ethd

#!/usr/bin/env bash
set -Eeuo pipefail

__project_name="Eth Docker"
__app_name="Ethereum node"
__sample_service="consensus"
__docker_exe="docker"
__old_docker=0
__docker_sudo=""
__docker_major_version=""
__docker_minor_version=""
__docker_patch_version=""
__compose_exe="docker compose"
__old_compose=0
__compose_upgraded=0
__distro=""
__os_major_version=""
__os_minor_version=""
__target_pg=18
__min_ubuntu=22
__suggest_ubuntu="24.04 or 22.04."
__upgrade_ubuntu="24.04: https://gist.github.com/yorickdowne/94f1e5538007f4c9d3da7b22b0dc28a4"
__min_debian=11
__suggest_debian="12 or 11."
__upgrade_debian="12: https://gist.github.com/yorickdowne/ec9e2c6f4f8a2ee93193469d285cd54c"
__eol_os=0
__non_interactive=0
__debug=0
__found=0
__env_file=.env
__during_config=0
__during_update=0
__during_postgres=0
__during_env_migrate=0
__during_pg_migrate=0
__env_migrated=0
__pg_migrated=0
__keep_targets=1
__target_ver=1
__source_ver=1
__minty_fresh=0
__network_change=0
__handler_ran=0
__deployment=""
__command=""
__params=""
__me=./ethd
__auto_sudo=""
__cannot_sudo=0
__as_owner=""
__owner=""
__owner_group=""
__value=""  # This is a global to hand a result back from __get_value_from_env
__free_space=0
__docker_dir="/var/lib/docker"
__keys_args=""
__final_msg=""
__ssv_operator_id=-1


__dodocker() {
  ${__docker_sudo} ${__docker_exe} "$@"
}


__docompose() {
# I want word splitting here
# shellcheck disable=SC2086
  ${__docker_sudo} ${__compose_exe} "$@"
}


__determine_distro() {
  local uname

# Determine OS platform
  uname=$(uname | tr "[:upper:]" "[:lower:]")
# If Linux, try to determine specific distribution
  if [[ "${uname}" = "linux" ]]; then
# If available, use LSB to identify distribution
    if [[ -n "$(command -v lsb_release 2>/dev/null)" ]]; then
      __distro=$(lsb_release -i | cut -d: -f2 | sed s/'^\t'//)
# Otherwise, use release info file
    else
      __distro=$(find /etc -maxdepth 1 -type f -name '[A-Za-z]*[_-][rv]e[lr]*' \
        | grep -v "lsb" | cut -d'/' -f3 | cut -d'-' -f1 | cut -d'_' -f1)
    fi
  else
    __distro=""
  fi
# For everything else (or if above failed), just use generic identifier
  [[ -z "${__distro}" ]] && __distro="${uname}"
  __distro=$(echo "${__distro}" | tr "[:upper:]" "[:lower:]")

  if [[ "${__distro}" = "ubuntu" ]]; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      if ! dpkg-query -W -f='${Status}' lsb-release 2>/dev/null | grep -q "ok installed"; then
        echo "Installing lsb-release"
        ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install lsb-release
      fi
    fi
    if [[ -n "$(command -v lsb_release 2>/dev/null)" ]]; then
      __os_major_version=$(lsb_release -r | cut -d: -f2 | sed s/'^\t'// | cut -d. -f1)
      __os_minor_version=$(lsb_release -r | cut -d: -f2 | sed s/'^\t'// | cut -d. -f2)
    else
      __os_major_version=24  # Without sudo and lsb_release let's just skip the check
      __os_minor_version=04
    fi
  elif [[ "${__distro}" =~ "debian" ]]; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      if ! dpkg-query -W -f='${Status}' lsb-release 2>/dev/null | grep -q "ok installed"; then
        echo "Installing lsb-release"
        ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install lsb-release
      fi
    fi
    if [[ -n "$(command -v lsb_release 2>/dev/null)" && $(lsb_release -r | cut -f2 2>/dev/null) =~ ^[0-9]+$ ]]; then
      __os_major_version=$(lsb_release -r | cut -f2)
      __os_minor_version=0
    else
      __os_major_version=12  # Without sudo and lsb_release let's just skip the check
      __os_minor_version=0
    fi
  fi
}


__handle_docker() {
  local exitstatus
  local var
  local regex

  set +e
  if [[ "${__distro}" =~ (debian|ubuntu) ]] && ! grep -qi microsoft /proc/version; then
    systemctl status docker >/dev/null
    exitstatus=$?
    if [[ ! "${exitstatus}" -eq 0 ]]; then
      echo "The Docker daemon is not running. Please check Docker installation."
      echo "\"sudo systemctl status docker\" and \"sudo journalctl -fu docker\" will be helpful."
      echo "Aborting."
      exit 1
    fi
  fi
  set -e

  __docker_version=$(docker --version | awk '{ gsub(/,/, "", $3); print $3 }')
  __docker_major_version=$(echo "${__docker_version}" | awk '{ split($1, version, "."); print version[1]; }')
  __docker_minor_version=$(echo "${__docker_version}" | awk '{ split($1, version, "."); print version[2]; }')
  __docker_patch_version=$(echo "${__docker_version}" | awk '{ split($1, version, "."); print version[3]; }')

  if [[ "${__docker_major_version}" -lt 23 ]]; then
    __old_docker=1
  else
    __old_docker=0
  fi

  if ! docker images >/dev/null 2>&1; then
    if [[ "${__cannot_sudo}" -eq 1 ]]; then
      echo "Cannot call Docker and cannot use sudo. Please make your user part of the docker group"
      exit 1
    fi
    echo "Will use sudo to access Docker"
    __docker_sudo="sudo"
  fi
  if [[ -f "${__env_file}" && "${__distro}" =~ (debian|ubuntu) ]] && ! grep -qi microsoft /proc/version; then
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
    DOCKER_ROOT=$(__dodocker system info --format '{{.DockerRootDir}}')
    var=DOCKER_ROOT
    __update_value_in_env "${var}" "${!var}" "${__env_file}"

    var=NODE_EXPORTER_IGNORE_MOUNT_REGEX
    __get_value_from_env "${var}" "${__env_file}" "__value"
# Match either of the patterns Eth Docker uses. Leave alone if there are user changes to the var
# Match literal `'^/(dev|proc|sys|run|some/path/.+)($|/)'` or `'^/(dev|proc|sys|run|var/snap/.+|some/path/.+)($|/)'
    regex="^'\^\/\(dev\|proc\|sys\|run\|(var\/snap\/\.\+\|)?[a-zA-Z/]+\/\.\+\)\(\\$\|\/\)'$"
    if [[ "${__value}" =~ ${regex} ]]; then
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
      NODE_EXPORTER_IGNORE_MOUNT_REGEX="'^/(dev|proc|sys|run|var/snap/.+|${DOCKER_ROOT#/}/.+)($|/)'"
      __update_value_in_env "${var}" "${!var}" "${__env_file}"
    fi
  fi
}


__handle_root() {
  if [[ "${EUID}" -eq 0 ]]; then
    __as_owner="sudo -u ${__owner}"
  else
    if groups | grep -q '\bsudo\b' || groups | grep -q '\badmin\b'; then
      __auto_sudo="sudo"
    else
      __cannot_sudo=1
    fi
  fi
}


