを使用したLinuxパッケージの管理**

These commands are used for updating and managing packages on a Linux system using the Advanced Package Tool (APT):

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
これらのコマンドは、Advanced Package Tool（APT）を使用してLinuxシステム上のパッケージを更新および管理するために使用されます。
</details>

```sh:1
sudo apt update -y && sudo apt upgrade -y
sudo apt install -y git nano curl wget
sudo apt autoremove -y
sudo apt autoclean -y
```

|Command|Description|
|:--|:--|
|sudo apt update| updates the list of available packages and their versions from the repository.|
|sudo apt upgrade| installs the updated packages.|
|sudo apt install| installs new packages.|
|sudo apt autoremove| removes packages that were installed as dependencies of other packages that are no longer installed on the system.|
|sudo apt autoclean| removes package files that can no longer be downloaded and are no longer needed.|

By running these commands, you can ensure that your system is up-to-date and has the latest security patches and bug fixes.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
|コマンド|説明|
|:--|:--|
|sudo apt update|	リポジトリから利用可能なパッケージとそのバージョンのリストを更新します。|
|sudo apt upgrade|	更新されたパッケージをインストールします。|
|sudo apt install|	新しいパッケージをインストールします。|
|sudo apt autoremove|	もはやシステムにインストールされていない他のパッケージの依存関係としてインストールされたパッケージを削除します。|
|sudo apt autoclean|	もはやダウンロードできず、不要なパッケージファイルを削除します。|

これらのコマンドを実行することで、システムが最新のセキュリティパッチやバグ修正を含んでいることを確認できます。
</details>


## 2. Automatic Security Updates on Ubuntu
**2. Ubuntuにおける自動セキュリティアップデート**

This is a command to install the `"unattended-upgrades"` package on Ubuntu system, which automatically applies security patches. The command also configures the package with low priority. Setting up `unattended-upgrades` minimizes system vulnerabilities. The dpkg-reconfigure command is used to modify package configurations. The `--priority=low` option sets the configuration priority of the `unattended-upgrades` package to low. Select `'yes'` is a prompt to select the default settings.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
これはUbuntuシステムに `"unattended-upgrades"`パッケージをインストールするコマンドで、セキュリティパッチを自動的に適用します。コマンドはまた、パッケージを低優先度で設定します。`unattended-upgrades`をセットアップすることで、システムの脆弱性を最小限に抑えることができます。`dpkg-reconfigure`コマンドは、パッケージの構成を変更するために使用されます。`--priority=lowオ`プションは、`unattended-upgrades`パッケージの構成優先度を低く設定します。`'yes'`を選択するプロンプトは、デフォルトの設定を有効にするために選択します。

</details>

```sh:2
sudo apt install unattended-upgrades
sudo dpkg-reconfigure --priority=low unattended-upgrades
# Select `yes` / `yes`を選択
```
|Command|Description|
|:--|:--|
|sudo apt install unattended-upgrades|	Installs the `unattended-upgrades` package, which enables automatic updates for the system.|
|sudo dpkg-reconfigure --priority=low unattended-upgrades|Reconfigures the `unattended-upgrades` package with low priority and prompts the user to select `'yes'` to enable automatic updates. This will allow the system to automatically download and install security updates.|

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
|コマンド|説明|
|:--|:--|
|sudo apt install unattended-upgrades|	システムの自動更新を有効にする `unattended-upgrades`パッケージをインストールします。|
|sudo dpkg-reconfigure --priority=low unattended-upgrades|低優先度で `unattended-upgrades`パッケージを再設定し、自動更新を有効にするには、ユーザーに `'yes'` を選択するように促します。これにより、システムは自動的にセキュリティアップデートをダウンロードおよびインストールできるようになります。|
</details>

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/7f749fd0-29f3-c4e4-3aa7-4330d324ef55.png)


## 3. Setting the Hostname: Optional
**3. ホスト名の設定：オプション**

The hostname is the name given to a computer or device on a network. It is used to identify the device and to connect to other devices on the same network. By default, Ubuntu assigns a hostname to your system based on your username. 
|LABEL|VALUE|
|:--|:--|
|Hostname|Goracle|

