freedombone/src/freedombone-app-tahoelafs

#!/bin/bash
#
# .---.                  .              .
# |                      |              |
# |--- .--. .-.  .-.  .-.|  .-. .--.--. |.-.  .-. .--.  .-.
# |    |   (.-' (.-' (   | (   )|  |  | |   )(   )|  | (.-'
# '    '     --'  --'  -' -  -' '  '   -' -'   -' '   -  --'
#
#                    Freedom in the Cloud
#
# Tahow-LAFS data storage grid implemented via Tor
# https://k0rx.com/blog/2017/01/lafs.html
# http://tahoe-lafs.readthedocs.io/en/latest/anonymity-configuration.html
#
# License
# =======
#
# Copyright (C) 2014-2017 Bob Mottram <bob@freedombone.net>
#
# This program is free software: you can redistribute it and/or modify
# it under the terms of the GNU Affero General Public License as published by
# the Free Software Foundation, either version 3 of the License, or
# (at your option) any later version.
#
# This program is distributed in the hope that it will be useful,
# but WITHOUT ANY WARRANTY; without even the implied warranty of
# MERCHANTABILITY or FITNESS FOR A PARTICULAR PURPOSE.  See the
# GNU Affero General Public License for more details.
#
# You should have received a copy of the GNU Affero General Public License
# along with this program.  If not, see <http://www.gnu.org/licenses/>.

VARIANTS='full full-vim cloud'

IN_DEFAULT_INSTALL=0
SHOW_ON_ABOUT=1
SHOW_ICANN_ADDRESS_ON_ABOUT=0

TAHOELAFS_PORT=50213
TAHOELAFS_STORAGE_PORT=50214
TAHOELAFS_ONION_PORT=8096
TAHOELAFS_STORAGE_ONION_PORT=8097

TAHOE_DIR=/home/tahoelafs
TAHOE_COMMAND='/usr/bin/tahoe'
tahoelafs_storage_file=$TAHOE_DIR/client/private/servers.yaml

TAHOELAFS_SHARES_NEEDED=3
TAHOELAFS_SHARES_HAPPY=7
TAHOELAFS_SHARES_TOTAL=10

tahoelafs_variables=(ONION_ONLY
                     MY_USERNAME
                     TAHOELAFS_PORT
                     TAHOELAFS_SHARES_NEEDED
                     TAHOELAFS_SHARES_HAPPY
                     TAHOELAFS_SHARES_TOTAL)

function logging_on_tahoelafs {
    echo -n ''
}

function logging_off_tahoelafs {
    echo -n ''
}

function add_user_tahoelafs {
    if [[ $(app_is_installed tahoelafs) == "0" ]]; then
        echo '0'
        return
    fi

    new_username="$1"
    new_user_password="$2"
    ${PROJECT_NAME}-pass -u $new_username -a tahoelafs -p "$new_user_password"
    if grep -q "${new_username}:" /etc/nginx/.htpasswd-tahoelafs; then
        sed -i '/${new_username}:/d' /etc/nginx/.htpasswd-tahoelafs
    fi
    echo "${new_user_password}" | htpasswd -i -s /etc/nginx/.htpasswd-tahoelafs ${new_username}
    echo '0'
}

function remove_user_tahoelafs {
    remove_username="$1"
    ${PROJECT_NAME}-pass -u $remove_username --rmapp tahoelafs
    if grep -q "${remove_username}:" /etc/nginx/.htpasswd-tahoelafs; then
        sed -i '/${remove_username}:/d' /etc/nginx/.htpasswd-tahoelafs
    fi
}

function change_password_tahoelafs {
    change_username="$1"
    change_password="$2"
    ${PROJECT_NAME}-pass -u $change_username -a tahoelafs -p "$change_password"
    if grep -q "${change_username}:" /etc/nginx/.htpasswd-tahoelafs; then
        sed -i '/tahoe-${change_username}:/d' /etc/nginx/.htpasswd-tahoelafs
    fi
    echo "${change_password}" | htpasswd -i -s /etc/nginx/.htpasswd-tahoelafs ${change_username}
}