__upgrade_docker() {
  local runc_version
  local runc_major_version
  local runc_minor_version
  local runc_patch_version
  local runc_dpkg_version
  local runc_fixed_version
  local yn

  if [[ -n "${ETHDSECUNDO-}" || ! "${__command}" = "update" ]]; then  # Don't run this twice
    if (( __docker_major_version < 28 )) ||
       (( __docker_major_version == 28 && __docker_minor_version < 5 )) ||
       (( __docker_major_version == 28 && __docker_minor_version == 5 && __docker_patch_version < 2 )); then
      runc_version=$(runc --version | awk '{ gsub(/[-\+~]/, " ", $3); $0=$0; print $3 }')
      runc_major_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[1]; }')
      runc_minor_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[2]; }')
      runc_patch_version=$(echo "${runc_version}" | awk '{ split($1, version, "."); print version[3]; }')

      if [[ "${__distro}" =~ (ubuntu|debian) ]]; then
        if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
          if [[ "${__distro}" =~ debian ]]; then
            if [[ "${__os_major_version}" -gt 13 ]]; then  # Assume Debian 14 and up are fine
              return
            fi
            runc_dpkg_version=$(dpkg-query -W -f='${Version}\n' runc)
            case ${__os_major_version} in
# These fixed versions are a guess and have not been released
              13) runc_fixed_version="1.1.15+ds1-2+deb13u1";;
              12) runc_fixed_version="1.1.5+ds1-1+deb12u2";;  # I don't expect to hit this, because docker.io is old
              11) runc_fixed_version="1.0.0~rc93+ds1-5+deb11u6";;  # I don't expect to hit this, because docker.io is old
              *) echo "Cannot check runc on Debian ${__os_major_version}. Please update to ${__min_debian} or later"; return;;
            esac
            if dpkg --compare-versions "${runc_dpkg_version}" lt "${runc_fixed_version}"; then
              echo
              echo "Docker ${__docker_version} with runc ${runc_version} detected"
              echo "This version of runc is vulnerable"
              echo "If an updated version of runc is available, please install it"
              echo "Alternatively, consider uninstalling runc and replacing it with crun"
# Commented out until fixed versions have actually been released
#              if [ "${__non_interactive}" -eq 0 ]; then
#                while true; do
#                  read -rp "Do you want to update runc (yes/no) " yn
#                  case "${yn}" in
#                    [Nn]*) echo "Please be sure to update runc yourself!"; return;;
#                    *)
#                      ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade runc
#                      break
#                      ;;
#                  esac
#                done
#              fi
            fi
          else  # This is Ubuntu and they fixed it with runc 1.3.3
            if (( runc_major_version == 1 &&  runc_minor_version < 3 )) ||
               (( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
              echo
              echo "Docker ${__docker_version} with runc ${runc_version} detected"
              echo "This version of runc is vulnerable"
              __nag_os_version
              if [ "${__eol_os}" -eq 1 ]; then
                echo "${__project_name} cannot update runc on Ubuntu ${__os_major_version}."
                return
              fi
              echo "It is recommended that you update runc"
              if [ "${__non_interactive}" -eq 0 ]; then
                while true; do
                  read -rp "Do you want to update runc (yes/no) " yn
                  case "${yn}" in
                    [Nn]*) echo "Please be sure to update runc yourself!"; return;;
                    *)
                      ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade runc
                      break
                      ;;
                  esac
                done
              fi
            fi
          fi
        elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
          echo
          echo "Docker ${__docker_version} detected"
          echo "This version of Docker has a vulnerable runc binary"
          __nag_os_version
          if [[ "${__eol_os}" -eq 1 ]]; then
            echo "${__project_name} cannot update Docker-CE on ${__distro} ${__os_major_version}."
            return
          fi
          echo "It is recommended that you update Docker-CE"
          if [[ "${__non_interactive}" -eq 0 ]]; then
            while true; do
              read -rp "Do you want to update Docker-CE? (yes/no) " yn
              case "${yn}" in
                [Nn]*) echo "Please be sure to update Docker CE yourself!"; return;;
                *)
                  ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install --only-upgrade docker-ce containerd.io
                  break
                  ;;
              esac
            done
          fi
        fi
      else
        if (( runc_major_version == 1 && runc_minor_version < 2 )) ||
           (( runc_major_version == 1 && runc_minor_version == 2 && runc_patch_version < 8 )) ||
           (( runc_major_version == 1 && runc_minor_version == 3 && runc_patch_version < 3 )); then
          echo
          echo "Docker ${__docker_version} with runc ${runc_version} detected"
          echo "This version of runc may be vulnerable, but ${__project_name} cannot update it on ${__distro}"
        fi
      fi
    fi
  fi
}


__upgrade_compose() {
  if ! type -P docker-compose >/dev/null 2>&1; then
    echo "Docker Compose has already been updated to V2"
    return
  fi
  echo "Updating Docker Compose to V2"
  if [[ "${__distro}" = "ubuntu" ]]; then
    __nag_os_version
    if [[ "${__eol_os}" -eq 1 ]]; then
      echo "${__project_name} cannot update Docker Compose on Ubuntu ${__os_major_version}."
      exit 1
    fi
    ${__auto_sudo} apt-get update
    ${__auto_sudo} apt-get install -y docker-compose-v2 docker-buildx
    echo "Installed docker-compose-v2"
    __old_compose=0
    __compose_upgraded=1
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      ${__auto_sudo} apt-mark manual docker.io
    elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
      ${__auto_sudo} apt-mark manual docker-ce
    fi
    ${__auto_sudo} apt-get remove -y docker-compose
    echo "Removed docker-compose"
  elif [[ "${__distro}" =~ "debian" ]]; then
    ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install ca-certificates curl gnupg
    __nag_os_version
    if [[ "${__eol_os}" -eq 1 ]]; then
      echo "${__project_name} cannot update Docker Compose on Debian ${__os_major_version}."
      exit 1
    fi
    ${__auto_sudo} mkdir -p /etc/apt/keyrings
    ${__auto_sudo} curl -fsSL https://download.docker.com/linux/debian/gpg | ${__auto_sudo} gpg --dearmor --yes \
    -o /etc/apt/keyrings/docker.gpg
    ${__auto_sudo} echo \
        "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
        https://download.docker.com/linux/debian $(lsb_release -cs) stable" \
        | ${__auto_sudo} tee /etc/apt/sources.list.d/docker.list > /dev/null
    ${__auto_sudo} apt-get update
    ${__auto_sudo} apt-get install -y docker-compose-plugin docker-buildx-plugin
    echo "Installed docker-compose-plugin"
    __old_compose=0
    __compose_upgraded=1
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
        ${__auto_sudo} apt-mark manual docker.io
    elif dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
        ${__auto_sudo} apt-mark manual docker-ce
    fi
    ${__auto_sudo} apt-get remove -y docker-compose
    echo "Removed docker-compose"
  else
    echo "${__project_name} does not know how to update Docker Compose on ${__distro}"
  fi
}