<details><summary>【日本語】</summary>
ホスト名とは、ネットワーク上のコンピューターやデバイスに与えられる名前のことで、デバイスの識別や同じネットワーク上の他のデバイスとの接続に使用されます。Ubuntuでは、デフォルトでユーザー名に基づいてホスト名が割り当てられます。

|ラベル|値|
|:--|:--|
|ホスト名|Goracle|
</details>

```sh:3-1
sudo hostnamectl set-hostname Goracle
# Change the hostname to "Goracle"
# ホスト名を "Goracle" に変更する
```
You can change the hostname to something more meaningful or memorable by using the `hostnamectl` command.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
`hostnamectl` コマンドを使用して、ホスト名を意味のあるものや覚えやすいものに変更できます。
</details>

```sh:3-2
sudo nano /etc/hosts
```
The `/etc/hosts` file is used to map IP addresses to hostnames. It is used by the system to resolve hostnames to IP addresses, and is an important part of network configuration. In this step, we use the `nano` text editor to edit the `/etc/hosts` file.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
`/etc/hosts` ファイルは、IPアドレスをホスト名にマッピングするために使用されます。システムがホスト名をIPアドレスに解決するために使用され、ネットワーク構成の重要な部分です。このステップでは、テキストエディタ `nano` を使用して `/etc/hosts` ファイルを編集します。
</details>

```sh:3-3
12.34.56.78 Goracle
# Press "Ctrl" + "X", then "y", then "Enter" key.
# "Ctrl" + "X" → "y" → "Enter" キーを押します。
```
This command adds an entry to the `/etc/hosts` file that associates the IP address `12.34.56.78` with the hostname `Goracle`. This allows the system to resolve the hostname to the IP address.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
このコマンドは、IPアドレス `12.34.56.78` とホスト名 `Goracle` を関連付けるエントリを `/etc/hosts` ファイルに追加します。これにより、システムはホスト名をIPアドレスに解決することができます。
</details>

:::note
To save the changes made to the file in `nano`, follow these steps:
1. Press the `"Ctrl"` and `"X"` keys on your keyboard at the same time.
1. Press the `"Y"` key on your keyboard to confirm that you want to save the changes.
1. Press the `"Enter"` key on your keyboard to exit the editor.

These steps will save the changes you made to the file and exit the nano editor.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
nano で編集したファイルを保存する方法は、次の手順に従ってください：

1. キーボードで `"Ctrl"` キーと `"X"` キーを同時に押します。
1. キーボードで `"Y"` キーを押して変更を保存することを確認します。
1. キーボードで `"Enter"` キーを押してエディターを終了します。
これらの手順により、編集したファイルの変更が保存され、nanoエディターが終了します。
</details>
:::

```sh:3-4
sudo reboot
# Verify that the hostname has been changed
# 再起動後にホスト名が変更されたか確認します
```
This command restarts the system. After the system has rebooted, verify that the hostname has been changed by using the `hostnamectl` command.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
このコマンドはシステムを再起動します。システムが再起動した後、`hostnamectl` コマンドを使用して、ホスト名が変更されたかどうかを確認します。
</details>

![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/f555c9e4-3878-624e-2258-fefd0f46f62f.png)
Once restarted, you will see the following image.

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
再起動後、以下の画像が表示されます。
</details>

![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/cc992daf-6042-5d01-5722-7c490b7c9c7c.png)

## 4. Setting up SSH Port and Firewall

|LABEL|VALUE|
|:--|:--|
|SSH Port|53814|

#### Changing SSH Port
To change the SSH port, run the following command to open the SSH configuration file:
```s:4-1
sudo nano /etc/ssh/sshd_config
```

:::note
Note that the default SSH port is 22, but it is recommended to change it to a random number **between 49513 and 65535** to avoid becoming a target of port attacks. Here, I will use 53814 as an example, but you can choose any other number within the range.