function add_tahoelafs_storage_node_interactive {
    data=$(tempfile 2>/dev/null)
    trap "rm -f $data" 0 1 2 5 15
    dialog --backtitle $"Freedombone Configuration" \
           --title $"Add Tahoe-LAFS storage node" \
           --form $"\nEnter the storage node details which can be found on the About screen of another server" 13 75 5 \
           $"Hostname:" 1 1 "" 1 14 53 40 \
           $"Public Key:" 2 1 "" 2 14 53 255 \
           $"Nickname:" 3 1 "" 3 14 53 255 \
           $"FURL:" 4 1 "" 4 14 53 255 \
           2> $data
    sel=$?
    case $sel in
        1) return;;
        255) return;;
    esac
    storage_hostname=$(cat $data | sed -n 1p)
    public_key="$(cat $data | sed -n 2p)"
    nick=$(cat $data | sed -n 3p)
    furl=$(cat $data | sed -n 4p)

    if [ ${#public_key} -eq 0 ]; then
        return
    fi

    add_tahoelafs_server "${storage_hostname}" "${public_key}" "${nick}" "${furl}"

    if grep -q "$public_key" ${tahoelafs_storage_file}; then
        dialog --title $"Add Tahoe-LAFS storage node" \
               --msgbox $"Storage node added" 6 40
    fi
}

function edit_tahoelafs_nodes {
    editor $tahoelafs_storage_file
    chown tahoelafs:debian-tor $tahoelafs_storage_file
    systemctl restart tahoelafs-client
}

function edit_tahoelafs_shares {
    read_config_param TAHOELAFS_SHARES_NEEDED
    read_config_param TAHOELAFS_SHARES_HAPPY
    read_config_param TAHOELAFS_SHARES_TOTAL

    data=$(tempfile 2>/dev/null)
    trap "rm -f $data" 0 1 2 5 15
    dialog --backtitle $"Freedombone Configuration" \
           --title $"Tahoe-LAFS shares" \
           --form $"\nEnter the storage node details which can be found on the About screen of another server" 13 40 3 \
           $"Needed:" 1 1 "${TAHOELAFS_SHARES_NEEDED}" 1 14 4 4 \
           $"Happy:" 2 1 "${TAHOELAFS_SHARES_HAPPY}" 2 14 4 4 \
           $"Total:" 3 1 "${TAHOELAFS_SHARES_TOTAL}" 3 14 4 4 \
           2> $data
    sel=$?
    case $sel in
        1) return;;
        255) return;;
    esac
    tl_needed="$(cat $data | sed -n 1p)"
    tl_happy="$(cat $data | sed -n 2p)"
    tl_total="$(cat $data | sed -n 3p)"
    if [ ${#tl_needed} -gt 0 ]; then
        TAHOELAFS_SHARES_NEEDED=${tl_needed}
    fi
    if [ ${#tl_happy} -gt 0 ]; then
        TAHOELAFS_SHARES_HAPPY=${tl_happy}
    fi
    if [ ${#tl_total} -gt 0 ]; then
        TAHOELAFS_SHARES_TOTAL=${tl_total}
    fi

    sed -i "s|shares.needed.*|shares.needed = ${TAHOELAFS_SHARES_NEEDED}|g" $TAHOE_DIR/tahoelafs/client/tahoe.cfg
    sed -i "s|shares.happy.*|shares.happy = ${TAHOELAFS_SHARES_HAPPY}|g" $TAHOE_DIR/tahoelafs/client/tahoe.cfg
    sed -i "s|shares.total.*|shares.total = ${TAHOELAFS_SHARES_TOTAL}|g" $TAHOE_DIR/tahoelafs/client/tahoe.cfg