__check_compose_version() {
  local yn

# Check for Compose V2 (docker compose) vs Compose V1 (docker-compose)
  if docker compose version >/dev/null 2>&1; then
    __compose_version=$(${__docker_sudo} docker compose version | sed -n -E -e "s/.*version [v]?([0-9.-]*).*/\1/ip")
    __compose_major=${__compose_version%%.*}
    __compose_minor=${__compose_version#*.}
    __compose_minor=${__compose_minor%%.*}
   if [[ "${__compose_major}" -eq 1 ]]; then
     __old_compose=1
   elif [[ "${__compose_minor}" -lt 18 ]]; then
     __old_compose=1
   else
     __old_compose=0
   fi
  else
    __old_compose=1
    __compose_version=$(${__docker_sudo} docker-compose --version | sed -n -E -e "s/.*version [v]?([0-9.-]*).*/\1/ip")
    __compose_major=${__compose_version%%.*}
    __compose_minor=${__compose_version#*.}
    __compose_minor=${__compose_minor%%.*}
  fi
  if [ "${__old_compose}" -eq 1 ]; then
    if [[ "${__compose_major}" -eq 1 ]]; then
      # This runs before the actual update command, in the main section. ethd exits if it can't upgrade, therefore
      # no check for ${ETHDSECUNDO} or command update, here
      echo
      echo "You are using docker-compose ${__compose_version}, which is unsupported by Docker, Inc."
      echo "${__project_name} only supports Compose V2."
      echo
      if [[ "${__distro}" = "ubuntu" ]]; then
        echo "It is recommended that you replace Compose V1 with Compose V2."
        if [[ "${__non_interactive}" -eq 0 ]]; then
          while true; do
            read -rp "Do you want to update Docker Compose to V2? (yes/no) " yn
            case "${yn}" in
              [Nn]*)
                echo "Please be sure to update Docker Compose yourself!"
                echo "You can install it with \"sudo apt update && sudo apt install docker-compose-v2\"."
                echo "You can remove the old docker-compose:"
                echo "\"sudo apt-mark manual docker.io && sudo apt --autoremove remove docker-compose\""
                break
                ;;
              *) __upgrade_compose; break;;
            esac
          done
        fi
      elif [[ "${__distro}" =~ debian ]]; then
        if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
          if [[ "${__os_major_version}" -lt 13 ]]; then
            echo "Debian ${__os_major_version}'s docker.io does not ship with Compose V2. Please replace docker.io with docker-ce"
            echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
          else
            echo "Debian ${__os_major_version} ships with Compose V2."
            echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
            echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
          fi
        else
          echo "You appear to be using Docker CE, which ships with Compose V2."
          echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
          echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
        fi
      else
        echo "${__project_name} does not know how to update Docker Compose on ${__distro}"
      fi
    else  # Old Compose V2
      if [[ -n "${ETHDSECUNDO-}" || ! "${__command}" = "update" ]]; then  # Don't run this twice
        true  # Nothing now for old V2; maybe in future we'll do the update for the user
      fi
    fi
  fi
}


__prep_conffiles() {
# Create custom-prom.yml if it doesn't exist
  if [[ ! -f "./prometheus/custom-prom.yml" ]]; then
    ${__as_owner} touch "./prometheus/custom-prom.yml"
  fi
# Make sure the prometheus dir and its contents are accessible to user nobody
  if find prometheus -type d \! -perm 755 | grep -q .; then
    find prometheus -type d -exec chmod 755 {} \;
  fi
  if find prometheus -name '*.yml' \! -perm 664 | grep -q .; then
    find prometheus -name '*.yml' -exec chmod 664 {} \;
  fi
# Create config.yaml if it doesn't exist
  if [[ ! -f "ssv-config/config.yaml" ]]; then
    ${__as_owner} cp ssv-config/config.yaml.sample ssv-config/config.yaml
  fi
  if [[ ! -f "ssv-config/dkg-config.yaml" ]]; then
    ${__as_owner} cp ssv-config/dkg-config.yaml.sample ssv-config/dkg-config.yaml
  fi
# Make sure ssv-config yaml files are 664
  if find ssv-config -maxdepth 0 \! -perm 755 | grep -q .; then
    chmod 755 ssv-config
  fi
  if find ssv-config -name '*.yaml' \! -perm 664 | grep -q .; then
    chmod 664 ssv-config/*.yaml
  fi
# Make sure local user owns the dkg output dir and everything in it
if find .eth/dkg_output \( \! -user "${__owner}" -o \! -group "${__owner_group}" \) -print -quit | grep -q .; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      echo "Fixing ownership of .eth/dkg_output"
      ${__auto_sudo} chown -R "${__owner}:${__owner_group}" .eth/dkg_output
      ${__auto_sudo} chmod 755 .eth/dkg_output
    else
      echo "Ownership of .eth/dkg_output should be fixed, but this user can't sudo"
    fi
  fi
# Make sure the dkg output dir and its subdirs are mod 0755
  if find .eth/dkg_output -type d \! -perm 755 | grep -q .; then
    find .eth/dkg_output -type d -exec chmod 755 {} \;
  fi
# Make sure the contents of the dkg output dir are mod 0644
  if find .eth/dkg_output -type f \! -perm 644 | grep -q .; then
    find .eth/dkg_output -type f -exec chmod 644 {} \;
  fi

# Create cb-config.toml if it doesn't exist
  if [[ ! -f "commit-boost/cb-config.toml" ]]; then
    ${__as_owner} cp commit-boost/cb-config.toml.sample commit-boost/cb-config.toml
  fi
# Create tempo.yaml if it doesn't exist
  if [[ ! -f "tempo/tempo.yaml" ]]; then
    ${__as_owner} cp tempo/tempo.yaml.sample tempo/tempo.yaml
  fi
  if [[ ! -f "tempo/overrides.yaml" ]]; then
    ${__as_owner} cp tempo/overrides.yaml.sample tempo/overrides.yaml
  fi
# Make sure local user owns .env
if find . -name .env \( \! -user "${__owner}" -o \! -group "${__owner_group}" \) -print -quit | grep -q ./.env; then
    if [[ "${__cannot_sudo}" -eq 0 ]]; then
      echo "Fixing ownership of .env"
      ${__auto_sudo} chown -R "${__owner}:${__owner_group}" .env
      ${__auto_sudo} chmod -R 644 .env
      if [[ -f .env.tmp ]]; then
        ${__auto_sudo} rm -f .env.tmp
      fi
    else
      echo "Ownership of .env should be fixed, but this user can't sudo"
    fi
  fi
}


__check_for_snap() {
  if [[ "${__distro}" = "ubuntu" && -n "$(command -v snap)" ]] && snap list 2>/dev/null | grep -qw 'docker'; then
    echo
    echo "WARNING! Snap Docker package detected. This WILL result in issues."
    echo "Removing the package will delete volumes and require a resync."
    echo
    echo "Doing so is still highly recommended however."
    echo
    echo "The exact steps depend a little on whether there already is an apt version of Docker installed as well,"
    echo "but in a nutshell \"${__me} stop\" followed by \"sudo snap remove --purge docker\" followed by a reboot,"
    echo "and as needed install docker-ce or docker.io with apt."
    echo
    echo "Do join us on EthStaker Discord at http://discord.gg/ethstaker to work through this issue."
    echo
    echo "Aborting, this is not safe"
    exit 1
  fi
}


__install_bash_completions() {
  if [[ "$OSTYPE" = "darwin"* ]]; then
    echo "Skipping installation of tab completions (not supported on macOS)"
  else
    if [[ ! -f "$(pkg-config --variable=completionsdir bash-completion)/ethd" ]]; then
      echo "Installing bash completions for ethd"
      ${__auto_sudo} ln -sf "$(dirname "$(realpath "${BASH_SOURCE[0]}")")/bash-completion" \
      "$(pkg-config --variable=completionsdir bash-completion)/ethd" || true
    fi
  fi
}


# Persist noatime in fstab for a given mount point
__fstab_noatime() {
  local mountpoint="$1"
  local fstab="/etc/fstab"
  local backup="${fstab}.bak"
  local noatime="${fstab}.noatime"

  # Check if fstab already has an entry for this mountpoint
  if grep -E "^[^#].*\s${mountpoint//\//\\/}(\s|\$)" "${fstab}" >/dev/null; then
    echo
    echo "Found ${fstab} entry for ${mountpoint}, creating a version with \"noatime\""
    echo