Once you have decided on the new port number, uncomment the following line in the configuration file and replace `"22"` with the new port number:

```s:4-2
#Port 22
Port 53814
```

![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/3dc9fab7-919a-3690-3101-447b06874a1c.png)
Save the changes to the file by pressing `"Ctrl" + "X"`, then `"y"`, and finally `"Enter"`. Restart the SSH service to apply the changes:
:::

```sh:4-3
sudo service ssh restart
```

#### Firewall Configuration
To allow traffic on the new SSH port, run the following command:
```s:4-4
sudo ufw allow 53814/tcp
```

Next, enable the firewall and choose `"yes"` when prompted:

```s:4-5
sudo ufw enable
```
This will configure the firewall to allow incoming traffic on the new SSH port.

```s:4-6
sudo ufw status verbose
```
This command is used in Linux to check the current status of the firewall settings using **U**ncomplicated **F**ire**w**all (**UFW**). `"sudo"` is used to run the command with administrative privileges. `"ufw status verbose"` is an option to display detailed information about the firewall, such as whether UFW is enabled or disabled, a list of open ports, and allowed IP addresses.
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/4bed9202-9753-695b-f78e-16ba664d0c78.png)


## 5. Adding a User
To add a new user to the system, follow these steps:

Choose a username and password. In this example, we will use `"GoraGang"` as the username and `"AlgorandOracle"` as the password.
|LABEL|VALUE|
|:--|:--|
|User|GoraGang|
|Password|AlgorandOracle|

Create a new group for the user with the following command:
```sh:5-1
sudo groupadd GoraGang
```
This will create a new group with the name `"GoraGang"`.

Add the user to the system with the following command:
```sh:5-2
sudo useradd -p $(openssl passwd -6 AlgorandOracle) GoraGang -m -s /bin/bash -g GoraGang -G sudo
```
This command will create a new user with the username `"GoraGang"`, a home directory, and a default shell of `"/bin/bash"`. The user will be added to the `"GoraGang"` group and also to the `"sudo"` group, which will allow the user to perform administrative tasks.

:::note
Note that the `"-p"` option in the `"useradd"` command sets the user's password using the output of the `"openssl passwd"` command. The `"-6"` flag specifies that the password will be hashed using `SHA-512`. This ensures that the password is securely stored in the system's password database.

![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/008f74b8-4e6c-0bd0-9085-cfc054cc3228.png)
:::


To confirm that the user was created successfully, open a new terminal window and log in with the new user's credentials:
```s:5-3
ssh -p 53814 GoraGang@12.34.56.78
# Enter the password "AlgorandOracle" when prompted
```
This will establish an SSH connection to the server with the new user's account. If you can log in successfully, then the user was created and configured correctly.





## 6. Setting up SSH Keys
This section explains how to set up an SSH key on a remote server. An SSH key is used to log in to a remote server without entering a password.

1. First, open a terminal on your local machine and create an SSH key pair. This is used to authenticate with the remote server using the public key during SSH connections.

2. Next, copy the public key to the remote server. This step registers the public key on the remote server so that you can authenticate with it during SSH connections.

3. Finally, test the SSH connection. This will verify that the SSH key is set up correctly.

|LABEL|VALUE|
|:--|:--|
|SSH Key Type|ed25519|
|SSH Private Key|goracle_ed25519|
|SSH Public Key |goracle_ed25519.pub|
|SSH Comment|goracle_ed25519_key|

Open a terminal on your local machine (Mac, Windows, or Linux).

Create an SSH key pair using the Ed25519 algorithm with the following command:
```sh:6-1
ssh-keygen -t ed25519 -N '' -C "goracle_ed25519_key" -f ~/.ssh/goracle_ed25519
cd ~/.ssh && ls
# Confirm that "goracle_ed25519" and "goracle_ed25519.pub" exist
```
:::note
Here's a breakdown of the options used:
```s:6-2　ssh-keygen
  -t ed25519                - Specifies that the Ed25519 algorithm should be used to generate the key pair.
  -N ''                     - Sets an empty passphrase for the key. This means that the key can be used without entering a password each time.
  -C                        - "goracle_ed25519_key": Adds a comment to the key to help identify it later.
  -f ~/.ssh/goracle_ed25519 - Specifies the filename and path for the private key. The public key will be saved in the same location with a .pub extension.
```
This command will generate two files in the `"~/.ssh"` directory: the private key (`"goracle_ed25519"`) and the public key (`"goracle_ed25519.pub"`). The private key should be kept secret and protected with a strong passphrase, while the public key can be safely shared with remote servers for authentication purposes.