    sed -i "s|shares.needed.*|shares.needed = ${TAHOELAFS_SHARES_NEEDED}|g" $TAHOE_DIR/tahoelafs/storage/tahoe.cfg
    sed -i "s|shares.happy.*|shares.happy = ${TAHOELAFS_SHARES_HAPPY}|g" $TAHOE_DIR/tahoelafs/storage/tahoe.cfg
    sed -i "s|shares.total.*|shares.total = ${TAHOELAFS_SHARES_TOTAL}|g" $TAHOE_DIR/tahoelafs/storage/tahoe.cfg

    systemctl restart tahoelafs-storage
    systemctl restart tahoelafs-client

    dialog --title $"Tahoe-LAFS shares" \
           --msgbox $"Shares settings changed" 6 40
}

function configure_interactive_tahoelafs {
    data=$(tempfile 2>/dev/null)
    trap "rm -f $data" 0 1 2 5 15
    dialog --backtitle $"Freedombone Configuration" \
           --title $"Tahoe-LAFS" \
           --radiolist $"The least authority is always the best" 11 50 5 \
           1 "Add a storage node" off \
           2 "Manually edit storage nodes" off \
           3 "Shares settings" off \
           4 "Back to main menu" on 2> $data
    sel=$?
    case $sel in
        1) exit 1;;
        255) exit 1;;
    esac
    case $(cat $data) in
        1) add_tahoelafs_storage_node_interactive;;
        2) edit_tahoelafs_nodes;;
        3) edit_tahoelafs_shares;;
    esac
}

function tahoelafs_setup_client_config {
    config_file=$1
    nick="$2"

    echo '[node]' > $config_file
    echo "nickname = $nick" >> $config_file
    echo 'reveal-IP-address = false' >> $config_file
    echo "web.port = tcp:${TAHOELAFS_PORT}:interface=127.0.0.1" >> $config_file
    echo 'web.static = public_html' >> $config_file
    echo 'tub.port = disabled' >> $config_file
    echo 'tub.location = disabled' >> $config_file
    echo '' >> $config_file
    echo '[client]' >> $config_file
    echo 'introducer.furl =' >> $config_file
    echo "shares.needed = ${TAHOELAFS_SHARES_NEEDED}" >> $config_file
    echo "shares.happy = ${TAHOELAFS_SHARES_HAPPY}" >> $config_file
    echo "shares.total = ${TAHOELAFS_SHARES_TOTAL}" >> $config_file
    echo '' >> $config_file
    echo '[storage]' >> $config_file
    echo 'enabled = false' >> $config_file
    echo 'reserved_space = 3G' >> $config_file
    echo '' >> $config_file
    echo '[helper]' >> $config_file
    echo 'enabled = false' >> $config_file
    echo '' >> $config_file
    echo '[connections]' >> $config_file
    echo 'tcp = tor' >> $config_file
}

function tahoelafs_setup_storage_config {
    config_file=$1
    nick="$2"

    echo '[node]' > $config_file
    echo "nickname = $nick" >> $config_file
    echo 'reveal-IP-address = false' >> $config_file
    echo 'web.port =' >> $config_file
    echo 'web.static = public_html' >> $config_file
    echo "tub.port = tcp:${TAHOELAFS_STORAGE_ONION_PORT}:interface=127.0.0.1" >> $config_file
    echo "tub.location = tor:${TAHOELAFS_STORAGE_ONION_HOSTNAME}:${TAHOELAFS_STORAGE_PORT}" >> $config_file
    echo '' >> $config_file
    echo '[client]' >> $config_file
    echo 'introducer.furl =' >> $config_file
    echo 'helper.furl =' >> $config_file
    echo '' >> $config_file
    echo "shares.needed = ${TAHOELAFS_SHARES_NEEDED}" >> $config_file
    echo "shares.happy = ${TAHOELAFS_SHARES_HAPPY}" >> $config_file
    echo "shares.total = ${TAHOELAFS_SHARES_TOTAL}" >> $config_file
    echo '' >> $config_file
    echo '[storage]' >> $config_file
    echo 'enabled = true' >> $config_file
    echo 'reserved_space = 3G' >> $config_file
    echo 'expire.enabled = true' >> $config_file
    echo 'expire.mode = age' >> $config_file
    echo 'expire.override_lease_duration = 3 months' >> $config_file
    echo '' >> $config_file
    echo '[helper]' >> $config_file
    echo 'enabled = false' >> $config_file
    echo '' >> $config_file
    echo '[connections]' >> $config_file
    echo 'tcp = tor' >> $config_file