    ${__auto_sudo} cp ${fstab} ${backup}
    # Edit the existing line: add noatime if not already there
    awk -v mountpoint="${mountpoint}" '
    /^[ \t]*#/ || NF < 6 { print; next }
    {
        line = $0
        split(line, fields, /[ \t]+/)
        mount = fields[2]
        opts = fields[4]

        if (mount == mountpoint && opts !~ /(^|,)noatime(,|$)/) {
            # Match the byte offset of the first four fields
            match(line, /^[ \t]*[^ \t]+[ \t]+[^ \t]+[ \t]+[^ \t]+[ \t]+/)
            prefix = substr(line, 1, RLENGTH)
            rest = substr(line, RLENGTH + 1)

            # Extract first word from rest (the options field)
            match(rest, /^[^ \t]+/)
            opts_field = substr(rest, RSTART, RLENGTH)
            opts_field = opts_field ",noatime"

            suffix = substr(rest, RSTART + RLENGTH)
            line = prefix opts_field suffix
        }

        print line
    }' "${fstab}" | ${__auto_sudo} tee "${noatime}" >/dev/null
    ${__auto_sudo} chmod 664 "${noatime}"
    echo "${fstab} has not been altered. A backup copy is in ${backup}"
    echo "If the below diff looks good to you, you can \"sudo cp ${noatime} ${fstab}\""
    echo "followed by \"sudo mount -o remount ${mountpoint}\" to verify everything still works."
    echo
    echo "Note: You may see a warning suggesting 'systemctl daemon-reload'. This is only relevant"
    echo "for systemd's internal mount unit management and does not affect the active mount options"
    echo "applied via 'mount'."
    echo
    diff ${noatime} ${fstab} || true
  else
    echo "No ${fstab} entry for ${mountpoint} — not adding one automatically."
    echo "Manual intervention required for \"noatime\" persistence."
  fi
}


__optimize_chrony() {
  local file
  local new_file

  if [[ -f /etc/chrony/chrony.conf && -d /etc/chrony/sources.d ]]; then
    echo
    echo "Configuring chrony to use Google's time-smearing servers"
    if ! ${__auto_sudo} sed -Ei.bak '/^\s*(pool|server|leapsectz)\b/ s/^/#/' "/etc/chrony/chrony.conf"; then
      echo "Failed to alter /etc/chrony/chrony.conf"
      echo "Manual intervention is required to use Google's time-smearing servers with chrony"
      return 0
    fi

    while IFS= read -r -d '' file; do
      new_file="${file}.bak"
      if ! ${__auto_sudo} mv "${file}" "${new_file}"; then
        printf "Failed to rename %s to %s\n" "${file}" "${new_file}"
        return 0
      fi
    done < <(find "/etc/chrony/sources.d" -maxdepth 1 -type f -name '*.sources' -print0)
    if ! ${__auto_sudo} tee "/etc/chrony/sources.d/google-ntp.sources" >/dev/null <<EOF
# Google's time-smearing NTP servers
# Requires leapsectz in chrony.conf to be commented out or not exist
pool time.google.com iburst minpoll 4 maxpoll 6 polltarget 16
EOF
    then
      printf "Failed to write Google servers to %s\n" "/etc/chrony/sources.d/google-ntp.sources"
      return 0
    fi
    if ! ${__auto_sudo} systemctl restart chrony; then
      echo "Failed to restart the chrony service"
      echo "Manual intervention is required to have it use the new configuration"
    fi
  fi
}


# Apply common performance optimizations on behalf of the user
__optimize_host() {
  local docker_root
  local docker_mount
  local docker_mount_opts
  local exitstatus
  local swappiness
  local cache_pressure
  local target_pressure
  local memtotal

  echo
  docker_root=$(__dodocker system info --format '{{.DockerRootDir}}')
  if command -v findmnt >/dev/null; then
    docker_mount=$(findmnt -T "${docker_root}" -o TARGET -n)
    docker_mount_opts=$(findmnt -T "${docker_root}" -o OPTIONS -n 2>/dev/null)
  else
    docker_mount=$(df --output=target "${docker_root}" | tail -1)
    docker_mount_opts=$(awk -v path="${docker_mount}" '$2 == path {print $4}' /proc/mounts)
  fi
  if [[ "${docker_mount_opts}" == *noatime* ]]; then
    echo "\"noatime\" already set on ${docker_mount}"
  else
    echo "Remounting ${docker_mount} with \"noatime\""
    ${__auto_sudo} mount -o remount,noatime "${docker_mount}" || true
    exitstatus=$?
    if [[ ${exitstatus} -eq 0 ]]; then
      __fstab_noatime "${docker_mount}"
    else
      echo "Applying \"noatime\" to ${docker_mount} failed"
    fi
  fi

  swappiness=$(${__auto_sudo} sysctl -n vm.swappiness)
  if [[ "${swappiness}" -gt 1 ]]; then
    echo "Adjusting swappiness down to 1 from ${swappiness}"
    ${__auto_sudo} sysctl -w vm.swappiness=1
    if [[ -d /etc/sysctl.d ]]; then
      echo "Persisting vm.swappiness=1 in /etc/sysctl.d/10-swappiness.conf"
      echo "vm.swappiness=1" | ${__auto_sudo} tee /etc/sysctl.d/10-swappiness.conf >/dev/null
    elif [[ -f /etc/sysctl.conf ]]; then
      if ! grep -E '^\s*vm\.swappiness\s*=' /etc/sysctl.conf >/dev/null; then
        echo "Appending vm.swappiness=1 to /etc/sysctl.conf"
        echo "vm.swappiness=1" | ${__auto_sudo} tee -a /etc/sysctl.conf > /dev/null
      else
        echo "vm.swappiness is already set in /etc/sysctl.conf"
      fi
    else
      echo "Unable to find /etc/sysctl.conf or /etc/sysctl.d"
      echo "Manual intervention is required to set swappiness permanently"
    fi
  fi

  cache_pressure=$(${__auto_sudo} sysctl -n vm.vfs_cache_pressure)
  memtotal=$(awk '/MemTotal/ {printf "%d", int($2/1024/1024)}' /proc/meminfo)
  if [[ "${memtotal}" -ge 60 ]]; then
    target_pressure=10
  elif [[ "${memtotal}" -ge 30 ]]; then
    target_pressure=25
  else
    target_pressure=50
  fi

  if [[ "${cache_pressure}" -gt "${target_pressure}" ]]; then
    echo "Adjusting vfs_cache_pressure down to ${target_pressure} from ${cache_pressure}"
    ${__auto_sudo} sysctl -w vm.vfs_cache_pressure="${target_pressure}"
    if [[ -d /etc/sysctl.d ]]; then
      echo "Persisting vm.vfs_cache_pressure=${target_pressure} in /etc/sysctl.d/10-vfs_cache_pressure.conf"
      echo "vm.vfs_cache_pressure=${target_pressure}" | ${__auto_sudo} tee /etc/sysctl.d/10-vfs_cache_pressure.conf >/dev/null
    elif [[ -f /etc/sysctl.conf ]]; then
      if ! grep -E '^\s*vm\.vfs_cache_pressure\s*=' /etc/sysctl.conf >/dev/null; then
        echo "Appending vm.vfs_cache_pressure=${target_pressure} to /etc/sysctl.conf"
        echo "vm.vfs_cache_pressure=${target_pressure}" | ${__auto_sudo} tee -a /etc/sysctl.conf > /dev/null
      else
        echo "vm.vfs_cache_pressure is already set in /etc/sysctl.conf"
      fi
    else
      echo "Unable to find /etc/sysctl.conf or /etc/sysctl.d"
      echo "Manual intervention is required to set vfs_cache_pressure permanently"
    fi
  fi