:::


Copy the public key file `"goracle_ed25519.pub"` to the remote server (VPS).
```sh:6-3
ssh-copy-id -p 53814 -i ~/.ssh/goracle_ed25519.pub GoraGang@12.34.56.78 
# Type "yes" to continue connecting, then enter the password "AlgorandOracle" for the GoraGang user account
```
:::note
This command is used to set up public key authentication for logging into a remote host. Specifically, it is composed of the following:

```s:6-4　ssh-copy-id
  ssh-copy-id                   - a command for copying SSH public keys to a remote machine
  -p 53814                      - specifies the SSH port number, which in this case is port "53814"
  -i ~/.ssh/goracle_ed25519.pub - specifies the path to the public key file, which in this case is "~/.ssh/goracle_ed25519.pub"
  GoraGang@12.34.56.78          - login information for the remote host, where "GoraGang" is the username on the remote host and "12.34.56.78" is the IP address or domain name of the remote host.
```

In summary, this command adds the public key in `"~/.ssh/goracle_ed25519.pub"` to the `"authorized_keys"` file for the user `"GoraGang"` on the remote host, and connects to the remote host using port number `"53814"`. Once connected, this public key can be used to log into the remote host in the future **without requiring a password, improving security**.
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/953ec02f-863b-5c22-af88-c57f6f273d81.png)

:::

#### Testing SSH Login with GoraGang User
To test whether the SSH key setup was successful, try logging into the VPS as the `"GoraGang"` user using the following command:
```sh:6-5
ssh -p 53814 -i ~/.ssh/goracle_ed25519 GoraGang@12.34.56.78 
```
:::note
The permission of the remote host's `~/.ssh` directory should be set to **700**, which allows the owner to access the directory. This means that only the owner can have read, write, and execute permissions. 
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/99681fa2-d9fa-7ad6-860f-5d71cc7ec017.png)

You can set this using the following command:
```sql:6-6
chmod 700 ~/.ssh
```
The permission of the `authorized_keys` file should be set to **600**, which indicates that the file can only be read and written by the owner. 
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/bc147a2b-7bf1-9783-895a-d9e1a7fcaccd.png)

You can set this using the following command:
```sql:6-7
chmod 600 ~/.ssh/authorized_keys
```
If these permissions are not set, you can set them using the following command:
```sql:6-8
chmod 700 ~/.ssh && chmod 600 ~/.ssh/authorized_keys
```
These commands set the permission of the `"~/.ssh"` directory to **700** and the permission of the `"authorized_keys"` file to **600**.
:::

## 7. SSH Configuration and Verification

In this section, we will configure the SSH settings on the remote server to improve security and then verify that we can still connect to the server using SSH key authentication.

#### SSH Configuration
First, open the SSH configuration file using the following command:
```sh:7-1
sudo nano /etc/ssh/sshd_config
```
Then make the following changes to the configuration file:
```sql:7-2
Port 53814
AllowUsers GoraGang
PermitRootLogin no
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM no
# Uncomment the above line by removing the '#' symbol at the beginning.
# Save: Press `Ctrl + X` → Press `y` → Press `Enter`
```

:::note
These changes will do the following:

* Change the SSH port to 53814
* Allow only the GoraGang user to connect
* Disable root login
* Disable password authentication
* Disable empty passwords
* Disable challenge-response authentication
* Disable PAM

These changes will improve the security of our server by limiting the methods by which someone can gain access.
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/b831f02e-7f0a-663a-e025-33fef0dc3896.png)
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/b946c179-cf46-031c-c5f7-f3738996ba32.png)
:::

After making the changes, restart the SSH service using the following command:
```sh:7-3
sudo service ssh restart
```

#### SSH Verification
To verify that we can still connect to the server using SSH key authentication, open a new terminal window and run the following command to connect as the GoraGang user:

```sql:7-4
ssh -p 53814 -i ~/.ssh/goracle_ed25519 GoraGang@12.34.56.78
```

Make sure to replace 12.34.56.78 with the IP address of your server. If everything is configured correctly, you should be able to connect to the server without having to enter a password.