    chown -R tahoelafs:debian-tor $TAHOE_DIR
}

function install_interactive_tahoelafs {
    echo -n ''
    APP_INSTALLED=1
}

function upgrade_tahoelafs {
    echo -n ''
}

function backup_local_tahoelafs {
    source_directory=$TAHOE_DIR
    if [ ! -d $source_directory ]; then
        return
    fi
    systemctl stop tahoelafs
    dest_directory=tahoelafs
    function_check backup_directory_to_usb
    backup_directory_to_usb $source_directory $dest_directory
    systemctl start tahoelafs
}

function restore_local_tahoelafs {
    echo $"Restoring Tahoe-LAFS"
    systemctl stop tahoelafs-storage
    systemctl stop tahoelafs-client
    temp_restore_dir=/root/temptahoelafs
    restore_directory_from_usb $temp_restore_dir tahoelafs
    mv $TAHOE_DIR ${TAHOE_DIR}-old
    cp -r $temp_restore_dir$TAHOE_DIR $TAHOE_DIR
    if [ ! "$?" = "0" ]; then
        mv ${TAHOE_DIR}-old $TAHOE_DIR
        exit 246833
    fi
    rm -rf ${TAHOE_DIR}-old
    chown -R tahoelafs:debian-tor $TAHOE_DIR
    systemctl start tahoelafs-client
    systemctl start tahoelafs-storage
    echo $"Restore complete"
}

function backup_remote_tahoelafs {
    source_directory=$TAHOE_DIR
    if [ ! -d $source_directory ]; then
        return
    fi
    systemctl stop tahoelafs-storage
    systemctl stop tahoelafs-client
    dest_directory=tahoelafs
    function_check backup_directory_to_usb
    backup_directory_to_friend $source_directory $dest_directory
    systemctl start tahoelafs-client
    systemctl start tahoelafs-storage
}

function restore_remote_tahoelafs {
    echo $"Restoring Tahoe-LAFS"
    systemctl stop tahoelafs-storage
    systemctl stop tahoelafs-client
    temp_restore_dir=/root/temptahoelafs
    restore_directory_from_friend $temp_restore_dir tahoelafs
    mv $TAHOE_DIR ${TAHOE_DIR}-old
    cp -r $temp_restore_dir$TAHOE_DIR $TAHOE_DIR
    if [ ! "$?" = "0" ]; then
        mv ${TAHOE_DIR}old $TAHOE_DIR
        exit 623925
    fi
    rm -rf ${$TAHOE_DIR}-old
    chown -R tahoelafs:debian-tor $TAHOE_DIR
    systemctl start tahoelafs-client
    systemctl start tahoelafs-storage
    echo $"Restore complete"
}

function reconfigure_tahoelafs {
    if [ -f $tahoelafs_storage_file ]; then
        shred -zu $tahoelafs_storage_file
    fi
    sed -i '/HidServAuth /d' /etc/tor/torrc
}

function remove_tahoelafs {
    if [ -f /etc/nginx/sites-available/tahoelafs ]; then
        nginx_dissite tahoelafs
        rm /etc/nginx/sites-available/tahoelafs
        if [ -d /var/www/tahoelafs ]; then
            rm -rf /var/www/tahoelafs
        fi
        systemctl reload nginx
    fi