  __optimize_chrony

  return 0
}


__install_docker() {
  local repo
  local groups

  if [[ "${__distro}" = "ubuntu" ]]; then
    repo=ubuntu
  elif [[ "${__distro}" = *"debian"* ]]; then
    repo=debian
  else
    echo
    echo "__install_docker() was called on ${__distro}, which is neither Debian nor Ubuntu."
    echo "This is a bug."
    exit 70
  fi

  if [[ -z "$(command -v docker)" ]]; then
    ${__auto_sudo} mkdir -p /etc/apt/keyrings
    curl -fsSL "https://download.docker.com/linux/${repo}/gpg" | ${__auto_sudo} gpg --dearmor \
      --yes -o /etc/apt/keyrings/docker.gpg
    echo \
      "deb [arch=$(dpkg --print-architecture) signed-by=/etc/apt/keyrings/docker.gpg] \
      https://download.docker.com/linux/${repo} $(lsb_release -cs) stable" \
      | ${__auto_sudo} tee /etc/apt/sources.list.d/docker.list > /dev/null
    ${__auto_sudo} apt-get update
    ${__auto_sudo} apt-get install -y docker-ce docker-ce-cli containerd.io docker-compose-plugin \
      docker-buildx-plugin
    ${__auto_sudo} systemctl start systemd-logind
    echo "Installed docker-ce and docker-compose-plugin"
  else
    echo "Docker is already installed"
  fi

  groups=$(${__as_owner} groups)
  if [[ ! "${groups}" =~ "docker" ]]; then
    echo "Making your user part of the docker group"
    ${__auto_sudo} usermod -aG docker "${__owner}"
    echo "Please run newgrp docker or log out and back in"
  else
    echo "Your user is already part of the docker group"
  fi

  return 0
}


install() {
  local yn

  if ! [[ "${__distro}" =~ (ubuntu|debian) ]]; then
    echo "${__project_name} does not know how to install Docker on ${__distro}"
    return 0
  fi

  __nag_os_version
  if [[ "${__eol_os}" -eq 1 ]]; then
    echo "${__project_name} requires an upgraded Linux distribution to run install."
    return 0
  fi

  if [[ "${__cannot_sudo}" -eq 1 ]]; then
    echo "The install command requires the user to be part of the sudo group, or on macOS the admin group"
    return 0
  fi

  echo "Installing packages that ${__project_name} requires or considers helpful"
  echo
  ${__auto_sudo} apt-get update
  ${__auto_sudo} apt-get install -y ca-certificates curl gnupg whiptail chrony pkg-config screen ncdu gzip speedtest-cli jq iputils-ping

  echo
  read -rp "Do you want to install Docker and make your user part of the docker group? (no/yes) " yn
  case "${yn}" in
    [Yy]*) __install_docker;;
    *) ;;
  esac

  if [[ -n "$(command -v docker)" ]]; then
    __handle_docker
  else
    echo "${__project_name} requires Docker to be present to continue with install steps."
    echo "Please install Docker and run \"${__me} install\" again."
    return 0
  fi

  echo
  read -rp "Do you want ${__project_name} to apply common performance optimizations? (no/yes) " yn
  case "${yn}" in
    [Yy]*) __optimize_host;;
    *) ;;
  esac

  __install_bash_completions

  if ! grep -q "alias ethd" ~/.profile; then  # If an alias already exists, don't touch it
    echo
    read -rp "Do you want to be able to call 'ethd' from anywhere? (yes/no) " yn
    case "${yn}" in
      [Nn]*) return 0;;
      *) ;;
    esac
    echo "alias ethd=$(realpath "${BASH_SOURCE[0]}")" >>~/.profile
    echo "cat $(dirname "$(realpath "${BASH_SOURCE[0]}")")/.motd" >>~/.profile
    echo "Go ahead and 'source ~/.profile' or log out and back in."
    echo "After that, you can use the command 'ethd'."
  fi

  return 0
}


# set global __free_space to what's available to Docker
__get_docker_free_space() {
  local regex

  if [[ "$OSTYPE" = "darwin"* ]]; then  # macOS doesn't expose docker root dir to the OS
    __free_space=$(__dodocker run --rm -v macos-space-check:/dummy busybox df -P /dummy | awk '/[0-9]%/{print $(NF-2)}')
  else
    __docker_dir=$(__dodocker system info --format '{{.DockerRootDir}}')
    __free_space=$(df -P "${__docker_dir}" | awk '/[0-9]%/{print $(NF-2)}')
  fi

  regex='^[0-9]+$'
  if ! [[ "${__free_space}" =~ ${regex} ]] ; then
    echo "Unable to determine free disk space. This is likely to be a bug."
    if [[ "$OSTYPE" = "darwin"* ]]; then
      echo "df reports $(__dodocker run --rm -v macos-space-check:/dummy busybox df -P /dummy) and __free_space is ${__free_space}"
    else
      echo "df reports $(df -P "${__docker_dir}") and __free_space is ${__free_space}"
    fi
    exit 70
  fi
}


__display_docker_dir() {
  if [[ "$OSTYPE" = "darwin"* ]]; then  # macOS doesn't expose docker root dir to the OS
    echo "Here's total and used space on Docker's virtual volume"
    __dodocker run --rm -v macos-space-check:/dummy busybox df -h /dummy
  else
    echo "Here's total and used space on ${__docker_dir}"
    df -h "${__docker_dir}"
  fi
}


__display_docker_volumes() {
  echo
  # Assume project name and volume are delimited by _ and there is no _ in the volume name. Done to avoid catching project-2 while looking at project
  if [[ -z "$(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_[^_]+$")" ]]; then
    echo "There are no Docker volumes for this copy of ${__project_name}"
    echo
  else
    echo "Here are the Docker volumes used by this copy of ${__project_name} and their space usage:"
    __dodocker system df -v | grep -A 500 "VOLUME NAME" | grep -iE "^$(basename "$(dirname "$(realpath "${BASH_SOURCE[0]}")")")_[^_]+$"
    echo
    echo "If your Consensus Layer client takes more than 300 GiB, you can resync it with"
    echo "\"${__me} resync-consensus\"."
    echo
  fi
  if command -v ncdu >/dev/null 2>&1; then
    echo "If there is some mystery space being taken up, try \"sudo ncdu /\"."
  else
    echo "If there is some mystery space being taken up, install ncdu, then try \"sudo ncdu /\"."
    if [[ "$OSTYPE" == "darwin"* ]]; then
      echo "To install ncdu, run \"brew install ncdu\"."
    elif [[ "${__distro}" =~ (ubuntu|debian) ]]; then
      echo "To install ncdu, run \"sudo apt update && sudo apt install ncdu\"."
    else
      echo "How to install ncdu will be specific to your distribution ${__distro}."
    fi
  fi
  echo
}


space() {
  local var

  __get_docker_free_space
  echo
  if [[ "$OSTYPE" = "darwin"* ]]; then # macOS doesn't expose docker root dir to the OS
    echo "You have $(( __free_space / 1024 / 1024 )) GiB free for Docker volumes"
  else
    echo "You have $(( __free_space / 1024 / 1024 )) GiB free on ${__docker_dir}"
  fi
  echo
  __display_docker_dir
  __display_docker_volumes

  var=ANCIENT_DIR
  __get_value_from_env "${var}" "${__env_file}" "ANCIENT_DIR"
  if [[ -n "${ANCIENT_DIR}" ]]; then
    echo
    ${__auto_sudo} du -sh "${ANCIENT_DIR}"
  fi
}