## 8. Installing Goracle Node on User GoraGang

Please make sure that the current user is GoraGang by running the following command if you are not sure:
```sh:8-1
sudo -i -u GoraGang
```

The next command downloads a file called `goracle` (`Goracle CLI`) from `https://staging.dev.goracle.io/downloads/latest-staging/goracle` and gives it executable permissions using `chmod u+x`.

Specifically, it does the following:

* Uses the `wget` command to download the `goracle` file from the specified URL.
* Uses the `chmod` command to grant execute permissions to the downloaded `goracle` file.
* The `u+x` option means to grant execute permission to the file owner.
* This makes the downloaded `goracle` file usable as an executable file, specifically as a `Goracle CLI` tool.

If you follow the official Goracle documentation:
Goracle Node Runner User Manual: `https://docs.goracle.io/technical-documentation/`
```s:8-2
cd ~/ 
wget https://staging.dev.goracle.io/downloads/latest-staging/goracle
chmod u+x ./goracle
```
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/94ce82a4-e1a0-fea2-72cf-7de6ca07667c.png)

:::note warn
According to the guide on the following site, it looks like this:
Goracle Node Guide: `https://teletype.in/@ttimmatti/goracle-node`
```s:8-3
sudo wget -qP /usr/bin/ https://staging.dev.goracle.io/downloads/latest-staging/goracle
sudo chmod u+x /usr/bin/goracle
```
The difference between the two commands is the location where `goracle` is saved. In the first command, the goracle binary is downloaded to the `home directory` of the GoraGang user and made executable with `chmod u+x`. The `./` before `goracle` is required to run the goracle command because the current directory is not in the system PATH. 
```s:8-4
./goracle init
./goracle docker-start --background
./goracle docker-stop
```
In the second command, `goracle` is downloaded directly to `/usr/bin/` and made executable with `chmod u+x`. This allows the goracle command to be run from any directory without needing to specify the path.
```s:8-5
goracle init
goracle docker-start --background
goracle docker-stop
```
:::


## 9. Installing Docker
Run the following command to install Docker:

```sh:9-1
bash <(wget -qO- https://raw.githubusercontent.com/ttimmatti/dependencies/main/docker.sh)
```
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/10f64aa6-6a3d-aa5f-911c-aa431ad88380.png)

#### Creating Configuration for a New Goracle Node
After Docker is installed, run the following command to initialize Goracle:
```s:9-2
./goracle init
# goracle init
```
#### Goracle Initialization Prompts
:::note alert
As of April 4th, 2023, the Goracle team recommends option B until option A becomes stable.
:::

##### -- Prompt A --
```armasm:9-3 Prompt A
→ your Goracle participation account using your Algorand wallet.Continue? y
→ Use Algonode Algorand API service (recommended)? [Y/n]? y
→ Enter Algonode API auth token or press enter for free-tier default: y
```
You should answer `"y"` to the first question to continue with setting up your Goracle participation account. For the second question, you can answer `"y"` to use the Algonode Algorand API service (recommended), or `"n"` to use another API service. If you choose to use the Algonode Algorand API service, you can enter your API auth token or leave it blank to use the free-tier default.

##### -- Prompt B --
Please register and obtain a `Purestake API authentication key` beforehand using the following website.

https://developer.purestake.io/

![image.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/d7445834-0104-431e-b1fd-44cc39e3e5e1.png)

```armasm:9-4 Prompt B
→ Use Algonode Algorand API service (recommended)? [Y/n]? n # Select "n" for now
→ Use a Purestake account for Algorand API service? [y/N]? y
→ Enter Purestake API authentication key: <Your Purestake API authentication key>
Enter your main Algorand account address: <Your main Algorand account address>
```
If you choose to not use the Algonode Algorand API service, you will be prompted with the above questions instead. Answer `"n"` to the first question, and `"y"` to the second question if you want to use a Purestake account for Algorand API service. Then, enter your Purestake API authentication key and main Algorand account address as prompted.

#### Participate in Oracle Consensus
The detailed steps for proceeding from here are described in steps **1.3 to 1.6** of the following guide. Please refer to it:

https://teletype.in/@ttimmatti/goracle-node#ChsM

I would also like to express my gratitude to `@ttimmatti` for creating this guide and for his/her excellent work.


