ethd

#!/usr/bin/env bash
# shellcheck disable=SC2034
set -Eeuo pipefail

__project_name="Eth Docker"
__app_name="Ethereum node"
__sample_service="consensus"
__target_pg=18
__current_docker=29
__min_ubuntu=22
__eol_min_ubuntu=2027-05-31
__upgrade_ubuntu="Guide to upgrading to 24.04: https://gist.github.com/yorickdowne/94f1e5538007f4c9d3da7b22b0dc28a4 , consider an upgrade to 26.04 after that"
__min_debian=12
__eol_min_debian=2028-06-30
__upgrade_debian="Guide to upgrading to 12: https://gist.github.com/yorickdowne/ec9e2c6f4f8a2ee93193469d285cd54c , consider an upgrade to 13 after that"
__stat_mode_param=()
__docker_exe="docker"
__old_docker=0
__oldish_docker=0
__old_rootless_docker=0
__old_traefik=0
__traefik_tag=""
__docker_sudo=""
__docker_version=""
__docker_major_version=""
__docker_minor_version=""
__docker_patch_version=""
__compose_exe="docker compose"
__compose_version=""
__compose_major=""
__compose_minor=""
__old_compose=0
__compose_upgraded=0
__distro=""
__os_major_version=""
__os_minor_version=""
__eol_os=0
__non_interactive=0
__debug=0
__found=0
__env_file=.env
__during_config=0
__during_update=0
__during_postgres=0
__during_env_migrate=0
__during_pg_migrate=0
__env_migrated=0
__pg_migrated=0
__keep_targets=1
__target_ver=1
__source_ver=1
__minty_fresh=0
__network_change=0
__handler_ran=0
__lock_file=""
__deployment=""
__write_vars=()
__command=""
__params=""
__me=./ethd
__auto_sudo=""
__chmod_sudo=""
__cannot_sudo=0
__as_owner=""
__new_owner=""
__owner=""
__owner_group=""
__group_can_write=0
__value=""  # This is a global to hand a result back from __get_value_from_env
__free_space=0
__docker_dir="/var/lib/docker"
__keys_args=""
__final_msg=""


__dodocker() {
  ${__docker_sudo} ${__docker_exe} "$@"
}


__docompose() {
# I want word splitting here
# shellcheck disable=SC2086
  ${__docker_sudo} ${__compose_exe} "$@"
}


__determine_distro() {
  local uname

# Determine OS platform
  uname=$(uname | tr "[:upper:]" "[:lower:]")
# If Linux, try to determine specific distribution
  if [[ "${uname}" = "linux" ]]; then
# If available, use LSB to identify distribution
    if [[ -n "$(command -v lsb_release 2>/dev/null)" ]]; then
      __distro=$(lsb_release -i | cut -d: -f2 | sed s/'^\t'//)
# Otherwise, use release info file
    else
      __distro=$(find /etc -maxdepth 1 -type f -name '[A-Za-z]*[_-][rv]e[lr]*' \
        | grep -v "lsb" | cut -d'/' -f3 | cut -d'-' -f1 | cut -d'_' -f1)
    fi
  else
    __distro=""
  fi
# For everything else (or if above failed), just use generic identifier
  [[ -z "${__distro}" ]] && __distro="${uname}"
  __distro=$(echo "${__distro}" | tr "[:upper:]" "[:lower:]")

  if [[ "${__distro}" = "ubuntu" ]]; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      if ! dpkg-query -W -f='${Status}' lsb-release 2>/dev/null | grep -q "ok installed"; then
        echo "Installing lsb-release"
        ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install lsb-release
      fi
    fi
    if [[ -n "$(command -v lsb_release 2>/dev/null)" ]]; then
      __os_major_version=$(lsb_release -r | cut -d: -f2 | sed s/'^\t'// | cut -d. -f1)
      __os_minor_version=$(lsb_release -r | cut -d: -f2 | sed s/'^\t'// | cut -d. -f2)
    else
      __os_major_version=24  # Without sudo and lsb_release let's just skip the check
      __os_minor_version=04
    fi
  elif [[ "${__distro}" =~ "debian" ]]; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      if ! dpkg-query -W -f='${Status}' lsb-release 2>/dev/null | grep -q "ok installed"; then
        echo "Installing lsb-release"
        ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install lsb-release
      fi
    fi
    if [[ -n "$(command -v lsb_release 2>/dev/null)" && $(lsb_release -r | cut -f2 2>/dev/null) =~ ^[0-9]+$ ]]; then
      __os_major_version=$(lsb_release -r | cut -f2)
      __os_minor_version=0
    else
      __os_major_version=12  # Without sudo and lsb_release let's just skip the check
      __os_minor_version=0
    fi
  fi
}


__handle_docker() {
  local exitstatus
  local var
  local regex
  local message
  local use_podman=0
  local use_docker=0

  if [[ "${__distro}" =~ (debian|ubuntu) ]]; then
    set +e
    if dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed" \
         || dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      use_docker=1
    fi
    if dpkg-query -W -f='${Status}' podman 2>/dev/null | grep -q "ok installed"; then
      use_podman=1
    fi

    # If both are installed:
    # If DOCKER_SOCK is set to podman.sock, assume the user prefers podman
    # If service podman.socket is running, assume the user prefers podman
    # Otherwise, default to Docker
    if [[ "${use_docker}" -eq 1 && "${use_podman}" -eq 1 ]]; then
      echo "Both Docker and Podman are installed"
      echo "Guessing at user preference by \"DOCKER_SOCK\" in \".env\" and status of service podman.socket"
      var=DOCKER_SOCK
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" =~ podman.sock ]] || systemctl --user status podman.socket >/dev/null 2>&1 || systemctl status podman.socket >/dev/null 2>&1; then
        echo "Preferring Podman"
        echo
        use_docker=0
      else
        echo "Preferring Docker"
        echo
        use_podman=0
      fi
    fi

    if [[ "${use_docker}" -eq 1 ]]; then
      if ${__docker_exe} system info --format '{{json .SecurityOptions}}' | grep -qi rootless; then
        systemctl --user status docker >/dev/null 2>&1
        exitstatus=$?
        message="\"systemctl --user status docker\" and \"journalctl --user -fu docker\" will be helpful."
      else
        systemctl status docker >/dev/null 2>&1
        exitstatus=$?
        message="\"systemctl status docker\" and \"sudo journalctl -fu docker\" will be helpful."
      fi
      if [[ ! "${exitstatus}" -eq 0 ]]; then
        echo "The Docker daemon is not running. Please check Docker installation."
        echo "${message}"
        echo "Aborting."
        exit 1
      fi
    elif [[ "${use_podman}" -eq 1 ]]; then
      __docker_exe=podman
      __compose_exe="podman compose"
      if systemctl status podman.socket >/dev/null 2>&1; then  # User has enabled system socket, run podman with sudo.
        __docker_sudo="sudo"
      else
        systemctl --user status podman.socket >/dev/null 2>&1
        exitstatus=$?
        if [[ ! "${exitstatus}" -eq 0 ]]; then
          echo "The Podman socket service is not running. Please check Podman installation."
          echo "\"systemctl --user status podman.socket\" and \"journalctl --user -fu podman.socket\" will be helpful."
          echo "Aborting."
          exit 1
        fi
      fi
    else
      echo "Neither docker-ce, docker.io nor podman appear to be installed."
      echo "One of those is required to run ${__project_name}."
      echo "Aborting."
      exit 1
    fi
    set -e
    if ! dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed" \
         && ! dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      echo "WARNING: Neither docker-ce nor docker.io appear to be installed via apt."
      echo "The docker daemon is running. A non-packaged install is highly unusual and hard to maintain."
      echo "Please switch to docker-ce installed via the official Docker repo."
    fi
    if [[ -f "${__env_file}" ]]; then
      if [[ "${use_docker}" -eq 1 ]]; then
        LOG_DRIVER="json-file"
        LOG_TAG="'{{.ImageName}}|{{.Name}}|{{.ImageFullID}}|{{.FullID}}'"
      else
        LOG_DRIVER="journald"
        LOG_TAG="'{{.ImageName}}|{{.Name}}|{{.ID}}'"
      fi
      var=LOG_DRIVER
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" =~ ^(json-file|journald)$ ]]; then  # Leave user overrides alone
        __update_value_in_env "${var}" "${!var}" "${__env_file}"
      fi
      var=LOG_TAG
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "'{{.ImageName}}|{{.Name}}|{{.ImageFullID}}|{{.FullID}}'" || \
            "${__value}" = "'{{.ImageName}}|{{.Name}}|{{.ID}}'" ]]; then  # Leave user overrides alone
        __update_value_in_env "${var}" "${!var}" "${__env_file}"
      fi
    fi
  fi

  __docker_version=$(${__docker_exe} --version | awk '{ gsub(/,/, "", $3); print $3 }')
  __docker_major_version=$(echo "${__docker_version}" | awk '{ split($1, version, "."); print version[1]; }')
  __docker_minor_version=$(echo "${__docker_version}" | awk '{ split($1, version, "."); print version[2]; }')
  __docker_patch_version=$(echo "${__docker_version}" | awk '{ split($1, version, "."); print version[3]; }')

  if [[ "${use_docker}" -eq 1 && "${__docker_major_version}" -lt 23 ]]; then
  # Debian 12 has docker.io 20.10. From Debian 13, it's >= 26
  # Ubuntu has docker.io>= 27 from 22.04
  # The code to detect old docker.io can be removed when Debian 12 goes EOL in 2028
    __old_docker=1
  else
    __old_docker=0
  fi

# Warn user if their Docker-CE on Debian/Ubuntu is old. Maybe they're not updating.
  if [[ "${__distro}" =~ (debian|ubuntu) && "${__docker_exe}" = "docker" && "${__docker_major_version}" -lt "${__current_docker}" ]] \
        && dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
    __oldish_docker=1
  fi

  if ! ${__docker_sudo} ${__docker_exe} images >/dev/null 2>&1; then
    if [[ "${__cannot_sudo}" -eq 1 ]]; then
      echo "Cannot call ${__docker_exe} and cannot use sudo"
      if [[ "${__distro}" =~ (debian|ubuntu) && "${__docker_exe}" = "docker" ]]; then
        echo "Please make your user part of the docker group"
      fi
      exit 1
    fi
    echo "Will use sudo to access ${__docker_exe}"
    __docker_sudo="sudo"
  fi

  if [[ -f "${__env_file}" && "${__distro}" =~ (debian|ubuntu) ]]; then
    if [[ "${__docker_exe}" = "podman" ]]; then
      DOCKER_ROOT=$(__dodocker system info --format '{{.Store.GraphRoot}}')
    else
      DOCKER_ROOT=$(__dodocker system info --format '{{.DockerRootDir}}')
    fi
    var=DOCKER_ROOT
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ "${DOCKER_ROOT}" != "${__value}" ]]; then
      __update_value_in_env "${var}" "${!var}" "${__env_file}"
    fi

    # Determine the real mountpoint backing DOCKER_ROOT, so Grafana dashboards
    # can report disk usage for that filesystem instead of always "/"
    if command -v findmnt >/dev/null; then
      DOCKER_ROOT_MOUNTPOINT=$(findmnt -T "${DOCKER_ROOT}" -o TARGET -n)
    else
      DOCKER_ROOT_MOUNTPOINT=$(df --output=target "${DOCKER_ROOT}" | tail -1)
    fi
    var=DOCKER_ROOT_MOUNTPOINT
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ "${DOCKER_ROOT_MOUNTPOINT}" != "${__value}" ]]; then
      __update_value_in_env "${var}" "${!var}" "${__env_file}"
    fi

    # on macOS, user would set this manually to Colima or Docker Desktop value
    if [[ "${__docker_exe}" = "podman" ]]; then
      if [[ "$(__dodocker system info --format '{{.Host.Security.Rootless}}')" = "true" ]]; then
        DOCKER_SOCK=/run/user/$(id -u)/podman/podman.sock
      else
        DOCKER_SOCK=/run/podman/podman.sock
      fi
    else
      if __dodocker system info --format '{{.SecurityOptions}}' | grep -qi rootless; then
        DOCKER_SOCK=/run/user/$(id -u)/docker.sock
        if [[ "${__docker_major_version}" -lt 29 \
              || ( "${__docker_major_version}" -eq 29 && "${__docker_minor_version}" -lt 5 ) ]]; then
          __old_rootless_docker=1
        fi
      else
        DOCKER_SOCK=/var/run/docker.sock
      fi
    fi
    var=DOCKER_SOCK
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ "${DOCKER_SOCK}" != "${__value}" ]]; then
      __update_value_in_env "${var}" "${!var}" "${__env_file}"
    fi

    var=NODE_EXPORTER_IGNORE_MOUNT_REGEX
    __get_value_from_env "${var}" "${__env_file}" "__value"
# Match either of the patterns Eth Docker uses. Leave alone if there are user changes to the var
# Match literal `'^/(dev|proc|sys|run|some/path/.+)($|/)'` or `'^/(dev|proc|sys|run|var/snap/.+|some/path/.+)($|/)'
    regex="^'\^\/\(dev\|proc\|sys\|run\|(var\/snap\/\.\+\|)?[a-zA-Z/]+\/\.\+\)\(\\$\|\/\)'$"
    if [[ "${__value}" =~ ${regex} ]]; then
      NODE_EXPORTER_IGNORE_MOUNT_REGEX="'^/(dev|proc|sys|run|var/snap/.+|${DOCKER_ROOT#/}/.+)($|/)'"
      if [[ "${NODE_EXPORTER_IGNORE_MOUNT_REGEX}" != "${__value}" ]]; then
        __update_value_in_env "${var}" "${!var}" "${__env_file}"
      fi
    fi
  fi
}


# Allow users to set their own umask like 077, and make it x0x if we are going to rely on group write
__adjust_umask_for_group() {
  local current_umask
  local new_umask

  current_umask=$(umask)

  # split into 3 or 4 digits safely, set group to 0
  case ${#current_umask} in
    3) # ugo form
      u=${current_umask:0:1}
      g=0
      o=${current_umask:2:1}
      new_umask="${u}${g}${o}"
      ;;
    4) # sugo form
      s=${current_umask:0:1}
      u=${current_umask:1:1}
      g=0
      o=${current_umask:3:1}
      new_umask="${s}${u}${g}${o}"
      ;;
    *)
      echo "Umask is neither 3 nor 4 characters in length, which is unexpected. Not adjusting. Umask: ${current_umask}"
      new_umask="${current_umask}"
  esac

  umask "${new_umask}"
}


__mode_after_umask() {
  local mode="$1"
  local mask
  local adjusted

  mask=$(umask)
  adjusted=$(( 8#${mode} & (07777 ^ 8#${mask}) ))

  if [[ "${__group_can_write}" -eq 1 ]]; then
    (( adjusted & 0400 )) && adjusted=$(( adjusted | 0040 ))
    (( adjusted & 0200 )) && adjusted=$(( adjusted | 0020 ))
    (( adjusted & 0100 )) && adjusted=$(( adjusted | 0010 ))
  fi

  printf "%03o" "${adjusted}"
}


# Who owns the directory, what permissions do they have, and do we need to sudo -u ${__owner} when creating files
# Also, can we sudo
# Assume owner has rw on everything
# EUID is owner of directory: No umask adjustment, no sudo
# EUID is not owner of directory, but directory is group-writeable and EUID is in the group that can write:
#   change umask to not touch group perms
# Neither: sudo -u ${__owner}
# __owner and __owner_group are set at script entry and have the user:group owners of the directory
__handle_ownership() {
  local g
  local can_sudo=0
  local is_in_group=0
  local perms
  local group_w
  local sudo_group
  local reason_msg=""
  local action_msg=""

# shellcheck disable=SC2012
  perms=$(ls -ld . | awk '{print $1}')

  group_w="${perms:5:1}"
  if [[ "${group_w}" != "-" ]]; then
    __group_can_write=1
  fi

  for g in $(id -nG); do
    if [[ "${g}" = "${__owner_group}" ]]; then
      is_in_group=1
      break
    fi
  done

  if [[ "$OSTYPE" = "darwin"* ]]; then
    sudo_group="admin"
    __stat_mode_param=("-f" "%Lp")
  else
    sudo_group="sudo"
    __stat_mode_param=("-c" "%a")
  fi
# Figure out whether the user can sudo
  __cannot_sudo=1
  if [[ "${EUID}" -ne 0 ]]; then
    for g in $(id -nG); do
      if [[ "${g}" = "${sudo_group}" ]]; then
        __auto_sudo="sudo"
        __cannot_sudo=0
        break
      fi
    done
  else  # root always can
    __cannot_sudo=0
  fi

  if [[ "${EUID}" = $(id -u "${__owner}") ]]; then  # No adjustments needed
    __as_owner=""
    __new_owner="${__owner}"
  elif [[ "${__group_can_write}" -eq 1 && "${is_in_group}" -eq 1 ]]; then
    __adjust_umask_for_group  # Adjust umask to make sure files are group-writable
    __as_owner=""
    __new_owner="$(id -nu ${EUID})"
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      __chmod_sudo="sudo"
    fi
  else
    __as_owner="sudo -u ${__owner}"
    __new_owner="${__owner}"
    __chmod_sudo="sudo"
  fi

  if [[ -n "${__as_owner}" && "${__cannot_sudo}" -eq 1 ]]; then  # Have to sudo but can't
    if [[ "${is_in_group}" -eq 1 ]]; then
      reason_msg="and all of its groups "
      action_msg="or give write permissions to ${__owner_group}, "
    fi
    echo "The $(dirname "$(realpath "${BASH_SOURCE[0]}")") directory is owned by ${__owner}, the script runs as $(id -nu), and that user ${reason_msg}cannot write files in \
this directory, nor run \"sudo\"."
    echo "This means ${__me} cannot modify or create files, which keeps it from working."
    echo "Please run ${__me} as ${__owner}, ${action_msg}or make $(id -nu) part of the ${sudo_group} group."
    echo "Aborting."
    exit 1
  fi
}


__upgrade_docker() {
  local runc_version
  local runc_major_version
  local runc_minor_version
  local runc_patch_version
  local runc_dpkg_version
  local runc_fixed_version
  local yn

  if [[ -z "${ETHDSECUNDO:-}" && "${__command}" = "update" ]]; then  # Run this after getting the new ethd
    return
  fi

# A vulnerable runc may be found in Debian <= 13 or Ubuntu <= 24.04
# The Debian code can be removed when Debian 13 goes EOL in 2030.
# The Ubuntu code can be removed when Ubuntu 24.04 goes EOL in 2029.
  if (( __docker_major_version < 28 )) ||
      (( __docker_major_version == 28 && __docker_minor_version < 5 )) ||
      (( __docker_major_version == 28 && __docker_minor_version == 5 && __docker_patch_version < 2 )); then
    runc_version=$(runc --version | awk '{ gsub(/[-\+~]/, " ", $3); $0=$0; print $3 }')
    runc_major_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[1]; }')
    runc_minor_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[2]; }')
    runc_patch_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[3]; }')

    if [[ "${__distro}" =~ (ubuntu|debian) ]]; then
      if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
        if [[ "${__distro}" =~ debian ]]; then
          if [[ "${__os_major_version}" -gt 13 ]]; then  # Assume Debian 14 and up are fine
            return
          fi
          runc_dpkg_version=$(dpkg-query -W -f='${Version}\n' runc)
          case ${__os_major_version} in
# These fixed versions are a guess and have not been released
            13) runc_fixed_version="1.1.15+ds1-2+deb13u1";;
            12) runc_fixed_version="1.1.5+ds1-1+deb12u2";;  # I don't expect to hit this, because docker.io is old
            *) echo "Cannot check runc on Debian ${__os_major_version}. Please update to ${__min_debian} or later"; return;;
          esac
          if dpkg --compare-versions "${runc_dpkg_version}" lt "${runc_fixed_version}"; then
            echo
            echo "Docker ${__docker_version} with runc ${runc_version} detected"
            echo "This version of runc is vulnerable"
            echo "If an updated version of runc is available, please install it"
            echo "Alternatively, consider uninstalling runc and replacing it with crun"
# Commented out until fixed versions have actually been released
#              if [[ "${__non_interactive}" -eq 0 ]]; then
#                while true; do
#                  read -rp "Do you want to update runc (yes/no) " yn
#                  case "${yn}" in
#                    [Nn]*) echo "Please be sure to update runc yourself!"; return;;
#                    *)
#                      ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade runc
#                      break
#                      ;;
#                  esac
#                done
#              fi
          fi
        else  # This is Ubuntu and they fixed it with runc 1.3.3
          if (( runc_major_version == 1 &&  runc_minor_version < 3 )) ||
              (( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
            echo
            echo "Docker ${__docker_version} with runc ${runc_version} detected"
            echo "This version of runc is vulnerable"
            __nag_os_version
            if [[ "${__eol_os}" -eq 1 ]]; then
              echo "${__project_name} cannot update runc on Ubuntu ${__os_major_version}."
              return
            fi
            echo "It is recommended that you update runc"
            if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
              while true; do
                read -rp "Do you want to update runc (yes/no) " yn
                case "${yn}" in
                  [Nn]*) echo "Please be sure to update runc yourself!"; return;;
                  *)
                    ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade runc
                    break
                    ;;
                esac
              done
            fi
          fi
        fi
      elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
        echo
        echo "Docker ${__docker_version} detected"
        echo "This version of Docker has a vulnerable runc binary"
        __nag_os_version
        if [[ "${__eol_os}" -eq 1 ]]; then
          echo "${__project_name} cannot update Docker-CE on ${__distro} ${__os_major_version}."
          return
        fi
        echo "It is recommended that you update Docker-CE"
        if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
          while true; do
            read -rp "Do you want to update Docker-CE? (yes/no) " yn
            case "${yn}" in
              [Nn]*) echo "Please be sure to update Docker CE yourself!"; return;;
              *)
                ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade docker-ce containerd.io
                break
                ;;
            esac
          done
        fi
      fi
    else
      if (( runc_major_version == 1 && runc_minor_version < 2 )) ||
          (( runc_major_version == 1 && runc_minor_version == 2 && runc_patch_version < 8 )) ||
          (( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
        echo
        echo "Docker ${__docker_version} with runc ${runc_version} detected"
        echo "This version of runc may be vulnerable, but ${__project_name} cannot update it on ${__distro}"
      fi
    fi
  fi
}


__upgrade_compose() {
  if ! type -P docker-compose >/dev/null 2>&1; then
    echo "Docker Compose has already been updated to V2"
    return
  fi
  echo "Updating Docker Compose to V2"
  if [[ "${__distro}" = "ubuntu" ]]; then
    __nag_os_version
    if [[ "${__eol_os}" -eq 1 ]]; then
      echo "${__project_name} cannot update Docker Compose on Ubuntu ${__os_major_version}."
      exit 1
    fi
    ${__auto_sudo} apt-get update
    ${__auto_sudo} apt-get install -y docker-compose-v2 docker-buildx
    echo "Installed docker-compose-v2"
    __old_compose=0
    __compose_upgraded=1
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      ${__auto_sudo} apt-mark manual docker.io
    elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
      ${__auto_sudo} apt-mark manual docker-ce
    fi
    ${__auto_sudo} apt-get remove -y docker-compose
    echo "Removed docker-compose"
  elif [[ "${__distro}" =~ "debian" ]]; then
    ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install ca-certificates curl gnupg
    __nag_os_version
    if [[ "${__eol_os}" -eq 1 ]]; then
      echo "${__project_name} cannot update Docker Compose on Debian ${__os_major_version}."
      exit 1
    fi
    ${__auto_sudo} install -m 0755 -d /etc/apt/keyrings
    ${__auto_sudo} curl -fsSL https://download.docker.com/linux/debian/gpg -o /etc/apt/keyrings/docker.asc
    ${__auto_sudo} chmod a+r /etc/apt/keyrings/docker.asc
    ${__auto_sudo} tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/debian
Suites: $(. /etc/os-release && echo "$VERSION_CODENAME")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
    ${__auto_sudo} apt-get update
    ${__auto_sudo} apt-get install -y docker-compose-plugin docker-buildx-plugin
    echo "Installed docker-compose-plugin"
    __old_compose=0
    __compose_upgraded=1
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
        ${__auto_sudo} apt-mark manual docker.io
    elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
        ${__auto_sudo} apt-mark manual docker-ce
    fi
    ${__auto_sudo} apt-get remove -y docker-compose
    echo "Removed docker-compose"
  else
    echo "${__project_name} does not know how to update Docker Compose on ${__distro}"
  fi
}


# Always called after __handle_docker, so that ${__docker_sudo} is set
__check_compose_version() {
  local yn

# Compose V1 is in Debian 12. The Debian-specific code can be removed when Debian 12 goes EOL in 2028.
# Compose V1 is in Ubuntu 22.04 and 24.04. The Compose version check can be removed when Ubuntu 24.04 goes EOL in 2029.

# Check for Compose V2+ (docker compose) vs Compose V1 (docker-compose)
  if ${__docker_sudo} ${__docker_exe} compose version >/dev/null 2>&1; then
    __compose_version=$(${__docker_sudo} ${__docker_exe} compose version | sed -n -E -e "s/.*version [v]?([0-9.-]*).*/\1/ip")
    __compose_major=${__compose_version%%.*}
    __compose_minor=${__compose_version#*.}
    __compose_minor=${__compose_minor%%.*}
   if [[ "${__compose_major}" -eq 1 ]]; then
     __old_compose=1
   elif [[ "${__compose_major}" -eq 2 && "${__compose_minor}" -lt 18 ]]; then
     __old_compose=1
   fi
  elif ${__docker_sudo} docker-compose --version >/dev/null 2>&1; then
    __old_compose=1
    __compose_version=$(${__docker_sudo} docker-compose --version | sed -n -E -e "s/.*version [v]?([0-9.-]*).*/\1/ip")
    __compose_major=${__compose_version%%.*}
    __compose_minor=${__compose_version#*.}
    __compose_minor=${__compose_minor%%.*}
  else
    echo "Unable to find ${__docker_exe} compose. Please be sure it's installed"
    echo "Aborting"
    exit 1
  fi

  if [[ "${__compose_major}" -gt 1 ]]; then
    return
  fi

  # This runs before the actual update command, in the main section. ethd exits if it can't upgrade, therefore
  # no check for ${ETHDSECUNDO} or command update, here
  echo
  echo "You are using docker-compose ${__compose_version}, which is unsupported by Docker, Inc."
  echo "${__project_name} only supports Compose V2."
  echo
  if [[ "${__distro}" = "ubuntu" ]]; then
    echo "It is recommended that you replace Compose V1 with Compose V2."
    if [[ "${__non_interactive}" -eq 0 && "${__cannot_sudo}" -eq 0 ]]; then
      while true; do
        read -rp "Do you want to update Docker Compose to V2? (yes/no) " yn
        case "${yn}" in
          [Nn]*)
            echo "Please be sure to update Docker Compose yourself!"
            echo "You can install it with \"sudo apt update && sudo apt install docker-compose-v2\"."
            echo "You can remove the old docker-compose:"
            echo "\"sudo apt-mark manual docker.io && sudo apt --autoremove remove docker-compose\""
            break
            ;;
          *) __upgrade_compose; break;;
        esac
      done
    fi
  elif [[ "${__distro}" =~ debian ]]; then
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      if [[ "${__os_major_version}" -lt 13 ]]; then
        echo "Debian ${__os_major_version}'s docker.io does not ship with Compose V2. Please replace docker.io with docker-ce"
        echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
      else
        echo "Debian ${__os_major_version} ships with Compose V2."
        echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
        echo "Please come to EthCoördinate Discord: https://discord.gg/ethstaker"
      fi
    else
      echo "You appear to be using Docker CE, which ships with Compose V2."
      echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
      echo "Please come to EthCoördinate Discord: https://discord.gg/ethstaker"
    fi
  else
    echo "${__project_name} does not know how to update Docker Compose on ${__distro}"
  fi
}


__check_traefik_version() {
  local traefik_major
  local traefik_minor
  local traefik_patch
  local version

  if [[ ! "${COMPOSE_FILE}" =~ (traefik-cf\.yml|traefik-aws\.yml) ]]; then
    return 0
  fi

  var=TRAEFIK_TAG
  __get_value_from_env "${var}" "${__env_file}" "__traefik_tag"

  if [[ ! "${__traefik_tag}" =~ ^v[0-9]+\.[0-9]+(\.[0-9]+)?$  ]]; then  # Can't parse this
    return 0
  fi

  version=${__traefik_tag#v}
  traefik_major=${version%%.*}
  traefik_minor=${version#*.}
  traefik_minor=${traefik_minor%%.*}

  if [[ "${traefik_major}" -lt 3 || ( "${traefik_major}" -eq 3 && "${traefik_minor}" -le 5 ) ]]; then
    __old_traefik=1
  fi

# In the unlikely case a user pinned v3.6.0
  if [[ "${traefik_major}" -eq 3 && "${traefik_minor}" -eq 6 ]]; then
    if [[ "${version}" = *.*.* ]]; then
      traefik_patch=${version##*.}
      if [[ "${traefik_patch}" -eq 0 ]]; then
        __old_traefik=1
      fi
    fi
  fi
}


__prep_conffiles() {
  local env
  local file
  local dir
  local mode
  local -A create_files=(
    [./prometheus/prometheus.yml]="./prometheus/prometheus.yml.sample"
    [./alloy/loki-write.alloy]="./alloy/loki-write.alloy.sample"
    [./alloy/prometheus-write.alloy]="./alloy/prometheus-write.alloy.sample"
    [./alloy/alloy-logs.alloy]="./alloy/alloy-logs.alloy.sample"
    [./ssv-config/config.yaml]="./ssv-config/config.yaml.sample"
    [./ssv-config/dkg-config.yaml]="./ssv-config/dkg-config.yaml.sample"
    [./commit-boost/cb-config.toml]="./commit-boost/cb-config.toml.sample"
    [./tempo/tempo.yaml]="./tempo/tempo.yaml.sample"
    [./.motd]="./.motd.sample"
  )
  local -A chmod_dirs=(
    [./prometheus]="*.yml"
    [./alloy]="*.alloy"
    [./alloy-obol]="*.alloy"
    [./ssv-config]="*.yaml"
    [./.eth/dkg_output]="*"
    [./commit-boost]="cb-config.toml"
    [./tempo]="*.yaml"
    [./loki]="*.yml"
    [./siren]="*.sh"
  )

# Create configuration files if they do not exist
  for file in "${!create_files[@]}"; do
    if [[ ! -f "${file}" ]]; then
      mode=$(${__as_owner} stat "${__stat_mode_param[@]}" "${create_files[${file}]}")
      mode=$(__mode_after_umask "${mode}")
      ${__as_owner} install -g "${__owner_group}" -o "${__new_owner}" -m "${mode}" "${create_files[${file}]}" "${file}"
    fi
  done

# Make sure directory owner owns the SSV dkg output dir and everything in it. ssvlabs/ssv-dkg runs as root
  if ${__as_owner} find ./.eth/dkg_output \( \! -user "${__owner}" -o \! -group "${__owner_group}" \) -print -quit | grep -q .; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      echo "Fixing ownership of .eth/dkg_output"
      ${__auto_sudo} chown -R "${__owner}:${__owner_group}" .eth/dkg_output
      ${__chmod_sudo} chmod u+rwx,o+rx .eth/dkg_output
    else
      echo "Ownership of .eth/dkg_output should be fixed, but this user can't sudo"
    fi
  fi

# Adjust "other" read permissions for files that are bind-mounted
  for dir in "${!chmod_dirs[@]}"; do
# shellcheck disable=SC2086
     find "${dir}" -type d \! -perm -o+rx -exec ${__chmod_sudo} chmod o+rx {} +
# shellcheck disable=SC2086
     find "${dir}" -type f -name "${chmod_dirs[${dir}]}" \! -perm -o+r -exec ${__chmod_sudo} chmod o+r {} +
  done