# Warn user if space is low, so they can prune
# This runs after any ethd command: It is safe to assign to uppercase vars
__check_disk_space() {
  local low=0
  min_free=314572800
  min_gib=300
  safe_prune=250

  __get_docker_free_space

  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  var="AUTOPRUNE_NM"
  __get_value_from_env "${var}" "${__env_file}" "AUTOPRUNE_NM"
  var="NETWORK"
  __get_value_from_env "${var}" "${__env_file}" "NETWORK"
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "EL_NODE_TYPE"

  if [[ "${NETWORK}" =~ ^(mainnet|gnosis)$ ]]; then
    min_free=314572800
    min_gib=300
    safe_prune=250
  else
    min_free=31457280
    min_gib=30
    safe_prune=25
  fi

# Literal match intended
# shellcheck disable=SC2076
  if [[ "${__value}" =~ "nethermind.yml" && "${__free_space}" -lt "${min_free}" ]]; then
    low=1
    echo
    echo "You are running Nethermind and have less than ${min_gib} GiB of free disk space."
# shellcheck disable=SC2154
    if [[ "${AUTOPRUNE_NM}" = true ]]; then
      echo "It should currently be auto-pruning, check logs with \"${__me} logs -f --tail 500 execution | grep \
Full\". Free space:"
    else
      echo "If the below reads above ${safe_prune} GiB free, prune it with \"${__me} prune-nethermind\""
    fi
    echo
    __display_docker_dir
    __display_docker_volumes
  elif [[ "${__value}" =~ "geth.yml" && "${__free_space}" -lt 104857600 ]]; then
    low=1
    echo
    echo "You are running Geth and have less than 100 GiB of free disk space."
    echo "You may resync from scratch to use PBSS and slow on-disk DB growth, with \"${__me} resync-execution\"."
    echo
    __display_docker_dir
    __display_docker_volumes
  elif [[ "${__value}" =~ "besu.yml" && "${__free_space}" -lt 52428800 ]]; then
    low=1
    echo
    echo "You are running Besu and have less than 50 GiB of free disk space."
    echo
    echo "If this is a long-running Besu, you may prune trie-logs with \"${__me} prune-besu\"."
    echo
    __display_docker_dir
    __display_docker_volumes
  elif [[ "${__free_space}" -lt 52428800 ]]; then
    low=1
    echo
    echo "You have less than 50 GiB of free disk space:"
    echo
    __display_docker_dir
    __display_docker_volumes
  fi

  if [[ "${low}" -eq 1 && "${NETWORK}" = "mainnet" ]]; then
#shellcheck disable=SC2154
    if [[ "${EL_NODE_TYPE}" =~ expiry ]]; then
      echo "You are already configured to expire execution layer history."
    else
      echo "You are not configured to expire execution layer history. You can free space with \"${__me} prune-history\"."
      echo "If this is an RPC node that needs history, do not run that command."
    fi
  fi
}


# Check whether there's a source-built client and if so, force it with --no-cache
# This is called after writing to .env; it is safe to assign to uppercase variables
__source_build() {
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "COMPOSE_FILE"

  case "${COMPOSE_FILE}" in
    *deposit-cli.yml*)
      var="DEPCLI_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
# shellcheck disable=SC2154
      if [[ "${__value}" = "Dockerfile.source" ]]; then
        __docompose --profile tools build --pull --no-cache deposit-cli-new
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *mev-boost.yml*)
      var="MEV_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache mev-boost
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *reth.yml*)
      var="RETH_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *geth.yml*)
      var="GETH_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *besu.yml*)
      var="BESU_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *nethermind.yml*)
      var="NM_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *erigon.yml*)
      var="ERIGON_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *nimbus-el.yml*)
      var="NIMEL_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
    *ethrex.yml*)
      var="ETHREX_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache execution
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *lighthouse.yml*|*lighthouse-cl-only.yml*)
      var="LH_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *teku.yml*|*teku-allin1.yml*|*teku-cl-only.yml*)
      var="TEKU_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *lodestar.yml*|*lodestar-cl-only.yml*)
      var="LS_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *nimbus.yml*|*nimbus-allin1.yml*|*nimbus-cl-only.yml*)
      var="NIM_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *prysm.yml*|*prysm-cl-only.yml*)
      var="PRYSM_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
    *grandine.yml*| *grandine-allin1.yml*|*grandine-cl-only.yml*)
      var="GRANDINE_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
          __docompose build --pull --no-cache consensus
      fi
      ;;
  esac
  case "${COMPOSE_FILE}" in
    *vero-vc-only.yml*)
      var="VERO_DOCKERFILE"
      __get_value_from_env "${var}" "${__env_file}" "__value"
      if [[ "${__value}" = "Dockerfile.source" ]]; then
        __docompose build --pull --no-cache validator
      fi
      ;;
  esac
}


# When this gets called $var is COMPOSE_FILE and $__value is what is set in .env for it
# This function rebuilds __value
__migrate_compose_file() {
  local ymlarray
  local ymlfile
  local n
  local index

# Some files have been renamed and others removed altogether
  local from_yml=( )
  local to_yml=( )

  IFS=":"
  set -o noglob
# Globbing is off
# shellcheck disable=SC2206
  ymlarray=(${__value})  # split+glob with glob disabled, and split using : as delimiter
  set +o noglob
# Unset restores default
  unset IFS

  __value=""
  for n in "${!ymlarray[@]}"; do
    ymlfile="${ymlarray[n]}"
    for index in "${!from_yml[@]}"; do
      if [[ "${from_yml[index]}" = "${ymlfile}" ]]; then
        ymlfile=${to_yml[index]}
        break
      fi
    done
    if [[ -n "${ymlfile}" ]]; then
      if [[ -z "${__value}" ]]; then
        __value="${ymlfile}"
      else
        __value="${__value}:${ymlfile}"
      fi
    fi
  done
}


__upgrade_postgres() {
  local source_vol
  local source_pg
  local source_size
  local backup_vol
  local regex
  local yn

# Check for web3signer
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
# I do mean to match literally
# shellcheck disable=SC2076
  if [[ ! "${__value}" =~ "web3signer.yml" ]]; then
    return 0
  fi

  source_vol="$(basename "$(pwd)" | tr '[:upper:]' '[:lower:]')_web3signer-slashing-data"
  if [[ -z "$(__dodocker volume ls -q -f "name=${source_vol}")" ]]; then
    return 0
  fi

  __during_postgres=1

  source_pg="$(__dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
    alpine:3 cat /var/lib/postgres-data/PG_VERSION)"

  if [[ "${source_pg}" -lt "${__target_pg}" ]]; then
    echo "Web3signer is using PostgreSQL ${source_pg}. The current version is PostgreSQL ${__target_pg}."
    echo
    if [[ "${__non_interactive}" -eq 0 ]]; then
      while true; do
        read -rp "Would you like to migrate to PostgreSQL ${__target_pg}? (Y/n) " yn
        case "${yn}" in
          [Nn]o|[Nn]) echo "Keeping PostgreSQL at version ${source_pg}"; __during_postgres=0; return 0;;
          *) break;;
        esac
      done
    fi
  else
    __during_postgres=0
    return 0
  fi

  source_size="$(__dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
    alpine:3 du -s /var/lib/postgres-data/ | awk '{print $1}')"

  regex='^[0-9]+$'
  if ! [[ "${source_size}" =~ ${regex} ]] ; then
    echo "Unable to determine database size. This is likely a bug."
    echo "source_size is ${source_size}"
    return 70
  fi