## 10. Adding user to docker group

This command is used to add the currently logged-in user to the docker group. The `"$USER"` is an environment variable that indicates the username of the currently logged-in user.

Users who belong to the docker group have permission to run the docker command, which allows them to run the docker command without using the sudo command. Here is the command to add the current user to the docker group:

```bash:10-1
sudo usermod -aG docker $USER
```
:::note warn
After running `sudo usermod -aG docker $USER`, **you must log out of the current terminal session and then log back in for the changes to take effect.**
:::
```sh:10-2
exit
```
or
```sh:10-3
logout
```

**Once you are logged back in**, you can start the Goracle Docker container by running the following command:

```sh:10-4
./goracle docker-start --background
```
This command is used to start the Goracle Docker container in the background. The Goracle container is used to connect to a blockchain network using the Oracle Consensus protocol and enable database operations. The `"--background"` option specifies that the container should be run in the background.
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/a83d2bcf-88f3-c946-6d0e-b166e6ab87d1.png)

```sh:10-5
docker logs -f goracle-nr
```
This command is used to monitor the logs of the Goracle Docker container.
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/acf6b0a5-c22c-bbaf-5a7c-8ab4485f5df9.png)
The `"-f"` option allows you to follow the logs in real-time, so you can see the output as it is generated. This can be useful for troubleshooting and debugging any issues that may arise while running the container.

```sh:10-6
docker ps
```
The `"docker ps"` command lists only the running containers. Therefore, by executing the `"docker ps"` command here, we can see that a Docker container named `"goracle-nr"` is up and running. 
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/03f074db-1132-0222-3e09-12ab9f58859b.png)
This command is very useful for monitoring and managing running applications.

## 11. Goracle CLI & Docker Command
:::note
```s:11-1　goracle CLI
  goracle help          - Show usage information
  goracle init          - Create configuration for a new node
  goracle info          - Display information on the configured Goracle network
  goracle update        - Check for updates, optionally installing them
  goracle docker-status - Show status of local docker instance
  goracle docker-start  - Start local docker instance
  goracle docker-stop   - Stop locally running docker container(s)
```

1. #### 　**./goracle docker-start --background**
    ```sh:11-2
    ./goracle docker-start --background
    ```
    * Executes the Goracle binary file to start the Docker container.
    * The `"--background"` option specifies to run the container in the background.
    * Assumes that the Goracle binary file is located in the current working directory (which is often the home directory).
    * This command starts a Docker container named `"goracle-nr"`.

1. #### 　**goracle docker-start --background**
    ```sh:11-3
    goracle docker-start --background
    ```
    * If the Goracle binary file is installed on the system path (`/usr/bin`), this command starts the Docker container in a similar way.
    * The `"--background"` option specifies to run the container in the background.
    * Assumes that the Goracle binary file is located in the `/usr/bin/goracle` directory.
    * This command starts a Docker container named `"goracle-nr"`.

1. #### 　**docker start goracle-nr**
    ```sh:11-4
    ./docker start goracle-nr
    # docker start goracle-nr
    ```
    * This command restarts a stopped Docker container named `"goracle-nr"`. The Docker container needs to have already been created in order to use this command.

1. #### 　**docker stop goracle-nr**
    ```sh:11-5
    ./docker stop goracle-nr
    # docker stop goracle-nr
    ```
    * This command is a command to stop the Docker container named `"goracle-nr"`.
    
1. #### 　**docker ps**
    ```sh:11-6
    ./docker ps
    # docker ps
    ```
    * This command is used to list all running containers. It displays information such as the container ID, image used to create the container, and the command that is currently running inside the container.

1. #### 　**docker ps -a**
    ```sh:11-7
    ./docker ps -a
    # docker ps -a
    ```
    * This command is used to list all containers, whether they are running or not. It displays information similar to docker ps, but includes additional information such as the container's status (e.g. exited, restarting) and when it was created.

1. #### 　**docker container prune**
    ```sh:11-8
    ./docker container prune
    # docker container prune
    ```
    * This command is used to remove all stopped containers. Stopped containers can accumulate on a system and take up disk space, so running this command periodically can help to keep the system clean. 
    