# Make sure directory owner owns .env, or it's owned by directory group and group is writable
  if ! ${__as_owner} test -f "${__env_file}" || ${__as_owner} find . -maxdepth 1 -name "${__env_file}" -user "${__owner}" -print -quit | grep -q "${__env_file}" \
    || { ${__as_owner} find . -maxdepth 1 -name "${__env_file}" -group "${__owner_group}" -print -quit | grep -q "${__env_file}" \
          && [[ "${__group_can_write}" -eq 1 ]]; }; then
    true  # Nothing to do
  else
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      echo "Fixing ownership of ${__env_file}"
      ${__auto_sudo} chown -R "${__owner}:${__owner_group}" "${__env_file}"
      if [[ ${__group_can_write} -eq 1 ]]; then
        ${__chmod_sudo} chmod ug+rw "${__env_file}"
      else
        ${__chmod_sudo} chmod u+rw "${__env_file}"
      fi
      if [[ -f ${__env_file}.tmp ]]; then
        ${__auto_sudo} rm -f "${__env_file}".tmp
      fi
    else
      echo "Ownership of ${__env_file} should be fixed, but this user can't sudo"
    fi
  fi
  if [[ "${__group_can_write}" -eq 1 ]] && find . -maxdepth 1 -name "${__env_file}" \! -perm -g+rw -print -quit | grep -q "${__env_file}"; then
    ${__chmod_sudo} chmod g+rw "${__env_file}"
  fi
}


__check_for_snap() {
  if [[ "${__distro}" = "ubuntu" && -n "$(command -v snap)" ]] && snap list 2>/dev/null | grep -qw 'docker'; then
    echo
    echo "WARNING! Snap Docker package detected. This WILL result in issues."
    echo "Removing the package will delete volumes and require a resync."
    echo
    echo "Doing so is still highly recommended however."
    echo
    echo "The exact steps depend a little on whether there already is an apt version of Docker installed as well,"
    echo "but in a nutshell \"${__me} stop\" followed by \"sudo snap remove --purge docker\" followed by a reboot,"
    echo "and as needed install docker-ce or docker.io with apt."
    echo
    echo "Do join us on EthCoördinate Discord at https://discord.gg/ethstaker to work through this issue."
    echo
    echo "Aborting, this is not safe"
    exit 1
  fi
}


__install_bash_completions() {
  if [[ "$OSTYPE" = "darwin"* ]]; then
    echo "Skipping installation of tab completions (not supported on macOS)"
  else
    if [[ ! -f "$(pkg-config --variable=completionsdir bash-completion)/ethd" ]]; then
      echo "Installing bash completions for ethd"
      ${__auto_sudo} ln -sf "$(dirname "$(realpath "${BASH_SOURCE[0]}")")/bash-completion" \
      "$(pkg-config --variable=completionsdir bash-completion)/ethd" || true
    fi
  fi
}


# Persist noatime in fstab for a given mount point
__fstab_noatime() {
  local mountpoint="$1"
  local fstab="/etc/fstab"
  local backup="${fstab}.bak"
  local noatime="${fstab}.noatime"

  # Check if fstab already has an entry for this mountpoint
  if grep -E "^[^#].*\s${mountpoint//\//\\/}(\s|\$)" "${fstab}" >/dev/null; then
    echo
    echo "Found ${fstab} entry for ${mountpoint}, creating a version with \"noatime\""
    echo

    ${__auto_sudo} cp ${fstab} ${backup}
    # Edit the existing line: add noatime if not already there
    awk -v mountpoint="${mountpoint}" '
    /^[ \t]*#/ || NF < 6 { print; next }
    {
        line = $0
        split(line, fields, /[ \t]+/)
        mount = fields[2]
        opts = fields[4]

        if (mount == mountpoint && opts !~ /(^|,)noatime(,|$)/) {
            # Match the byte offset of the first four fields
            match(line, /^[ \t]*[^ \t]+[ \t]+[^ \t]+[ \t]+[^ \t]+[ \t]+/)
            prefix = substr(line, 1, RLENGTH)
            rest = substr(line, RLENGTH + 1)

            # Extract first word from rest (the options field)
            match(rest, /^[^ \t]+/)
            opts_field = substr(rest, RSTART, RLENGTH)
            opts_field = opts_field ",noatime"

            suffix = substr(rest, RSTART + RLENGTH)
            line = prefix opts_field suffix
        }

        print line
    }' "${fstab}" | ${__auto_sudo} tee "${noatime}" >/dev/null
    ${__auto_sudo} chmod 664 "${noatime}"
    echo "${fstab} has not been altered. A backup copy is in ${backup}"
    echo "If the below diff looks good to you, you can \"sudo cp ${noatime} ${fstab}\""
    echo "followed by \"sudo mount -o remount ${mountpoint}\" to verify everything still works."
    echo
    echo "Note: You may see a warning suggesting 'systemctl daemon-reload'. This is only relevant"
    echo "for systemd's internal mount unit management and does not affect the active mount options"
    echo "applied via 'mount'."
    echo
    diff ${fstab} ${noatime} || true
  else
    echo "No ${fstab} entry for ${mountpoint} — not adding one automatically."
    echo "Manual intervention required for \"noatime\" persistence."
  fi
}


__optimize_chrony() {
  local file
  local new_file

  if [[ -f /etc/chrony/chrony.conf && -d /etc/chrony/sources.d ]]; then
    echo
    echo "Configuring chrony to use Google's time-smearing servers"
    if ! ${__auto_sudo} sed -Ei.bak '/^\s*(pool|server|leapsectz|leapseclist|leapsecmode)\b/ s/^/#/' "/etc/chrony/chrony.conf"; then
      echo "Failed to alter /etc/chrony/chrony.conf"
      echo "Manual intervention is required to use Google's time-smearing servers with chrony"
      return 0
    fi
    if ! ${__auto_sudo} tee "/etc/chrony/conf.d/ignore-leapsec.conf" >/dev/null <<EOF
# Ignore any leap seconds. Meant to be used with Google's time smearing servers, see sources.d
leapsecmode ignore
EOF
    then
      echo "Failed to write to /etc/chrony/conf.d/ignore-leapsec.conf"
      echo "Manual intervention is required to use Google's time-smearing servers with chrony"
      return 0
    fi

    while IFS= read -r -d '' file; do
      new_file="${file}.bak"
      if ! ${__auto_sudo} mv "${file}" "${new_file}"; then
        printf "Failed to rename %s to %s\n" "${file}" "${new_file}"
        return 0
      fi
    done < <(find "/etc/chrony/sources.d" -maxdepth 1 -type f -name '*.sources' -print0)
    if ! ${__auto_sudo} tee "/etc/chrony/sources.d/google-ntp.sources" >/dev/null <<EOF
# Google's time-smearing NTP servers
# Requires leapsectz and leapseclist in chrony.conf to be commented out or not exist
pool time.google.com iburst minpoll 4 maxpoll 6 polltarget 16
EOF
    then
      echo "Failed to write Google servers to /etc/chrony/sources.d/google-ntp.sources"
      echo "Manual intervention is required to use Google's time-smearing servers with chrony"
      return 0
    fi
    if ! ${__auto_sudo} systemctl restart chrony; then
      echo "Failed to restart the chrony service"
      echo "Manual intervention is required to have it use the new configuration"
    fi
  fi
}


# Apply common performance optimizations on behalf of the user
__optimize_host() {
  local docker_root
  local docker_mount
  local docker_mount_opts
  local exitstatus
  local swappiness
  local cache_pressure
  local target_pressure
  local memtotal

  echo
  if dpkg-query -W -f='${Status}' podman 2>/dev/null | grep -q "ok installed"; then
    docker_root=$(__dodocker system info --format '{{.Store.GraphRoot}}')
  else
    docker_root=$(__dodocker system info --format '{{.DockerRootDir}}')
  fi
  if command -v findmnt >/dev/null; then
    docker_mount=$(findmnt -T "${docker_root}" -o TARGET -n)
    docker_mount_opts=$(findmnt -T "${docker_root}" -o OPTIONS -n 2>/dev/null)
  else
    docker_mount=$(df --output=target "${docker_root}" | tail -1)
    docker_mount_opts=$(awk -v path="${docker_mount}" '$2 == path {print $4}' /proc/mounts)
  fi
  if [[ "${docker_mount_opts}" == *noatime* ]]; then
    echo "\"noatime\" already set on ${docker_mount}"
  else
    echo "Remounting ${docker_mount} with \"noatime\""
    ${__auto_sudo} mount -o remount,noatime "${docker_mount}" || true
    exitstatus=$?
    if [[ ${exitstatus} -eq 0 ]]; then
      __fstab_noatime "${docker_mount}"
    else
      echo "Applying \"noatime\" to ${docker_mount} failed"
    fi
  fi

  swappiness=$(${__auto_sudo} sysctl -n vm.swappiness)
  if [[ "${swappiness}" -gt 1 ]]; then
    echo "Adjusting swappiness down to 1 from ${swappiness}"
    ${__auto_sudo} sysctl -w vm.swappiness=1
    if [[ -d /etc/sysctl.d ]]; then
      echo "Persisting vm.swappiness=1 in /etc/sysctl.d/10-swappiness.conf"
      echo "vm.swappiness=1" | ${__auto_sudo} tee /etc/sysctl.d/10-swappiness.conf >/dev/null
    elif [[ -f /etc/sysctl.conf ]]; then
      if ! grep -E '^\s*vm\.swappiness\s*=' /etc/sysctl.conf >/dev/null; then
        echo "Appending vm.swappiness=1 to /etc/sysctl.conf"
        echo "vm.swappiness=1" | ${__auto_sudo} tee -a /etc/sysctl.conf > /dev/null
      else
        echo "vm.swappiness is already set in /etc/sysctl.conf"
      fi
    else
      echo "Unable to find /etc/sysctl.conf or /etc/sysctl.d"
      echo "Manual intervention is required to set swappiness permanently"
    fi
  fi

  cache_pressure=$(${__auto_sudo} sysctl -n vm.vfs_cache_pressure)
  memtotal=$(awk '/MemTotal/ {printf "%d", int($2/1024/1024)}' /proc/meminfo)
  if [[ "${memtotal}" -ge 60 ]]; then
    target_pressure=10
  elif [[ "${memtotal}" -ge 30 ]]; then
    target_pressure=25
  else
    target_pressure=50
  fi

  if [[ "${cache_pressure}" -gt "${target_pressure}" ]]; then
    echo "Adjusting vfs_cache_pressure down to ${target_pressure} from ${cache_pressure}"
    ${__auto_sudo} sysctl -w vm.vfs_cache_pressure="${target_pressure}"
    if [[ -d /etc/sysctl.d ]]; then
      echo "Persisting vm.vfs_cache_pressure=${target_pressure} in /etc/sysctl.d/10-vfs_cache_pressure.conf"
      echo "vm.vfs_cache_pressure=${target_pressure}" | ${__auto_sudo} tee /etc/sysctl.d/10-vfs_cache_pressure.conf >/dev/null
    elif [[ -f /etc/sysctl.conf ]]; then
      if ! grep -E '^\s*vm\.vfs_cache_pressure\s*=' /etc/sysctl.conf >/dev/null; then
        echo "Appending vm.vfs_cache_pressure=${target_pressure} to /etc/sysctl.conf"
        echo "vm.vfs_cache_pressure=${target_pressure}" | ${__auto_sudo} tee -a /etc/sysctl.conf > /dev/null
      else
        echo "vm.vfs_cache_pressure is already set in /etc/sysctl.conf"
      fi
    else
      echo "Unable to find /etc/sysctl.conf or /etc/sysctl.d"
      echo "Manual intervention is required to set vfs_cache_pressure permanently"
    fi
  fi

  __optimize_chrony

  return 0
}


__install_docker() {
  local repo
  local user

  if [[ "${__distro}" = "ubuntu" ]]; then
    repo=ubuntu
  elif [[ "${__distro}" =~ debian ]]; then
    repo=debian
  else
    echo
    echo "__install_docker() was called on ${__distro}, which is neither Debian nor Ubuntu."
    echo "This is a bug."
    exit 70
  fi

  if dpkg-query -W -f='${Status}' podman 2>/dev/null | grep -q "ok installed"; then
    echo "Found podman. Will not install Docker, as it would conflict."
    return
  fi

  if [[ -z "$(command -v docker)" ]]; then
    ${__auto_sudo} install -m 0755 -d /etc/apt/keyrings
    ${__auto_sudo} curl -fsSL https://download.docker.com/linux/${repo}/gpg -o /etc/apt/keyrings/docker.asc
    ${__auto_sudo} chmod a+r /etc/apt/keyrings/docker.asc
    ${__auto_sudo} tee /etc/apt/sources.list.d/docker.sources <<EOF
Types: deb
URIs: https://download.docker.com/linux/${repo}
Suites: $(. /etc/os-release && echo "${UBUNTU_CODENAME:-${VERSION_CODENAME}}")
Components: stable
Architectures: $(dpkg --print-architecture)
Signed-By: /etc/apt/keyrings/docker.asc
EOF
    ${__auto_sudo} apt-get update
    ${__auto_sudo} apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin \
      docker-buildx-plugin
    ${__auto_sudo} systemctl start systemd-logind
    echo "Installed docker-ce and docker-compose-plugin"
  else
    echo "Docker is already installed"
  fi

  user="${SUDO_USER:-$(id -nu)}"
  if ! id -nG "${user}" | grep -qw docker; then
    echo "Making your user part of the docker group"
    ${__auto_sudo} usermod -aG docker "${user}"
    echo "Please log out and back in or run \"sudo su - $(id -un)\""
  else
    echo "Your user is already part of the docker group"
  fi

  return 0
}


install_command() {
  local yn
  local project_dir

  if [[ ! "${__distro}" =~ (ubuntu|debian) ]]; then
    echo "${__project_name} does not know how to install Docker on ${__distro}"
    return 0
  fi

  __nag_os_version
  if [[ "${__eol_os}" -eq 1 ]]; then
    echo "${__project_name} requires an upgraded Linux distribution to run install."
    return 0
  fi

  if [[ "${__cannot_sudo}" -eq 1 ]]; then
    echo "The install command requires the user to be part of the sudo group, or on macOS the admin group"
    return 0
  fi

  echo "Installing packages that ${__project_name} requires or considers helpful"
  echo
  ${__auto_sudo} apt-get update
  ${__auto_sudo} apt-get install -y ca-certificates curl gnupg whiptail chrony pkg-config screen ncdu gzip speedtest-cli jq iputils-ping

  echo
  read -rp "Do you want to install Docker and make your user part of the docker group? (no/yes) " yn
  case "${yn}" in
    [Yy]*) __install_docker;;
    *) ;;
  esac

  if [[ -n "$(command -v docker)" ]]; then
    __handle_docker
  else
    echo "${__project_name} requires Docker to be present to continue with install steps."
    echo "Please install Docker and run \"${__me} install\" again."
    return 0
  fi

  echo
  read -rp "Do you want ${__project_name} to apply common performance optimizations? (no/yes) " yn
  case "${yn}" in
    [Yy]*) __optimize_host;;
    *) ;;
  esac

  __install_bash_completions

  if ! grep -q "alias ethd" ~/.profile; then  # If an alias already exists, don't touch it
    echo
    read -rp "Do you want to be able to call 'ethd' from anywhere? (yes/no) " yn
    case "${yn}" in
      [Nn]*) return 0;;
      *) ;;
    esac
    project_dir=$(dirname "$(realpath "${BASH_SOURCE[0]}")")
    echo "alias ethd=$(realpath "${BASH_SOURCE[0]}")" >>~/.profile
    echo "cat \"${project_dir}\"/.motd" >>~/.profile
    if [[ ! -f ./.motd ]]; then  # Also in __prep_conffiles, be doubly sure
      ${__as_owner} cp ./.motd.sample ./.motd
    fi
    local escaped="${project_dir//\\/\\\\}"
    escaped="${escaped//&/\\&}"
    ${__as_owner} sed -i'.original' $'s\x01~/eth-docker\x01'"${escaped}"$'\x01' ./.motd
    ${__as_owner} rm -f ./.motd.original
    echo "Go ahead and 'source ~/.profile' or log out and back in."
    echo "After that, you can use the command 'ethd'."
  fi

  return 0
}


# set global __free_space to what's available to Docker
__get_docker_free_space() {
  local regex

  if [[ "$OSTYPE" = "darwin"* ]]; then  # macOS doesn't expose docker root dir to the OS
    __free_space=$(__dodocker run --rm -v macos-space-check:/dummy busybox df -P /dummy | awk '/[0-9]%/{print $(NF-2)}')
  else
    if [[ "${__docker_exe}" = "podman" ]]; then
      __docker_dir=$(__dodocker system info --format '{{.Store.GraphRoot}}')
    else
      __docker_dir=$(__dodocker system info --format '{{.DockerRootDir}}')
    fi
    __free_space=$(${__docker_sudo} df -P "${__docker_dir}" | awk '/[0-9]%/{print $(NF-2)}')  # Allow for rootful podman
  fi

  regex='^[0-9]+$'
  if [[ ! "${__free_space}" =~ ${regex} ]] ; then
    echo "Unable to determine free disk space. This is likely to be a bug."
    if [[ "$OSTYPE" = "darwin"* ]]; then
      echo "df reports $(__dodocker run --rm -v macos-space-check:/dummy busybox df -P /dummy) and __free_space is ${__free_space}"
    else
      echo "df reports $(${__docker_sudo} df -P "${__docker_dir}") and __free_space is ${__free_space}"  # Allow for rootful podman
    fi
    exit 70
  fi
}


__display_docker_dir() {
  if [[ "$OSTYPE" = "darwin"* ]]; then  # macOS doesn't expose docker root dir to the OS
    echo "Here's total and used space on Docker's virtual volume"
    __dodocker run --rm -v macos-space-check:/dummy busybox df -h /dummy
  else
    echo "Here's total and used space on ${__docker_dir}"
    ${__docker_sudo} df -h "${__docker_dir}"  # Allow for rootful podman
  fi
}


__display_docker_volumes() {
  echo
  # Assume project name and volume are delimited by _ and there is no _ in the volume name. Done to avoid catching project-2 while looking at project
  if [[ -z "$(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_[^_]+$")" ]]; then
    echo "There are no Docker volumes for this copy of ${__project_name}"
    echo
  else
    echo "Here are the Docker volumes used by this copy of ${__project_name} and their space usage:"
    __dodocker system df -v | grep -A 500 "VOLUME NAME" | grep -iE "^$(basename "$(dirname "$(realpath "${BASH_SOURCE[0]}")")")_[^_]+$"
    echo
    echo "If your Consensus Layer client takes more than 300 GiB, you can resync it with"
    echo "\"${__me} resync-consensus\"."
    echo
  fi
  if command -v ncdu >/dev/null 2>&1; then
    echo "If there is some mystery space being taken up, try \"sudo ncdu /\"."
  else
    echo "If there is some mystery space being taken up, install ncdu, then try \"sudo ncdu /\"."
    if [[ "$OSTYPE" == "darwin"* ]]; then
      echo "To install ncdu, run \"brew install ncdu\"."
    elif [[ "${__distro}" =~ (ubuntu|debian) ]]; then
      echo "To install ncdu, run \"sudo apt update && sudo apt install ncdu\"."
    else
      echo "How to install ncdu will be specific to your distribution ${__distro}."
    fi
  fi
  echo
}


space() {
  local var

  __get_docker_free_space
  echo
  if [[ "$OSTYPE" = "darwin"* ]]; then # macOS doesn't expose docker root dir to the OS
    echo "You have $(( __free_space / 1024 / 1024 )) GiB free for Docker volumes"
  else
    echo "You have $(( __free_space / 1024 / 1024 )) GiB free on ${__docker_dir}"
  fi
  echo
  __display_docker_dir
  __display_docker_volumes

  var=ANCIENT_DIR
  __get_value_from_env "${var}" "${__env_file}" "ANCIENT_DIR"
  if [[ -n "${ANCIENT_DIR}" ]]; then
    echo
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      ${__auto_sudo} du -sh "${ANCIENT_DIR}"
    else
      echo "Your user cannot sudo. ${__project_name} cannot show the size of ${ANCIENT_DIR}."
    fi
  fi
}


# Warn user if space is low, so they can prune
# This runs after any ethd command: It is safe to assign to uppercase vars
__check_disk_space() {
  local low=0
  min_free=314572800
  min_gib=300
  safe_prune=250

  __get_docker_free_space

  if [[ ! -f "${__env_file}" ]]; then
    if [[ "${__free_space}" -lt 52428800 ]]; then
      echo
      echo "You have less than 50 GiB of free disk space:"
      echo
      __display_docker_dir
      __display_docker_volumes
    fi
    return 0
  fi

  __value="${COMPOSE_FILE}"
  var="AUTOPRUNE_NM"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
  var="NETWORK"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "${var}"

  if [[ "${NETWORK}" =~ ^(mainnet|gnosis)$ ]]; then
    min_free=314572800
    min_gib=300
    safe_prune=250
  else
    min_free=31457280
    min_gib=30
    safe_prune=25
  fi

  if [[ "${__value}" =~ nethermind\.yml && "${__free_space}" -lt "${min_free}" ]]; then
    low=1
    echo
    echo "You are running Nethermind and have less than ${min_gib} GiB of free disk space."
# shellcheck disable=SC2154
    if [[ "${AUTOPRUNE_NM}" = true ]]; then
      echo "It should currently be auto-pruning, check logs with \"${__me} logs -f --tail 500 execution | grep \
Full\". Free space:"
    else
      echo "If the below reads above ${safe_prune} GiB free, prune it with \"${__me} prune-nethermind\""
    fi
    echo
    __display_docker_dir
    __display_docker_volumes
  elif [[ "${__value}" =~ geth\.yml && "${__free_space}" -lt 104857600 ]]; then
    low=1
    echo
    echo "You are running Geth and have less than 100 GiB of free disk space."
    echo "You may resync from scratch to use PBSS and slow on-disk DB growth, with \"${__me} resync-execution\"."
    echo
    __display_docker_dir
    __display_docker_volumes
  elif [[ "${__value}" =~ besu\.yml && "${__free_space}" -lt 52428800 ]]; then
    low=1
    echo
    echo "You are running Besu and have less than 50 GiB of free disk space."
    echo
    echo "If this is a long-running Besu, you may prune trie-logs with \"${__me} prune-besu\"."
    echo
    __display_docker_dir
    __display_docker_volumes
  elif [[ "${__free_space}" -lt 52428800 ]]; then
    low=1
    echo
    echo "You have less than 50 GiB of free disk space:"
    echo
    __display_docker_dir
    __display_docker_volumes
  fi

  if [[ "${low}" -eq 1 && "${NETWORK}" = "mainnet" ]]; then
#shellcheck disable=SC2154
    if [[ "${EL_NODE_TYPE}" =~ expiry ]]; then
      echo "You are already configured to expire execution layer history."
    else
      echo "You are not configured to expire execution layer history. You can free space with \"${__me} prune-history\"."
      echo "If this is an RPC node that needs history, do not run that command."
    fi
  fi
}


# Check whether there's a source-built client and if so, force it with --no-cache
# This is called after writing to .env; it is safe to assign to uppercase variables
__source_build() {
  case "${COMPOSE_FILE}" in
    *deposit-cli.yml*)
      var="DEPCLI_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
# shellcheck disable=SC2154
      if [[ "${__value}" = "Dockerfile.source" ]]; then
        __docompose --profile tools build --pull --no-cache deposit-cli-new
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *web3signer.yml*)
      var="W3S_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
# shellcheck disable=SC2154
      if [[ "${__value}" = "Dockerfile.source" ]]; then
        __docompose build --pull --no-cache web3signer
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *mev-boost.yml*)
      var="MEV_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache mev-boost
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *reth.yml*)
      var="RETH_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *geth.yml*)
      var="GETH_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *besu.yml*)
      var="BESU_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *nethermind.yml*)
      var="NM_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *erigon.yml*)
      var="ERIGON_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *nimbus-el.yml*)
      var="NIMEL_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *ethrex.yml*)
      var="ETHREX_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *lighthouse.yml*|*lighthouse-cl-only.yml*)
      var="LH_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *teku.yml*|*teku-allin1.yml*|*teku-cl-only.yml*)
      var="TEKU_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *lodestar.yml*|*lodestar-cl-only.yml*)
      var="LS_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *nimbus.yml*|*nimbus-allin1.yml*|*nimbus-cl-only.yml*)
      var="NIM_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *nimbus-unified.yml*)
      var="NIMUNIFIED_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile-unified.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *prysm.yml*|*prysm-cl-only.yml*)
      var="PRYSM_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *grandine.yml*| *grandine-allin1.yml*|*grandine-cl-only.yml*)
      var="GRANDINE_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *vero-vc-only.yml*)
      var="VERO_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
        __docompose build --pull --no-cache validator
      fi
      ;;
  esac
}


# Remove after Glamsterdam
__migrate_alloy_obol() {
  local prom_token

  __get_compose_file
  if [[ "${__source_ver}" -lt 55 && "${COMPOSE_FILE}" =~ lido-obol-alloy.yml ]]; then
    var="OBOL_PROM_REMOTE_WRITE_TOKEN"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ -z "${__value}" && -f ./prometheus/custom-prom.yml ]] && grep -q 'credentials:' ./prometheus/custom-prom.yml >/dev/null; then
      echo "Migrating Lido Obol Promtail to Lido Obol Alloy"
      prom_token=$(awk -F': *' '/credentials:/ {gsub(/"/,"",$2); print $2; exit}' ./prometheus/custom-prom.yml)
      if [[ -z "${prom_token}" ]]; then
        echo "Could not determine value of OBOL_PROM_REMOTE_WRITE_TOKEN in ./prometheus/custom-prom.yml"
        echo "Please update it yourself with \"nano .env\""
        return
      fi
      var="OBOL_PROM_REMOTE_WRITE_TOKEN"
      OBOL_PROM_REMOTE_WRITE_TOKEN="${prom_token}"
      __update_value_in_env "${var}" "${!var}" "${__env_file}"
    fi
  fi
}


# When this gets called $var is CORE_FILES or CUSTOM_FILES and $__value is what is set in .env for it
# This function rebuilds __value, applying any file name changes
__migrate_compose_files() {
  local ymlarray
  local ymlfile
  local n
  local index

# Some files have been renamed and others removed altogether
  local from_yml=("lido-obol-promtail.yml" "prysm-web-shared.yml")
  local to_yml=("lido-obol-alloy.yml" "")

  IFS=":"
  set -o noglob
# Globbing is off
# shellcheck disable=SC2206
  ymlarray=(${__value})  # split+glob with glob disabled, and split using : as delimiter
  set +o noglob
# Unset restores default
  unset IFS

  __value=""
  for n in "${!ymlarray[@]}"; do
    ymlfile="${ymlarray[n]}"
    for index in "${!from_yml[@]}"; do
      if [[ "${from_yml[index]}" = "${ymlfile}" ]]; then
        ymlfile=${to_yml[index]}
        break
      fi
    done
    if [[ -n "${ymlfile}" ]]; then
      if [[ -z "${__value}" ]]; then
        __value="${ymlfile}"
      else
        __value="${__value}:${ymlfile}"
      fi
    fi
  done
}


__upgrade_postgres() {
  local source_vol
  local source_pg
  local source_size
  local backup_vol
  local regex
  local yn

# Check for web3signer
  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ web3signer\.yml ]]; then
    return 0
  fi

  source_vol="$(basename "$(pwd)" | tr '[:upper:]' '[:lower:]')_web3signer-slashing-data"
  if [[ -z "$(__dodocker volume ls -q -f "name=${source_vol}")" ]]; then
    return 0
  fi

  __during_postgres=1

  source_pg="$(__dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
    alpine:3 cat /var/lib/postgres-data/PG_VERSION)"

  if [[ "${source_pg}" -lt "${__target_pg}" ]]; then
    echo "Web3signer is using PostgreSQL ${source_pg}. The current version is PostgreSQL ${__target_pg}."
    echo
    if [[ "${__non_interactive}" -eq 0 ]]; then
      while true; do
        read -rp "Would you like to migrate to PostgreSQL ${__target_pg}? (Y/n) " yn
        case "${yn}" in
          [Nn]o|[Nn]) echo "Keeping PostgreSQL at version ${source_pg}"; __during_postgres=0; return 0;;
          *) break;;
        esac
      done
    fi
  else
    __during_postgres=0
    return 0
  fi

  source_size="$(__dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
    alpine:3 du -s /var/lib/postgres-data/ | awk '{print $1}')"

  regex='^[0-9]+$'
  if [[ ! "${source_size}" =~ ${regex} ]] ; then
    echo "Unable to determine database size. This is likely a bug."
    echo "source_size is ${source_size}"
    return 70
  fi

  __get_docker_free_space

  if [[ "${__free_space}" -lt $(( (source_size * 2) + 10485760 )) ]]; then
    echo
    echo "You don't have enough free space to migrate the slashing protection database."
    echo "It is $(( source_size / 1024 / 1024 )) GiB in size and you need twice as much free again."
    echo
    __display_docker_dir
    echo
    return 1
  fi

  backup_vol="$(basename "$(pwd)" | tr '[:upper:]' '[:lower:]')_web3signer-slashing-data-pg${source_pg}-backup"
  if [[ -n "$(__dodocker volume ls -q -f "name=${backup_vol}")" ]]; then
    echo "PostgreSQL upgrade was aborted. A backup volume ${backup_vol} already exists,"
    echo "and you are on PostgreSQL ${source_pg}. This suggests a failed upgrade previously."
    echo "Upgrading PostgreSQL isn't safe."
    echo "This should not have happened. Please come to EthCoördinate Discord at https://discord.gg/ethstaker to troubleshoot this."
    return 70
  fi

  echo "Stopping Web3signer"
  __docompose stop web3signer && __docompose rm -f web3signer
  echo "Stopping PostgreSQL"
  __docompose stop postgres && __docompose rm -f postgres

  echo "Copying data in web3signer-slashing-data volume to backup"
  __dodocker volume create "${backup_vol}"
  __dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
    -v "${backup_vol}":"/var/lib/pg-backup" \
    alpine:3 cp -a /var/lib/postgres-data/. /var/lib/pg-backup

  echo
  echo "Migrating database from PostgreSQL ${source_pg} to PostgreSQL ${__target_pg}"
  echo "If this step fails, the Web3signer slashing protection database is no longer protecting you."
  echo "In failure case, do not start Web3signer again, instead seek help on EthCoördinate Discord: https://discord.gg/ethstaker"
  echo

  __dodocker pull "pgautoupgrade/pgautoupgrade:${__target_pg}-trixie"
  __during_pg_migrate=1
  __dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
   -e PGAUTO_ONESHOT=yes -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres -e PGDATA=/var/lib/postgres-data \
   "pgautoupgrade/pgautoupgrade:${__target_pg}-trixie"

  __pg_migrated=1

  echo
  echo "Adjusting PostgreSQL Docker tag"
  if [[ ! -f "${__env_file}.source" ]]; then  # update() didn't migrate env, let's make sure .env.source exists
    cp "${__env_file}" "${__env_file}.source"
  fi
  var="PG_DOCKER_TAG"
  PG_DOCKER_TAG=${__target_pg}-trixie
  __update_value_in_env "${var}" "${!var}" "${__env_file}"
  __final_msg+="\nWeb3signer has been stopped. You'll need to run \"${__me} up\" to start it again.\n"
  __final_msg+="Before you do, double-check that the upgrade was successful, by scrolling through the\n"
  __final_msg+="upgrade messages above.\n"
  __final_msg+="\nA copy of your old slashing protection database is in the Docker volume ${backup_vol}.\n"
  __final_msg+="Confirm that everything works, and then delete it with \"docker volume rm ${backup_vol}\".\n"
  __during_postgres=0
}