    systemctl stop tahoelafs-storage
    systemctl disable tahoelafs-storage
    rm /etc/systemd/system/tahoelafs-storage.service
    systemctl daemon-reload

    systemctl stop tahoelafs-client
    systemctl disable tahoelafs-client
    rm /etc/systemd/system/tahoelafs-client.service
    systemctl daemon-reload

    pip uninstall tahoe-lafs[tor]
    apt-get -yq remove tahoe-lafs

    if [ -d /var/lib/tahoelafs ]; then
        rm -rf /var/lib/tahoelafs
    fi
    remove_completion_param install_tahoelafs
    function_check remove_onion_service
    remove_onion_service tahoelafs ${TAHOELAFS_ONION_PORT}
    remove_onion_service storage-tahoelafs ${TAHOELAFS_STORAGE_ONION_PORT} $(get_tahoelafs_nick)
    sed -i '/HidServAuth /d' /etc/tor/torrc

    groupdel -f tahoelafs
    userdel -r tahoelafs

    if [ -d $TAHOE_DIR ]; then
        rm -rf $TAHOE_DIR
    fi
    remove_app tahoelafs
    if [ -f /etc/nginx/.htpasswd-tahoelafs ]; then
        shred -zu /etc/nginx/.htpasswd-tahoelafs
    fi
    onion_update
}

function create_tahoelafs_stealth_node {
    node_dir="$1"
    client_dir="$2"
    node_nick="$3"
    client_nick="$4"

    if [ ${#node_dir} -eq 0 ]; then
        echo $'No tahoe-LAFS storage node directory given'
        exit 783522
    fi
    if [ ${#client_dir} -eq 0 ]; then
        echo $'No tahoe-LAFS client directory given'
        exit 368935
    fi
    if [ ${#node_nick} -eq 0 ]; then
        echo $'No tahoe-LAFS node nick given'
        exit 672351
    fi
    if [ ${#client_nick} -eq 0 ]; then
        echo $'No tahoe-LAFS client nick given'
        exit 682362
    fi

    if [ ! -f ${node_dir}/tahoe.cfg ]; then
        su -c "mkdir ${node_dir}" - tahoelafs
        su -c "$TAHOE_COMMAND create-node -C ${node_dir} --hostname=fixme" - tahoelafs
        tahoelafs_setup_storage_config ${node_dir}/tahoe.cfg ${node_nick}
    fi

    if [ ! -f ${client_dir}/tahoe.cfg ]; then
        su -c "mkdir ${client_dir}" - tahoelafs
        su -c "$TAHOE_COMMAND create-client -C ${client_dir}" - tahoelafs
        tahoelafs_setup_client_config ${client_dir}/tahoe.cfg ${client_nick}
    fi
}

function create_tahoelafs_introducer {
    introducer_dir="$1"

    if [ -f ${introducer_dir}/tahoe.cfg ]; then
        return
    fi

    su -c "mkdir ${introducer_dir}" - tahoelafs
    su -c "$TAHOE_COMMAND create-introducer -C ${introducer_dir} --hide-ip --hostname=127.0.0.1" - tahoelafs
}

function create_tahoelafs_storage_node {
    # Nodes can store data
    node_dir="$1"
    furl="$2"

    if [ ${#furl} -eq 0 ]; then
        return
    fi

    if [ -f ${node_dir}/tahoe.cfg ]; then
        return
    fi

    su -c "mkdir ${node_dir}" - tahoelafs
    su -c "$TAHOE_COMMAND create-node -C ${node_dir} --introducer=\"$furl\" --listen=tor --hide-ip" - tahoelafs
}

function create_tahoelafs_client {
    # Clients have no storage
    client_dir="$1"
    furl="$2"