  __get_docker_free_space

  if [[ "${__free_space}" -lt $(( (source_size * 2) + 10485760 )) ]]; then
    echo
    echo "You don't have enough free space to migrate the slashing protection database."
    echo "It is $(( source_size / 1024 / 1024 )) GiB in size and you need twice as much free again."
    echo
    __display_docker_dir
    echo
    return 1
  fi

  backup_vol="$(basename "$(pwd)" | tr '[:upper:]' '[:lower:]')_web3signer-slashing-data-pg${source_pg}-backup"
  if [[ -n "$(__dodocker volume ls -q -f "name=${backup_vol}")" ]]; then
    echo "PostgreSQL upgrade was aborted. A backup volume ${backup_vol} already exists,"
    echo "and you are on PostgreSQL ${source_pg}. This suggests a failed upgrade previously."
    echo "Upgrading PostgreSQL isn't safe."
    echo "This should not have happened. Please come to Ethstaker Discord to troubleshoot this."
    return 70
  fi

  echo "Stopping Web3signer"
  __docompose stop web3signer && __docompose rm -f web3signer
  echo "Stopping PostgreSQL"
  __docompose stop postgres && __docompose rm -f postgres

  echo "Copying data in web3signer-slashing-data volume to backup"
  __dodocker volume create "${backup_vol}"
  __dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
    -v "${backup_vol}":"/var/lib/pg-backup" \
    alpine:3 cp -a /var/lib/postgres-data/. /var/lib/pg-backup

  echo
  echo "Migrating database from PostgreSQL ${source_pg} to PostgreSQL ${__target_pg}"
  echo "If this step fails, the Web3signer slashing protection database is no longer protecting you."
  echo "In failure case, do not start Web3signer again, instead seek help on Ethstaker Discord: http://discord.gg/ethstaker"
  echo

  __dodocker pull "pgautoupgrade/pgautoupgrade:${__target_pg}-trixie"
  __during_pg_migrate=1
  __dodocker run --rm -v "${source_vol}":"/var/lib/postgres-data" \
   -e PGAUTO_ONESHOT=yes -e POSTGRES_PASSWORD=postgres -e POSTGRES_USER=postgres -e PGDATA=/var/lib/postgres-data \
   "pgautoupgrade/pgautoupgrade:${__target_pg}-trixie"

  __pg_migrated=1

  echo
  echo "Adjusting PostgreSQL Docker tag"
  if [[ ! -f "${__env_file}.source" ]]; then  # update() didn't migrate env, let's make sure .env.source exists
    cp "${__env_file}" "${__env_file}.source"
  fi
  var="PG_DOCKER_TAG"
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
  PG_DOCKER_TAG=${__target_pg}-trixie  # Match pgautoupgrade Debian version to avoid collation errors
  __update_value_in_env "${var}" "${!var}" "${__env_file}"
  __final_msg+="\nWeb3signer has been stopped. You'll need to run \"${__me} up\" to start it again.\n"
  __final_msg+="Before you do, double-check that the upgrade was successful, by scrolling through the\n"
  __final_msg+="upgrade messages above.\n"
  __final_msg+="\nA copy of your old slashing protection database is in the Docker volume ${backup_vol}.\n"
  __final_msg+="Confirm that everything works, and then delete it with \"docker volume rm ${backup_vol}\".\n"
  __during_postgres=0
}


repair-reth() {
  local exitstatus
  local var
  local yn

# Check for Reth
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
# I do mean to match literally
# shellcheck disable=SC2076
  if [[ ! "${__value}" =~ "reth.yml" ]]; then
    echo "You do not appear to be using Reth. Aborting"
    return 0
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    echo
    while true; do
      read -rp "WARNING - About to repair the Reth database. This can take 2 hours or more. Do you wish to continue? (Y/n) " yn
      case "${yn}" in
        [Nn]o|[Nn]) echo "Skipping Reth database repair"; return 0;;
        *) break;;
      esac
    done
  fi

  __docompose exec execution touch /var/lib/reth/repair-trie
  echo "Restarting Reth to initiate repair"
  echo "You can monitor progress with \"./ethd logs -f execution\"."
  restart execution
}


__enable_v6() {
  local var
  local v6_works

  if [[ "${__docker_major_version}" -lt 27 ]]; then
    return
  fi

  var="IPV6"
  __get_value_from_env "${var}" "${__env_file}" "IPV6"
  if [[ "${IPV6}" = "true" ]]; then
    return
  fi

  if [[ "${__distro}" =~ (ubuntu|debian) ]]; then
    if ! dpkg-query -W -f='${Status}' iputils-ping 2>/dev/null | grep -q "ok installed"; then
      echo "Installing ping utility"
      ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install iputils-ping
    fi
  fi

  echo "Testing IPv6 host connectivity"
  if ! ping -c1 2001:4860:4860::8888 >/dev/null; then
    echo "No IPv6 detected; continuing with IPv4"
    return
  fi

  echo "Testing IPv6 Docker connectivity"
  __dodocker network create --ipv6 ip6net_ethd_test
  v6_works=$(__dodocker run --rm --network ip6net_ethd_test busybox sh -c \
    "if ping -c1 -6 2001:4860:4860::8888 >/dev/null; then echo true; else echo false; fi" < /dev/null)
  __dodocker network rm ip6net_ethd_test

  if [[ "${v6_works}" = "true" ]]; then
    echo "Enabling IPv4/6 dual-stack for your ${__project_name} setup"
    IPV6="true"
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
  else
    echo "Docker cannot use IPv6; continuing with IPv4"
  fi
}


__get_value_from_env() {
  # Call with variable name to read, env file name, and global variable to assign the __value to
  # Also sets global __found
  local var_name="$1"
  local env_file="$2"
  local output_var="$3"
  local output
  local parsed_value
  local awk_exe

  if [[ "${output_var}" = "parsed_value" || "${output_var}" = "output_var" \
      || "${output_var}" = "output" || "${output_var}" = "env_file" \
      || "${output_var}" = "var_name" ]]; then
    echo "__get_value_from_env was called with a conflicting output variable: ${output_var}"
    echo "This is a bug."
    exit 70
  fi

  if [[ "$OSTYPE" = "darwin"* ]]; then
    awk_exe="gawk"  # Built-in awk can't handle multi-line. Does require brew install gawk
  else
    awk_exe="awk"
  fi

#shellcheck disable=SC2016
  output=$(${awk_exe} -v var="${var_name}" '
    BEGIN { __found = 0; __value = "" }

    # Skip empty lines and comments
    /^[[:space:]]*($|#)/ {
      next
    }

    # Match single-line unquoted __value
    $0 ~ "^[ \t]*" var "=" && $0 !~ "^[ \t]*" var "=[ \t]*[\"'\'']" {
      sub("^[ \t]*"var"=", "")
      gsub(/^[ \t]*|[ \t]*$/, "", $0)
      __value = $0
      __found = 1
      exit
    }

    # Match empty unquoted __value
    $0 ~ "^[ \t]*"var"=$" {
      __value = ""
      __found = 1
      exit
    }

    # Single-line DOUBLE-quoted: VAR="..."; allow trailing spaces
    $0 ~ "^[ \t]*" var "=\"[^\"]*\"[ \t]*$" {
      sub("^[ \t]*" var "=\"", "", $0)
      sub(/"[ \t]*$/, "", $0)
      __value = "\"" $0 "\""
      __found = 1
      exit
    }

    # Single-line SINGLE-quoted: VAR='\''...'\''; allow trailing spaces
    $0 ~ "^[ \t]*" var "='\''[^'\'']*'\''[ \t]*$" {
      sub("^[ \t]*" var "='\''", "", $0)
      sub(/'\''[ \t]*$/, "", $0)
      __value = "'"'"'" $0 "'"'"'"
      __found = 1
      exit
    }