__check_teku_db_version() {
  local teku_volume
  local volume_name
  local db_version

  case "${COMPOSE_FILE}" in
    *teku-allin1.yml*) teku_volume='teku-data';;
    *teku.yml*|*teku-cl-only.yml*) teku_volume='tekuconsensus-data';;
    *) return 0;;
  esac

  volume_name="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_${teku_volume}"
  if [[ -z "$(__dodocker volume ls -q -f "name=${volume_name}")" ]]; then
    return 0
  fi

  db_version="$(__dodocker run --rm -v "${volume_name}:/var/lib/teku" alpine:3 \
    cat /var/lib/teku/beacon/db.version 2>/dev/null || true)"
  if [[ "${db_version}" = "leveldb2" ]]; then
    __final_msg+="\nWARNING: Your Teku database is using LevelDB. You can switch to RocksDB by running \"${__me} resync-consensus\".\n"
  fi
}


repair-reth() {
  local yn

# Check for Reth
  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ reth\.yml ]]; then
    echo "You do not appear to be using Reth. Aborting"
    return 0
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    echo
    while true; do
      read -rp "WARNING - About to repair the Reth database. This can take 2 hours or more. Do you wish to continue? (Y/n) " yn
      case "${yn}" in
        [Nn]o|[Nn]) echo "Skipping Reth database repair"; return 0;;
        *) break;;
      esac
    done
  fi

  __docompose exec execution touch /var/lib/reth/repair-trie
  echo "Restarting Reth to initiate repair"
  echo "You can monitor progress with \"./ethd logs -f execution\"."
  restart execution
}


migrate-reth() {
  local yn

# Check for Reth
  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ reth\.yml ]]; then
    echo "You do not appear to be using Reth. Aborting"
    return 0
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    echo
    while true; do
      read -rp "WARNING - About to migrate the Reth database to v2. This can take up to 24 hours for an archive node. Do you wish to continue? (Y/n) " yn
      case "${yn}" in
        [Nn]o|[Nn]) echo "Skipping Reth database migration"; return 0;;
        *) break;;
      esac
    done
  fi

  __docompose exec execution touch /var/lib/reth/migrate-v2
  echo "Restarting Reth to initiate migration"
  echo "You can monitor progress with \"./ethd logs -f execution\"."
  restart execution
}


migrate-geth() {
  local yn

# Check for Geth
  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ geth\.yml ]]; then
    echo "You do not appear to be using Geth. Aborting"
    return 0
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    echo
    while true; do
      read -rp "WARNING - About to migrate the Geth database to Pebble v2. Do you wish to continue? (Y/n) " yn
      case "${yn}" in
        [Nn]o|[Nn]) echo "Skipping Geth database migration"; return 0;;
        *) break;;
      esac
    done
  fi

  __docompose exec execution touch /var/lib/geth/migrate-v2
  echo "Restarting Geth to initiate migration"
  echo "You can monitor progress with \"./ethd logs -f execution\"."
  restart execution
}


__detect_v6() {
  local v6_works

  if [[ "${__docker_major_version}" -lt 27 ]]; then  # Docker-CE v27 is when IPv6 support became usable.
    return
  fi

  if [[ "${__distro}" =~ (ubuntu|debian) ]]; then
    if ! dpkg-query -W -f='${Status}' iputils-ping 2>/dev/null | grep -q "ok installed"; then
      if [[ "${__cannot_sudo}" -eq 1 ]]; then
        echo "IPv6 connectivity test requires the ping utility, which is not installed."
        echo "Please install iputils-ping and run \"${__me} ${__command}\" again."
        return
      fi
      echo "Installing ping utility"
      ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install iputils-ping
    fi
  fi

  __write_vars+=("IPV6")

  echo "Testing IPv6 host connectivity"
  if ! ping -c1 2001:4860:4860::8888 >/dev/null; then
    echo "No IPv6 detected; continuing with IPv4"
    IPV6="false"
    return
  fi

  echo "Testing IPv6 Docker connectivity"
  if ! __dodocker network ls --filter "name=^ip6net_ethd_test$" -q | grep -q .; then
    __dodocker network create --ipv6 ip6net_ethd_test
  fi
  v6_works=$(__dodocker run --rm --network ip6net_ethd_test busybox sh -c \
    "if ping -c1 -6 2001:4860:4860::8888 >/dev/null; then echo true; else echo false; fi" < /dev/null)
  __dodocker network rm ip6net_ethd_test

  if [[ "${v6_works}" = "true" ]]; then
    echo "Enabling IPv4/6 dual-stack for your ${__project_name} setup"
    IPV6="true"
  else
    echo "Docker cannot use IPv6; continuing with IPv4"
    IPV6="false"
  fi
}


__get_value_from_env() {
  # Call with variable name to read, env file name, and global variable to assign the __value to
  # Also sets global __found
  local var_name="$1"
  local env_file="$2"
  local output_var="$3"
  local output
  local parsed_value
  local awk_exe

  if [[ "${output_var}" = "parsed_value" || "${output_var}" = "output_var" \
      || "${output_var}" = "output" || "${output_var}" = "env_file" \
      || "${output_var}" = "var_name" ]]; then
    echo "__get_value_from_env was called with a conflicting output variable: ${output_var}"
    echo "This is a bug."
    exit 70
  fi

  if [[ "$OSTYPE" = "darwin"* ]]; then
    awk_exe="gawk"  # Built-in awk can't handle multi-line. Does require brew install gawk
  else
    awk_exe="awk"
  fi

#shellcheck disable=SC2016
  output=$(${awk_exe} -v var="${var_name}" '
    BEGIN { __found = 0; __value = "" }

    # Skip empty lines and comments
    /^[[:space:]]*($|#)/ {
      next
    }

    # Match single-line unquoted __value
    $0 ~ "^[ \t]*" var "=" && $0 !~ "^[ \t]*" var "=[ \t]*[\"'\'']" {
      sub("^[ \t]*"var"=", "")
      gsub(/^[ \t]*|[ \t]*$/, "", $0)
      __value = $0
      __found = 1
      exit
    }

    # Match empty unquoted __value
    $0 ~ "^[ \t]*"var"=$" {
      __value = ""
      __found = 1
      exit
    }

    # Single-line DOUBLE-quoted: VAR="..."; allow trailing spaces
    $0 ~ "^[ \t]*" var "=\"[^\"]*\"[ \t]*$" {
      sub("^[ \t]*" var "=\"", "", $0)
      sub(/"[ \t]*$/, "", $0)
      __value = "\"" $0 "\""
      __found = 1
      exit
    }

    # Single-line SINGLE-quoted: VAR='\''...'\''; allow trailing spaces
    $0 ~ "^[ \t]*" var "='\''[^'\'']*'\''[ \t]*$" {
      sub("^[ \t]*" var "='\''", "", $0)
      sub(/'\''[ \t]*$/, "", $0)
      __value = "'"'"'" $0 "'"'"'"
      __found = 1
      exit
    }

    # Match the start of a multi-line __value (with opening double or single quote)
    $0 ~ "^[ \t]*"var"=\"[^\"]*$" || $0 ~ "^[ \t]*" var "='\''[^'\'']*$" {
      # Pick which quote we matched and strip the var=<quote> prefix
      if ($0 ~ "^[ \t]*" var "=\"[^\"]*$") {
        __q="\""; sub("^[ \t]*" var "=\"", "", $0)
      } else {
        __q="'\''";  sub("^[ \t]*" var "='\''", "", $0)
      }
      # Accumulator starts with the opening quote, plus first chunk + newline
      __value = __q $0 "\n"
      __found = 1
      next
    }

    # Continue collecting lines for a multi-line __value
    __found && ($0 !~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$")) {
      __value = __value $0 "\n"
      next
    }

    # End of a multi-line __value (with closing quote)
    __found && ($0 ~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$")) {
      # Remove the trailing quote + any spaces/tabs around it
      if (__q == "\"") {
        sub(/[ \t]*"[ \t]*$/, "", $0)
      } else {
        sub(/[ \t]*'\''[ \t]*$/, "", $0)
      }
      __value = __value $0 __q
      __found = 1
      exit
    }

    END {
      # Print here-doc style so we can parse with awk
      # Print the __value as is, including quotes for multi-line
      print "__value<<EOF"
      print __value
      print "EOF"
      print "__found=" __found
    }
  ' "${env_file}")

  # Parse __value using here-doc style
#shellcheck disable=SC2016
  parsed_value=$(${awk_exe} '/^__value<<EOF$/ {getline; while ($0 != "EOF") { print; getline } }' <<< "${output}")
  # Parse __found directly into a global variable
#shellcheck disable=SC2016
  __found=$(${awk_exe} -F= '/^__found=/ {print $2}' <<< "${output}")

  # assign __value to caller’s variable
  printf -v "${output_var}" '%s' "${parsed_value}"
}


__update_value_in_env() {
# Call as __update_value_in_env "${var}" "${value}" "${env_file}"
  local var_name="$1"
  local new_value="$2"
  local env_file="$3"
  local escaped_value
  local awk_exe
  local mode

  if [[ "$OSTYPE" = "darwin"* ]]; then
    awk_exe="gawk"  # Built-in awk can't handle multi-line. Does require brew install gawk
  else
    awk_exe="awk"
  fi

  # Escape backslashes for safety
  escaped_value=$(printf '%s' "${new_value}" | sed 's/\\/\\\\/g')

  # Check if the variable already exists in the .env file
  if grep -q "^[ \t]*${var_name}=" "${env_file}"; then
    # Variable exists, update it
#shellcheck disable=SC2016
    ${awk_exe} -v var="${var_name}" -v new_value="${escaped_value}" '
      BEGIN { in_block = 0; multi_line = 0; __q="" }
      # Start of the target variable
      $0 ~ "^[ \t]*" var "=" {
        # Determine opening quote (if any)
        if ($0 ~ "^[ \t]*" var "=\"") {
          __q = "\""
          # If there is NOT a second " later on the line, it is multiline
          if ($0 !~ "^[ \t]*" var "=\".*\"[ \t]*$")
            multi_line = 1
          else
            multi_line = 0
        }
        else if ($0 ~ "^[ \t]*" var "='\''") {
          __q = "'\''"
          # If there is NOT a second '\'' later on the line, it is multiline
          if ($0 !~ "^[ \t]*" var "='\''.*'\''[ \t]*$")
            multi_line = 1
          else
            multi_line = 0
        }
        else {
          __q = ""
          multi_line = 0
        }

        # Replace with new value, verbatim (already escaped upstream)
        gsub(/&/, "\\&", new_value)   # AWK print safety
        print var "=" new_value

        in_block = 1
        next
      }

      # A new variable definition resets skipping
      /^[ \t]*[A-Z_][A-Z0-9_]*=/ && in_block {
        in_block=0
        multi_line=0
        __q=""
      }

      # Skip multiline content until closing quote line
      multi_line && ( $0 !~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$") ) {
        next
      }

      # Closing line of the multi-line block: consume it and reset
      multi_line && ( $0 ~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$") ) {
        in_block=0
        multi_line=0
        __q=""
        next
      }

      # Print all lines if not in the target variable block
      { print }
    ' "${env_file}" | ${__as_owner} tee "${env_file}.tmp" >/dev/null
    mode=$(${__as_owner} stat "${__stat_mode_param[@]}" "${env_file}")
    mode=$(__mode_after_umask "${mode}")
    ${__as_owner} install -g "${__owner_group}" -o "${__new_owner}" -m "${mode}" "${env_file}.tmp" "${env_file}"
    ${__as_owner} rm -f "${env_file}.tmp"
  else
    # Variable does not exist, append it
    printf "%s=%s\n" "${var_name}" "${escaped_value}" | ${__as_owner} tee -a "${env_file}" >/dev/null
  fi
}


__migrate_env() {
  local old_vars=( DDNS_PROXY DDNS_SUBDOMAIN ERA_URL RPC_URL CB_PBS_DOCKER_TAG CB_PBS_DOCKER_REPO )
  local new_vars=( CF_PROXY DDNS_HOST ERE_URL RPC_URLS CB_DOCKER_TAG CB_DOCKER_REPO )
  local error
  local line
  local index
  local var
  local varname

  if [[ ! -f "${__env_file}" ]]; then
    return 0
  fi

  if [[ "${__debug}" -eq 1 ]]; then  # Find any values in default.env that contain dashes
    error=0
    while IFS= read -r line; do
      # Skip blank lines and comments
      [[ -z "${line}" || "${line}" =~ ^# ]] && continue

      # Warn on dash-containing variable names
      if [[ "${line}" =~ ^([A-Za-z0-9_-]+)= ]]; then
        varname="${BASH_REMATCH[1]}"
        if [[ "${varname}" = *-* ]]; then
          echo "Error: Variable '${varname}' contains a dash and would not be usable in Bash."
          (( ++error ))
        fi
        if [[ "${varname}" = "ENV_VERSION" ]]; then
          continue
        fi
      else
        continue  # Doesn't match variable assignment format
      fi
    done < "./default.env"
    if [[ "${error}" -gt 0 ]]; then
      exit 1
    fi
  fi

# Always make sure we have a SIREN password
  var="SIREN_PASSWORD"
  __get_value_from_env "${var}" "${__env_file}" "SIREN_PASSWORD"
  if [[ -z "${SIREN_PASSWORD}" ]]; then
    SIREN_PASSWORD=$(head -c 8 /dev/urandom | od -A n -t u8 | tr -d '[:space:]' | sha256sum | head -c 32)
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
  fi

  var=ENV_VERSION
  __get_value_from_env "${var}" "default.env" "__target_ver"
  __get_value_from_env "${var}" "${__env_file}" "__source_ver"

# shellcheck disable=SC2154
  if [[ "${__keep_targets}" -eq 1 && "${__target_ver}" -le "${__source_ver}" ]]; then  # No changes in template, do nothing
    return 0
  fi

  if [[ "${__keep_targets}" -eq 0 ]]; then
    echo "Refreshing build targets in ${__env_file}"
  fi
  if [[ "${__target_ver}" -gt "${__source_ver}" ]]; then
    # Remove with version 68
    if [[ "${__target_ver}" -eq "67" ]]; then
      echo "Migrating ${__env_file} to version ⁶🤷⁷"
    else
      echo "Migrating ${__env_file} to version ${__target_ver}"
    fi
    echo "Note this is not an ${__project_name} version, it is an internal config file version"
  fi

  ${__as_owner} cp "${__env_file}" "${__env_file}".source
  __during_env_migrate=1
  __env_migrated=1
  ${__as_owner} cp default.env "${__env_file}"

  # Migrate over user settings
  while IFS= read -r line; do  # read default.env and process all variables in it
    # Skip blank lines and comments
    [[ -z "${line}" || "${line}" =~ ^# ]] && continue

    if [[ "${line}" =~ ^([A-Za-z0-9_-]+)= ]]; then
      var="${BASH_REMATCH[1]}"
    else
      continue  # Doesn't match variable assignment format
    fi
    if [[ "${var}" = "ENV_VERSION" ]]; then
      continue
    fi

    __get_value_from_env "${var}" "${__env_file}.source" "__value"
    if [[ "${__found}" -eq 1 ]]; then  # Only if variable isn't new in default.env
      if [[ "${var}" = "CORE_FILES" || "${var}" = "CUSTOM_FILES" ]]; then
        __migrate_compose_files
      fi
      # Remove after Glamsterdam
      if [[ "${__source_ver}" -lt "54" && "${var}" = "COMPOSE_FILE" ]]; then
        __update_value_in_env "CORE_FILES" "${__value}" "${__env_file}"
# shellcheck disable=SC2016
        __value='${CORE_FILES}${CUSTOM_FILES:+:${CUSTOM_FILES}}'
      fi
      # Remove after Glamsterdam
      if [[ "${var}" = "NODE_EXPORTER_COLLECTOR_MOUNT_PATH" && "${__value}" = "/dev/null" ]]; then
        __value=""
      fi
      # Remove after Glamsterdam
      if [[ "${var}" = "CHECKPOINT_SYNC_URL" && "${__value}" =~ ^https://beaconstate.info ]]; then
        __value="https://sync-mainnet.beaconcha.in"
      fi
      # Remove after Glamsterdam
      if [[ "${var}" = "CHECKPOINT_SYNC_URL" && "${__value}" =~ ^https://hoodi.beaconstate.info ]]; then
        __value="https://hoodi.checkpoint.sigp.io"
      fi
      # Remove after Glamsterdam
      if [[ "${var}" = "CHECKPOINT_SYNC_URL" && "${__value}" =~ ^https://sepolia.beaconstate.info ]]; then
        __value="https://checkpoint-sync.sepolia.ethpandaops.io"
      fi
      # Remove after Glamsterdam
      if [[ "${__source_ver}" -lt "59" && "${var}" = "CL_NODE_TYPE" && "${__value}" = "archive"
            && ${COMPOSE_FILE} =~ (prysm\.yml|prysm-cl-only\.yml|lighthouse\.yml|lighthouse-cl-only\.yml|lodestar\.yml|lodestar-cl-only\.yml|caplin\.yml) ]]; then
        __value="blob-archive"
      fi
      # Remove after Glamsterdam
      if [[ "${__source_ver}" -lt "65" && "${var}" = "EL_EXTRAS" && "${COMPOSE_FILE}" =~ nethermind\.yml ]]; then
        if [[ -z "${__value}" ]]; then
          __value="--LogIndex.Enabled true"
        elif [[ ! "${__value}" =~ Logindex\.Enabled|logindex-enabled ]]; then
          __value+=" --LogIndex.Enabled true"
        fi
      fi

      if [[ "${var}" = "CL_QUIC_PORT" ]]; then
        __get_value_from_env "CL_P2P_PORT" "${__env_file}.source" "CL_P2P_PORT"
        if [[ -n "${CL_P2P_PORT}" && "${CL_P2P_PORT}" = "${__value}" ]]; then
          __value=$((__value + 1))
          echo "Adjusted CL_QUIC_PORT to ${__value} so it does not conflict with CL_P2P_PORT"
        fi
        __get_value_from_env "PRYSM_UDP_PORT" "${__env_file}.source" "PRYSM_UDP_PORT"
        if [[ -n "${PRYSM_UDP_PORT}" && "${PRYSM_UDP_PORT}" = "${__value}" ]]; then  # just in case this is one ahead
          __value=$((__value + 1))
          echo "Adjusted CL_QUIC_PORT to ${__value} so it does not conflict with PRYSM_UDP_PORT"
        fi
      fi

      if [[ "${__keep_targets}" -eq 0 && "${var}" =~ (_TAG|_REPO|_TARGET|_DOCKERFILE)$ && ! "${var}" = "PG_DOCKER_TAG" ]]; then
        __get_value_from_env "${var}" "default.env" "__value"  # Reset build target to default.env __value
      fi
      __update_value_in_env "${var}" "${__value}" "${__env_file}"
    else  # New variables, but they need to be adjusted
      # Remove after Glamsterdam
      if [[ "${__source_ver}" -lt "48" && "${var}" = "EL_NODE_TYPE" ]]; then
        __get_value_from_env "EL_ARCHIVE_NODE" "${__env_file}.source" "EL_ARCHIVE_NODE"
        if [[ "${EL_ARCHIVE_NODE}" = "true" ]]; then
          __value=archive
        else
          __get_value_from_env "EL_MINIMAL_NODE" "${__env_file}.source" "EL_MINIMAL_NODE"
          case "${EL_MINIMAL_NODE}" in
            true) __value=pre-merge-expiry;;
            aggressive) __value=aggressive-expiry;;
            rolling) __value=rolling-expiry;;
            *) __value=full;;
          esac
        fi
        __update_value_in_env "${var}" "${__value}" "${__env_file}"
      fi
      # Remove after Glamsterdam
      if [[ "${__source_ver}" -lt "48" && "${var}" = "CL_NODE_TYPE" ]]; then
        __get_value_from_env "CL_ARCHIVE_NODE" "${__env_file}.source" "CL_ARCHIVE_NODE"
        if [[ "${CL_ARCHIVE_NODE}" = "true" ]]; then
          __value=archive
        else
          __get_value_from_env "CL_MINIMAL_NODE" "${__env_file}.source" "CL_MINIMAL_NODE"
          case "${CL_MINIMAL_NODE}" in
            true) __value=pruned;;
            *) __value=full;;
          esac
        fi
        __update_value_in_env "${var}" "${__value}" "${__env_file}"
      fi
    fi
  done < "./default.env"

  # Move __value from old variable name(s) to new one(s)
  for index in "${!old_vars[@]}"; do
    var=${old_vars[index]}
    __get_value_from_env "${var}" "${__env_file}.source" "__value"
    # Remove after Glamsterdam
    if [[ "${__source_ver}" -lt "67" && "${var}" = "CB_PBS_DOCKER_REPO" && ${__value} = "ghcr.io/commit-boost/pbs" ]]; then
      __value="ghcr.io/commit-boost/commit-boost"
    fi
    if [[ "${__found}" -eq 1 ]]; then
      __update_value_in_env "${new_vars[index]}" "${__value}" "${__env_file}"
    fi
  done
# Check whether we run a CL or VC, if so nag about FEE_RECIPIENT
  __value="${COMPOSE_FILE}"
# It's CL&VC, CL-only, or VC-only
  if [[ "${__value}" =~ (prysm\.yml|lighthouse\.yml|teku\.yml|nimbus\.yml|lodestar\.yml|-cl-only\.yml|-allin1\.yml|-vc-only\.yml) ]]; then
    # Check for rewards
    var="FEE_RECIPIENT"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ -z "${__value}" || ${__value} != 0x* || ${#__value} -ne 42 ]]; then
      if [[ "${__non_interactive}" -eq 0 ]]; then
        whiptail --msgbox "A fee recipient ETH wallet address is required in order to start the client. This is \
for priority fees and, optionally, MEV. Please enter a valid ETH address in the next screen. Refer to \
${__project_name} docs (https://ethdocker.com/About/Rewards) for more information.\n\nCAUTION: \"${__me} up\" will fail if no \
valid address is set" 12 75
        __query_fee_recipient
        __update_value_in_env "${var}" "${!var}" "${__env_file}"
      else
        echo "A fee recipient ETH wallet address is required in order to start the client. Please set one in \".env\"."
        echo "CAUTION: \"${__me} up\" will fail if no valid address is set."
      fi
    fi
  fi

  __during_env_migrate=0
  echo "${__env_file} updated successfully"
}


# Both tells the user that their OS is old, and sets __eol_os for code that requires a min version
__nag_os_version() {
  local eol_epoch
  local now_epoch
  local days_diff

  now_epoch=$(date +%s)

  if [[ "${__distro}" = "ubuntu" && "${__os_major_version}" -le "${__min_ubuntu}" ]]; then
    if ! eol_epoch=$(date -d "${__eol_min_ubuntu}" +%s 2>/dev/null); then
      echo "Invalid EOL date: ${__eol_min_ubuntu}"
      echo "This is a bug. Exiting so CI fails."
      exit 70
    fi
    days_diff=$(( (eol_epoch - now_epoch) / 86400 ))

    if [[ "${__os_major_version}" -lt "${__min_ubuntu}" || "${days_diff}" -lt 0 ]]; then
      echo
      echo "Ubuntu ${__os_major_version} is past the end of its standard support period."
      echo "Updated Docker packages may no longer be available for this version, and it may not receive security updates."
      echo "!! Upgrading is highly recommended !!"
      echo
      echo "${__upgrade_ubuntu}"
      __eol_os=1
    elif [[ "${days_diff}" -lt 30 ]]; then
      echo
      echo "Ubuntu ${__os_major_version} is approaching the end of its standard support period in ${days_diff} days."
      echo "Upgrading before then is highly recommended."
      echo
      echo "${__upgrade_ubuntu}"
    elif [[ "${days_diff}" -lt 90 ]]; then
      echo
      echo "Ubuntu ${__os_major_version} is approaching the end of its standard support period in ${days_diff} days."
      echo "Scheduling an upgrade before then is recommended."
      echo
      echo "${__upgrade_ubuntu}"
    fi
  fi

  if [[ "${__distro}" =~ "debian" &&  "${__os_major_version}" -le "${__min_debian}" ]]; then
    if ! eol_epoch=$(date -d "${__eol_min_debian}" +%s 2>/dev/null); then
      echo "Invalid EOL date: ${__eol_min_debian}"
      echo "This is a bug. Exiting so CI fails."
      exit 70
    fi
    days_diff=$(( (eol_epoch - now_epoch) / 86400 ))

    if [[ "${__os_major_version}" -lt "${__min_debian}" || "${days_diff}" -lt 0 ]]; then
      echo
      echo "Debian ${__os_major_version} is past the end of its long term support period."
      echo "Updated Docker packages may no longer be available for this version, and it may not receive security updates."
      echo "!! Upgrading is highly recommended !!"
      echo
      echo "${__upgrade_debian}"
      __eol_os=1
    elif [[ "${days_diff}" -lt 30 ]]; then
      echo
      echo "Debian ${__os_major_version} is approaching the end of its long term support period in ${days_diff} days."
      echo "Upgrading before then is highly recommended."
      echo
      echo "${__upgrade_debian}"
    elif [[ "${days_diff}" -lt 90 ]]; then
      echo
      echo "Debian ${__os_major_version} is approaching the end of its long term support period in ${days_diff} days."
      echo "Scheduling an upgrade before then is recommended."
      echo
      echo "${__upgrade_debian}"
    fi
  fi
}


__nag_os_update() {
  if [[ ! "${__distro}" =~ (ubuntu|debian) ]]; then
    return 0
  fi

  local line
  local logdir="/var/log/"
  local dpkg_logs=()
  local dpkg_log
  local oldest_log
  local grep_cmd
  local cat_cmd
  local last_upgrade_line=""
  local last_upgrade_date=""
  local last_epoch
  local now_epoch
  local days_diff

  mapfile -t dpkg_logs < <(
    find "${logdir}" -maxdepth 1 -type f -name 'dpkg.log*' -printf '%T@ %p\n' 2>/dev/null |
      sort -n |  # Numeric sort of UNIX timestamps, oldest first
      cut -d' ' -f2-
  )
  if [[ ${#dpkg_logs[@]} -eq 0 ]]; then
    return 0
  fi

  for dpkg_log in "${dpkg_logs[@]}"; do  # Oldest to newest, end up with the newest upgrade line
    if [[ "${dpkg_log}" = *.gz ]]; then
      if [[ -z "$(command -v zgrep)" ]]; then
        return 0
      fi
      grep_cmd="zgrep"
    else
      grep_cmd="grep"
    fi
    line=$(${grep_cmd} 'upgrade ' "${dpkg_log}" | tail -n1 || true)
    if [[ -n "${line}" ]]; then
      last_upgrade_line="${line}"
    fi
  done
  if [[ -z "${last_upgrade_line}" ]]; then  # No upgrade line found; use the oldest file timestamp or log entry
    oldest_log="${dpkg_logs[0]}"
    if [[ -n "${oldest_log}" && -f "${oldest_log}" ]]; then
      if [[ "${oldest_log}" = *.gz ]]; then
        if [[ -z "$(command -v zcat)" ]]; then
          return 0
        fi
        cat_cmd="zcat"
      else
        cat_cmd="cat"
      fi
      last_upgrade_date=$(stat -c %y "${oldest_log}" 2>/dev/null | cut -d' ' -f1 \
        || ${cat_cmd} "${oldest_log}" | head -n1 | cut -d' ' -f1)
    fi
  else
    last_upgrade_date=$(awk '{print $1}' <<< "${last_upgrade_line}")
  fi
  if [[ ! "${last_upgrade_date}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then  # Verify we have a YYYY-MM-DD date
    return 0
  fi

  last_epoch=$(date -d "${last_upgrade_date}" +%s)
  now_epoch=$(date +%s)
  days_diff=$(( (now_epoch - last_epoch) / 86400 ))

  if [[ "${days_diff}" -gt 300 ]]; then
    if [[ -n "${last_upgrade_line}" ]]; then
      echo "Your ${__distro} Linux was last updated ${days_diff} days ago on ${last_upgrade_date}."
    else
      echo "Your ${__distro} Linux was last updated more than ${days_diff} days ago."
    fi
    echo "Please run \"sudo apt update && sudo apt dist-upgrade\" to bring in security updates and bug fixes."
  fi

  if [[ -f "/var/run/reboot-required" ]]; then
    echo "A previous OS update requires you to reboot this machine to complete the update."
    echo "Please run \"sudo reboot\" to activate the updated components, like for example the kernel."
  fi
}


__docker_df_to_bytes() {
  local awk_exe
  local num
  local unit

  if [[ "$OSTYPE" = "darwin"* ]]; then
    awk_exe="gawk"  # Built-in awk is BSD and may behave in ways I do not code for
  else
    awk_exe="awk"
  fi

  if [[ "$1" =~ ^([0-9.]+)([kMGTP]?B)$ ]]; then
    num="${BASH_REMATCH[1]}"
    unit="${BASH_REMATCH[2]}"
  else
    echo "Docker build cache size parsing failed. This may be a bug"
    return
  fi

  ${awk_exe} -v num="${num}" -v unit="${unit}" '
    # docker system df reports GB, not GiB
    function pow1000(n, i) { r=1; for (i=0;i<n;i++) r*=1000; return r }

    BEGIN {
      if (unit == "B")      bytes = num
      else if (unit == "kB") bytes = num * pow1000(1)
      else if (unit == "MB") bytes = num * pow1000(2)
      else if (unit == "GB") bytes = num * pow1000(3)
      else if (unit == "TB") bytes = num * pow1000(4)
      else if (unit == "PB") bytes = num * pow1000(5)  # OK yes I am being silly
      else bytes = 0  # In case bash format parsing is incorrect

      printf "%.0f\n", bytes
    }
  '
}


__prune_docker_cache() {
  local val
  local bytes
  local threshold

  val=$(__dodocker system df --format '{{if eq .Type "Build Cache"}}{{.Reclaimable}}{{end}}' \
      | sed '/^$/d' | awk '{print $1}' || true)
  if [[ ! "${val}" =~ ^[0-9.]+[kMGTP]?B$ ]]; then
    echo "Docker build cache size query failed. This may be a bug."
    return
  fi
  bytes=$(__docker_df_to_bytes "${val}")

  threshold=$((50 * 1000 * 1000 * 1000 ))  # 50GB
  if [[ "$bytes" =~ ^[0-9]+$ && "${bytes}" -gt "${threshold}" ]]; then
    echo "Pruning Docker build cache, >50GB reclaimable."
    __dodocker system prune --force
  fi
}


__pull_and_build() {
  echo "Building local client images"
  __prune_docker_cache
  __docompose --profile tools pull
  __source_build
  __docompose --profile tools build --pull
}


# Run optional pre-update hook script for custom actions before update/config.
# Users can create pre-ethd-update.sh to run validation or preparation steps.
__run_pre_update_script() {
  local exitstatus
  local pre_update_script

  pre_update_script="$(dirname "$(realpath "${BASH_SOURCE[0]}")")/pre-ethd-update.sh"
  if [[ -f "${pre_update_script}" ]]; then
    if [[ -x "${pre_update_script}" ]]; then
      echo "[ethd] Running pre-ethd-update.sh..."
      set +e
      "${pre_update_script}"
      exitstatus=$?
      set -e
      if [[ ${exitstatus} -ne 0 ]]; then
        echo "[ethd] pre-ethd-update.sh exited with code ${exitstatus}"
        echo "[ethd] Aborting due to pre-update script failure."
        exit ${exitstatus}
      fi
    else
      echo "[ethd] ERROR: pre-ethd-update.sh exists but is not executable."
      echo "[ethd] Please make it executable with: chmod +x pre-ethd-update.sh"
      echo "[ethd] Or remove it if it's not needed."
      exit 1
    fi
  fi
}


# Run optional post-update hook script for custom actions after update/config.
# Users can create post-ethd-update.sh to run additional setup steps.
__run_post_update_script() {
  local exitstatus
  local post_update_script

  post_update_script="$(dirname "$(realpath "${BASH_SOURCE[0]}")")/post-ethd-update.sh"
  if [[ -f "${post_update_script}" ]]; then
    if [[ -x "${post_update_script}" ]]; then
      echo "[ethd] Running post-ethd-update.sh..."
      set +e
      "${post_update_script}"
      exitstatus=$?
      set -e
      if [[ ${exitstatus} -ne 0 ]]; then
        echo "[ethd] post-ethd-update.sh exited with code ${exitstatus}"
      fi
    else
      echo "[ethd] ERROR: post-ethd-update.sh exists but is not executable."
      echo "[ethd] Please make it executable with: chmod +x post-ethd-update.sh"
      echo "[ethd] Or remove it if it's not needed."
    fi
  fi
}