    if [ ${#furl} -eq 0 ]; then
        return
    fi

    if [ -f ${client_dir}/tahoe.cfg ]; then
        return
    fi

    su -c "mkdir ${client_dir}" - tahoelafs
    su -c "$TAHOE_COMMAND create-client -C ${client_dir} --introducer=\"$furl\" --listen=tor --hide-ip --hostname=127.0.0.1" - tahoelafs
    sed -i 's|reveal-IP-address =.*|reveal-IP-address = False|g' $client_dir/tahoe.cfg
    sed -i 's|tub.port =.*|tub.port = disabled|g' $client_dir/tahoe.cfg
    sed -i 's|tub.location =.*|tub.location = disabled|g' $client_dir/tahoe.cfg
}

function get_tahoelafs_furl {
    furl=$(cat $TAHOE_DIR/storage/private/storage.furl)
    furl_1=$(echo "${furl}" | awk -F ' ' '{print $1}')
    furl_2=$(echo "${furl}" | awk -F ':' '{print $5}')
    echo "${furl_1}:${furl_2}"
}

function get_tahoelafs_nick {
    echo "${MY_USERNAME}-node"
}

function get_tahoelafs_storage_hostname {
    echo "$(cat /var/lib/tor/hidden_service_storage-tahoelafs/hostname)"
}

function get_tahoelafs_public_key {
    echo "$(cat $TAHOE_DIR/storage/node.pubkey | grep 'v0-' | sed 's|pub-||g')"
}

function add_tahoelafs_server {
    storage_hostname="$1"
    public_key="$2"
    nick="$3"
    furl="$4"

    if [ ${#storage_hostname} -eq 0 ]; then
        echo $'No storage hostname'
        return
    fi
    if [ ${#public_key} -eq 0 ]; then
        echo $'No public key'
        return
    fi
    if [ ${#nick} -eq 0 ]; then
        echo $'No nick'
        return
    fi
    if [ ${#furl} -eq 0 ]; then
        echo $'No furl'
        return
    fi

    if [ ! -f ${tahoelafs_storage_file} ]; then
        echo 'storage:' > ${tahoelafs_storage_file}
    else
        if grep -q "${public_key}" ${tahoelafs_storage_file}; then
            echo $'Public key already exists'
            return
        fi
        echo '# storage' >> ${tahoelafs_storage_file}
    fi
    echo "  ${public_key}:" >> ${tahoelafs_storage_file}
    echo "    ann:" >> ${tahoelafs_storage_file}
    echo "      nickname: ${nick}" >> ${tahoelafs_storage_file}
    echo "      anonymous-storage-FURL: ${furl}" >> ${tahoelafs_storage_file}
    chown tahoelafs:debian-tor ${tahoelafs_storage_file}

    if ! grep -q "HidServAuth ${storage_hostname}" /etc/tor/torrc; then
        echo "HidServAuth ${storage_hostname}" >> /etc/tor/torrc
    fi
}

function create_tahoelafs_daemon {
    daemon_name=$1

    TAHOELAFS_DAEMON_FILE=/etc/systemd/system/tahoelafs-${daemon_name}.service
    echo "Creating daemon: $TAHOELAFS_DAEMON_FILE"