1. #### 　**# Restart Policy**

    In Docker, you can set the restart policy for a container. The restart policy specifies the action that the Docker engine should take when a container stops. There are several types of restart policies:

    |Restart Policy|Description|
    |:--|:--|
    |no|	Do not automatically restart the container when it exits.|
    |always	|Always restart the container when it exits, regardless of the exit status.|
    |on-failure|	Restart the container if it exits with a non-zero exit status.|
    |on-failure:N|	Similar to on-failure, but limits the number of times to attempt the restart to N times. If you don't specify N, Docker will keep trying indefinitely.|
    |unless-stopped|	Similar to always, but the container will not be restarted if it was stopped manually.|

    You can specify the restart policy with the `--restart` option when you run the `docker run` command. For example, you can start a container with the `always` restart policy like this:
    ```sh:11-9
    docker run --restart always goracle-nr
    ```
    
    You can also change the restart policy for a running container with the docker update command. For example, you can change the restart policy to on-failure with a maximum of 5 retries like this:
    ```sh:11-10
    docker update --restart on-failure:5 goracle-nr
    ```
:::


## 12. Upgrading
```s:12-1
./goracle docker-stop
```
This command will stop the Goracle Docker container running on your system.

After stopping the Goracle Docker container, you can update Goracle to the latest version using the following command:
```s:12-2
./goracle update
```
This command will download and install the latest version of Goracle.

Once Goracle has been updated, you can start the Goracle Docker container again in the background using the following command:
```s:12-3
./goracle docker-start --background
```


## 13. Installing Fail2ban
**13. Fail2banのインストール**

`Fail2ban` is an intrusion prevention system that monitors log files and watches for certain patterns of failed login attempts. If a certain number of login failures from a particular IP address are detected within a specified time frame, Fail2ban will block access from that IP address.

To install Fail2ban, run the following command:
<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
`Fail2ban`は侵入防止システムであり、ログファイルを監視し、失敗したログイン試行の特定のパターンを監視します。特定のIPアドレスからのログイン失敗が指定された時間枠内で一定数検出された場合、Fail2banはそのIPアドレスからのアクセスをブロックします。

Fail2banをインストールするには、以下のコマンドを実行してください。
</details>

```sh:13-1
sudo apt install fail2ban -y
```
To configure Fail2ban to monitor SSH logins, open the configuration file using the following command:

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
Fail2banがSSHログインを監視するように設定するには、次のコマンドを使用して設定ファイルを開きます。
</details>

```sh:13-2
sudo nano /etc/fail2ban/jail.local
```
At the end of the file, add the following lines, replacing "(enter your SSH port)" with the SSH port number you set in `step 4`:

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
ファイルの最後に、以下の行を追加し、"(enter your SSH port)"をステップ4で設定したSSHポート番号に置き換えてください。その後、ファイルを保存して終了します。
</details>

```s:13-3
[sshd]
enabled = true
port = 53814 # Enter your SSH port
filter = sshd
logpath = /var/log/auth.log
maxretry = 3
# Save: Press `Ctrl + X` → Press `y` → Press `Enter`
# 保存：`Ctrl + X` を押してから、`y` を押して、`Enter`を押します。
```
Save the file and exit.


:::note
The following configuration sets up Fail2ban to monitor SSH login attempts and block IP addresses that exceed the maximum number of login failures within a certain time period. The configuration is added to the file /etc/fail2ban/jail.local.

|Parameter|Description|
|:--|:--|
|[sshd]|The name of this section, indicating that this configuration is related to `sshd`.|
|enabled	|Determines if the jail is enabled or not. Set to `true` to enable the jail.|
|port	|The SSH port number. Sets the port used for SSH. Here, port number `53814` is used.|
|filter	|This configuration monitors logs using a filter named sshd. The sshd filter is used to obtain the IP address of users attempting to connect via SSH.|
|logpath	|The path to the monitored log file. Here, `/var/log/auth.log` is being monitored. This file contains information about user SSH connections.|
|maxretry|Sets how many failed logins are allowed before the IP address is blocked. Here, if there are `3` failed login attempts, access from that IP address will be blocked.|