# Arguments are passed, but shellcheck doesn't recognize that
# shellcheck disable=SC2120
update() {
  local targetcli
  local script_dir
  local uniq_id
  local screen_session
  local old_sessions
  local session_id
  local log
  local no_screen_cmd
  local dirty
  local branch
  local latest_tag
  local env_ts
  local tempo_ts  # Remove after Glamsterdam

  if [[ "$*" =~ --debug ]]; then
    __debug=1
  fi
  if [[ "$*" =~ --trace ]]; then
    __debug=1
    set -x
  fi

  if [[ ! "$OSTYPE" = "darwin"* ]]; then
# Only one copy of update() should run per Eth Docker stack
    script_dir="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
    uniq_id="${script_dir//\//_}"
    __lock_file="${uniq_id}_lock"
    ${__as_owner} touch "/tmp/${__lock_file}"
    exec 200<"/tmp/${__lock_file}"
    if ! flock -n 200; then
        echo "Another instance of \"${__me} update\" is running. Aborting."
        exit 1
    fi
  fi

  __during_update=1
  __final_msg=""

  if [[ -z "${ETHDSECUNDO:-}" ]]; then
    __run_pre_update_script
  fi

  if [[ $(${__as_owner} git status --porcelain) ]]; then
    dirty=1
  else
    dirty=0
  fi

  __free_space=$(df -P "$(pwd)" | awk '/[0-9]%/{print $(NF-2)}')

  __regex='^[0-9]+$'
  if [[ ! "${__free_space}" =~ ${__regex} ]] ; then
    echo "Unable to determine free disk space. This is likely a bug."
    echo "df reports $(df -P "$(pwd)") and __free_space is ${__free_space}"
    exit 70
  elif [[ "$(df -P "$(pwd)" | awk '/[0-9]%/{print $(NF-2)}')" -lt 1024 ]]; then
    echo "You have less than 1 MiB of space left on $(pwd)."
    echo "Aborting, as an update is not safe."
    exit 1
  fi

  __get_docker_free_space
  if [[ "${__free_space}" -lt 1048576 ]]; then
    echo "You have less than 1 GiB of space left for Docker volumes."
    echo "Aborting, as an update is not safe."
    exit 1
  fi

# This is long-running, and it's better if we're in a protected session if interactive
  if [[ -z "${ETHDSECUNDO:-}" && -z "${STY:-}" && -z "${TMUX:-}" && -n "${SSH_CONNECTION:-}" && ! "$*" =~ --no-screen \
        && ! "$*" =~ --non-interactive && ! "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    no_screen_cmd=0
    echo "\"${__me} update\" over SSH benefits from running in a session that protects it against disconnects."
    if [[ -z "$(command -v screen)" ]]; then
      if [[ "${__cannot_sudo}" -eq 0 && "${__distro}" =~ (ubuntu|debian) ]]; then
        echo "Installing screen"
        ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install screen
      else
        echo "\"screen\" command not found, continuing as-is"
        no_screen_cmd=1
      fi
    fi

    if [[ "${no_screen_cmd}" -eq 0 ]]; then
      local screen_session="${uniq_id}"
# Find old lingering screen sessions and close them
      set +e
      old_sessions=$(screen -ls 2>/dev/null | awk -v name="${screen_session}" -v status="Detached" '$0 ~ name && $0 ~ status {print $1}')
      set -e
      if [[ -n "${old_sessions}" ]]; then
        echo "Closing old, detached screen sessions"
        while IFS= read -r session_id; do
          if [[ -n "${session_id}" ]]; then
            echo "Closing screen session ${session_id}"
            screen -S "${session_id}" -X quit
          fi
        done <<< "${old_sessions}"
        echo
      fi

# Screen should run with login shell so that .profile gets loaded and aliases work
      if [[ ! -f "${HOME}/.screenrc" ]] || ! grep -q 'shell' "${HOME}/.screenrc"; then
# Intentional, I want this verbatim
# shellcheck disable=SC2016
        echo 'shell -$SHELL' >>"${HOME}/.screenrc"
      fi
      echo "Starting a new screen session with identifier ${screen_session}"
      echo "If you get disconnected, reconnect with \"screen -r ${screen_session}\""
      if [[ "${__debug}" -eq 1 ]]; then
        echo "A log of the update run can be found in \"/tmp/${screen_session}.log\""
      fi
      exec 200<&-
# Launch a new detached screen session and attach to it.
# Use bash -c to run 'ethd update', and pass along "$@"
#
#     ${BASH_SOURCE[0]} update "\$@"; exec bash
#   Escape \$@ so the outer shell doesn't expand it. Inner shell expands it.
#
#   "dummy" becomes $0 in the inner shell; "$@" parameters are assigned to $1, $2, etc.
#
#   exec bash replaces bash -c , so that the user is still inside screen at the end
#
      if [[ "${__debug}" -eq 1 ]]; then
        log="-L -Logfile /tmp/${screen_session}.log"
      else
        ${__as_owner} rm -f "/tmp/${screen_session}.log"
        log=""
      fi
# shellcheck disable=SC2086
      screen -S "${screen_session}" ${log} -dma bash -c "${BASH_SOURCE[0]} update \"\$@\"; exec bash --login" dummy "$@"
      screen -RR "${screen_session}"
      exit 0
    fi
  fi

  if [[ -z "${ETHDSECUNDO:-}" ]]; then
# Remove after Glamsterdam
    if git ls-files --error-unmatch ./prometheus/node-exporter-text/eth-docker-version.prom >/dev/null 2>&1; then
      rm -f ./prometheus/node-exporter-text/eth-docker-version.prom
    fi

    set +e
    ${__as_owner} git config pull.rebase true
    var="ETH_DOCKER_TAG"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ -z "${__value}" || "${__value}" = "latest" ]]; then
      export ETHDPINNED=""
      branch=$(git rev-parse --abbrev-ref HEAD)
      if [[ "${branch}" =~ ^tag-* ]]; then
        git checkout main
      fi
      ${__as_owner} git pull origin main
    else
      if [[ "${__value}" = "stable" ]]; then
        if [[ "${__distro}" =~ (debian|ubuntu) ]]; then
          if ! dpkg-query -W -f='${Status}' curl 2>/dev/null | grep -q "ok installed" || ! dpkg-query -W -f='${Status}' jq 2>/dev/null | grep -q "ok installed"; then
            if [[ "${__cannot_sudo}" -eq 0 ]]; then
              echo "Installing curl and jq"
              ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install -y --no-install-recommends curl jq
            else
              echo "Cannot install curl and jq, unable to check for a \"stable\" Eth Docker release"
              echo "Please install curl and jq manually, and try again"
              exit 1
            fi
          fi
        fi
        latest_tag=$(curl -s -m 10 https://api.github.com/repos/ethstaker/eth-docker/releases/latest 2>/dev/null| jq -r '.tag_name // empty' 2>/dev/null) || true
        if [ -z "${latest_tag}" ]; then
          echo "ERROR: Cannot fetch the latest release tag for ${__project_name} from Github."
          if [[ ! "${__distro}" =~ (debian|ubuntu) ]]; then
            echo "Make sure \"curl\" and \"jq\" are installed, and \"api.github.com\" is reachable."
          fi
          echo "Try again later or change to a specific pinned tag for \"ETH_DOCKER_TAG\" in \".env\""
          exit 1
        fi
        __value="${latest_tag}"
      fi
      export ETHDPINNED="${__value}"
      ${__as_owner} git fetch --tags
      ${__as_owner} git checkout -B "tag-${__value}" "tags/${__value}"
    fi
    export GITEXITCODE=$?
    set -e
    # BASH_SOURCE so newer code gets to do the update. Use an ENV var
    # to avoid infinite loop
    export ETHDSECUNDO=1
    exec "${BASH_SOURCE[0]}" update "$@"
  fi


  __keep_targets=1
  targetcli=""
  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --keep-targets)
        if [[ -n "${targetcli}" ]]; then
          echo "Error: --keep-targets and --refresh-targets cannot be used together; use either option once only"
          exit 1
        fi
        __keep_targets=1
        targetcli="--keep-targets"
        shift
        ;;
      --refresh-targets|--reset-targets)
        if [[ -n "${targetcli}" ]]; then
          echo "Error: --keep-targets and --refresh-targets cannot be used together; use either option once only"
          exit 1
        fi
        __keep_targets=0
        targetcli="--refresh-targets"
        shift
        ;;
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      --debug | --trace)
        __debug=1
        shift
        ;;
      --no-screen)
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        shift
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  __migrate_env
  if [[ "${__env_migrated}" -eq 1 ]] && ! cmp -s "${__env_file}" "${__env_file}".source; then  # Create .bak early
    env_ts=$(date +%s)
    ${__as_owner} cp "${__env_file}.source" "${__env_file}.bak.${env_ts}"
  fi

  # Remove after Glamsterdam
  if [[ ${__source_ver} -lt 58 ]]; then
    if [[ -f ./tempo/tempo.yaml ]]; then
      tempo_ts=$(date +%s)
      ${__as_owner} mv ./tempo/tempo.yaml "./tempo/tempo.yaml.bak.${tempo_ts}"
      __final_msg+="\nGrafana Tempo has been updated to v3; old tempo/tempo.yaml has been saved as tempo/tempo.yaml.bak.${tempo_ts}"
    fi
  fi

  # Remove after Glamsterdam
  __migrate_alloy_obol
  __pull_and_build

  __upgrade_postgres
  __check_teku_db_version

  echo
  if [[ "${__env_migrated}" -eq 1 ]] && ! cmp -s "${__env_file}" "${__env_file}".source; then
    ${__as_owner} rm "${__env_file}".source  # .bak was created earlier
    echo "Your ${__env_file} configuration settings have been migrated to a fresh copy. You can \
find the original contents in ${__env_file}.bak.${env_ts}"
    if [[ "${__keep_targets}" -eq 0 ]]; then
      echo "NB: If you made changes to the source or binary build targets, these have been \
reset to defaults."
    fi
    echo
    echo "List of changes made to ${__env_file} during migration - current on left, original on right:"
    echo
    diff -y --suppress-common-lines "${__env_file}" "${__env_file}.bak.${env_ts}" || true
  else
    echo "No changes made to ${__env_file} during update"
    if [[ -f "${__env_file}".source ]]; then
      ${__as_owner} rm "${__env_file}".source || true
    fi
  fi
  echo
  if [[ -z "${GITEXITCODE+x}" || "${GITEXITCODE}" -eq 0 ]]; then
    echo "An \"${__me} up\" command will start using the new images and configuration."
  else
    echo "WARNING"
    echo
    echo "Updating ${__project_name} failed during \"git pull\""
    echo
    echo "Please try \"git pull\" manually."
    echo "Do not run \"${__me} up\" until git can update ${__project_name}."
    echo "The current partial update risks startup failure."
  fi

  __nag_os_version
  __nag_os_update
  __upgrade_docker

  unset ETHDSECUNDO
  unset GITEXITCODE
  if [[ "${dirty}" -eq 1 ]]; then
    echo
    echo "WARNING"
    echo
    echo "You have uncommitted local changes to ${__project_name}, which may interfere with updates."
    echo "Please undo these changes or \"git commit\" them."
    echo "These are the files with local changes:"
    echo
    ${__as_owner} git status --porcelain
  fi
  if [[ -n "${ETHDPINNED:-}" ]]; then
    echo "${__project_name} version is pinned to ${ETHDPINNED} in \".env\"."
    echo "Please make sure to run compatible client versions."
  fi

  __write_eth_docker_version_metric

  if [[ ! "$OSTYPE" = "darwin"* ]]; then
# Release lock and remove lock file
    exec 200<&-
    ${__as_owner} rm -f "/tmp/${__lock_file}"
  fi

  if [[ -n "${STY:-}" || -n "${TMUX:-}" ]]; then
    echo
    echo "You are in a screen or tmux session. This is good!"
    echo "\"${__me} update\" may have started screen for you to ensure the update finishes."
    if [[ -n "${STY:-}" ]]; then
      echo "You can scroll through the update messages with arrow keys. Get into scrollback mode first, with \"Ctrl-a ESC\"."
    else
      echo "You can scroll through the update messages with arrow keys. Get into scrollback mode first, with \"Ctrl-b [\"."
    fi
    echo
    echo "When you are done, remember to \"exit\" the session."
    echo
  fi

  echo -e "${__final_msg-}"

  __during_update=0

  __run_post_update_script
}


__verify_ancient_dir() {
  if [[ -z "$1" ]]; then
    return 1
  fi
  local dir="$1"
  local all_files=true
  local entries
  local entry

  if [[ ! -d "${dir}" ]]; then
    echo "ANCIENT_DIR ${dir} is not a directory. This is a configuration error."
    return 1
  fi

  if [[ "${__cannot_sudo}" -eq 0 ]] && ! mapfile -t entries < <(${__auto_sudo} find "${dir}" -mindepth 1 -maxdepth 1 -exec basename {} \;); then
    echo "ANCIENT_DIR ${dir} contents could not be listed. This is unexpected and may be a configuration error, or a bug."
    return 1
  fi

  # Check if all entries are files - this is Reth
  for entry in "${entries[@]}"; do
    if [[ -d "${dir}/${entry}" ]]; then
      all_files=false
      break
    fi
  done

  if [[ "${all_files}" = "true" ]]; then
    return 0
  else
    # Check for exactly two directories: 'chain' and 'state' - this is Geth
    if [[ ${#entries[@]} -eq 2 && \
          -d "${dir}/chain" && -d "${dir}/state" ]]; then
      return 0
    fi
  fi

   echo "ANCIENT_DIR ${dir} looks like neither a Geth nor Reth directory: Leaving it alone out of caution"
   return 1
}


resync-execution() {
  local el_volume
  local el_client
  local extra_msg
  local yn
  local volume_id
  local legacy_volume

# Check for EL client
  __value="${COMPOSE_FILE}"

  case "${__value}" in
    *erigon.yml*)
      el_volume='erigon-el-data'
      el_client="Erigon"
      extra_msg="A full resync should take 6-8 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *geth.yml*)
      el_volume='geth-el-data'
      el_client="Geth"
      extra_msg="A full resync should take 6-8 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *reth.yml*)
      el_volume='reth-el-data'
      el_client="Reth"
      extra_msg="A full resync should take 1 to 3 weeks, or 2-4 hours with \"RETH_SNAPSHOT\".\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *besu.yml*)
      el_volume='besu-el-data'
      el_client="Besu"
      extra_msg="A full resync should take 14 to 30 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *nethermind.yml*)
      el_volume='nethermind-el-data'
      el_client="Nethermind"
      extra_msg="A full resync should take 1-2 hours to where attestations work.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *nimbus-el.yml*)
      el_volume='nimbus-el-data'
      el_client="Nimbus"
      extra_msg="A full resync should take 5 days.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *nimbus-unified.yml*)
      el_volume='wipe-el-db'
      el_client="Nimbus Unified"
      extra_msg="A full resync should take 5 days.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *ethrex.yml*)
      el_volume='ethrex-el-data'
      el_client="Ethrex"
      extra_msg="A full resync should take a few hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *) echo "You do not appear to be running an execution layer client. Nothing to do."; return 0;;
  esac

  if [[ ! "${el_volume}" = "wipe-el-db" ]] && ! __dodocker volume ls -q \
      | grep -qi "$(basename "$(realpath .)")[_-]${el_volume}"; then
    echo "Did not find Docker volume for ${el_client}. Nothing to do."
    return 0
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    echo "This will stop ${el_client} and delete its database to force a resync."
    if [[ -n "${extra_msg:-}" ]]; then
      echo -e "${extra_msg}"
    fi
    read -rp "WARNING - resync will take validators offline unless rescue node is used. Do you wish to continue? (No/yes) " yn
    case "${yn}" in
      [Yy][Ee][Ss]) ;;
      *) echo "Aborting."; exit 130;;
    esac
  fi

  echo "Stopping ${el_client} container"
  if [[ "${el_client}" = "Nimbus Unified" ]]; then
    __docompose stop consensus && __docompose rm -f consensus
  else
    __docompose stop execution && __docompose rm -f execution
  fi

  if [[ "${el_volume}" = "wipe-el-db" ]]; then
    __docompose run --rm wipe-el-db
  else
    el_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_${el_volume}"
    __dodocker volume rm "$(__dodocker volume ls -q -f "name=${el_volume}")"
    volume_id=""
    if [[ "${el_volume}" =~ geth-el-data ]]; then
      legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_geth-eth1-data"
      volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
    elif [[ "${el_volume}" =~ besu-el-data ]]; then
      legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_besu-eth1-data"
      volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
    elif [[ "${el_volume}" =~ nethermind-el-data ]]; then
      legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_nm-eth1-data"
      volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
    fi
    if [[ -n "${volume_id}" ]]; then
      __dodocker volume rm "${volume_id}"
    fi
  fi
  var="ANCIENT_DIR"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if __verify_ancient_dir "${__value}"; then
    echo "Removing contents of ancient/static directory ${__value}"
    ${__auto_sudo} rm -rf "${__value%/}/"*
  fi
  echo
  echo "${el_client} stopped and database deleted."
  echo
  echo "Restarting for resync."
  up
}


resync-consensus() {
  local cl_volume
  local cl_client
  local volume_id
  local legacy_volume
  local yn

  # Check for CL client
  __value="${COMPOSE_FILE}"

  case "${__value}" in
    *lighthouse.yml*|*lighthouse-cl-only.yml*) cl_volume='lhconsensus-data'; cl_client="Lighthouse";;
    *teku-allin1.yml*) cl_volume='wipe-cl-db'; cl_client="Teku";;
    *teku.yml*|*teku-cl-only.yml*) cl_volume='tekuconsensus-data'; cl_client="Teku";;
    *nimbus-allin1.yml*) cl_volume='wipe-cl-db'; cl_client="Nimbus";;
    *nimbus.yml*|*nimbus-cl-only.yml*) cl_volume='nimbus-consensus-data'; cl_client="Nimbus";;
    *nimbus-unified.yml*) cl_volume='wipe-cl-db'; cl_client="Nimbus Unified";;
    *lodestar.yml*|*lodestar-cl-only.yml*) cl_volume='lsconsensus-data'; cl_client="Lodestar";;
    *prysm.yml*|*prysm-cl-only.yml*) cl_volume='prysmconsensus-data'; cl_client="Prysm";;
    *grandine-plugin.yml*|*grandine-plugin-allin1.yml*) cl_volume='wipe-cl-db'; cl_client="Grandine Plugin";;
    *grandine-allin1.yml*) cl_volume='wipe-cl-db'; cl_client="Grandine";;
    *grandine.yml*|*grandine-cl-only.yml*) cl_volume='grandineconsensus-data'; cl_client="Grandine";;
    *caplin.yml*) cl_volume='wipe-cl-db'; cl_client="Caplin";;
    *) echo "You do not appear to be running a consensus layer client. Nothing to do."; return;;
  esac

  if [[ ! "${cl_volume}" = "wipe-cl-db" ]] && ! __dodocker volume ls -q \
      | grep -qi "$(basename "$(realpath .)")[_-]${cl_volume}"; then
    echo "Did not find Docker volume for ${cl_client}. Nothing to do."
    return 0
  fi

  if [[ "${cl_client}" =~ ^Grandine ]]; then
    __adjust_grandine_permissions
  fi

  # Can we checkpoint sync?
  var="CHECKPOINT_SYNC_URL"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  echo "This will stop ${cl_client} and delete its database to force a resync."
  if [[ -z "${__value}" ]]; then
    read -rp "WARNING - CHECKPOINT_SYNC_URL not set, resync may take days. Do you wish to continue? (No/yes) " yn
  else
    read -rp "CHECKPOINT_SYNC_URL set, resync should finish in minutes. Do you wish to continue? (No/yes) " yn
  fi
  case "${yn}" in
    [Yy][Ee][Ss]) ;;
    *) echo "Aborting."; exit 130;;
  esac

  echo "Stopping ${cl_client} container"
  if [[ "${cl_client}" =~ ^(Caplin|Grandine Plugin)$ ]]; then
    __docompose stop execution && __docompose rm -f execution
  else
    __docompose stop consensus && __docompose rm -f consensus
  fi
  if [[ "${cl_volume}" = "wipe-cl-db" ]]; then
    __docompose run --rm wipe-cl-db
  else
    cl_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_${cl_volume}"
    __dodocker volume rm "$(__dodocker volume ls -q -f "name=${cl_volume}")"
    volume_id=""
    if [[ "${cl_volume}" =~ lhconsensus-data ]]; then
      legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_lhbeacon-data"
      volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
    elif [[ "${cl_volume}" =~ prysmconsensus-data ]]; then
      legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_prysmbeacon-data"
      volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
    fi
    if [[ -n "${volume_id}" ]]; then
      __dodocker volume rm "${volume_id}"
    fi
  fi
  echo
  echo "${cl_client} stopped and database deleted."
  echo
  echo "Restarting for resync."
  up
}


attach-geth() {
  local legacy_datadir

  if [[ ! "${COMPOSE_FILE}" =~ geth\.yml ]] ; then
    echo "You do not appear to be using Geth, aborting."
    exit 1
  fi
  legacy_datadir=$(__dodocker run --rm -v "$(__dodocker volume ls -q -f \
    "name=$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')[_-]geth-eth1-data")":"/var/lib/goethereum" \
    alpine:3 sh -c 'if [ -d "/var/lib/goethereum/geth/chaindata" ]; then echo true; else echo false; fi')

  if [[ "${legacy_datadir}" = "true" ]]; then
    __docompose exec -it execution bash -c "geth attach /var/lib/goethereum/geth.ipc"
  else
    __docompose exec -it execution bash -c "geth attach /var/lib/geth/geth.ipc"
  fi
}


prune-besu() {
  local var
  local rpc_line
  local rpc_port
  local sync_status
  local exitstatus
  local regex
  local yn

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [[ ! "${COMPOSE_FILE}" =~ besu\.yml ]] ; then
    echo "You do not appear to be using Besu, aborting."
    exit 1
  fi

  # Check for archive node
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "archive" ]]; then
    echo "Besu is an archive node: Aborting."
    exit 1
  fi

  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" \
  --header 'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Besu: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "Besu is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      read -rp "WARNING - this will stop Besu and prune its trie-logs. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Besu prune"
  echo
  __docompose run --rm set-prune-marker "touch /var/lib/besu/prune-marker"
  __docompose stop execution && __docompose rm -f execution
  start
  echo
  echo "Prune is running, you can observe it with '${__me} logs -f execution'"
  echo
  echo "When prune is done, Besu will automatically start again."
  echo
}


prune-reth() {
  local rpc_line
  local rpc_port
  local var
  local regex
  local sync_status
  local exitstatus
  local yn

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [[ ! "${COMPOSE_FILE}" =~ reth\.yml ]] ; then
    echo "You do not appear to be using Reth, aborting."
    exit 1
  fi

  # Check for archive node
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "archive" ]]; then
    echo "Reth is an archive node: Aborting."
    exit 1
  fi

  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" \
  --header 'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Reth: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "Reth is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      read -rp "WARNING - this will stop Reth and prune its database. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Reth prune"
  echo
  __docompose run --rm set-prune-marker "touch /var/lib/reth/prune-marker"
  __docompose stop execution && __docompose rm -f execution
  start
  echo
  echo "Prune is running, you can observe it with '${__me} logs -f execution'"
  echo
  echo "When prune is done, Reth will automatically start again."
  echo
}


prune-nethermind() {
  local exitstatus
  local var
  local min_free
  local min_gib
  local threshold
  local rpc_line
  local rpc_port
  local regex
  local yn
  local sync_status
  local exitstatus
  local prune_result

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [[ ! "${COMPOSE_FILE}" =~ nethermind\.yml ]] ; then
    echo "You do not appear to be using Nethermind, aborting."
    exit 1
  fi

  # Check for archive node
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "archive" ]]; then
    echo "Nethermind is an archive node: Aborting."
    exit 1
  fi

  # Check for FlatDB
  var="NETHERMIND_FLATDB"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ -n "${__value}" ]]; then
    echo "Nethermind is configured for FlatDB, which need not and cannot be pruned. Aborting."
    exit 1
  fi

  __get_docker_free_space

  var="NETWORK"
  __get_value_from_env "${var}" "${__env_file}" "NETWORK"

  if [[ "${NETWORK}" =~ ^(mainnet|gnosis)$ ]]; then
    min_free=262144000
    min_gib=250
  else
    min_free=26214400
    min_gib=25
  fi

  if [[ "${__free_space}" -lt ${min_free} ]]; then
    echo "You do not have enough free disk space. Make sure this reads at least ${min_gib}G free (Avail):"
    echo
    __display_docker_dir
    echo
    echo "Aborting."
    exit 1
  fi

  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" --header \
    'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Nethermind: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "Nethermind is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  var="AUTOPRUNE_NM"
  __get_value_from_env "${var}" "${__env_file}" "AUTOPRUNE_NM"

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      if [[ "${AUTOPRUNE_NM}" = true ]]; then
        if [[ "${NETWORK}" =~ ^(mainnet|gnosis)$ ]]; then
          threshold="350"
        else
          threshold="50"
        fi
        echo "Nethermind should auto-prune below ${threshold} GiB free. Check logs with \"${__me} logs -f --tail 500 \
execution | grep Full\" to see whether it is."
      fi
      read -rp "WARNING - this will prune Nethermind's database in the background. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Nethermind prune"
  echo

  set +e
  prune_result=$(__docompose exec -T execution wget -qO- "http://localhost:1337" --header \
  'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"admin_prune","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to start prune, error code ${exitstatus}. This is likely a bug."
    echo "An attempt to run it returned this: ${prune_result}"
    # shellcheck disable=SC2028
    echo 'The command attempted was: docker compose run --rm set-prune-marker "curl -s \
--data {\\\"method\\\":\\\"admin_prune\\\",\\\"params\\\":[],\\\"id\\\":1,\\\"jsonrpc\\\":\\\"2.0\\\"} \
-H Content-Type:\ application/json http://execution:8545"'
    exit ${exitstatus}
  fi
  echo "Nethermind returns ${prune_result}"
  if [[ ! "${prune_result}" =~ [Ss]tarting ]]; then
    echo "Unable to start prune. This is likely a bug."
    exit 70
  fi
  echo
  echo "Prune is running, you can observe it with \"${__me} logs -f --tail 500 execution | grep Full\""
  echo
  echo "Please do not restart the node or restart Nethermind until prune is done."
  echo
  echo "When prune is done, Nethermind will automatically re-start."
  echo
}


prune-history() {
  local var
  local rpc_line
  local regex
  local client
  local extra_msg
  local prune_marker
  local warning
  local yn
  local -a choices=()
  local num_items
  local menu_height
  local target
  local target_level
  local current_level
  local must_resync

  target=""

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      --pre-merge)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=pre-merge
        shift
        ;;
      --pre-prague)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=pre-prague
        shift
        ;;
      --rolling)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=rolling
        shift
        ;;
      --aggressive)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=aggressive
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done

  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

# pre-merge is only meaningful on mainnet or sepolia
  var=NETWORK
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${target}" = "pre-merge" && ! "${__value}" =~ ^(mainnet|sepolia)$ ]]; then
    echo "There is no ${target} history for ${__value} network."
    echo "Nothing to do. Aborting."
    exit 0
  fi

# Check whether this has already been done
  var=EL_NODE_TYPE
  __get_value_from_env "${var}" "${__env_file}" "EL_NODE_TYPE"
  if [[ "${EL_NODE_TYPE}" = "${target}-expiry" ]]; then
    echo "This node is already configured for \"${var}=${EL_NODE_TYPE}\"."
    echo "Nothing to do. Aborting."
    exit 0
  fi
  if [[ "${EL_NODE_TYPE}" = "archive" ]]; then
    echo "This node is an archive node, and should not use expired history"
    echo "Nothing to do. Aborting"
    exit 0
  fi
  if [[ "${EL_NODE_TYPE}" = "custom" ]]; then
    echo "This node uses custom database settings, and ${__me} can't reconfigure it"
    echo "Edit \".env\" and change \"EL_NODE_TYPE\" and \"EL_EXTRAS\" as desired, then run"
    echo "\"${__me} resync-execution\""
    echo "Nothing to do. Aborting"
    exit 0
  fi

  if [[ -z "${target}" ]]; then
    if [[ "${__non_interactive}" -eq 1 ]]; then
      echo "You need to specify a pruning mode when running in non-interactive mode"
      echo "Aborting"
      exit 1
    fi

    case "${COMPOSE_FILE}" in
      *besu.yml*)
        choices+=("rolling" "Rolling expiry (experimental)")
        ;;
      *erigon.yml*)
        choices+=("rolling" "Rolling expiry")
        ;;
      *nethermind.yml*)
        choices+=("rolling" "Rolling expiry")
        ;;
      *reth.yml*)
        choices+=("rolling" "Rolling expiry")
        ;;
      *geth.yml*)
        ;;
      *ethrex.yml*)
        ;;
      *nimbus-el.yml*|*nimbus-unified.yml*)
        choices+=("rolling" "Rolling expiry")
        ;;
    esac

    choices+=("pre-merge" "Pre-merge expiry")

    num_items=$(( ${#choices[@]} / 2 ))
    menu_height=$(( 8 + num_items ))

    target=$(whiptail --notags --title "Select history expiry extent" --menu \
    "How much history do you wish to prune?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)
  fi

  case "${target}" in
    pre-merge)
      target_level=1
      ;;
    pre-prague)
      target_level=2
      ;;
    rolling)
      target_level=3
      ;;
    aggressive)
      target_level=4
      ;;
    *)
      echo "Unable to parse ${target} expiry. This is a bug. Aborting"
      exit 70
      ;;
  esac

  case "${EL_NODE_TYPE}" in
    full)
      current_level=0
      ;;
    pre-merge-expiry)
      current_level=1
      ;;
    pre-prague-expiry)
      current_level=2
      ;;
    rolling-expiry)
      current_level=3
      ;;
    aggressive-expiry)
      current_level=4
      ;;
    *)
      echo "Unable to parse node type ${EL_NODE_TYPE}. This is a bug. Aborting"
      exit 70
      ;;
  esac

# Some clients support changing history expiry without resync. This can only ever throw away more history.
# If the user wants more history now, that requires a resync
  if [[ "${target_level}" -lt "${current_level}" ]]; then
    must_resync=1
  else
    must_resync=0
  fi

  case "${COMPOSE_FILE}" in
    *geth.yml*)
      client="Geth"
      if [[ "${target}" =~ ^(rolling|aggressive)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      if [[ "${must_resync}" -eq 0 ]]; then
        extra_msg="History can be pruned by ${client} without requiring a full resync. You can observe pruning with \"./ethd logs -f execution\"."
        prune_marker="/var/lib/geth/prune-marker"
      else
        extra_msg="To switch to ${target} expiry requires a full resync, which should take 6-8 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
        prune_marker=""
      fi
      ;;
    *nimbus-el.yml*|*nimbus-unified.yml*)
      client="Nimbus"
      if [[ "${target}" =~ ^(pre-prague|aggressive)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      extra_msg="To switch to ${target} expiry requires a full resync, which should take 5 days.\nYou can use https://rescuenode.com to keep attesting during resync."
      prune_marker=""
      ;;
    *nethermind.yml*)
      client="Nethermind"
      if [[ "${target}" = "aggressive" ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      extra_msg="To switch to ${target} expiry requires a full resync, which should take 1-2 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      prune_marker=""
      ;;
    *besu.yml*)
      client="Besu"
      if [[ "${target}" = "pre-prague" ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      extra_msg="To switch to ${target} expiry requires a full resync, which should take 16-24 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      prune_marker=""
      ;;
    *reth.yml*)
      client="Reth"
      if [[ "${must_resync}" -eq 0 ]]; then
        extra_msg="${target} expiry does not require a resync and should be immediate.\nA resync saves more space than a prune: You can set \"EL_NODE_TYPE=${target}-expiry\" manually with \"nano .env\" and then resync with \"./ethd resync-execution\"."
        prune_marker="/var/lib/reth/minimal-node"
      else
        extra_msg="To switch to ${target} expiry requires a full resync, which should take 1-2 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
        prune_marker=""
      fi
      ;;
    *erigon.yml*)
      client="Erigon"
      if [[ "${target}" = "pre-prague" ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      extra_msg="To switch to ${target} expiry requires a full resync, which should take 2-3 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      prune_marker=""
      ;;
    *ethrex.yml*)
      client="Ethrex"
      if [[ "${target}" =~ ^(pre-prague|rolling|aggressive)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      if [[ "${target}" = "pre-merge" ]]; then
        extra_msg="${client} always expires ${target} history. This command will have no effect."
        prune_marker="/var/lib/ethrex/minimal-node"
      else
        extra_msg="To switch to ${target} expiry requires a full resync, which should take 16-24 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
        prune_marker=""
      fi
      ;;
    *)
      echo "${__project_name} does not know how to prune ${target} history on ${client:-MysteryClient},"
      echo "nor how to configure it for ${target} history expiry on fresh sync."
      exit 0
      ;;
  esac

  if [[ -n "${extra_msg:-}" ]]; then
    echo -e "${extra_msg}"
    echo
  fi
  if [[ -z "${prune_marker}" ]]; then  # Full resync
    if [[ "${__non_interactive}" -eq 0 ]]; then
      warning="WARNING - this will stop ${client} and resync it from scratch without pre-merge history. Do you wish to continue? (No/Yes) "
      while true; do
        read -rp "${warning}" yn
        case "${yn}" in
          [Yy][Ee][Ss]) break;;
          *) echo "Aborting, no changes made"; exit 130;;
        esac
      done
    fi
    var=EL_NODE_TYPE
    EL_NODE_TYPE=${target}-expiry
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
    __non_interactive=1
    resync-execution
    return 0
  fi