    echo '[Unit]' > $TAHOELAFS_DAEMON_FILE
    echo "Description=Tahoe-LAFS ${daemon_name}" >> $TAHOELAFS_DAEMON_FILE
    echo 'After=syslog.target' >> $TAHOELAFS_DAEMON_FILE
    echo 'After=network.target' >> $TAHOELAFS_DAEMON_FILE
    echo '' >> $TAHOELAFS_DAEMON_FILE
    echo '[Service]' >> $TAHOELAFS_DAEMON_FILE
    echo 'Type=simple' >> $TAHOELAFS_DAEMON_FILE
    echo "User=tahoelafs" >> $TAHOELAFS_DAEMON_FILE
    echo "Group=debian-tor" >> $TAHOELAFS_DAEMON_FILE
    echo "WorkingDirectory=${TAHOE_DIR}" >> $TAHOELAFS_DAEMON_FILE
    echo "ExecStart=/usr/bin/tahoe run ${TAHOE_DIR}/${daemon_name}" >> $TAHOELAFS_DAEMON_FILE
    echo "ExecStop=/usr/bin/tahoe stop ${TAHOE_DIR}/${daemon_name}" >> $TAHOELAFS_DAEMON_FILE
    echo 'Restart=on-failure' >> $TAHOELAFS_DAEMON_FILE
    echo 'RestartSec=10' >> $TAHOELAFS_DAEMON_FILE
    echo "Environment=\"USER=tahoelafs\" \"HOME=${TAHOE_DIR}\"" >> $TAHOELAFS_DAEMON_FILE
    echo '' >> $TAHOELAFS_DAEMON_FILE
    echo '[Install]' >> $TAHOELAFS_DAEMON_FILE
    echo 'WantedBy=multi-user.target' >> $TAHOELAFS_DAEMON_FILE
    systemctl enable tahoelafs-${daemon_name}
    systemctl daemon-reload
    systemctl start tahoelafs-${daemon_name}
}

function create_tahoelafs_web {
    if [ ! -d /var/www/tahoelafs/htdocs ]; then
        mkdir -p /var/www/tahoelafs/htdocs
    fi
    TAHOELAFS_LOGIN_TEXT=$'Tahoe-LAFS login'

    tahoelafs_nginx_site=/etc/nginx/sites-available/tahoelafs
    echo 'server {' > $tahoelafs_nginx_site
    echo "    listen 127.0.0.1:$TAHOELAFS_ONION_PORT default_server;" >> $tahoelafs_nginx_site
    echo "    server_name $TAHOELAFS_ONION_HOSTNAME;" >> $tahoelafs_nginx_site
    echo '' >> $tahoelafs_nginx_site
    function_check nginx_disable_sniffing
    nginx_disable_sniffing tahoelafs
    echo '' >> $tahoelafs_nginx_site
    echo '  # Logs' >> $tahoelafs_nginx_site
    echo '  access_log /dev/null;' >> $tahoelafs_nginx_site
    echo '  error_log /dev/null;' >> $tahoelafs_nginx_site
    echo '' >> $tahoelafs_nginx_site
    echo '  # Root' >> $tahoelafs_nginx_site
    echo "  root /var/www/tahoelafs/htdocs;" >> $tahoelafs_nginx_site
    echo '' >> $tahoelafs_nginx_site
    echo '  location / {' >> $tahoelafs_nginx_site
    echo "    auth_basic \"${TAHOELAFS_LOGIN_TEXT}\";" >> $tahoelafs_nginx_site
    echo '    auth_basic_user_file /etc/nginx/.htpasswd-tahoelafs;' >> $tahoelafs_nginx_site
    function_check nginx_limits
    nginx_limits tahoelafs '15m'
    echo '    rewrite /(.*) /$1 break;' >> $tahoelafs_nginx_site
    echo '    proxy_set_header X-Real-IP $remote_addr;' >> $tahoelafs_nginx_site
    echo '    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;' >> $tahoelafs_nginx_site
    echo '    proxy_set_header Host $http_host;' >> $tahoelafs_nginx_site
    echo '    proxy_set_header X-NginX-Proxy true;' >> $tahoelafs_nginx_site
    echo "    proxy_pass http://localhost:${TAHOELAFS_PORT};" >> $tahoelafs_nginx_site
    echo '    proxy_redirect off;' >> $tahoelafs_nginx_site
    echo '  }' >> $tahoelafs_nginx_site
    echo '}' >> $tahoelafs_nginx_site