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
以下の設定は、Fail2banがSSHログイン試行を監視し、一定時間内に最大ログイン失敗回数を超えたIPアドレスをブロックするように設定します。この設定は、ファイル/etc/fail2ban/jail.localに追加されます。

|パラメータ|説明|
|:--|:--|
|[sshd]|	このセクションの名前で、この設定が`sshd`に関連していることを示します。|
|enabled|	ジェイルが有効かどうかを決定します。ジェイルを有効にするには、`true`に設定します。|
|port|	SSHポート番号です。SSHに使用されるポートを設定します。ここではポート番号`53814`が使用されます。|
|filter|	この設定は、sshdという名前のフィルタを使用してログを監視します。 sshdフィルタを使用して、SSH経由で接続しようとするユーザーのIPアドレスを取得します。|
|logpath|	監視されるログファイルへのパスです。ここでは、`/var/log/auth.log`が監視されています。このファイルには、ユーザーのSSH接続に関する情報が含まれています。|
|maxretry|	IPアドレスがブロックされる前に許可される失敗したログインの回数を設定します。ここでは、`3`回のログイン失敗試行がある場合、そのIPアドレスからのアクセスがブロックされます。|
</details>
:::

![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/be2e863e-e9a5-38a8-5bab-2bdd166b1be0.png)
Restart Fail2ban to apply the new configuration:
<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
新しい設定を適用するために、Fail2banを再起動してください。
</details>

```sh:13-4
sudo systemctl restart fail2ban
```
![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/38f2136d-0b5d-6f92-9889-c0890f5e146d.png)
That's it! `Fail2ban` is now set up to monitor SSH logins and block IPs with a certain number of failed login attempts.

Fail2ban monitors `/var/log/auth.log` to collect information such as unauthorized access and authentication errors. The information about blocked and unblocked IP addresses by fail2ban is recorded in `/var/log/fail2ban.log`. Therefore, `/var/log/fail2ban.log` is a log file to check the actions taken by fail2ban.

You can view the fail2ban log file by using the command:

<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->
以上で完了です！ `Fail2ban`は、一定数のログイン失敗試行を行ったIPアドレスをブロックするように設定され、SSHログインを監視するように設定されました。

Fail2banは、 `/var/log/auth.log`を監視して、不正アクセスや認証エラーなどの情報を収集します。Fail2banによってブロックされたIPアドレスとアンブロックされたIPアドレスに関する情報は、`/var/log/fail2ban.log`に記録されます。したがって、`/var/log/fail2ban.log`はFail2banによって実行されたアクションを確認するためのログファイルです。

fail2banログファイルを表示するには、次のコマンドを使用します：
</details>

```s:13-5
sudo cat /var/log/fail2ban.log
```

:::note warn
If you accidentally get banned by fail2ban, you can unban yourself by:

1. Using a `VPN` to access from a different IP address.
1. Editing the log file by removing the entry that contains your IP address using the following command:
    ```s:13-6
    sudo cat /var/log/fail2ban.log
    ```
1. Restarting fail2ban to apply the changes by running the following command:
    ```s:13-7
    sudo service fail2ban restart
    ```
<details><summary>【日本語】</summary>

<!--(上に空行が必要)-->

もしFail2banによって誤ってあなた自身がBANされた場合は、以下の方法で自分自身をアンバンすることができます。

1. `VPN`を使用して別のIPアドレスからアクセスすること。
1. 次のコマンドを使用して、あなたのIPアドレスを含むエントリを削除することによって、ログファイルを編集すること。
    ```s:13-6
    sudo cat /var/log/fail2ban.log
    ```
1. 変更を適用するために、Fail2banを再起動するために以下のコマンドを実行すること。
    ```s:13-7
    sudo service fail2ban restart
    ```
</details>
:::





# Author
:::note
@Moon1215i 

If you are interested in Goracle, please follow me on Twitter:

https://twitter.com/Moon1215i

It would be great if I could receive a comment on Twitter, even just a few words.

![Screenshot by Dropbox Capture.png](https://qiita-image-store.s3.ap-northeast-1.amazonaws.com/0/3307384/44dfe685-89aa-9466-edb3-5f26e2518848.png)
:::