# We only get here if the client can prune
  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" \
  --header 'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to ${client}: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "${client} is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    warning="WARNING - this will stop ${client} and remove ${target} history. Do you wish to continue? (No/Yes) "
    while true; do
      read -rp "${warning}" yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  var=EL_NODE_TYPE
  EL_NODE_TYPE=${target}-expiry
  __update_value_in_env "${var}" "${!var}" "${__env_file}"
  echo
  echo "Starting ${client} ${target} history prune"
  __docompose run --rm set-prune-marker "touch ${prune_marker}"
  restart execution
  echo
  echo "${target} history prune is running, you can observe it with \"${__me} logs -f execution\""
  echo
  echo "When prune is done, ${client} will automatically start again."
  echo
}


prune-lighthouse() {
  local var
  local rpc_line
  local rpc_port
  local sync_status
  local exitstatus
  local regex
  local yn

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ (lighthouse.\yml|lighthouse-cl-only\.yml) ]]; then
    echo "You do not appear to be using Lighthouse, aborting."
    exit 1
  fi

  # Check for archive node
  var="CL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" =~ archive$ ]]; then
    echo "Lighthouse is an archive node: Aborting."
    exit 1
  fi

  rpc_line=$(grep '^CL_REST_PORT=' "${__env_file}")
  regex='^CL_REST_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine CL_REST_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T consensus wget -qO- "http://localhost:${rpc_port}/eth/v1/node/syncing")
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Lighthouse: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ "${sync_status}" =~ "true" ]]; then # Avoid jq - if el_offline or is_optimistic or is_syncing, don't proceed
    echo "Lighthouse is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      read -rp "WARNING - this will stop Lighthouse and prune its state. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Lighthouse prune"
  echo
  __docompose run --rm set-cl-prune-marker "touch /var/lib/lighthouse/beacon/prune-marker"
  __docompose stop consensus && __docompose rm -f consensus
  start
  echo
  echo "Prune is running, you can observe it with '${__me} logs -f consensus'"
  echo
  echo "When prune is done, Lighthouse will automatically start again."
  echo
}


__prep-keyimport() {
  local var
  local files

  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ (prysm\.yml|lighthouse\.yml|teku\.yml|nimbus\.yml|lodestar\.yml|-allin1\.yml|vc-only\.yml) ]]; then
    echo "You do not appear to be running a validator client. Aborting."
    exit 1
  fi

  __keys_args=""
  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --path)
        if [[ -z "${2+x}" ]]; then
          echo "--path requires a directory path, aborting"
          exit 1
        fi
        if [[ ! -d "$2" ]]; then
          echo "$2 is not a directory"
          exit 1
        fi
        if [[ "$(realpath "$2")" = "$(realpath ".eth/validator_keys")" ]]; then
          echo "$2 is the default path, doing nothing special"
          shift 2
          continue
        fi
        IFS=$'\n'
        files=$(find "$2" -maxdepth 1 -name '*.json')
        # Unset restores default
        unset IFS
        if [[ -z "${files}" ]]; then
          echo "No .json files found in $2, aborting"
          exit 1
        fi
        IFS=$'\n'
        files=$(find ./.eth/validator_keys -maxdepth 1 -name '*.json')
        # Unset restores default
        unset IFS
        if [[ -n "${files}" ]]; then
          ${__as_owner} mkdir -p ./.eth/validator_keys/keybackup
          ${__as_owner} mv -uf ./.eth/validator_keys/*.json ./.eth/validator_keys/keybackup
          ${__as_owner} rm -f ./.eth/validator_keys/*.json
          echo "Moved existing json files to .eth/validator_keys/keybackup"
        fi
        ${__as_owner} cp "$2"/*.json .eth/validator_keys/
        shift 2
        ;;
      --non-interactive)
        if [[ -z "${KEYSTORE_PASSWORD+x}" ]]; then
          echo "KEYSTORE_PASSWORD not set or empty, aborting"
          exit 1
        fi
        __keys_args+="${__keys_args:+ }--non-interactive"
        shift
        ;;
      --debug)
        __keys_args+="${__keys_args:+ }--debug"
        shift
        ;;
      --trace)
        __keys_args+="${__keys_args:+ }--trace"
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi
}


__i_haz_deposit_cli() {
  local var

  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ deposit-cli\.yml ]]; then
    echo "Please edit the ${__env_file} file and make sure \":deposit-cli.yml\" is added to the \"CORE_FILES\" line"
    echo "For example, \"nano ${__env_file}\" will open the nano text editor with the \"${__env_file}\" file loaded."
    echo "Without it, this step cannot be run"
    echo
    var="NETWORK"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ "${__value}" = "mainnet" ]]; then
      echo "WARNING: On Ethereum mainnet, best practice is to run key generation on an air-gapped live USB,"
      echo "such as Ubuntu Live or Tails."
      echo
    fi
    exit 1
  fi
}


__i_haz_ethdo() {
  local var
  local yn

  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ ethdo\.yml ]]; then
    echo "Please edit the ${__env_file} file and make sure \"ethdo.yml\" is added to the \"CUSTOM_FILES\" line"
    echo "For example, \"nano ${__env_file}\" will open the nano text editor with the \"${__env_file}\" file loaded."
    echo "Without it, this step cannot be run"
    echo
    read -rp "Do you want me to make this change for you? (n/y)" yn
    case "${yn}" in
      [Yy]);;
      *) exit 130;;
    esac
    if [[ -n "${CUSTOM_FILES}" ]]; then
      CUSTOM_FILES+=":ethdo.yml"
    else
      CUSTOM_FILES="ethdo.yml"
    fi
    var="CUSTOM_FILES"
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
    echo "Your CUSTOM_FILES now reads ${CUSTOM_FILES}"
  fi
}


__i_haz_web3signer() {
  local var
  local yn

  var="WEB3SIGNER"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ ! "${__value}" = "true" ]]; then
    return 0
  fi

  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ web3signer\.yml ]]; then
    echo "WEB3SIGNER=true in ${__env_file}, but web3signer.yml is not in use"
    echo "Please edit the ${__env_file} file and make sure \":web3signer.yml\" is added to the \"CORE_FILES\" line"
    echo "For example, \"nano ${__env_file}\" will open the nano text editor with the \"${__env_file}\" file loaded."
    echo "Without it, \"${__me} keys\" cannot be run"
    echo
    read -rp "Do you want me to make this change for you? (n/y)" yn
    case "${yn}" in
      [Yy]);;
      *) exit 130;;
    esac
    if [[ -n "${CORE_FILES}" ]]; then
      CORE_FILES+=":web3signer.yml"
    else
      echo "You do not appear to have a validator client in ${__project_name}. Web3signer cannot be used without one."
      exit 1
    fi
    var="CORE_FILES"
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
    echo "Your CORE_FILES now reads ${CORE_FILES}"
  fi
}


# There is a race condition somewhere. This does and does not succeed, on the same installation
__i_haz_keys_service() {
  if ! __docompose --profile tools config --services | grep -q validator-keys; then
    echo "The validator-keys service is not defined. Are you running only a consensus layer client?"
    echo "Key management happens on the validator client / web3signer, not the consensus layer client."
    echo "You can however do things like send an exit message, prep a withdrawal credentials change,"
    echo "sign exit messages with ethdo."
    echo
    echo "Aborting."
    exit 1
  fi
  return 0
}


__keys_usage() {
  echo "Call keymanager with an ACTION, one of:"
  echo "  create-for-csm"
  echo "      Create keys for Lido CSM"
  echo "  list"
  echo "      Lists the public keys of all validators currently loaded into your validator client"
  echo "  count"
  echo "      Counts the keys currently loaded into your validator client"
  echo "  import"
  echo "      Import all keystore*.json in .eth/validator_keys while loading slashing protection data"
  echo "      in slashing_protection*.json files that match the public key(s) of the imported validator(s)"
  echo "  delete 0xPUBKEY | all"
  echo "      Deletes the validator with public key 0xPUBKEY from the validator client, and exports its"
  echo "      slashing protection database."
  echo "      \"all\" deletes all detected validators."
  echo "  register"
  echo "      For use with web3signer only: Re-register all keys in web3signer with the validator client"
  echo
  echo "  get-recipient 0xPUBKEY"
  echo "      List fee recipient set for the validator with public key 0xPUBKEY"
  echo "      Validators will use FEE_RECIPIENT in ${__env_file} by default, if not set individually"
  echo "  set-recipient 0xPUBKEY 0xADDRESS"
  echo "      Set individual fee recipient for the validator with public key 0xPUBKEY"
  echo "  delete-recipient 0xPUBKEY"
  echo "      Delete individual fee recipient for the validator with public key 0xPUBKEY"
  echo
  echo "  get-gas 0xPUBKEY"
  echo "      List execution gas limit set for the validator with public key 0xPUBKEY"
  echo "      Validators will use the client's default, if not set individually"
  echo "  set-gas 0xPUBKEY amount"
  echo "      Set individual execution gas limit for the validator with public key 0xPUBKEY"
  echo "  delete-gas 0xPUBKEY"
  echo "      Delete individual execution gas limit for the validator with public key 0xPUBKEY"
  echo
  echo "  get-graffiti 0xPUBKEY"
  echo "      List graffiti set for the validator with public key 0xPUBKEY"
  echo "      Validators will use GRAFFITI in .env by default, if not set individually"
  echo "  set-graffiti 0xPUBKEY amount"
  echo "      Set individual graffiti for the validator with public key 0xPUBKEY"
  echo "  delete-graffiti 0xPUBKEY"
  echo "      Delete individual graffiti for the validator with public key 0xPUBKEY"
  echo
  echo "  get-api-token"
  echo "      Print the token for the keymanager API running on port ${KEY_API_PORT:-7500}."
  echo "      This is also the token for the Prysm Web UI"
  echo
  echo "  create-prysm-wallet"
  echo "      Create a new Prysm wallet to store keys in"
  echo "  get-prysm-wallet"
  echo "      Print Prysm's wallet password"
  echo
  echo "  get-grandine-wallet"
  echo "      Print Grandine's wallet password"
  echo
  echo "  prepare-address-change"
  echo "      Create an offline-preparation.json with ethdo"
  echo "  send-address-change"
  echo "      Send a change-operations.json with ethdo, setting the withdrawal address"
  echo
  echo "  sign-exit 0xPUBKEY | all"
  echo "      Create pre-signed exit message for the validator with public key 0xPUBKEY"
  echo "      \"all\" signs an exit message for all detected validators"
  echo "  sign-exit from-keystore [--offline]"
  echo "      Create pre-signed exit messages with ethdo, from keystore files in ./.eth/validator_keys"
  echo "  send-exit"
  echo "      Send pre-signed exit messages in ./.eth/exit_messages to the Ethereum chain"
  echo
  echo " Commands can be appended with \"--debug\" to see debug output"
}


# Call with repo and expected suffix as well as directory and target name.
__get_github_release() {
  local repo=$1
  local suffix=$2
  local dirname=$3
  local targetname=$4

  ${__as_owner} mkdir -p "${dirname}"
  if [[ "${targetname}" = "__untar__" ]]; then
    wget -q -O- https://api.github.com/repos/"${repo}"/releases/latest | grep "browser_download_url.*${suffix}" \
      | head -1 \
      | cut -d : -f 2,3 \
      | tr -d \" \
      | wget -qi- -O- \
      | ${__as_owner} tar zxf - -C "${dirname}" \
      || echo "-> Could not download the latest version of '${suffix}' from github '${repo}'."
  else
    wget -q -O- https://api.github.com/repos/"${repo}"/releases/latest | grep "browser_download_url.*${suffix}" \
      | head -1 \
      | cut -d : -f 2,3 \
      | tr -d \" \
      | ${__as_owner} wget -qi- -O "${dirname}/${targetname}" \
      && ${__chmod_sudo} chmod +x "${dirname}/${targetname}" \
      || echo "-> Could not download the latest version of '${suffix}' from github '${repo}'."
  fi
}


keys() {
  local var
  local owner_uid
  local offline
  local pubkey
  local num_files
  local keyfile
  local json
  local justone
  local network_name
  local password
  local password2
  local created
  local failed
  local exitstatus
  local yn

  if [[ "$#" -eq 0 || "$1" =~ (help|-h|--help) ]]; then
    __keys_usage
    return 0
  fi

  __i_haz_web3signer

  owner_uid=$(id -u "${__owner}")
  if [[ "${1:-}" = "import" ]]; then
    #__i_haz_keys_service
    shift
    __prep-keyimport "$@"
    __docompose run --rm -e OWNER_UID="${owner_uid}" validator-keys import "${__keys_args}"
  elif [[ "${1:-}" = "create-prysm-wallet" ]]; then
    __value="${COMPOSE_FILE}"
    if [[ ! "${__value}" =~ (prysm\.yml|prysm-vc-only\.yml) ]]; then
      echo "You do not appear to be using a Prysm validator. Aborting."
      exit 1
    fi
    if __docompose run --rm create-wallet; then
      __docompose stop validator
      __docompose rm --force validator
      up
    fi
  elif [[ "${1:-}" = "create-for-csm" ]]; then
    __i_haz_deposit_cli
    var="NETWORK"
    __get_value_from_env "${var}" "${__env_file}" "NETWORK"
    __query_lido_keys_generation
  elif [[ "${1:-}" = "prepare-address-change" ]]; then
    __i_haz_ethdo
    echo "Generating offline prep file"
    set +e
    __docompose run --rm ethdo validator credentials set --prepare-offline
    exitstatus=$?
    set -e
    if [[ "${exitstatus}" -ne 0 ]]; then
      echo "Running ethdo failed, unfortunately. Is the CL running and synced?"
      echo "Please try again after fixing root cause. Aborting."
      exit 1
    fi
    echo
    echo "Downloading ethdo"
    __get_github_release wealdtech/ethdo linux-amd64.tar.gz ./.eth/ethdo/amd64 __untar__
    __get_github_release wealdtech/ethdo linux-arm64.tar.gz ./.eth/ethdo/arm64 __untar__
    echo
    echo "Downloading jq"
    __get_github_release jqlang/jq jq-linux-amd64 ./.eth/ethdo/amd64 jq
    __get_github_release jqlang/jq jq-linux-arm64 ./.eth/ethdo/arm64 jq
    echo
    echo "Copy the contents of ./.eth/ethdo to a USB drive, and prepare a Linux Live USB to safely enter your mnemonic."
    echo "Please see https://ethdocker.com/Support/ChangingWithdrawalCredentials for details"
  elif [[ "${1:-}" = "send-address-change" ]]; then
    __i_haz_ethdo
    __docompose run --rm ethdo validator credentials set
  elif [[ "${1:-}" = "sign-exit" && "${2:-}" = "from-keystore" ]]; then
    __i_haz_ethdo

    if echo "$@" | grep -q '.*--offline.*' 2>/dev/null ; then
      offline="--offline"
    else
      offline=""
    fi

    if echo "$@" | grep -q '.*--non-interactive.*' 2>/dev/null ; then
      __non_interactive=1
    fi
    if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
      __non_interactive=1
    fi

    if [[ ${__non_interactive} -eq 1 ]]; then
      password="${KEYSTORE_PASSWORD}"
      justone=1
    else
      num_files=$(find .eth/validator_keys -maxdepth 1 -type f -name 'keystore*.json' | wc -l)
      if [[ "${num_files}" -eq 0 ]]; then
        echo "No keystore*.json files found in .eth/validator_keys/"
        echo "Nothing to do"
        exit 0
      fi

      if [[ "${num_files}" -gt 1 ]]; then
        while true; do
          read -rp "Do all validator keys have the same password? (y/n) " yn
          case "${yn}" in
            [Yy]*) justone=1; break;;
            [Nn]*) justone=0; break;;
            *) echo "Please answer yes or no.";;
          esac
        done
      else
        justone=1
      fi
      if [[ "${justone}" -eq 1 ]]; then
        while true; do
          read -srp "Please enter the password for your validator key(s): " password
          echo
          read -srp "Please re-enter the password: " password2
          echo
          if [[ "${password}" = "${password2}" ]]; then
            break
          else
            echo "The two entered passwords do not match, please try again."
            echo
          fi
        done
        echo
      fi
    fi

    created=0
    failed=0
    for keyfile in .eth/validator_keys/keystore-*.json; do
      [[ -f "${keyfile}" ]] || continue  # Should always evaluate true - just in case
      if [[ "${justone}" -eq 0 ]]; then
        while true; do
          read -srp "Please enter the password for your validator key stored in ${keyfile}: " password
          echo
          read -srp "Please re-enter the password: " password2
          echo
          if [[ "${password}" = "${password2}" ]]; then
            break
          else
            echo "The two entered passwords do not match, please try again."
            echo
          fi
          echo
        done
      fi

      pubkey="$(sed -E 's/.*"pubkey":\s*"([0-9a-fA-F]+)".*/\1/' < "${keyfile}")"
      if [[ -z "${pubkey}" ]]; then
        echo "Unable to read public key from ${keyfile}. Is it the right format?"
        continue
      else
          pubkey="0x${pubkey}"
      fi
      set +e
      # offline may be empty, don't quote it
      # shellcheck disable=SC2086
      json=$(__docompose run --rm ethdo validator exit --validator "${keyfile}" --json --timeout 2m \
        --passphrase "${password}" ${offline})
      exitstatus=$?
      if [[ "${exitstatus}" -eq 0 ]]; then
        echo "${json}" >".eth/exit_messages/${pubkey::10}--${pubkey:90}-exit.json"
# shellcheck disable=SC2320
        exitstatus=$?
        if [[ "${exitstatus}" -eq 0 ]]; then
          echo "Creating an exit message for validator ${pubkey} into file \
./.eth/exit_messages/${pubkey::10}--${pubkey:90}-exit.json succeeded"
          (( created++ ))
        else
          echo "Error writing exit json to file ./.eth/exit_messages/${pubkey::10}--${pubkey:90}-exit.json"
          (( failed++ ))
        fi
      else
        echo "Creating an exit message for validator ${pubkey} from file ${keyfile} failed"
        (( failed++ ))
      fi
      set -e
    done
    echo
    echo "Created pre-signed exit messages for ${created} validators"
    if [[ "${created}" -gt 0 ]]; then
      echo "You can find them in ./.eth/exit_messages"
    fi
    if [[ "${failed}" -gt 0 ]]; then
      echo "Failed for ${failed} validators"
    fi
  elif [[ "${1:-}" = "send-exit" ]]; then
    var="CL_NODE"
    __get_value_from_env "${var}" "${__env_file}" "CL_NODE"
    CL_NODE="${CL_NODE%%,*}"
    network_name="$(__docompose config | awk '
      BEGIN {
          found_networks=0;
          found_default=0;
      }
      /networks:/ {
          found_networks=1;
          next;
      }
      found_networks && /default:/ {
          found_default=1;
          next;
      }
      found_default && /^ *name:/ {
          print $2;
          exit;
      }
      ')"
    if ! __dodocker image ls --format "{{.Repository}}:{{.Tag}}" | grep -q "vc-utils:local"; then
      if ! dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
        __dodocker build -t vc-utils:local ./vc-utils
      else
        if ! dpkg-query -W -f='${Status}' docker-buildx-plugin 2>/dev/null | grep -q "ok installed"; then
          ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install -y docker-buildx-plugin
        fi
        __dodocker buildx build -t vc-utils:local ./vc-utils
      fi
    fi
    __dodocker run --rm \
      -u 1000:1000 \
      --network "${network_name}" \
      --name send-exit \
      -v "$(pwd)/.eth/exit_messages:/exit_messages" \
      -v "/etc/localtime:/etc/localtime:ro" \
      -e "CL_NODE=${CL_NODE}" \
      --entrypoint "keymanager.sh" \
      vc-utils:local /var/lib/lighthouse/nonesuch.txt eth2 send-exit
  else
    #__i_haz_keys_service
    __docompose run --rm -e OWNER_UID="${owner_uid}" validator-keys "$@"
  fi
}


__adjust_grandine_permissions() {
  local datadir_owner
  local datadir_volume

  __value="${COMPOSE_FILE}"
  if [[ ! "${__value}" =~ grandine ]]; then
    return 0
  fi

  if [[ "${__value}" =~ grandine-plugin ]]; then
    datadir_owner=10001
  else
    datadir_owner=10002
  fi

  datadir_volume="$(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_grandineconsensus-data$")"
  if [[ -z "${datadir_volume}" ]]; then
    return 0
  fi

  __dodocker run --rm \
    --user root \
    -v "${datadir_volume}:/var/lib/grandine" \
    alpine:3 \
    sh -c "
      if find /var/lib/grandine \( \! -user ${datadir_owner} -o \! -group ${datadir_owner} \) -print -quit | grep -q .; then
        echo 'Fixing ownership of Grandine volume'
        chown -R ${datadir_owner}:${datadir_owner} /var/lib/grandine
      fi
    "
}


# Writes the currently checked-out Eth Docker version as a node-exporter
# textfile-collector metric (see grafana.yml), so it can be tracked the same
# way the EL/CL client versions already are. "tag" comes from README.md's
# "This is Eth Docker vX.Y.Z" line (the same source `version` reads). A
# release commit bumps that line straight to "vX.Y.Z-dev" for the next
# version, so this stays accurate on main between releases. Writes into
# the same host directory node-exporter's textfile collector is already
# mounted from (NODE_EXPORTER_COLLECTOR_MOUNT_PATH, defaulting to
# ./prometheus/node-exporter-text) - that mount is read-only inside the
# container, so the file has to land there from the host side.
__write_eth_docker_version_metric() {
  local tag
  local commit
  local var
  local textfile_dir

  tag=$(grep -m1 "^This is ${__project_name} v" README.md 2>/dev/null | sed -E "s/^This is ${__project_name} //") || tag=""
  commit=$(${__as_owner} git rev-parse --short HEAD 2>/dev/null) || commit=""

  var=NODE_EXPORTER_COLLECTOR_MOUNT_PATH
  __get_value_from_env "${var}" "${__env_file}" "__value"
  textfile_dir="${__value:-./prometheus/node-exporter-text}"

  ${__as_owner} mkdir -p "${textfile_dir}"
  {
    echo "# HELP eth_docker_version_info Currently checked out ${__project_name} version"
    echo "# TYPE eth_docker_version_info gauge"
    echo "eth_docker_version_info{tag=\"${tag}\",commit=\"${commit}\"} 1"
  } | ${__as_owner} tee "${textfile_dir}/eth-docker-version.prom.tmp" >/dev/null
  ${__as_owner} mv "${textfile_dir}/eth-docker-version.prom.tmp" "${textfile_dir}/eth-docker-version.prom"
}


# Sets ALLOY_PROJECT_NAME in .env so config.alloy can scope Alloy's Docker
# service discovery to this install's own containers (see grafana.yml). When
# ALLOY_FILTER_BY_PROJECT_NAME is true, the name is read back from Compose's
# own resolution (docker compose config), never computed independently and
# never written to COMPOSE_PROJECT_NAME. Otherwise it is cleared, and Alloy
# coalesces the empty value to ".*" - the scrape-all default. Runs on every
# start so toggling ALLOY_FILTER_BY_PROJECT_NAME takes effect on the next up.
__set_alloy_project_name() {
  local var

  var=ALLOY_FILTER_BY_PROJECT_NAME
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "true" ]]; then
    ALLOY_PROJECT_NAME=$(__docompose config 2>/dev/null | awk -F': ' '/^name:/{print $2; exit}') || ALLOY_PROJECT_NAME=""
  else
    ALLOY_PROJECT_NAME=""
  fi

  var=ALLOY_PROJECT_NAME
  __update_value_in_env "${var}" "${!var}" "${__env_file}"
}


upgrade() {
  update
}


start() {
  __set_alloy_project_name
  __adjust_grandine_permissions
  __docompose up -d --remove-orphans "$@"
}

# Passed by user
# shellcheck disable=SC2120
up() {
  start "$@"
}


run() {
  start "$@"
}


stop() {
  __docompose down --remove-orphans "$@"
}


down() {
  stop "$@"
}


restart() {
  stop "$@"
  start "$@"
}


logs() {
  __docompose logs "$@"
}


cmd() {
  __docompose "$@"
}


terminate() {
  local yn
  local message

  # Assume project name and volume are delimited by _ and there is no _ in the volume name. Done to avoid catching project-2 while looking at project
  if [[ -z "$(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_[^_]+$")" ]]; then
    echo "There are no data stores - Docker volumes - left to remove for this Ethereum node."
    if [[ -f "${__env_file}" ]]; then
      stop
    fi
    return 0
  fi

  while true; do
    read -rp "WARNING - this action will destroy all data stores for this Ethereum node. Do you wish to continue? \
(No/Yes) " yn
    case "${yn}" in
      [Yy][Ee][Ss]) break;;
      *) echo "Aborting, no changes made"; exit 130;;
    esac
  done

  if [[ -f "${__env_file}" ]]; then
    stop
    message="All containers stopped and all volumes deleted"
  else
    message="All volumes deleted. ${__project_name} is not configured, so no containers could be stopped."
  fi

# In this case I want the word splitting, so rm can remove all volumes
# shellcheck disable=SC2046
  __dodocker volume rm $(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_[^_]+$")
  echo
  echo "${message}"
  echo
}


__query_network() {
  local var
  local -a choices=()
  local num_items
  local menu_height

  __write_vars+=("NETWORK")

  choices+=("hoodi" "Hoodi Testnet")
  choices+=("plataberget" "Plataberget Testnet (short-lived)")
  choices+=("ephemery" "Ephemery Testnet")
  choices+=("mainnet" "Ethereum Mainnet")
  choices+=("gnosis" "Gnosis Chain")
  choices+=("sepolia" "Sepolia Testnet (permissioned validators)")
  choices+=("custom" "Custom Testnet (needs a URL)")

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  var="NETWORK"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  NETWORK=$(whiptail --notags --title "Select Network" --menu \
    "Which network do you want to run on?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)

  case "${NETWORK}" in
    mainnet)
      echo "You chose to run on Ethereum mainnet"
      ;;
    gnosis)
      echo "You chose to run on Gnosis Chain"
      ;;
    sepolia|hoodi|ephemery|plataberget)
      echo "You chose to run on ${NETWORK} testnet"
      ;;
    custom)
      while true; do
        NETWORK=$(whiptail --title "Configure testnet URL" --inputbox "What is github URL of your custom testnet \
spec? (right-click to paste)" 10 60 3>&1 1>&2 2>&3)
        if [[ ${NETWORK} =~ ^https?:// ]]; then
          echo "Your custom testnet URL is: ${NETWORK}"
          break
        else
          whiptail --msgbox "${NETWORK} is not a valid URL. You can try again or Cancel on the next \
screen.\n\nCustom testnets only work with a URL to fetch their configuration from." 12 65
        fi
      done
      ;;
  esac
# shellcheck disable=SC2154
  if [[ ! "${NETWORK}" = "${__value}" ]]; then
    __network_change=1
  else
    __network_change=0
  fi

  if [[ ${NETWORK} =~ ^https?:// ]]; then  # The aliases need to not use ${NETWORK}
    __write_vars+=("W3S_ALIAS" "PG_ALIAS" "CL_ALIAS" "EL_ALIAS" "MEV_ALIAS" "RPC_PROXY_ALIAS")

    W3S_ALIAS=custom-web3signer
    PG_ALIAS=custom-postgres
    CL_ALIAS=custom-consensus
    EL_ALIAS=custom-execution
    MEV_ALIAS=custom-mev
    RPC_PROXY_ALIAS=custom-rpc-proxy
  fi
}


# Has to be called after __query_network
__query_deployment() {
  local -a choices=()
  local arch
  local num_items
  local menu_height

  arch=$(uname -m)

  if [[ "${NETWORK}" = "gnosis" ]]; then
    if [[ "${arch}" =~ riscv64 ]]; then
      echo "Gnosis network has no available client combos on RISC-V. Aborting."
      exit 1
    fi
    choices+=("node" "Ethereum node - consensus, execution and validator client")
    choices+=("rpc" "Ethereum RPC node - consensus and execution client")
    choices+=("validator" "Validator client only")
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    if [[ "${arch}" =~ riscv64 ]]; then
      echo "Ephemery network has no available client combos on RISC-V. Aborting."
      exit 1
    fi
    choices+=("node" "Ethereum node - consensus, execution and validator client")
    choices+=("rpc" "Ethereum RPC node - consensus and execution client")
    choices+=("validator" "Validator client only")
  elif [[ "${NETWORK}" = "sepolia" ]]; then
    choices+=("rpc" "Ethereum RPC node - consensus and execution client")
    choices+=("node" "Ethereum node - consensus, execution and validator client")
    choices+=("validator" "Validator client only")
  elif [[ "${arch}" =~ (aarch64|arm64) ]]; then
    choices+=("node" "Ethereum node - consensus, execution and validator client")
    choices+=("rpc" "Ethereum RPC node - consensus and execution client")
    choices+=("ssv" "SSV node - consensus, execution and ssv-node")
    choices+=("lido_comp" "Lido-compatible node (Community Staking / Simple DVT)")
    choices+=("rocket" "Validator client only - integrate with RocketPool")
    choices+=("validator" "Validator client only")
  elif [[ "${arch}" =~ riscv64 ]]; then
    choices+=("node" "Ethereum node - consensus, execution and validator client")
    choices+=("rpc" "Ethereum RPC node - consensus and execution client")
    choices+=("validator" "Validator client only")
  elif [[ "${arch}" =~ x86_64 ]]; then
    choices+=("node" "Ethereum node - consensus, execution and validator client")
    choices+=("rpc" "Ethereum RPC node - consensus and execution client")
    choices+=("ssv" "SSV node - consensus, execution and ssv-node")
    choices+=("lido_comp" "Lido-compatible node (Community Staking / Simple DVT)")
    choices+=("rocket" "Validator client only - integrate with RocketPool")
    choices+=("validator" "Validator client only")
  else
    echo "${__project_name} does not recognize this CPU architecture. Aborting."
    echo "Output of uname -m"
    uname -m
    exit 1
  fi