    TAHOELAFS_ADMIN_PASSWORD="$(create_password ${MINIMUM_PASSWORD_LENGTH})"
    ${PROJECT_NAME}-pass -u $MY_USERNAME -a tahoelafs -p "$TAHOELAFS_ADMIN_PASSWORD"
    if [ ! -f /etc/nginx/.htpasswd-tahoelafs ]; then
        touch /etc/nginx/.htpasswd-tahoelafs
    fi
    if grep -q "${MY_USERNAME}:" /etc/nginx/.htpasswd-tahoelafs; then
        sed -i '/${MY_USERNAME}:/d' /etc/nginx/.htpasswd-tahoelafs
    fi
    echo "${TAHOELAFS_ADMIN_PASSWORD}" | htpasswd -i -s /etc/nginx/.htpasswd-tahoelafs ${MY_USERNAME}

    function_check nginx_ensite
    nginx_ensite tahoelafs
    systemctl reload nginx
}

function install_tahoelafs {
    if [ $INSTALLING_MESH ]; then
        return
    fi

    apt-get -yq install build-essential python-pip python-dev libffi-dev libssl-dev
    apt-get -yq install libcrypto++-dev python-pycryptopp python-cffi
    apt-get -yq install python-virtualenv apache2-utils

    if [ -d $TAHOE_DIR ]; then
        groupdel -f tahoelafs
        userdel -r tahoelafs
        rm -rf $TAHOE_DIR
    fi

    # create a user
    adduser --disabled-login --gecos 'tahoe-lafs' tahoelafs

    if [ ! -d $TAHOE_DIR ]; then
        echo $"$TAHOE_DIR directory was not created"
        exit 879335
    fi

    adduser tahoelafs debian-tor
    groupadd tahoelafs

    apt-get -yq install tahoe-lafs
    pip install tahoe-lafs[tor]

    if [ -d $TAHOE_DIR/Maildir ]; then
        rm -rf $TAHOE_DIR/Maildir
    fi

    # remove files we don't need
    rm -rf $TAHOE_DIR/.mutt
    rm $TAHOE_DIR/.emacs-mutt
    rm $TAHOE_DIR/.muttrc
    rm $TAHOE_DIR/.mutt-alias
    rm $TAHOE_DIR/.procmailrc

    # set permissions
    chown -R tahoelafs:debian-tor $TAHOE_DIR

    node_nick=$(get_tahoelafs_nick)
    client_nick=${MY_USERNAME}-client

    # create an onion address for storage node
    TAHOELAFS_STORAGE_ONION_HOSTNAME=$(add_onion_service storage-tahoelafs ${TAHOELAFS_STORAGE_PORT} ${TAHOELAFS_STORAGE_ONION_PORT} ${node_nick})

    # create an onion address for client node
    TAHOELAFS_ONION_HOSTNAME=$(add_onion_service tahoelafs 80 ${TAHOELAFS_ONION_PORT})

    create_tahoelafs_stealth_node $TAHOE_DIR/storage $TAHOE_DIR/client ${node_nick} ${client_nick}

    # start the storage node
    su -c "/usr/bin/python2 /usr/bin/tahoe start $TAHOE_DIR/storage" - tahoelafs
    create_tahoelafs_daemon "storage"

    # start the client
    su -c "/usr/bin/python2 /usr/bin/tahoe start $TAHOE_DIR/client" - tahoelafs
    add_tahoelafs_server "$(get_tahoelafs_storage_hostname)" "$(get_tahoelafs_public_key)" "${node_nick}" "$(get_tahoelafs_furl)"
    if ! grep -q "HidServAuth $(get_tahoelafs_storage_hostname)" /etc/tor/torrc; then
        echo $'Unable to create tahoelafs server'
        exit 738752
    fi
    if [ ! -f ${tahoelafs_storage_file} ]; then
        echo $'tahoelafs server file missing'
        exit 529362
    fi
    create_tahoelafs_daemon "client"

    set_completion_param "tahoelafs onion domain" "$TAHOELAFS_ONION_HOSTNAME"

    create_tahoelafs_web
    onion_update
    APP_INSTALLED=1
}

# NOTE: deliberately no exit 0