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  __deployment=$(whiptail --notags --title "Select deployment type" --menu \
    "What kind of deployment do you want to run?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)

  if [[ "${__deployment}" = "lido_comp" ]]; then
    choices=()
    if [[ "${arch}" =~ (aarch64|arm64) ]]; then
      choices+=("lido_csm" "[Community Staking] CSM node - Consensus, execution and validator client")
      choices+=("lido_ssv" "[Simple DVT] SSV node - Consensus, execution and ssv-node")
      choices+=("lido_obol" "[Simple DVT] Obol node - Nodes, validator client and charon node (obol middleware)")
    elif [[ "${arch}" =~ x86_64 ]]; then
      choices+=("lido_csm" "[Community Staking] CSM node - Consensus, execution and validator client")
      choices+=("lido_ssv" "[Simple DVT] SSV node - Consensus, execution and ssv-node")
      choices+=("lido_obol" "[Simple DVT] Obol node - Nodes, validator client and charon node (obol middleware)")
    else
      echo "${__project_name} does not support Lido on this CPU architecture. Aborting."
      echo "Output of uname -m"
      uname -m
      exit 1
    fi

    num_items=$(( ${#choices[@]} / 2 ))
    menu_height=$(( 8 + num_items ))

    __deployment=$(whiptail --notags --title "Select deployment type for Lido" --menu \
      "What kind of deployment to participate in Lido protocol do you want to run?" "${menu_height}" 90 "${num_items}" \
      "${choices[@]}" 3>&1 1>&2 2>&3)
  fi

  echo "Your deployment choice is: ${__deployment}"
}


__query_validator_client() {
  local -a choices=()
  local arch
  local num_items
  local menu_height

  arch=$(uname -m)

  if [[ "${NETWORK}" = "gnosis" ]]; then
    choices+=("lighthouse-vc-only.yml" "Lighthouse validator client")
    choices+=("teku-vc-only.yml" "Teku validator client")
    choices+=("lodestar-vc-only.yml" "Lodestar validator client")
    choices+=("nimbus-vc-only.yml" "Nimbus validator client")
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    choices+=("teku-vc-only.yml" "Teku validator client")
    choices+=("lodestar-vc-only.yml" "Lodestar validator client")
  elif [[ "${__deployment}" = "rocket" ]]; then
    if [[ "${arch}" =~ (aarch64|arm64) ]]; then
      choices+=("lighthouse-vc-only.yml" "Lighthouse validator client")
      choices+=("teku-vc-only.yml" "Teku validator client")
      choices+=("lodestar-vc-only.yml" "Lodestar validator client")
      choices+=("nimbus-vc-only.yml" "Nimbus validator client")
    else
      choices+=("teku-vc-only.yml" "Teku validator client")
      choices+=("lighthouse-vc-only.yml" "Lighthouse validator client")
      choices+=("lodestar-vc-only.yml" "Lodestar validator client")
      choices+=("nimbus-vc-only.yml" "Nimbus validator client")
    fi
  elif [[ "${arch}" =~ (aarch64|arm64) ]]; then
    choices+=("lighthouse-vc-only.yml" "Lighthouse validator client")
    choices+=("teku-vc-only.yml" "Teku validator client")
    choices+=("lodestar-vc-only.yml" "Lodestar validator client")
    choices+=("nimbus-vc-only.yml" "Nimbus validator client")
    choices+=("prysm-vc-only.yml" "Prysm validator client")
  else
    choices+=("teku-vc-only.yml" "Teku validator client")
    choices+=("lighthouse-vc-only.yml" "Lighthouse validator client")
    choices+=("lodestar-vc-only.yml" "Lodestar validator client")
    choices+=("nimbus-vc-only.yml" "Nimbus validator client")
    choices+=("prysm-vc-only.yml" "Prysm validator client")
  fi

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  VALIDATOR_CLIENT=$(whiptail --notags --title "Select validator client" --menu \
    "Which validator client do you want to run?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)

  if [[ "${VALIDATOR_CLIENT}" = "nimbus-vc-only.yml" && "${NETWORK}" = "gnosis" ]]; then
    __write_vars+=("NIM_DOCKERFILE")
    NIM_DOCKERFILE=Dockerfile.sourcegnosis
  fi

  if [[ -n "${CONSENSUS_CLIENT+x}" ]]; then
    CORE_FILES+=":${VALIDATOR_CLIENT}"
  else
    CORE_FILES="${VALIDATOR_CLIENT}"
  fi

  echo "Your validator client file is:" "${VALIDATOR_CLIENT}"
}


__query_consensus_client() {
  local -a choices=()
  local arch
  local num_items
  local menu_height

  __write_vars+=("CL_NODE")

  arch=$(uname -m)

  if [[ "${NETWORK}" = "gnosis" ]]; then
    choices+=("teku.yml" "Teku (Java) - consensus and validator client")
    choices+=("lighthouse.yml" "Lighthouse (Rust) - consensus and validator client")
    choices+=("lodestar.yml" "Lodestar (TypeScript) - consensus and validator client")
    choices+=("nimbus.yml" "Nimbus (Nim) - consensus and validator client")
    choices+=("caplin.yml" "Caplin (Go) - Erigon's built-in CL")
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    choices+=("teku.yml" "Teku (Java) - consensus and validator client")
    choices+=("lodestar.yml" "Lodestar (TypeScript) - consensus and validator client")
  elif [[ "${arch}" =~ (aarch64|arm64) ]]; then
    choices+=("nimbus.yml" "Nimbus (Nim) - consensus and validator client")
    if [[ "${NETWORK}" != "mainnet" ]]; then
      choices+=("nimbus-unified.yml" "Nimbus Unified (Nim) - consensus and execution client - beta")
    fi
    choices+=("grandine-allin1.yml" "Grandine (Rust) - consensus with built-in validator client")
    choices+=("lodestar.yml" "Lodestar (TypeScript) - consensus and validator client")
    choices+=("teku.yml" "Teku (Java) - consensus and validator client")
    choices+=("lighthouse.yml" "Lighthouse (Rust) - consensus and validator client")
    choices+=("prysm.yml" "Prysm (Go) - consensus and validator client")
    choices+=("caplin.yml" "Caplin (Go) - Erigon's built-in CL")
  elif [[ "${arch}" =~ riscv64 ]]; then
    choices+=("nimbus.yml" "Nimbus (Nim) - consensus and validator client")
    if [[ "${NETWORK}" != "mainnet" ]]; then
      choices+=("nimbus-unified.yml" "Nimbus Unified (Nim) - consensus and execution client - beta")
    fi
  elif [[ "${__deployment}" = "lido_obol" ]]; then
    choices+=("lodestar.yml" "Lodestar (TypeScript) - consensus and validator client")
    choices+=("nimbus.yml" "Nimbus (Nim) - consensus and validator client")
    choices+=("teku.yml" "Teku (Java) - consensus and validator client")
    choices+=("lighthouse.yml" "Lighthouse (Rust) - consensus and validator client")
    choices+=("prysm.yml" "Prysm (Go) - consensus and validator client")
  else
    choices+=("teku.yml" "Teku (Java) - consensus and validator client")
    choices+=("grandine-allin1.yml" "Grandine (Rust) - consensus with built-in validator client")
    choices+=("lodestar.yml" "Lodestar (TypeScript) - consensus and validator client")
    choices+=("nimbus.yml" "Nimbus (Nim) - consensus and validator client")
    if [[ "${NETWORK}" != "mainnet" ]]; then
      choices+=("nimbus-unified.yml" "Nimbus Unified (Nim) - consensus and execution client - beta")
    fi
    choices+=("lighthouse.yml" "Lighthouse (Rust) - consensus and validator client")
    choices+=("prysm.yml" "Prysm (Go) - consensus and validator client")
    choices+=("caplin.yml" "Caplin (Go) - Erigon's built-in CL")
  fi

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)

  if [[ "${CONSENSUS_CLIENT}" = "nimbus.yml" && "${NETWORK}" = "gnosis" ]]; then
    __write_vars+=("NIM_DOCKERFILE")
    NIM_DOCKERFILE=Dockerfile.sourcegnosis
  fi

  if [[ "${CONSENSUS_CLIENT}" = "nimbus.yml" && "${arch}" =~ riscv64 ]]; then
    __write_vars+=("NIM_DOCKERFILE")
    NIM_DOCKERFILE=Dockerfile.source
  fi

# This only works if __query_consensus_client is always called first
  CORE_FILES="${CONSENSUS_CLIENT}"

  if [[ "${CONSENSUS_CLIENT}" = "caplin.yml" ]]; then
    CL_NODE=http://execution:5052
  else
    CL_NODE=http://consensus:5052
  fi

  if [[ "${__deployment}" = "lido_obol" && "${CONSENSUS_CLIENT}" = "lodestar.yml" ]]; then
    CONSENSUS_CLIENT="lodestar-cl-only.yml"  # Charon does not handle SSZ
    VALIDATOR_CLIENT="lodestar-vc-only.yml"
    CORE_FILES="${CONSENSUS_CLIENT}:${VALIDATOR_CLIENT}"
  fi

  echo "Your consensus client file is:" "${CONSENSUS_CLIENT}"
}


__query_consensus_only_client() {
  local -a choices=()
  local arch
  local num_items
  local menu_height

  __write_vars+=("CL_NODE")

  arch=$(uname -m)

  if [[ "${NETWORK}" = "gnosis" ]]; then
    choices+=("lighthouse-cl-only.yml" "Lighthouse (Rust) - consensus client")
    choices+=("teku-cl-only.yml" "Teku (Java) - consensus client")
    choices+=("lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client")
    choices+=("nimbus-cl-only.yml" "Nimbus (Nim) - consensus client")
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    choices+=("teku-cl-only.yml" "Teku (Java) - consensus client")
    choices+=("lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client")
  elif [[ "${arch}" =~ (aarch64|arm64) ]]; then
    choices+=("nimbus-cl-only.yml" "Nimbus (Nim) - consensus client")
    if [[ "${NETWORK}" != "mainnet" ]]; then
      choices+=("nimbus-unified.yml" "Nimbus Unified (Nim) - consensus and execution client - beta")
    fi
    choices+=("grandine-cl-only.yml" "Grandine (Rust) - consensus client")
    choices+=("lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client")
    choices+=("lighthouse-cl-only.yml" "Lighthouse (Rust) - consensus client")
    choices+=("teku-cl-only.yml" "Teku (Java) - consensus client")
    choices+=("prysm-cl-only.yml" "Prysm (Go) - consensus client")
    choices+=("caplin.yml" "Caplin (Go) - Erigon's built-in CL")
  elif [[ "${arch}" =~ riscv64 ]]; then
    choices+=("nimbus-cl-only.yml" "Nimbus (Nim) - consensus client")
    if [[ "${NETWORK}" != "mainnet" ]]; then
      choices+=("nimbus-unified.yml" "Nimbus Unified (Nim) - consensus and execution client - beta")
    fi
  else
    choices+=("teku-cl-only.yml" "Teku (Java) - consensus client")
    choices+=("grandine-cl-only.yml" "Grandine (Rust) - consensus client")
    choices+=("lighthouse-cl-only.yml" "Lighthouse (Rust) - consensus client")
    choices+=("nimbus-cl-only.yml" "Nimbus (Nim) - consensus client")
    if [[ "${NETWORK}" != "mainnet" ]]; then
      choices+=("nimbus-unified.yml" "Nimbus Unified (Nim) - consensus and execution client - beta")
    fi
    choices+=("lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client")
    choices+=("prysm-cl-only.yml" "Prysm (Go) - consensus client")
    choices+=("caplin.yml" "Caplin (Go) - Erigon's built-in CL")
  fi

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)

  if [[ "${CONSENSUS_CLIENT}" = "nimbus-cl-only.yml" && "${NETWORK}" = "gnosis" ]]; then
    __write_vars+=("NIM_DOCKERFILE")
    NIM_DOCKERFILE=Dockerfile.sourcegnosis
  fi

  if [[ "${CONSENSUS_CLIENT}" = "nimbus-cl-only.yml" && "${arch}" =~ riscv64 ]]; then
    __write_vars+=("NIM_DOCKERFILE")
    NIM_DOCKERFILE=Dockerfile.source
  fi

# This only works when __query_consensus_only_client is always called first
  CORE_FILES="${CONSENSUS_CLIENT}"

  CL_NODE=http://consensus:5052

  echo "Your consensus client file is:" "${CONSENSUS_CLIENT}"
}


# Always called from __query_execution_client, __write_vars already has EL_NODE
__query_custom_execution_client() {
  local var

  __write_vars+=("JWT_SECRET")

  if [[ "${__minty_fresh}" -eq 1 ]]; then
    EL_NODE=""
    JWT_SECRET=""
  else
    var="EL_NODE"
    __get_value_from_env "${var}" "${__env_file}" "${var}"
    var="JWT_SECRET"
    __get_value_from_env "${var}" "${__env_file}" "${var}"
  fi
  EL_NODE=$(whiptail --title "Configure custom execution client" --inputbox "What is the URL for your custom \
execution client? (right-click to paste)" 10 65 "${EL_NODE}" 3>&1 1>&2 2>&3)

  echo "Your custom execution client is: $EL_NODE"

  while true; do
    JWT_SECRET=$(whiptail --title "Configure JWT secret" --inputbox "What is the JWT secret shared with the \
execution client? (right-click to paste)" 10 60 "${JWT_SECRET}" 3>&1 1>&2 2>&3)

    # Remove '0x' prefix if present
    JWT_SECRET=${JWT_SECRET#0x}

    # Check if the JWT_SECRET is exactly 64 hex characters long
    if [[ $JWT_SECRET =~ ^[0-9A-Fa-f]{64}$ ]]; then
      echo "JWT Secret set. Please make sure it matches on CL and EL."
      break
    else
      whiptail --msgbox "The JWT secret needs to be exactly 32 bytes, 64 hex characters long. You can try \
again or Cancel on the next screen." 10 65
    fi
  done
}


__query_execution_client() {
  local -a choices=()
  local arch
  local num_items
  local menu_height

  if [[ "${CONSENSUS_CLIENT}" = "nimbus-unified.yml" ]]; then
    EXECUTION_CLIENT="NONE"
    return 0
  fi

  __write_vars+=("EL_NODE")

  if [[ "${CONSENSUS_CLIENT}" = "caplin.yml" ]]; then
    EXECUTION_CLIENT="erigon.yml"
    echo "Your execution client file is:" "${EXECUTION_CLIENT}"
    CORE_FILES+=":${EXECUTION_CLIENT}"
    EL_NODE="http://execution:8551"
    return 0
  fi

  arch=$(uname -m)

  if [[ "${NETWORK}" = "gnosis" ]]; then
    choices+=("nethermind.yml" "Nethermind (.NET)")
    choices+=("erigon.yml" "Erigon (Go)")
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    if [[ "${arch}" != *"riscv64"* ]]; then
      choices+=("besu.yml" "Besu (Java)")
    else
      echo "Epheremy testnet is not supported on ${arch}"
      exit 1
    fi
  elif [[ "${arch}" =~ (aarch64|arm64) ]] ; then
    choices+=("reth.yml" "Reth (Rust)")
    choices+=("besu.yml" "Besu (Java)")
    choices+=("nethermind.yml" "Nethermind (.NET)")
    choices+=("erigon.yml" "Erigon (Go)")
    choices+=("geth.yml" "Geth (Go)")
    choices+=("ethrex.yml" "Ethrex (Rust)")
  elif [[ "${arch}" =~ riscv64 ]]; then
    choices+=("geth.yml" "Geth (Go)")
    choices+=("ethrex.yml" "Ethrex (Rust)")
  else
    choices+=("reth.yml" "Reth (Rust)")
    choices+=("besu.yml" "Besu (Java)")
    choices+=("nethermind.yml" "Nethermind (.NET)")
    choices+=("erigon.yml" "Erigon (Go)")
    choices+=("geth.yml" "Geth (Go)")
    choices+=("ethrex.yml" "Ethrex (Rust)")
  fi

  if [[ ! "${arch}" =~ riscv64 && "${NETWORK}" =~ (hoodi|sepolia) ]]; then
    choices+=("nimbus-el.yml" "Nimbus (Nim) - beta")
  fi

  choices+=("NONE" "Custom - Distributed")
  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  EXECUTION_CLIENT=$(whiptail --notags --title "Select execution client" --menu \
    "Which execution client do you want to run?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)

  if [[ "${arch}" =~ riscv64 ]]; then
    case "${EXECUTION_CLIENT}" in
      "geth.yml")
        __write_vars+=("GETH_DOCKERFILE")
        GETH_DOCKERFILE=Dockerfile.source
        ;;
      "ethrex.yml")
        __write_vars+=("ETHREX_DOCKERFILE")
        ETHREX_DOCKERFILE=Dockerfile.source
        ;;
    esac
  fi

  if [[ "${EXECUTION_CLIENT}" = "NONE" ]]; then
    __query_custom_execution_client
  else
    echo "Your execution client file is:" "${EXECUTION_CLIENT}"
    EL_NODE="http://execution:8551"
    CORE_FILES+=":${EXECUTION_CLIENT}"
  fi
}


__query_ssv_client() {
  local -a choices=()
  local num_items
  local menu_height

  choices+=("ssv.yml" "SSV Node (Go)")
  choices+=("anchor.yml" "Anchor (Rust)")

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  SSV_CLIENT=$(whiptail --notags --title "Select SSV client" --menu \
    "Which SSV client do you want to run?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)

  CORE_FILES+=":${SSV_CLIENT}"

  echo "Your SSV client file is:" "${SSV_CLIENT}"
}


__query_4444() {
  local -a choices=()
  local num_items
  local menu_height

  __write_vars+=("EL_NODE_TYPE")

  if [[ "${EXECUTION_CLIENT}" = "NONE" ]]; then
    EL_NODE_TYPE=full
    return
  fi

  # ssv should have pre-merge followed by rolling and full; rpc should have full and archive followed by pre-merge and rolling
  # All others in order of more disk space used
  if [[ ! "${__deployment}" =~ ^(rpc|.*ssv)$ && ! "${EXECUTION_CLIENT}" =~ ^(ethrex\.yml|geth\.yml)$ ]]; then
    choices+=("rolling-expiry" "Rolling expiry")
  fi
  if [[ "${__deployment}" != "rpc" ]]; then
    choices+=("pre-merge-expiry" "Pre-merge expiry")
  fi
  if [[ "${__deployment}" =~ ^(.*ssv)$ && ! "${EXECUTION_CLIENT}" =~ ^(ethrex\.yml|geth\.yml)$ ]]; then
    choices+=("rolling-expiry" "Rolling expiry")
  fi
  choices+=("full" "Full node without expiry, 4TB disk or more")
  if [[ "${__deployment}" = "rpc" ]]; then
    if [[ "${EXECUTION_CLIENT}" != "ethrex.yml" ]]; then
      choices+=("archive" "Archive node, 4TB disk or more")
    fi
    choices+=("pre-merge-expiry" "Pre-merge expiry")
    if [[ ! "${EXECUTION_CLIENT}" =~ ^(ethrex\.yml|geth\.yml)$ ]]; then
      choices+=("rolling-expiry" "Rolling expiry")
    fi
  fi

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  EL_NODE_TYPE=$(whiptail --notags --title "Select execution layer history" --menu \
    "Select the amount of execution layer history to keep" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)
}


__query_reth_snapshot() {
  if [[ "${EXECUTION_CLIENT}" != "reth.yml" || "${NETWORK}" != "mainnet" ]]; then
    return
  fi

  __write_vars+=("RETH_SNAPSHOT")

  if whiptail --title "Reth snapshot" --yesno "Do you want to speed up Reth sync by using a database snapshot?" 10 65; then
    RETH_SNAPSHOT=true
  else
    RETH_SNAPSHOT=""
  fi
}


__query_web3signer() {
  if [[ "${__minty_fresh}" -eq 0 ]]; then  # Do not force a key migration, only query on fresh install
    return
  fi

  __write_vars+=("WEB3SIGNER")

  if whiptail --title "Web3signer" --yesno "Do you want to keep validator keys in Web3signer?" 10 65; then
    WEB3SIGNER=true
    CORE_FILES+=":web3signer.yml"
  else
    WEB3SIGNER=false
  fi
}


__query_grafana() {
  if whiptail --title "Grafana" --yesno "Do you want to use Grafana dashboards?" 10 65; then
      if [[ "$OSTYPE" = "darwin"* ]] || { [[ "${__docker_exe}" = "podman" ]] && ! systemctl status podman.socket >/dev/null 2>&1 ;} || __dodocker system info --format '{{json .SecurityOptions}}' 2>/dev/null | grep -qi rootless; then
      # macOS doesn't do well with / bind mount - leave node-exporter and cadvisor off by default. Also detect rootless Docker/Podman
        CORE_FILES+=":grafana-rootless.yml:grafana-shared.yml"
      else
        CORE_FILES+=":grafana.yml:grafana-shared.yml"
        __configure_grafana_ufw
      fi
  fi
}


__configure_grafana_ufw() {
  local node_exporter_port
  local ufw_status

  if [[ "${__cannot_sudo}" -eq 1 ]]; then
    return
  fi

  if [[ -z "$(command -v ufw 2>/dev/null)" ]]; then
    return
  fi

  if ! ufw_status=$(${__auto_sudo} ufw status 2>/dev/null); then
    return
  fi
  if [[ "${ufw_status}" != *"Status: active"* ]]; then
    return
  fi

  var=NODE_EXPORTER_PORT
  __get_value_from_env "${var}" "${__env_file}" "__value"
  node_exporter_port="${__value:-9199}"

  if [[ "${ufw_status}" == *"${node_exporter_port}/tcp"*"ALLOW"*"172.16.0.0/12"* ]] &&
     [[ "${ufw_status}" == *"${node_exporter_port}/tcp"*"ALLOW"*"192.168.0.0/16"* ]]; then
    return
  fi

  echo "UFW is active and Grafana's node-exporter rules are missing. Adding them for port ${node_exporter_port}."
  ${__auto_sudo} ufw allow proto tcp from 172.16.0.0/12 to any port "${node_exporter_port}" comment "node-exporter from Docker"
  ${__auto_sudo} ufw allow proto tcp from 192.168.0.0/16 to any port "${node_exporter_port}" comment "node-exporter from Docker"
}


__query_remote_beacon() {
  local var

  __write_vars+=("CL_NODE")

  if [[ "${__minty_fresh}" -eq 1 ]]; then
    if [[ "${__deployment}" = "rocket" ]]; then
      CL_NODE="http://eth2:5052"
    else
      CL_NODE=""
    fi
  else
    var="CL_NODE"
    __get_value_from_env "${var}" "${__env_file}" "${var}"
  fi
  CL_NODE=$(whiptail --title "Configure remote consensus client" --inputbox "What is the URL for your remote \
consensus client? (right-click to paste)" 10 60 "${CL_NODE}" 3>&1 1>&2 2>&3)

  echo "Your remote consensus client is:" "${CL_NODE}"
}


__query_checkpoint_beacon() {
  local var

  if [[ "${__minty_fresh}" -eq 1 || "${__network_change}" -eq 1 ]]; then
    CHECKPOINT_SYNC_URL=""
  else
    var="CHECKPOINT_SYNC_URL"
    __get_value_from_env "${var}" "${__env_file}" "${var}"
  fi
  if [[ -z "${CHECKPOINT_SYNC_URL}" ]]; then
    case "${NETWORK}" in
      sepolia)
        CHECKPOINT_SYNC_URL="https://checkpoint-sync.sepolia.ethpandaops.io"
        ;;
      hoodi)
        CHECKPOINT_SYNC_URL="https://hoodi.checkpoint.sigp.io"
        ;;
      plataberget)
        CHECKPOINT_SYNC_URL="https://checkpoint-sync.plataberget.ethpandaops.io"
        ;;
      ephemery)
        CHECKPOINT_SYNC_URL="https://ephemery.beaconstate.ethstaker.cc"
        ;;
      mainnet)
        CHECKPOINT_SYNC_URL="https://sync-mainnet.beaconcha.in"
        ;;
      gnosis)
        CHECKPOINT_SYNC_URL="https://checkpoint.gnosischain.com"
        ;;
      *)
        CHECKPOINT_SYNC_URL=""
        ;;
    esac
  fi

  CHECKPOINT_SYNC_URL=$(whiptail --title "Configure CL checkpoint sync URL" --inputbox "What is the URL for your CL \
checkpoint sync provider? (right-click to paste)" 10 65 "${CHECKPOINT_SYNC_URL}" 3>&1 1>&2 2>&3)

  echo "Your checkpoint sync URL is:" "${CHECKPOINT_SYNC_URL}"
}


__query_graffiti() {
  local var

  __write_vars+=("GRAFFITI" "DEFAULT_GRAFFITI")

  var="GRAFFITI"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
  var="DEFAULT_GRAFFITI"  # "true" in default.env
  __get_value_from_env "${var}" "${__env_file}" "${var}"

  while true; do
    GRAFFITI=$(whiptail --title "Configure Graffiti" --inputbox "What optional Graffiti do you want to send with your blocks? \
(up to 32 characters)" 10 65 "${GRAFFITI}" 3>&1 1>&2 2>&3)

    if [[ $(echo -n "${GRAFFITI}" | wc -c) -gt 32 ]]; then
      whiptail --msgbox "The graffiti string cannot be longer than 32 characters. Emojis count as 4, each." 16 65
    else
      break
    fi
  done

  if [[ -n "${GRAFFITI}" ]]; then
    DEFAULT_GRAFFITI="false"
  else
    if whiptail --title "Default Graffiti" --yesno "Do you want to use the client's default Graffiti?" 10 65; then
      DEFAULT_GRAFFITI="true"
    else
      DEFAULT_GRAFFITI="false"
    fi
  fi

  if [[ "${DEFAULT_GRAFFITI}" = "true" ]]; then
    echo "You are using the client's default Graffiti"
  else
    echo "your Graffiti is:" "${GRAFFITI}"
  fi
}


__query_checkpoint_sync() {
  __write_vars+=("CHECKPOINT_SYNC_URL")

  if [[ "${NETWORK}" =~ ^https?:// ]]; then
    CHECKPOINT_SYNC_URL=""
    return
  fi
  __query_checkpoint_beacon
}


__query_fee_recipient() {
  local var
  local exitstatus

  __write_vars+=("FEE_RECIPIENT")

  var="FEE_RECIPIENT"
  __get_value_from_env "${var}" "${__env_file}" "FEE_RECIPIENT"

  while true; do
    set +e # Can't rely on the error handler here because of the special-casing below for update()
    if [[  "${__during_update}" -eq 0 && "${__deployment}" =~ "lido_" ]]; then  # Lido Execution Layer Rewards Vault
      case "${NETWORK}" in
        mainnet)
          FEE_RECIPIENT="0x388C818CA8B9251b393131C08a736A67ccB19297"
          ;;
        hoodi)
          FEE_RECIPIENT="0x9b108015fe433F173696Af3Aa0CF7CDb3E104258"
          ;;
        *)
          FEE_RECIPIENT="0x0000000000000000000000000000000000000000"
          ;;
      esac
    elif [[ "${__during_update}" -eq 1 || ! "${__deployment}" = rpc ]]; then
      FEE_RECIPIENT=$(whiptail --title "Configure rewards address" --inputbox "What is the address you want \
transaction rewards to be sent to by default? (right-click to paste, CANNOT be an ENS)" 10 65 "${FEE_RECIPIENT}" \
3>&1 1>&2 2>&3)
    else
      FEE_RECIPIENT=$(whiptail --title "Configure fallback fee recipient" --inputbox "What is the fallback fee recipient \
address? Required so that a) the CL doesn't print warnings and b) you can use the CL REST API for validators. \
(right-click to paste, CANNOT be an ENS)" 12 65 \
"${FEE_RECIPIENT}" 3>&1 1>&2 2>&3)
    fi

    exitstatus=$?
    set -e
    if [[ "${exitstatus}" -eq 0 ]]; then
      if [[ "${FEE_RECIPIENT}" = 0x* && "${#FEE_RECIPIENT}" -eq 42 ]]; then
        echo "Your rewards address is: ${FEE_RECIPIENT}"
        break
      else
        whiptail --msgbox "${FEE_RECIPIENT} is not a valid ETH address. You can try again or Cancel on the next \
screen.\n\nThe client will not start successfully until a valid ETH rewards address has been set." 16 65
      fi
    else
      if [[ "${__during_update}" -eq 1 ]]; then
        echo
        echo "Please make requested changes manually or run \"${__me} update\" again"
        echo "before running \"${__me} up\"."
        echo
        echo "Without a FEE_RECIPIENT set in \"${__env_file}\", containers will not"
        echo "start successfully. Already running containers will keep running with the"
        echo "old configuration until you are ready to restart them."
      else
        echo "Canceled config wizard."
      fi
      echo
      exit 130
    fi
  done
}


__query_mev() {
  local var
  local selected
  local -A relays=()
  local -A optional_relays=()
  local -a choices=()
  local num_items
  local menu_height
  local relay
  local message
  local default
  local message_mandatory=""
  local aestus_default="ON"
  local agnostic_default="ON"
  local bloxroute_default="ON"
  local flashbots_default="ON"
  local titan_global_default="ON"
  local titan_regional_default="ON"
  local ultrasound_default="ON"
  local ultrasound_filtered_default="ON"

  __write_vars+=("MEV_BOOST" "MEV_RELAYS")

  if [[ ! "${NETWORK}" =~ ^(mainnet|hoodi|sepolia)$ ]]; then
    MEV_BOOST="false"
    MEV_RELAYS=""
    return 0
  fi

  if [[ "${__deployment}" =~ (validator|rocket) ]]; then
    if whiptail --title "MEV Boost" --yesno "Is MEV Boost configured on your remote consensus client and do you \
want to use MEV Boost?" 10 65; then
      MEV_BOOST="true"
    else
      MEV_BOOST="false"
    fi
    MEV_RELAYS=""
    return 0
  fi

  if [[ "${__deployment}" = "ssv" ]]; then  # Don't give the user a choice and configure all relays that SSV knows about
    MEV_BOOST="true"
    case "${NETWORK}" in
      hoodi)
        MEV_RELAYS='"
https://0x98f0ef62f00780cf8eb06701a7d22725b9437d4768bb19b363e882ae87129945ec206ec2dc16933f31d983f8225772b6@hoodi.aestus.live,
https://0xafa4c6985aa049fb79dd37010438cfebeb0f2bd42b115b89dd678dab0670c1de38da0c4e9138c9290a398ecd9a0b3110@boost-relay-hoodi.flashbots.net,
https://0xaa58208899c6105603b74396734a6263cc7d947f444f396a90f7b7d3e65d102aec7e5e5291b27e08d02c50a050825c2f@hoodi.titanrelay.xyz,
https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-hoodi.ultrasound.money
"'
        ;;
      mainnet)
        MEV_RELAYS='"
https://0xa15b52576bcbf1072f4a011c0f99f9fb6c66f3e1ff321f11f461d15e31b1cb359caa092c71bbded0bae5b5ea401aab7e@aestus.live,
https://0xa7ab7a996c8584251c8f925da3170bdfd6ebc75d50f5ddc4050a6fdc77f2a3b5fce2cc750d0865e05d7228af97d69561@agnostic-relay.net,
https://0xb0b07cd0abef743db4260b0ed50619cf6ad4d82064cb4fbec9d3ec530f7c5e6793d9f286c4e082c0244ffb9f2658fe88@bloxroute.regulated.blxrbdn.com,
https://0xac6e77dfe25ecd6110b8e780608cce0dab71fdd5ebea22a16c0205200f2f8e2e3ad3b71d3499c54ad14d6c21b41a37ae@boost-relay.flashbots.net,
https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@global.titanrelay.xyz,
https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay.ultrasound.money
"'
        ;;
    esac
    CORE_FILES+=":mev-boost.yml"
    return 0
  fi

  var="MEV_BOOST"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "true" && "${__network_change}" -eq 0 ]]; then  # MEV_BOOST=true was already configured, default disable anything the user hadn't chosen previously
    var="MEV_RELAYS"
    __get_value_from_env "${var}" "${__env_file}" "__value"

    if [[ ! "${__value}" =~ aestus ]]; then
      aestus_default="OFF"
    fi
    if [[ ! "${__value}" =~ agnostic ]]; then
      agnostic_default="OFF"
    fi
    if [[ ! "${__value}" =~ bloxroute ]]; then
      bloxroute_default="OFF"
    fi
    if [[ ! "${__value}" =~ flashbots ]]; then
      flashbots_default="OFF"
    fi
    if [[ ! "${__value}" =~ (hoodi\.titanrelay|global.\titanrelay) ]]; then
      titan_global_default="OFF"
    fi
    if [[ ! "${__value}" =~ regional\.titanrelay ]]; then
      titan_regional_default="OFF"
    fi
    if [[ ! "${__value}" =~ (relay\.ultrasound|relay-hoodi\.ultrasound) ]]; then
      ultrasound_default="OFF"
    fi
    if [[ ! "${__value}" =~ relay-filtered.*\.ultrasound ]]; then
      ultrasound_filtered_default="OFF"
    fi
  fi

  if [[ "${__deployment}" =~ lido_ ]]; then
    MEV_BOOST="true"
    case "${NETWORK}" in
      mainnet)
        relays=(
          ['Aestus']="https://0xa15b52576bcbf1072f4a011c0f99f9fb6c66f3e1ff321f11f461d15e31b1cb359caa092c71bbded0bae5b5ea401aab7e@aestus.live"
          ['Agnostic']="https://0xa7ab7a996c8584251c8f925da3170bdfd6ebc75d50f5ddc4050a6fdc77f2a3b5fce2cc750d0865e05d7228af97d69561@agnostic-relay.net"
          ['bloXroute']="https://0xb0b07cd0abef743db4260b0ed50619cf6ad4d82064cb4fbec9d3ec530f7c5e6793d9f286c4e082c0244ffb9f2658fe88@bloxroute.regulated.blxrbdn.com"
          ['Flashbots']="https://0xac6e77dfe25ecd6110b8e780608cce0dab71fdd5ebea22a16c0205200f2f8e2e3ad3b71d3499c54ad14d6c21b41a37ae@boost-relay.flashbots.net"
          ['Ultra Sound']="https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay.ultrasound.money"
          ['Ultra Sound Filtered']="https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay-filtered.ultrasound.money"
        )
        optional_relays=(
          ['Titan Global']="https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@global.titanrelay.xyz"
          ['Titan Regional']='https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@regional.titanrelay.xyz'
        )
        choices=(
          "Aestus" "(unfiltered)" "${aestus_default}"
          "Agnostic" "(unfiltered)" "${agnostic_default}"
          "bloXroute" "" "${bloxroute_default}"
          "Flashbots" "" "${flashbots_default}"
          "Ultra Sound" "(unfiltered)" "${ultrasound_default}"
          "Ultra Sound Filtered" "" "${ultrasound_filtered_default}"
          "Titan Global" "(optional, unfiltered)" "${titan_global_default}"
          "Titan Regional" "(optional)" "${titan_regional_default}"
        )
        message_mandatory="mandatory "
        ;;
      hoodi)
        relays=(
          ['Aestus']="https://0x98f0ef62f00780cf8eb06701a7d22725b9437d4768bb19b363e882ae87129945ec206ec2dc16933f31d983f8225772b6@hoodi.aestus.live"
          ['Flashbots']="https://0xafa4c6985aa049fb79dd37010438cfebeb0f2bd42b115b89dd678dab0670c1de38da0c4e9138c9290a398ecd9a0b3110@boost-relay-hoodi.flashbots.net"
          ['Titan']="https://0xaa58208899c6105603b74396734a6263cc7d947f444f396a90f7b7d3e65d102aec7e5e5291b27e08d02c50a050825c2f@hoodi.titanrelay.xyz"
          ['Ultra Sound']="https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-hoodi.ultrasound.money"
          ['Ultra Sound Filtered']="https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-filtered-hoodi.ultrasound.money"
        )
        choices=(
          "Aestus" "(unfiltered)" "${aestus_default}"
          "Flashbots" "" "${flashbots_default}"
          "Titan" "(unfiltered)" "${titan_global_default}"
          "Ultra Sound" "(unfiltered)" "${ultrasound_default}"
          "Ultra Sound Filtered" "" "${ultrasound_filtered_default}"
        )
        ;;
      *)
        echo "No MEV RELAYS configured for ${NETWORK}"
        MEV_BOOST=false
        MEV_RELAYS=""
        return 0
        ;;
    esac
  else  # Not lido_ deployment
    if [[ "${__deployment}" = "rpc" ]]; then
      message="Do you want to use MEV Boost, e.g. because you will connect validators to CL REST API?"
      default="--defaultno"
    else
      message="Do you want to use MEV Boost?"
      default=""
    fi
    if ! whiptail --title "MEV Boost" --yesno "${message}" 10 65 "${default}"; then
      MEV_BOOST="false"
      MEV_RELAYS=""
      __final_msg+="\nYou are configured to build blocks locally, only.\nPlease ensure you have 200 Mbit/s upload bandwidth or more."
      return 0
    else
      MEV_BOOST="true"
    fi

    case "${NETWORK}" in
      sepolia)
        relays=(
          ['Flashbots']="https://0x845bd072b7cd566f02faeb0a4033ce9399e42839ced64e8b2adcfc859ed1e8e1a5a293336a49feac6d9a5edb779be53a@boost-relay-sepolia.flashbots.net"
        )
        choices=(
          "Flashbots" "" "${flashbots_default}"
        )
        ;;
      hoodi)
        relays=(
          ['Aestus']="https://0x98f0ef62f00780cf8eb06701a7d22725b9437d4768bb19b363e882ae87129945ec206ec2dc16933f31d983f8225772b6@hoodi.aestus.live"
          ['Flashbots']="https://0xafa4c6985aa049fb79dd37010438cfebeb0f2bd42b115b89dd678dab0670c1de38da0c4e9138c9290a398ecd9a0b3110@boost-relay-hoodi.flashbots.net"
          ['Titan']="https://0xaa58208899c6105603b74396734a6263cc7d947f444f396a90f7b7d3e65d102aec7e5e5291b27e08d02c50a050825c2f@hoodi.titanrelay.xyz"
          ['Ultra Sound']="https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-hoodi.ultrasound.money"
          ['Ultra Sound Filtered']="https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-filtered-hoodi.ultrasound.money"
        )
        choices=(
          "Aestus" "(unfiltered)" "${aestus_default}"
          "Flashbots" "" "${flashbots_default}"
          "Titan" "(unfiltered)" "${titan_global_default}"
          "Ultra Sound" "(unfiltered)" "${ultrasound_default}"
          "Ultra Sound Filtered" "" "${ultrasound_filtered_default}"
        )
        ;;
      mainnet)
        relays=(
          ['Aestus']="https://0xa15b52576bcbf1072f4a011c0f99f9fb6c66f3e1ff321f11f461d15e31b1cb359caa092c71bbded0bae5b5ea401aab7e@aestus.live"
          ['Agnostic']="https://0xa7ab7a996c8584251c8f925da3170bdfd6ebc75d50f5ddc4050a6fdc77f2a3b5fce2cc750d0865e05d7228af97d69561@agnostic-relay.net"
          ['bloXroute']="https://0xb0b07cd0abef743db4260b0ed50619cf6ad4d82064cb4fbec9d3ec530f7c5e6793d9f286c4e082c0244ffb9f2658fe88@bloxroute.regulated.blxrbdn.com"
          ['Flashbots']="https://0xac6e77dfe25ecd6110b8e780608cce0dab71fdd5ebea22a16c0205200f2f8e2e3ad3b71d3499c54ad14d6c21b41a37ae@boost-relay.flashbots.net"
          ['Titan Global']="https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@global.titanrelay.xyz"
          ['Titan Regional']="https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@regional.titanrelay.xyz"
          ['Ultra Sound']="https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay.ultrasound.money"
          ['Ultra Sound Filtered']="https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay-filtered.ultrasound.money"
        )
        choices=(
          "Aestus" "(unfiltered)" "${aestus_default}"
          "Agnostic" "(unfiltered)" "${agnostic_default}"
          "bloXroute" "" "${bloxroute_default}"
          "Flashbots" "" "${flashbots_default}"
          "Titan Global" "(unfiltered)" "${titan_global_default}"
          "Titan Regional" "" "${titan_regional_default}"
          "Ultra Sound" "(unfiltered)" "${ultrasound_default}"
          "Ultra Sound Filtered" "" "${ultrasound_filtered_default}"
        )
        ;;
    esac
  fi

# We have relays(), maybe optional_relays(), and choices(). Prompt user and construct MEV_RELAYS

  num_items=$(( ${#choices[@]} / 3 ))
  menu_height=$(( 8 + num_items ))

  MEV_RELAYS='"'$'\n'
  while true; do
    selected=$(whiptail --title "Relays list" --checklist \
      "Choose relays (use spacebar to unselect)" "${menu_height}" 65 "${num_items}" \
      "${choices[@]}" \
      3>&1 1>&2 2>&3)

    if [[ -z "${selected}" ]]; then
      whiptail --msgbox "At least one ${message_mandatory}relay should be chosen" 10 65
      continue
    fi

    for relay in "${!relays[@]}"; do
      if [[ ${selected} =~ \"${relay}\" ]]; then
        MEV_RELAYS+="${relays[$relay]},"$'\n'
      fi
    done

    for relay in "${!optional_relays[@]}"; do
      if [[ ${selected} =~ \"${relay}\" ]]; then
        MEV_RELAYS+="${optional_relays[$relay]},"$'\n'
      fi
    done
# Remove trailing comma and add closing quote
    MEV_RELAYS="${MEV_RELAYS%,$'\n'}"$'\n'
    MEV_RELAYS+='"'
    break
  done

  CORE_FILES+=":mev-boost.yml"
  echo "Your MEV relay(s): ${MEV_RELAYS}"
  __final_msg+="\nYou are configured to get block building bids remotely via relay(s)."
}


__query_mev_factor() {
  local var
  local message
  local default
  local speed_json
  local down_speed
  local up_speed
  local max_blobs

  var="MEV_BUILD_FACTOR"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
# If MEV_BUILD_FACTOR is already set to a non-default value, or MEV Boost is not enabled, or the user is using a CL-only deployment, leave as-is
  if [[ ( -n "${MEV_BUILD_FACTOR}" && ! "${MEV_BUILD_FACTOR}" =~ ^(90|100)$ ) || "${MEV_BOOST}" != "true" || "${CONSENSUS_CLIENT}" =~ -cl-only\.yml ]]; then
    return
  fi

  if [[ ! "${__distro}" =~ (ubuntu|debian) ]]; then
    __final_msg+="\nCannot measure network speed on ${__distro}. Please ensure you have 112 Mbit/s up or set MEV_BUILD_FACTOR=100 or set MAX_BLOBS."
    return
  fi

  if ! dpkg-query -W -f='${Status}' speedtest-cli 2>/dev/null | grep -q "ok installed" || ! dpkg-query -W -f='${Status}' jq 2>/dev/null | grep -q "ok installed"; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      echo "Installing speedtest-cli and jq"
      if ! { ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install -y --no-install-recommends speedtest-cli jq; }; then
        echo "Cannot install speedtest-cli and jq, skipping MEV Build Factor query"
        return
      fi
    else
      echo "Cannot install speedtest-cli and jq, skipping MEV Build Factor query"
      return
    fi
  fi

  echo "Running speedtest"
  set +e
  speed_json=$(speedtest-cli --secure --json)
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Speedtest failed, skipping MEV Build Factor query"
    return
  fi

# From here we know that we'll set these variables
  __write_vars+=("MEV_BUILD_FACTOR" "MAX_BLOBS")

  down_speed=$(jq -r '.download' <<< "${speed_json}" | awk '{print int($1 / 1000000)}')
  up_speed=$(jq -r '.upload' <<< "${speed_json}" | awk '{print int($1 / 1000000)}')
  echo "Measured download speed is ${down_speed} Mbit/s."
  echo
  __final_msg+="\nYour measured upload speed is ${up_speed} Mbit/s.\nYour measured download speed is ${down_speed} Mbit/s."
  if [[ "${up_speed}" -lt 112 ]]; then  # This should be adjusted as BPOs come in. 112 is BPO2
    echo "Your upload speed is less than 112 Mbit/s, it is ${up_speed} Mbit/s"
    max_blobs=$(echo "${up_speed}" | awk '{print int($1 / 5.33)}')
    if [[ "${max_blobs}" -eq 0 ]]; then
      echo "Your upload speed is too low to upload any blobs"
      echo "Disabling local block building by setting MEV_BUILD_FACTOR to 100"
      MEV_BUILD_FACTOR="100"
      MAX_BLOBS="0"
      __final_msg+="\nLocal block building was disabled, because your upload speed is low."
    else
      echo "You can upload up to ${max_blobs} with your upload speed"
      echo "Setting default MEV_BUILD_FACTOR and MAX_BLOBS=${max_blobs}"
      MEV_BUILD_FACTOR=""
      MAX_BLOBS="${max_blobs}"
      __final_msg+="\nBlobs were restricted to ${max_blobs} max, because your upload speed is low."
    fi
  else
    message="Your upload speed is ${up_speed} Mbit/s. Do you want to build local blocks, when the relay pays less than 10% more?"
    if whiptail --title "MEV Build Factor" --yesno "${message}" 10 65; then
      MEV_BUILD_FACTOR="90"
      __final_msg+="\nLocal block building is preferred, when the relay pays less than 10% more."
    else
      MEV_BUILD_FACTOR="100"
      __final_msg+="\nLocal block building is disabled."
    fi
    MAX_BLOBS=""
  fi
}


# Remove when Nethermind enables log index by default
# Called after __query_execution_client when configuring something that needs
# receipts, such as RPC and SSV
__set_nethermind_log_index() {
  local var

  if [[ "${EXECUTION_CLIENT}" != "nethermind.yml" ]]; then
    return
  fi

  var="EL_EXTRAS"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
  if [[ "${EL_EXTRAS}" =~ LogIndex\.Enabled|logindex-enabled ]]; then
    echo "Nethermind log index is already configured, making no changes"
    return
  fi

  echo "Enabling Nethermind log index via \"EL_EXTRAS\" in \".env\""
  __write_vars+=("EL_EXTRAS")
  if [[ -z "${EL_EXTRAS}" ]]; then
    EL_EXTRAS="--LogIndex.Enabled true"
  else
    EL_EXTRAS+=" --LogIndex.Enabled true"
  fi
}


__lido_withdrawal_credentials_address() {
  local lido_address

  case "${NETWORK}" in  # Lido Withdrawal Vault
    mainnet)
      lido_address="0xB9D7934878B5FB9610B3fE8A5e441e8fad7E293f"
      ;;
    hoodi)
      lido_address="0x4473dCDDbf77679A643BdB654dbd86D67F8d32f2"
      ;;
    *)
      lido_address="0x0000000000000000000000000000000000000000"
      ;;
  esac
  echo "${lido_address}"
}


__lido_keys_attention_message() {
  whiptail --title "Attention" --msgbox "Please, make sure that you set 32 ETH when you generate deposit data\nAnd use the right withdrawal address for your validator \
keys: $(__lido_withdrawal_credentials_address)\nOtherwise, your keys will not be valid!" 10 65
}


__query_lido_keys_generation() {
  local num_validators=1
  local keystore_password=""
  local keystore_password_confirm=""
  local mnemonic
  local exitstatus

  if [[ "${NETWORK}" = "mainnet" ]]; then
    if whiptail --title "Security warning" --yesno "Key generation is not recommended on MAINNET for security reasons.\n\nIt is recommended to Select 'No' to skip the \
step and generate keys in a more secure way later (ex. on an airgapped live USB)\n\nOtherwise, Select 'Yes' to proceed with key generation on this machine" 15 65 --defaultno; then
       echo "Proceeding with key generation on MAINNET."
    else
       __lido_keys_attention_message
       return 0
    fi
  fi

  num_validators=$(whiptail --title "Validators count" --inputbox "Enter the number of validators" 8 65 "${num_validators}" 3>&1 1>&2 2>&3)

  while true; do
    keystore_password=$(whiptail --title "Keystore password" --passwordbox "Enter validators keystore password (at least 12 chars)" 8 65 "${keystore_password}" 3>&1 1>&2 2>&3)
    if [[ ${#keystore_password} -ge 12 ]]; then
      keystore_password_confirm=$(whiptail --title "Keystore password" --passwordbox "Confirm validators keystore password" 8 65 "${keystore_password_confirm}" 3>&1 1>&2 2>&3)
      if [[ "${keystore_password}" = "${keystore_password_confirm}" ]]; then
        echo "Keystore password set."
        break
      else
        whiptail --msgbox "Passwords do not match. Please try again." 10 65
      fi
    else
      whiptail --msgbox "The keystore password secret needs to be at least 12 characters long. You can try again or Cancel on the next screen." 10 65
    fi
  done

  echo "Your number of validators is:" "${num_validators}"
  mnemonic="existing"
  if whiptail --title "Mnemonic" --yesno "Do you want to generate a new mnemonic?" 8 65; then
    mnemonic="new"
  fi

  echo "When prompted to confirm the withdrawal address, use $(__lido_withdrawal_credentials_address)"
  set +e  # Don't fail config if generation fails
  export NETWORK=${NETWORK} && __docompose -f ./deposit-cli.yml --profile tools run --rm deposit-cli-${mnemonic} \
    --uid "$(id -u)" \
    --execution_address "$(__lido_withdrawal_credentials_address)" \
    --num_validators "${num_validators}" \
    --keystore_password "${keystore_password}" \
    --non_interactive
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Something went wrong during key generation. Please, try again."
    read -n 1 -s -r -p "Press any key to continue..."
    __lido_keys_attention_message
  fi
}


__query_lido_obol_enr() {
  local outcome
  local lido_obol_operator_enr

  ${__as_owner} mkdir -p ./.eth/charon
  outcome=$(__docompose -f ./lido-obol.yml run -u "$(id -u)":"$(id -g)" --rm charon-create-enr)
  if [[ "${outcome}" =~ "Created ENR private key:" ]]; then
    lido_obol_operator_enr=$(echo "${outcome}" | grep -e 'enr:')
  else
    echo "Something went wrong. Please, try again."
    exit 1
  fi

  echo "Your created ENR is:" "${lido_obol_operator_enr}"
  echo "${lido_obol_operator_enr}" >> "./.eth/charon-enr-public-key"
  whiptail --title "Lido Obol operator ENR creation outcome" --msgbox "Your ENR is created!\n\n1. Backup your private key (path: .eth/charon-enr-private-key)!\n\
2. Copy your public ENR for the further steps\n\nYour public ENR is:\n\n${lido_obol_operator_enr}" 17 65
}


__query_lido_obol_cluster_definition() {
  local cluster_definition_url
  local cluster_definition_is_valid

  cluster_definition_url=$(whiptail --title "Lido Obol cluster creation" --inputbox "\nPut your cluster definition link below:" 10 65 \
"https://api.obol.tech/dv/example_link_to_your_definition" 3>&1 1>&2 2>&3)
  if [[ -z "${cluster_definition_url}" ]]; then
    echo "Cluster definition URL can't be empty"
    exit 1
  fi
  if ! ${__as_owner} curl -f -o ./.eth/cluster-definition.tmp -s "${cluster_definition_url}" -H "Accept: application/json"; then
    echo "Failed to download cluster definition from the provided URL. Please check the URL and try again."
    read -n 1 -s -r -p "Press any key to continue..."
    exit 1
  fi
  set +e
# shellcheck disable=SC2086
  cluster_definition_is_valid=$(__docompose -f ./lido-obol.yml run --rm -v "$(pwd)"/.eth/cluster-definition.tmp:/cluster-definition.json:ro curl-jq sh -c \
    "cat /cluster-definition.json | jq -r 'all(.validators[]; (.fee_recipient_address | ascii_downcase) == (\"'${FEE_RECIPIENT}'\" | ascii_downcase) and (.withdrawal_address | ascii_downcase) == (\"'$(__lido_withdrawal_credentials_address)'\" | ascii_downcase))'" | tail -n 1)
  set -e
  if [[ "${cluster_definition_is_valid}" = "true" ]]; then
    echo "Your cluster definition url is:" "${cluster_definition_url}"
    ${__as_owner} mv ./.eth/cluster-definition.tmp ./.eth/cluster-definition.json
  else
    whiptail --title "Lido Obol cluster creation" --msgbox "Your cluster definition is not valid.\n\nCheck that every validator has \`fee_recipient_address\` and \`withdrawal_address\` equal to Lido contracts and try again.\n\nLido fee recipient: '${FEE_RECIPIENT}'\nLido withdrawal credentials: '$(__lido_withdrawal_credentials_address)'" 14 90
    echo "Your cluster definition is NOT valid."
    ${__as_owner} rm ./.eth/cluster-definition.tmp
    exit 1
  fi
}


__query_lido_obol_cluster_dkg() {
  local folder_postfix=""
  local outcome
  local exitstatus

  if [[ -d ./.eth/validator_keys ]]; then
    folder_postfix=${EPOCHSECONDS}
    ${__as_owner} mkdir -p "./.eth_backup_${folder_postfix}"
    ${__as_owner} cp -vr ./.eth/validator_keys "./.eth_backup_${folder_postfix}/validator_keys"
    ${__as_owner} rm -rf ./.eth/validator_keys/*
  fi
  if whiptail --title "DKG ceremony" --yesno "Do you want to start DKG ceremony?\n\nMake sure all participants are ready!" 10 65; then
    outcome=$(__docompose -f ./lido-obol.yml run -u "$(id -u)":"$(id -g)" --rm charon-run-dkg)
    exitstatus=$?
    if [[ "${exitstatus}" -ne 0 ]]; then
      echo "Something went wrong. Please, try again."
      exit 1
    fi
    echo "DKG ceremony finished successfully"
    whiptail --title "Finish" --msgbox "\nThe DKG is finished!" 10 65
  else
    whiptail --title "DKG ceremony" --msgbox "You should start DKG ceremony before proceeding further" 8 65
    echo "DKG ceremony starting is canceled"
    exit 1
  fi
}


__query_dkg() {
  local key_file_content
  local public_key
  local ssv_operator_id=-1

  if uname -m | grep -q aarch64 || uname -m | grep -q arm64; then  # No multi-arch image for ssvlabs/ssv-dkg as of April 14th 2026
    return
  fi

  if [[ "${__cannot_sudo}" -eq 1 ]]; then
    whiptail --title "Need sudo" --msgbox "SSV DKG requires your user to have sudo rights" 10 65
    exit 1
  fi

  if whiptail --title "DKG ceremony" --yesno "Do you want to participate in DKG ceremonies as an operator?" 10 65; then
    key_file_content=$(${__auto_sudo} cat ./ssv-config/encrypted_private_key.json)
    public_key=$(__docompose -f ./ssv-dkg.yml run --rm curl-jq sh -c \
      "echo '${key_file_content}' | jq -r '.pubkey'" | tail -n 1)
    printf "\nYour SSV node public key is:\n\n%s\n\nRegister your operator now in the SSV network with the public key, at https://app.ssv.network\n" "${public_key}"
    read -n 1 -s -r -p "Make a note of your SSV Operator ID, then press any key to continue..."
    ssv_operator_id=$(whiptail --title "Input SSV Operator ID" --inputbox "Input your Operator ID (right-click to paste)" 9 65 3>&1 1>&2 2>&3)
    if [[ -n "${ssv_operator_id}" && ! "${ssv_operator_id}" = "-1" ]]; then
      sed -i'.original' "s|operatorID: .*|operatorID: ${ssv_operator_id}|" ./ssv-config/dkg-config.yaml
      echo "Your SSV Operator ID is: ${ssv_operator_id}"
      CORE_FILES+=":ssv-dkg.yml"
    else
      echo "Please manually edit \"./ssv-config/dkg-config.yaml\" with your SSV Operator ID"
      echo "and add \":ssv-dkg.yml\" to \"CORE_FILES\" in \".env\" after registering your operator."
    fi
  fi
  rm -f ssv-config/dkg-config.yaml.original
}


__handle_error() {
  local exitstatus=$1
  local line=$2
  local calling_line=$3

  if [[ -f /tmp/"${__lock_file}" ]]; then
    ${__as_owner} rm -f "/tmp/${__lock_file}"
  fi

  if [[ ! $- =~ e ]]; then
# set +e, do nothing
    return 0
  fi

  if [[ "${exitstatus}" -eq 0 ]]; then
    return 0
  fi

  if [[ "${__handler_ran}" -eq 1 ]]; then
    return 0
  fi
  __handler_ran=1

  echo
  if [[ "${exitstatus}" -eq 130 && "${__during_update}" -ne 1 ]]; then
    echo "${__me} terminated by user"
  elif [[ "${__during_config}" -eq 1 && "${exitstatus}" -eq 1 ]]; then
    echo "Canceled config wizard."
  else
    echo "${__me} terminated with exit code ${exitstatus} on line $line, called from $calling_line"
    if [[ -n "${__command}" ]]; then
      echo "This happened during ${__me} ${__command} ${__params}"
    fi
  fi
  if [[ "${__during_update}" -eq 1 && "${__during_env_migrate}" -eq 1 ]]; then
    cp "${__env_file}" "${__env_file}".partial
    cp "${__env_file}".source "${__env_file}"
    echo
    echo "Restored your ${__env_file} file, to undo partial migration. Please verify it looks correct."
    echo "The partially migrated file is in ${__env_file}.partial for troubleshooting."
  fi
  if [[ "${__during_postgres}" -eq 1 ]]; then
    echo
    if [[ "${__during_pg_migrate}" -eq 1 && "${__pg_migrated}" -eq 0 ]]; then
      echo "Web3signer slashing protection database migration failed, while switching to the migrated data."
      echo
      echo "WARNING: You are no longer protected by the slashing protection database."
      echo "Starting the node again could get you slashed."
      echo "Please look through the upgrade messages and remedy the fault."
      echo
      echo "Marking Web3signer as unsafe to start."
      __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 touch /var/lib/web3signer/.migration_fatal_error
    elif [[ "${__pg_migrated}" -eq 1 ]]; then
      echo "Web3signer slashing protection database migration failed, after switching to the migrated data."
      echo
      echo "The slashing protection database itself is likely fine, but switching to PostgreSQL ${__target_pg}"
      echo "in \"${__env_file}\" through its \"PG_DOCKER_TAG\" variable failed, which is likely to keep your node from functioning correctly."
      echo "Please look through the upgrade messages and remedy the fault."
      echo
      echo "Marking Web3signer with a migration error."
      __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 touch /var/lib/web3signer/.migration_error
    else
      if __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 [ -f /var/lib/web3signer/.migration_error ]; then
        echo "A previous PostgreSQL upgrade attempt failed after switching to the migrated data, and while switching"
        echo "to PostgreSQL ${__target_pg} in \"${__env_file}\"."__
        echo "Web3signer has a marker file \".migration_error\" inside its Docker volume."
        echo
        echo "Please look through the upgrade messages and remedy the fault."
        echo "And only then remove the marker file in the volume."
      elif __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 [ -f /var/lib/web3signer/.migration_fatal_error ]; then
        echo "A previous PostgreSQL upgrade attempt failed and left you unprotected by slashing data."
        echo "Web3signer is marked as unsafe to start, by the file \".migration_fatal_error\" inside its Docker volume"
        echo
        echo "Please look through the upgrade messages and remedy the fault."
        echo "Exercise utmost caution, so you do not accidentally get slashed."
        echo "And only then remove the marker file in the volume."
      else
        echo "Web3signer slashing protection database migration failed, but before removing the original data."
        echo "Please look through the logs of the attempted upgrade, and remedy the fault."
        echo
        echo "Your original Web3signer slashing protection database remains in place."
        echo "If you want an updated node and handle PostgreSQL issues later, you can safely update the node again,"
        echo "this time without migration, and start it."
      fi
    fi
    if [[ -n "${STY:-}" || -n "${TMUX:-}" ]]; then
      echo
      if [[ -n "${STY:-}" ]]; then
        echo "You can scroll through the upgrade messages with arrow keys. Get into scrollback mode first, with \"Ctrl-a ESC\"."
      else
        echo "You can scroll through the upgrade messages with arrow keys. Get into scrollback mode first, with \"Ctrl-b [\"."
      fi
    fi
  fi
}


__check_legacy() {
  local var
  local client

  __value="${COMPOSE_FILE}"

if [[ "${__value}" =~ -allin1\.yml && ! "${__value}" =~ (grandine-allin1\.yml|grandine-plugin-allin1\.yml) ]]; then # Warn re Grandine once VC
    if [[ "${__value}" =~ teku-allin1\.yml ]]; then
      client="Teku"
    elif [[ "${__value}" =~ nimbus-allin1\.yml ]]; then
      client="Nimbus"
    elif [[ "${__value}" =~ (grandine-allin1\.yml|grandine-plugin-allin1\.yml) ]]; then
      client="Grandine"
    else
      client="Mystery"
    fi
    if ! whiptail --title "All-In-One detected" --yesno "All-In-One client ${client} detected. Re-configuration requires re-import of the keys, \
which has to be treated like a move with 15 minutes downtime, to avoid slashing. Do you wish to continue, regardless?" 10 65 --defaultno; then
      echo "Canceled config wizard."
      exit 130
    fi
  fi
}


# Create a SIREN_PASSWORD if there is none
__make_siren_password() {
  local var
  var="SIREN_PASSWORD"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
  if [[ -z "${SIREN_PASSWORD}" ]]; then
    __write_vars+=("SIREN_PASSWORD")
    SIREN_PASSWORD=$(head -c 8 /dev/urandom | od -A n -t u8 | tr -d '[:space:]' | sha256sum | head -c 32)
  fi
}


# Interactive configuration of a node, with CL, EL and VC
__config_node() {
  __query_consensus_client
  if [[ "${CONSENSUS_CLIENT}" =~ ^(caplin.yml|nimbus-unified.yml)$ ]]; then
    __query_validator_client
  fi
  __query_web3signer
  __query_execution_client
  __query_4444
  __query_reth_snapshot
  __query_checkpoint_sync
  __query_mev
  __query_mev_factor
  __query_grafana
  __query_fee_recipient
  __query_graffiti
  if [[ "${NETWORK}" = "hoodi" || "${__deployment}" = "lido_csm" ]]; then
    CORE_FILES+=":deposit-cli.yml"
  fi
}


# Interactive configuration of an RPC node, with CL and EL
__config_rpc() {
  __query_consensus_only_client
  __query_execution_client
  __set_nethermind_log_index  # Remove after Nethermind enables it by default
  __query_4444
  __query_reth_snapshot
  __query_checkpoint_sync
  __query_mev
  __query_grafana
  __query_fee_recipient
}


# Interactive configuration of an SSV node, with CL, EL and SSV node
__config_ssv() {
  if [[ "${NETWORK}" = "hoodi" ]]; then
    sed -i'.original' 's/  Network: .*/  Network: hoodi/' ssv-config/config.yaml
  elif [[ "${NETWORK}" = "mainnet" ]]; then
    sed -i'.original' 's/  Network: .*/  Network: mainnet/' ssv-config/config.yaml
  else
    echo "${NETWORK} is not something that works with SSV."
    echo "Please choose Hoodi or Mainnet when running \"${__me} config\" again"
    echo "Aborting."
    exit 1
  fi
  rm ssv-config/config.yaml.original
  __query_consensus_only_client
  __query_ssv_client
  if [[ ! -f "./ssv-config/password.pass" ]]; then
    if [[ "${__cannot_sudo}" -eq 1 ]]; then
      whiptail --title "Need sudo" --msgbox "SSV key generation requires your user to have sudo rights" 10 65
      exit 1
    fi
    echo "Creating password file for encrypted SSV secret key"
    head -c 16 /dev/urandom | base64 | tr -d '[:space:]' >./ssv-config/password.pass
    ${__auto_sudo} chown 12000:12000 ./ssv-config/password.pass
    ${__auto_sudo} chmod 600 ./ssv-config/password.pass
  fi
  if [[ ! -f "./ssv-config/encrypted_private_key.json" ]]; then
    if [[ "${__cannot_sudo}" -eq 1 ]]; then
      whiptail --title "Need sudo" --msgbox "SSV key generation requires your user to have sudo rights" 10 65
      exit 1
    fi
    echo "Creating encrypted operator private key"
    case "${SSV_CLIENT}" in
      ssv.yml)
        __dodocker run --name ssv-node-key-generation -v "$(pwd)/ssv-config/password.pass":/password.pass \
          ssvlabs/ssv-node:latest /go/bin/ssvnode generate-operator-keys --password-file=/password.pass && \
        __dodocker cp ssv-node-key-generation:/encrypted_private_key.json ./ssv-config/encrypted_private_key.json && \
        __dodocker rm ssv-node-key-generation
        ;;
      anchor.yml)
        __dodocker run --name anchor-key-generation -v "$(pwd)/ssv-config/password.pass":/password.pass \
          sigp/anchor:latest keygen --password-file=/password.pass --encrypt --data-dir /anchor && \
        __dodocker cp anchor-key-generation:/anchor/encrypted_private_key.json ./ssv-config/encrypted_private_key.json && \
        __dodocker rm anchor-key-generation
        ;;
      *)
        echo "Unknown SSV client \"${SSV_CLIENT}\". This is a bug."
        exit 70
        ;;
    esac
    ${__auto_sudo} chown 12000:12000 ./ssv-config/encrypted_private_key.json
  fi
  __query_dkg
  __query_execution_client
  __set_nethermind_log_index  # Remove after Nethermind enables it by default
  __query_4444
  __query_reth_snapshot
  __query_checkpoint_sync
  __query_mev
  __query_grafana
  __query_fee_recipient
}


# Interactive configuration of a VC only
__config_validator() {
  __query_validator_client
  __query_web3signer
  __query_remote_beacon
  __query_mev
  __query_fee_recipient
  __query_graffiti
  if [[ "${NETWORK}" = "hoodi" ]]; then
    CORE_FILES+=":deposit-cli.yml"
  fi
}


# Interactive configuration of a VC only, for RocketPool
__config_rocket() {
  __write_vars+=("DOCKER_EXT_NETWORK")

  __config_validator
  CORE_FILES+=":ext-network.yml"
  DOCKER_EXT_NETWORK="rocketpool_net"
  __final_msg+="\nYou are connected to the \"rocketpool_net\" Docker bridge network"
}


# Interactive configuration of a Lido CSM node, with CL, EL and VC
__config_lido_csm() {
  local lido_csm_url

  __config_node

  if whiptail --title "Keys generation" --yesno "Do you want to generate validator keys?" 10 65; then
    __query_lido_keys_generation
  else
    __lido_keys_attention_message
  fi

  if [[ "${NETWORK}" = "hoodi" ]]; then
    lido_csm_url="https://csm.testnet.fi/?ref=ethdocker"
  else
    lido_csm_url="https://csm.lido.fi/?ref=ethdocker"
  fi
  whiptail --title "Finish" --msgbox "Final steps!\n\n1. Run your node './ethd start'\n\n2. Wait until your node is fully synchronized\n\n\
4. Open ${lido_csm_url} to submit your keys with '.eth/validator_keys/deposit-data-*.json' file content\n\n5. Wait for keys validation\n\n\
6. Import your keys with './ethd keys import'" 19 65
}


# Interactive configuration of a Lido SimpleDVT SSV node, with CL, EL and SSV node
__config_lido_ssv() {
  __config_ssv
}


# Interactive configuration of a Lido SimpleDVT Obol node, with CL, EL and Obol Charon
__config_lido_obol() {
  local cluster_lock_is_valid
  local obol_prom_remote_token

  __write_vars+=("VE_LOCATOR_ADDRESS" "VE_ORACLE_ADDRESSES_ALLOWLIST" "VE_STAKING_MODULE_ID" "LIDO_DV_EXIT_EXIT_EPOCH" \
    "VE_OPERATOR_ID" "OBOL_CLUSTER_NAME" "OBOL_CLUSTER_PEER" "OBOL_CHARON_REMOTE_LOKI_ADDRESSES" "ENABLE_DIST_ATTESTATION_AGGR" \
    "OBOL_PROM_REMOTE_WRITE_TOKEN" )

  if [[ ! "${NETWORK}" =~ (mainnet|hoodi) ]]; then
    echo "Lido SimpleDVT Obol is not supported on network ${NETWORK}"
    exit 1
  fi

  ENABLE_DIST_ATTESTATION_AGGR="true"

  __query_consensus_client
  CL_NODE="http://charon:3600"
  __query_execution_client
  __query_validator_client
  __query_4444
  __query_reth_snapshot
  __query_checkpoint_sync
  __query_mev
  __query_mev_factor
  __query_grafana
  __query_fee_recipient

  case "${NETWORK}" in  # Lido Locator, and oracle allowlist for exits
    mainnet)
      VE_LOCATOR_ADDRESS="0xC1d0b3DE6792Bf6b4b37EccdcC24e45978Cfd2Eb"
      VE_ORACLE_ADDRESSES_ALLOWLIST='["0x73181107c8D9ED4ce0bbeF7A0b4ccf3320C41d12","0x285f8537e1dAeEdaf617e96C742F2Cf36d63CcfB", \
"0x404335BcE530400a5814375E7Ec1FB55fAff3eA2","0x946D3b081ed19173dC83Cd974fC69e1e760B7d78","0x007DE4a5F7bc37E2F26c0cb2E8A95006EE9B89b5",\
"0xc79F702202E3A6B0B6310B537E786B9ACAA19BAf","0x61c91ECd902EB56e314bB2D5c5C07785444Ea1c8","0xe57B3792aDCc5da47EF4fF588883F0ee0c9835C9", \
"0x4118DAD7f348A4063bD15786c299De2f3B1333F3"]'
      VE_STAKING_MODULE_ID="2"
      LIDO_DV_EXIT_EXIT_EPOCH="194048"  # capella
      ;;
    hoodi)
      VE_LOCATOR_ADDRESS="0xe2EF9536DAAAEBFf5b1c130957AB3E80056b06D8"
      VE_ORACLE_ADDRESSES_ALLOWLIST='["0xcA80ee7313A315879f326105134F938676Cfd7a9","0xf03B8DC8762B97F13Ac82e6F94bE3Ed002FF7459", \
"0x1932f53B1457a5987791a40Ba91f71c5Efd5788F","0xf7aE520e99ed3C41180B5E12681d31Aa7302E4e5","0x99B2B75F490fFC9A29E4E1f5987BE8e30E690aDF", \
"0x219743f1911d84B32599BdC2Df21fC8Dba6F81a2","0xD3b1e36A372Ca250eefF61f90E833Ca070559970","0x4c75FA734a39f3a21C57e583c1c29942F021C6B7", \
"0x948A62cc0414979dc7aa9364BA5b96ECb29f8736","0xfe43A8B0b481Ae9fB1862d31826532047d2d538c","0x43C45C2455C49eed320F463fF4f1Ece3D2BF5aE2"]'
      VE_STAKING_MODULE_ID="2"
      LIDO_DV_EXIT_EXIT_EPOCH="256"  # capella
      ;;
  esac

  if [[ -f ./.eth/cluster-lock.json ]]; then
    if whiptail --title "Lido Obol cluster exists" --yesno "Your cluster has already been created. Continue with it?" 10 65; then
# shellcheck disable=SC2086
      cluster_lock_is_valid=$(__docompose -f ./lido-obol.yml run --rm -v "$(pwd)"/.eth/cluster-lock.json:/cluster-lock.json:ro curl-jq sh -c \
        "cat /cluster-lock.json | jq -r 'all(.cluster_definition.validators[]; (.fee_recipient_address | ascii_downcase) == (\"'${FEE_RECIPIENT}'\" | ascii_downcase) and (.withdrawal_address | ascii_downcase) == (\"'$(__lido_withdrawal_credentials_address)'\" | ascii_downcase))'" | tail -n 1)
      if [[ "${cluster_lock_is_valid}" =~ "true" ]]; then
        echo "Your cluster lock is valid."
      else
        whiptail --title "Lido Obol cluster definition" --msgbox "Your cluster lock file './.eth/cluster-lock.json' is not valid.\n\nCheck that every validator has \`fee_recipient_address\` and \`withdrawal_address\` equal to Lido contracts and try again.\n\nLido fee recipient: '${FEE_RECIPIENT}'\nLido withdrawal credentials: '$(__lido_withdrawal_credentials_address)'" 14 90
        echo "Your cluster lock is NOT valid."
        exit 1
      fi
    elif whiptail --title "Lido Obol cluster creation" --yesno "Backup a previously created cluster to create a new one?" 10 65; then
# A naive rm -rf on .eth throws out .gitignore
      ${__as_owner} mkdir -p "./.eth_backup_${EPOCHSECONDS}"
      ${__as_owner} cp -vr ./.eth/charon "./.eth_backup_${EPOCHSECONDS}"
      ${__as_owner} rm -rf ./.eth/charon/*
      ${__as_owner} cp -v ./.eth/cluster-lock.json "./.eth_backup_${EPOCHSECONDS}" 2>/dev/null || true
      ${__as_owner} rm -f ./.eth/cluster-lock.json
      ${__as_owner} cp -v ./.eth/cluster-definition.json "./.eth_backup_${EPOCHSECONDS}" 2>/dev/null || true
      ${__as_owner} rm -f ./.eth/cluster-definition.json
      ${__as_owner} cp -v ./.eth/charon-enr* "./.eth_backup_${EPOCHSECONDS}" 2>/dev/null || true
      ${__as_owner} rm -f ./.eth/charon-enr*
      __query_lido_obol_enr
      __query_lido_obol_cluster_definition
      __query_lido_obol_cluster_dkg
    else
      whiptail --title "Lido Obol cluster creation" --msgbox "The \`.eth\` folder must be empty or non-existent to continue" 10 65
      echo "The \`.eth\` folder must be empty to create a new cluster"
      exit 1
    fi
  else
    if [[ -f "./.eth/charon-enr-private-key" && -f "./.eth/charon-enr-public-key" ]]; then
      if whiptail --title "Lido Obol operator ENR creation" --yesno "You already have an ENR. Use it?" 8 65; then
        echo "Using existing ENR"
      else
# A naive rm -rf on .eth throws out .gitignore
        ${__as_owner} mkdir -p "./.eth_backup_${EPOCHSECONDS}"
        ${__as_owner} cp -vr ./.eth/charon "./.eth_backup_${EPOCHSECONDS}"
        ${__as_owner} rm -rf ./.eth/charon/*
        ${__as_owner} cp -v ./.eth/cluster-lock.json "./.eth_backup_${EPOCHSECONDS}" 2>/dev/null || true
        ${__as_owner} rm -f ./.eth/cluster-lock.json
        ${__as_owner} cp -v ./.eth/cluster-definition.json "./.eth_backup_${EPOCHSECONDS}" 2>/dev/null || true
        ${__as_owner} rm -f ./.eth/cluster-definition.json
        ${__as_owner} cp -v ./.eth/charon-enr* "./.eth_backup_${EPOCHSECONDS}" 2>/dev/null || true
        ${__as_owner} rm -f ./.eth/charon-enr*
        __query_lido_obol_enr
      fi
    else
      __query_lido_obol_enr
    fi

    if [[ -f ./.eth/cluster-definition.json ]]; then
      if whiptail --title "Lido Obol cluster creation in process" --yesno "You already have a cluster definition. Use it?" 10 65; then
        set +e
# shellcheck disable=SC2086
        cluster_definition_is_valid=$(__docompose -f ./lido-obol.yml run --rm -v "$(pwd)"/.eth/cluster-definition.json:/cluster-definition.json:ro curl-jq sh -c \
          "cat /cluster-definition.json | jq -r 'all(.validators[]; (.fee_recipient_address | ascii_downcase) == (\"'${FEE_RECIPIENT}'\" | ascii_downcase) and (.withdrawal_address | ascii_downcase) == (\"'$(__lido_withdrawal_credentials_address)'\" | ascii_downcase))'" | tail -n 1)
        set -e
        if [[ "${cluster_definition_is_valid}" = "true" ]]; then
          echo "Your cluster definition is valid."
        else
          whiptail --title "Lido Obol cluster creation" --msgbox "Your cluster definition is not valid.\n\nCheck that every validator has \`fee_recipient_address\` and \`withdrawal_address\` equal to Lido contracts and try again.\n\nLido fee recipient: '${FEE_RECIPIENT}'\nLido withdrawal credentials: '$(__lido_withdrawal_credentials_address)'" 14 90
          echo "Your cluster definition is NOT valid."
          exit 1
        fi
      else
        __query_lido_obol_cluster_definition
      fi
    else
      __query_lido_obol_cluster_definition
    fi
    __query_lido_obol_cluster_dkg
  fi

  VE_OPERATOR_ID=$(whiptail --title "Lido Operator ID" --inputbox "Input your Operator ID from Lido Operators dashboard \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
  OBOL_PROM_REMOTE_WRITE_TOKEN=$(whiptail --title "Obol Prometheus" --inputbox "Input the Obol Prometheus remote write token \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
  OBOL_CHARON_REMOTE_LOKI_ADDRESSES=$(whiptail --title "Obol Loki" --inputbox "Input the Obol Loki remote URL \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
  if [[ -n "${OBOL_CHARON_REMOTE_LOKI_ADDRESSES}" ]]; then
    OBOL_CLUSTER_NAME=$(whiptail --title "Obol cluster name" --inputbox "What is your Obol cluster name? \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
    OBOL_CLUSTER_PEER=$(whiptail --title "Obol cluster peer" --inputbox "What is your Obol cluster peer name? \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
  else
    OBOL_CLUSTER_NAME="dummy-cluster"
    OBOL_CLUSTER_PEER="dummy-peer"
    echo "Obol Loki remote URL is empty, skipping log collection"
  fi

  CORE_FILES+=":lido-obol.yml:lido-obol-alloy.yml"
}


config() {
  local var
  local mode

  # Create ENV file if needed
  if [[ ! -f "${__env_file}" ]]; then
    mode=$(${__as_owner} stat "${__stat_mode_param[@]}" default.env)
    mode=$(__mode_after_umask "${mode}")
    ${__as_owner} install -g "${__owner_group}" -o "${__new_owner}" -m "${mode}" default.env "${__env_file}"
    __minty_fresh=1
  else
    __minty_fresh=0
  fi

  __get_compose_file
  __verify_env_file --enforce-min

  __during_config=1
  __final_msg=""
  CORE_FILES=""
  __write_vars+=("CORE_FILES")

  __run_pre_update_script

  __check_legacy
  __query_network
  __query_deployment

# Every deployment type has a __config_xx function, which runs through the entire query and config workflow
# This is not DRY, but makes it very easy to see and customize the config workflow
  __config_"${__deployment}"

  __during_config=0

  __make_siren_password
  __detect_v6

  for var in "${__write_vars[@]}"; do
    __update_value_in_env "${var}" "${!var?Variable ${var} is not set, this is a bug}" "${__env_file}"
  done

  echo "Your chosen yml files are:" "${CORE_FILES}"
  var="CUSTOM_FILES"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
  __final_msg+="\nYou are using these service files: ${CORE_FILES}${CUSTOM_FILES:+:${CUSTOM_FILES}}"

  __get_compose_file
  if [[ ! "$*" =~ --ci ]]; then
    __pull_and_build
  fi
  __nag_os_version

  echo -e "${__final_msg-}"
  echo
  echo "Your configuration file is: $(dirname "$(realpath "${BASH_SOURCE[0]}")")/${__env_file}"
  echo "You can change advanced config items with \"nano .env\" when in the $(dirname "$(realpath "${BASH_SOURCE[0]}")") directory."
  echo

  __run_post_update_script
}


version() {
  local var
  local w3s_exec=""

  grep "^This is ${__project_name} v" README.md
  echo
  __value="${COMPOSE_FILE}"

  # CL versions
  case "${__value}" in
    *lighthouse.yml*|*lighthouse-cl-only*)
      __docompose exec consensus lighthouse --version
      echo
      ;;
    *lodestar.yml*|*lodestar-cl-only*)
      __docompose exec consensus node /usr/app/packages/cli/bin/lodestar --version
      echo
      ;;
    *prysm.yml*)
      __docompose exec consensus beacon-chain --version
      echo
      __docompose exec validator validator --version
      echo
      ;;
    *prysm-cl-only*)
      __docompose exec consensus beacon-chain --version
      echo
      ;;
    *nimbus.yml*|*nimbus-allin1.yml*|*nimbus-cl-only*)
      __docompose exec consensus nimbus_beacon_node --version
      echo
      ;;
    *nimbus-unified.yml*)
      __docompose exec consensus nimbus --version
      echo
      ;;
    *teku.yml*|*teku-allin1.yml*|*teku-cl-only*)
      __docompose exec consensus /opt/teku/bin/teku --version
      echo
      ;;
    *grandine.yml*|*grandine-allin1.yml*|*grandine-cl-only*)
      __docompose exec consensus grandine --version
      echo
      ;;
  esac

  # EL versions
  case "${__value}" in
    *geth.yml*)
      __docompose exec execution geth version
      echo
      ;;
    *reth.yml*)
      __docompose exec execution reth --version
      echo
      ;;
    *besu.yml*)
      __docompose exec execution /opt/besu/bin/besu --version
      echo
      ;;
    *nethermind.yml*)
      echo "Nethermind version"
      __docompose exec execution /nethermind/nethermind --version
      echo
      ;;
    *erigon.yml*)
      __docompose exec execution erigon --version
      echo
      ;;
    *nimbus-el.yml*)
      __docompose exec execution nimbus --version
      echo
      ;;
    *ethrex.yml*)
      __docompose exec execution ethrex --version
      echo
      ;;
  esac

  # VC versions
  case "${__value}" in
    *lighthouse-vc-only*)
      __docompose exec validator lighthouse --version
      echo
      ;;
    *lodestar-vc-only*)
      __docompose exec validator node /usr/app/packages/cli/bin/lodestar --version
      echo
      ;;
    *prysm-vc-only*)
      __docompose exec validator validator --version
      echo
      ;;
    *nimbus-vc-only*)
      __docompose exec validator nimbus_validator_client --version
      echo
      ;;
    *teku-vc-only*)
      __docompose exec validator /opt/teku/bin/teku --version
      echo
      ;;
    *grandine-vc-only*)
      __docompose exec validator grandine --version
      echo
      ;;
    *vero-vc-only*)
      __docompose exec validator python main.py --version
      echo
      ;;
  esac

  # DVT versions
  case "${__value}" in
    *lido-obol.yml*)
      __docompose exec charon charon version
      echo
      ;;
    *ssv.yml*)
      __docompose exec ssv-node /go/bin/ssvnode --version
      echo
      ;;
    *anchor.yml*)
      __docompose exec anchor anchor node --version
      echo
      ;;
  esac

  # Web3signer version
  case "${__value}" in
    *web3signer.yml*)
      var=W3S_DOCKER_TAG
      __get_value_from_env "${var}" "${__env_file}" "${var}"
      var=W3S_DOCKERFILE
      __get_value_from_env "${var}" "${__env_file}" "${var}"
      if [[ "${W3S_DOCKERFILE}" = "Dockerfile.binary" && "${W3S_DOCKER_TAG}" =~ distroless ]]; then
        w3s_exec="java -cp /opt/web3signer/lib/* tech.pegasys.web3signer.Web3SignerApp"
      else
        w3s_exec="/opt/web3signer/bin/web3signer"
      fi
  # shellcheck disable=SC2086
      __docompose exec web3signer ${w3s_exec} --version
      echo
      __docompose exec postgres pg_config --version
      echo
      ;;
  esac

  # PBS versions
  case "${__value}" in
    *mev-boost.yml*)
      __docompose exec mev-boost /app/mev-boost -version
      echo
      ;;
    *commit-boost-pbs.yml*)
      __docompose exec cb-pbs commit-boost --version
      echo
      ;;
  esac

  # RPC proxy version
  case "${__value}" in
    *nimbus-vp.yml*)
      __docompose exec rpc-proxy nimbus_verified_proxy --version
      echo
      ;;
  esac

  # Grafana version
  case "${__value}" in
    *grafana.yml*)
      echo -n "Grafana "
      __docompose exec grafana /run.sh -v
      echo
      ;;
  esac

  # Traefik version
  case "${__value}" in
    *traefik-*.yml*)
      echo "Traefik"
      __docompose exec traefik traefik version
      echo
      ;;
  esac

  # Contributoor version
  case "${__value}" in
    *contributoor.yml*)
      echo -n "Contributoor "
      __docompose exec contributoor sentry --release
      echo
      ;;
  esac
}


# Combine CORE_FILES and CUSTOM_FILES so they can be used as COMPOSE_FILE
__get_compose_file() {
  local var

  var="CUSTOM_FILES"
  __get_value_from_env "${var}" "${__env_file}" "${var}"
  var="CORE_FILES"
  __get_value_from_env "${var}" "${__env_file}" "${var}"

  COMPOSE_FILE="${CORE_FILES}${CUSTOM_FILES:+:${CUSTOM_FILES}}"
}


# env file exists, and if version passed, is minimum version
__verify_env_file() {
  local var

  if [[ ! -f "${__env_file}" ]]; then
    echo "Error: ${__env_file} not found. Please run \"${__me} config\" first to create it."
    exit 1
  fi

  if [[ "${1:-}" = "--enforce-min" ]]; then
    var=ENV_VERSION
    __get_value_from_env "${var}" "./default.env" "${var}"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ "${__value}" -lt "${ENV_VERSION}" ]]; then
      echo "Error: ${var} version ${__value} in ${__env_file} is less than required version ${ENV_VERSION}."
      echo "Please run \"${__me} update\", or manually adjust ${__env_file} from default.env."
      exit 1
    fi
  fi
}


__update_help() {
  echo "usage: ${__me} update [--refresh-targets] [--non-interactive] [--no-screen]"
  echo
  echo "Updates ${__project_name} itself, as required the contents of \".env\", and the clients."
  echo
  echo "A combination of \"git pull\" for ${__project_name}, some bash scripting to bring new variables from \"default.env\","
  echo "and \"${__compose_exe} pull\" as well as \"${__compose_exe} build\" for the clients."
  echo
  echo "If warranted, will also offer resync when clients require it, or upgrade of PostgreSQL version."
  echo
  echo "\"--refresh-targets\" sets Docker tags, source targets, and repos of clients back to the defaults in \"default.env\"."
  echo "\"--non-interactive\" does not ask questions and assumes Yes for database resyncs and migrations."
  echo "\"--no-screen\" does not use \"screen\" during the update."
  echo
}


__full_help() {
  echo "usage: ${__me} [-h|--help] <command>"
  echo
  echo "commands:"
  echo "  install"
  echo "    attempts to install Docker and Docker Compose for you"
  echo "  config"
  echo "    configures ${__project_name} with your choice of Ethereum clients"
  echo "  keys ACTION [--non-interactive] [--debug]"
  echo "    list, count, delete, import keys; their fee recipients; and gas fees"
  echo "    Run without ACTION to get help text"
  echo "  update [--refresh-targets] [--non-interactive] [--no-screen] [--debug] [--trace]"
  echo "    updates all client versions and ${__project_name} itself"
  echo "    --refresh-targets will reset your custom build targets in ${__env_file} to defaults"
  echo "  up|start [service-name]"
  echo "    starts the Ethereum node, or restarts containers that had their image or"
  echo "    configuration changed. Can also start a specific service by name"
  echo "  down|stop [service-name]"
  echo "    stops the Ethereum node, or a specific service by name"
  echo "  restart [service-name]"
  echo "    restarts the Ethereum node, or a specific service by name, a combination of down and up"
  echo "  version"
  echo "    prints the version(s) of currently running client(s)"
  echo "  logs"
  echo "    shows logs"
  echo "  cmd <compose-command>"
  echo "    executes an arbitrary Docker Compose command. Use \"cmd help\" to list them"
  echo "  terminate"
  echo "    stops the Ethereum node and destroys all data stores"
  echo "  prune-nethermind [--non-interactive]"
  echo "    restarts the Nethermind execution client and prunes its DB."
  echo "  prune-besu [--non-interactive]"
  echo "    stops the Besu execution client and prunes trie-logs."
  echo "  prune-reth [--non-interactive]"
  echo "    stops the Reth execution client and prunes its DB."
  echo "  prune-history [--non-interactive] [--pre-merge|--rolling]"
  echo "    stops the execution client and configures history expiry."
  echo "  prune-lighthouse [--non-interactive]"
  echo "    stops the Lighthouse consensus client and prunes state."
  echo "  repair-reth"
  echo "    stops the Reth execution client and repairs its database."
  echo "  migrate-reth"
  echo "    stops the Reth execution client and migrates its database to v2."
  echo "  migrate-geth"
  echo "    stops the Geth execution client and migrates its database to Pebble v2."
  echo "  resync-execution"
  echo "    removes the execution layer database and forces a resync."
  echo "  resync-consensus"
  echo "    removes the consensus layer database and forces a resync."
  echo "  space"
  echo "    show Docker volume space usage"
  echo "  attach-geth"
  echo "    launches an interactive geth attach repl"
  echo "  help"
  echo "    print this help screen"
  echo
  echo "  Instead of \"--non-interactive\" you may also use the \"ETHD_FRONTEND=noninteractive\" environment variable"
  echo
  echo "The logs command can be appended by flags and specify the container(s). Example: "
  echo
  echo "  ${__me} logs -f --tail 50 execution"
  echo "    shows logs only for execution service"
  echo
  echo "✍️ Give feedback and report issues on GitHub:"
  echo "  * https://github.com/ethstaker/eth-docker"
  echo "🤗 Get support on Discord:"
  echo "  * https://discord.gg/ethstaker"
}


help() {
  case $* in
    *update*) __update_help;;
    *) __full_help;;
  esac
}


# Main body from here
__me=$(basename "${BASH_SOURCE[0]}")
if [[ ! -f ~/.profile ]] || ! grep -q "alias ethd" ~/.profile; then
  __me="./${__me}"
fi

trap '__handle_error $? $LINENO ${BASH_LINENO[0]}' ERR EXIT

if [[ "$#" -eq 0 || "$*" = "--help" || "$*" = "-h" || "$*" = "update --help" || "$*" = "update -h" ]]; then
  help "$@"
  exit 0
fi

cd "$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
# Use this to make sure root doesn't end up owning files
# shellcheck disable=SC2012
__owner=$(ls -ld . | awk '{print $3}')
# shellcheck disable=SC2012
__owner_group=$(ls -ld . | awk '{print $4}')

if [[ "${__owner}" = "root" ]]; then
  echo "Please install ${__project_name} as a non-root user."
  exit 0
fi

if [[ "${EUID}" -eq 0 ]]; then
  echo "WARNING - please run ${__me} as a non-root user. It is not extensively tested when run as \"root\"."
  echo
fi

__command="$1"
shift
__params=$*

__handle_ownership
__determine_distro
__prep_conffiles

__check_for_snap

# Don't check for Docker before it's installed
if [[ "${__command}" = "install" ]]; then
  install_command "$@"
  exit "$?"
fi

__handle_docker
__check_compose_version

if [[ "${__old_compose}" -eq 1 && "${__compose_major}" -eq 1 ]]; then
  exit 0
fi

if [[ "${__old_docker}" -eq 1 ]]; then
  echo
  echo "Docker version ${__docker_version} detected. This version is no longer supported."
  echo "Please update to a current version. Supported versions can be seen at https://endoflife.date/docker-engine."
  if [[ "$__distro" = *"debian"* ]]; then
    echo
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      if [[ "${__os_major_version}" -lt 13 ]]; then
        echo "Debian ${__os_major_version}'s docker.io is old. Please replace docker.io with docker-ce"
        echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
        echo "Alternatively, upgrade to Debian 13 or later."
      else
        echo "Debian ${__os_major_version} ships with a newer docker.io."
        echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
        echo "Please come to EthCoördinate Discord: https://discord.gg/ethstaker"
      fi
    else
      echo "This should be as simple as \"sudo apt update && sudo apt dist-upgrade\""
    fi
  elif [[ "${__distro}" = "ubuntu" ]]; then
    echo
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      if [[ "$__os_major_version" -lt 25 ]]; then
        echo "Ubuntu ${__os_major_version}.${__os_minor_version}'s docker.io is old. Please replace docker.io with docker-ce"
        echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
        echo "Alternatively, upgrade to Ubuntu 26.04 or later."
      else
        echo "Ubuntu ${__os_major_version}.${__os_minor_version} ships with a newer docker.io."
        echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
        echo "Please come to EthCoördinate Discord: https://discord.gg/ethstaker"
      fi
    else
      echo "This should be as simple as \"sudo apt update && sudo apt dist-upgrade\""
    fi
  else
    echo
    echo "${__project_name} doesn't know what to recommend on ${__distro}, to effect a Docker upgrade."
  fi
  exit 0
fi

if ! type -P whiptail >/dev/null 2>&1; then
  echo "Please install the package whiptail or newt before running ${__project_name}."
  exit 0
fi

if ! __dodocker images >/dev/null 2>&1; then
  echo "Please ensure you can call ${__docker_exe} before running ${__project_name}."
  exit 0
fi

if ! __docompose --help >/dev/null 2>&1; then
  echo "Please ensure you can call ${__compose_exe} before running ${__project_name}."
  exit 0
fi

case "${__command}" in
  help|config|cmd|terminate)  # Commands that can be run without .env existing
    ${__command} "$@"
    exit 0
    ;;
  update)
    __verify_env_file
    __get_compose_file
    ${__command} "$@"
    ;;
  keys|up|start|down|stop|restart|version|logs|prune-nethermind\
|prune-besu|prune-reth|prune-history|prune-lighthouse|resync-execution|resync-consensus|attach-geth\
|repair-reth|migrate-reth|migrate-geth|space)
    __verify_env_file --enforce-min
    __get_compose_file
    ${__command} "$@"
    ;;
  *)
    echo "Unrecognized command ${__command}"
    help
    exit 1
    ;;
esac

__check_disk_space
__check_traefik_version

if [[ "${__compose_upgraded}" -eq 1 ]]; then
  echo
  echo "You updated Docker Compose to V2."
  echo "The \"docker-compose\" command is gone and replaced with \"docker compose\"."
  echo
  echo "Optionally, you can switch to docker-ce."
  echo "Please see https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce for instructions."
fi

if [[ "${__old_compose}" -eq 1 && "${__compose_major}" -eq 2 ]]; then
  echo "You are using Docker Compose ${__compose_version}, which has been shown to cause issues with new features"
  echo "${__project_name} requires Compose v2.18 or later"
  echo
  echo "It is recommended that you update Compose."
  if [[ "${__distro}" =~ (debian|ubuntu) ]]; then
    echo "Please do so by running: \"sudo apt update && sudo apt dist-upgrade\""
  fi
fi

if [[ "${__oldish_docker}" -eq 1 ]]; then
  echo "You are using Docker-CE version ${__docker_version}, which is not current."
  current_docker_release=$(curl -m5 -s -H "User-Agent: eth-docker" "https://api.github.com/repos/moby/moby/releases/latest" 2>/dev/null | jq -r '.name // empty' 2>/dev/null) || true
  if [[ -n "${current_docker_release}" && "${current_docker_release}" =~ ^v[0-9]+\.[0-9]+\.[0-9]+$ ]]; then
    echo "The current Docker-CE release is ${current_docker_release}"
  fi
  echo "Try a \"sudo apt update && sudo apt dist-upgrade\". If that does not bring in an updated Docker-CE,"
  echo "its repo file may have become disabled during an OS upgrade. Check \"/etc/apt/sources.list.d\" for"
  echo "your Docker repo \".list\" or \".sources\", and if it's been disabled, recreate it or re-enable it."
  echo "See https://docs.docker.com/engine/install/ for instructions."
fi

if [[ "${__old_rootless_docker}" -eq 1 ]]; then
  echo "You are using Docker version ${__docker_version} in rootless mode."
  echo "Rootless support has been greatly improved since version \"29.5.0\"."
  echo "Consider upgrading Docker, and reinstalling the rootless support after the upgrade."
fi

if [[ "${__old_traefik}" -eq 1 ]]; then
  echo "You are using the Traefik tag \"${__traefik_tag}\"."
  echo "This version of Traefik does not support current Docker releases."
  echo "You can run \"${__me} update --refresh-targets\" or manually change \"TRAEFIK_TAG\" in \"${__env_file}\"."
fi