    # Match the start of a multi-line __value (with opening double or single quote)
    $0 ~ "^[ \t]*"var"=\"[^\"]*$" || $0 ~ "^[ \t]*" var "='\''[^'\'']*$" {
      # Pick which quote we matched and strip the var=<quote> prefix
      if ($0 ~ "^[ \t]*" var "=\"[^\"]*$") {
        __q="\""; sub("^[ \t]*" var "=\"", "", $0)
      } else {
        __q="'\''";  sub("^[ \t]*" var "='\''", "", $0)
      }
      # Accumulator starts with the opening quote, plus first chunk + newline
      __value = __q $0 "\n"
      __found = 1
      next
    }

    # Continue collecting lines for a multi-line __value
    __found && ($0 !~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$")) {
      __value = __value $0 "\n"
      next
    }

    # End of a multi-line __value (with closing quote)
    __found && ($0 ~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$")) {
      # Remove the trailing quote + any spaces/tabs around it
      if (__q == "\"") {
        sub(/[ \t]*"[ \t]*$/, "", $0)
      } else {
        sub(/[ \t]*'\''[ \t]*$/, "", $0)
      }
      __value = __value $0 __q
      __found = 1
      exit
    }

    END {
      # Print here-doc style so we can parse with awk
      # Print the __value as is, including quotes for multi-line
      print "__value<<EOF"
      print __value
      print "EOF"
      print "__found=" __found
    }
  ' "${env_file}")

  # Parse __value using here-doc style
#shellcheck disable=SC2016
  parsed_value=$(${awk_exe} '/^__value<<EOF$/ {getline; while ($0 != "EOF") { print; getline } }' <<< "${output}")
  # Parse __found directly into a global variable
#shellcheck disable=SC2016
  __found=$(${awk_exe} -F= '/^__found=/ {print $2}' <<< "${output}")

  # assign __value to caller’s variable
  printf -v "${output_var}" '%s' "${parsed_value}"
}


__update_value_in_env() {
# Call as __update_value_in_env "${var}" "${value}" "${env_file}"
  local var_name="$1"
  local new_value="$2"
  local env_file="$3"
  local escaped_value
  local awk_exe

  if [[ "$OSTYPE" = "darwin"* ]]; then
    awk_exe="gawk"  # Built-in awk can't handle multi-line. Does require brew install gawk
  else
    awk_exe="awk"
  fi

  # Escape backslashes for safety
  escaped_value=$(printf '%s' "${new_value}" | sed 's/\\/\\\\/g')

  # Check if the variable already exists in the .env file
  if grep -q "^[ \t]*${var_name}=" "${env_file}"; then
    # Variable exists, update it
#shellcheck disable=SC2016
    ${awk_exe} -v var="${var_name}" -v new_value="${escaped_value}" '
      BEGIN { in_block = 0; multi_line = 0; __q="" }
      # Start of the target variable
      $0 ~ "^[ \t]*" var "=" {
        # Determine opening quote (if any)
        if ($0 ~ "^[ \t]*" var "=\"") {
          __q = "\""
          # If there is NOT a second " later on the line, it is multiline
          if ($0 !~ "^[ \t]*" var "=\".*\"[ \t]*$")
            multi_line = 1
          else
            multi_line = 0
        }
        else if ($0 ~ "^[ \t]*" var "='\''") {
          __q = "'\''"
          # If there is NOT a second '\'' later on the line, it is multiline
          if ($0 !~ "^[ \t]*" var "='\''.*'\''[ \t]*$")
            multi_line = 1
          else
            multi_line = 0
        }
        else {
          __q = ""
          multi_line = 0
        }

        # Replace with new value, verbatim (already escaped upstream)
        gsub(/&/, "\\&", new_value)   # AWK print safety
        print var "=" new_value

        in_block = 1
        next
      }

      # A new variable definition resets skipping
      /^[ \t]*[A-Z_][A-Z0-9_]*=/ && in_block {
        in_block=0
        multi_line=0
        __q=""
      }

      # Skip multiline content until closing quote line
      multi_line && ( $0 !~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$") ) {
        next
      }

      # Closing line of the multi-line block: consume it and reset
      multi_line && ( $0 ~ (__q=="\"" ? "\"[ \t]*$" : "'\''[ \t]*$") ) {
        in_block=0
        multi_line=0
        __q=""
        next
      }

      # Print all lines if not in the target variable block
      { print }
    ' "${env_file}" | ${__as_owner} tee "${env_file}.tmp" >/dev/null
    ${__as_owner} mv "${env_file}.tmp" "${env_file}"
  else
    # Variable does not exist, append it
    printf "%s=%s\n" "${var_name}" "${escaped_value}" | ${__as_owner} tee -a "${env_file}" >/dev/null
  fi
}


__env_migrate() {
  if [[ ! -f "${__env_file}" ]]; then
    return 0
  fi

  local old_vars=( )
  local new_vars=( )
  local error
  local line
  local index
  local var
  local varname

  if [[ "${__debug}" -eq 1 ]]; then  # Find any values in default.env that contain dashes
    error=0
    while IFS= read -r line; do
      # Skip blank lines and comments
      [[ -z "${line}" || "${line}" =~ ^# ]] && continue

      # Warn on dash-containing variable names
      if [[ "${line}" =~ ^([A-Za-z0-9_-]+)= ]]; then
        varname="${BASH_REMATCH[1]}"
        if [[ "${varname}" = *-* ]]; then
          echo "Error: Variable '${varname}' contains a dash and would not be usable in Bash."
          (( ++error ))
        fi
        if [[ "${varname}" = "ENV_VERSION" ]]; then
          continue
        fi
      else
        continue  # Doesn't match variable assignment format
      fi
    done < "./default.env"
    if [[ "${error}" -gt 0 ]]; then
      exit 1
    fi
  fi

# Always make sure we have a SIREN password
  var="SIREN_PASSWORD"
  __get_value_from_env "${var}" "${__env_file}" "SIREN_PASSWORD"
  if [[ -z "${SIREN_PASSWORD}" ]]; then
    SIREN_PASSWORD=$(head -c 8 /dev/urandom | od -A n -t u8 | tr -d '[:space:]' | sha256sum | head -c 32)
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
  fi

  var=ENV_VERSION
  __get_value_from_env "${var}" "default.env" "__target_ver"
  __get_value_from_env "${var}" "${__env_file}" "__source_ver"

# shellcheck disable=SC2154
  if [[ "${__keep_targets}" -eq 1 && "${__target_ver}" -le "${__source_ver}" ]]; then  # No changes in template, do nothing
    return 0
  fi

  if [[ "${__keep_targets}" -eq 0 ]]; then
    echo "Refreshing build targets in ${__env_file}"
  fi
  if [[ "${__target_ver}" -gt "${__source_ver}" ]]; then
    echo "Migrating ${__env_file} to version ${__target_ver}"
    echo "Note this is not an ${__project_name} version, it is an internal config file version"
  fi

  ${__as_owner} cp "${__env_file}" "${__env_file}".source
  __during_env_migrate=1
  __env_migrated=1
  ${__as_owner} cp default.env "${__env_file}"

  # Migrate over user settings
  while IFS= read -r line; do  # read default.env and process all variables in it
    # Skip blank lines and comments
    [[ -z "${line}" || "${line}" =~ ^# ]] && continue

    if [[ "${line}" =~ ^([A-Za-z0-9_-]+)= ]]; then
      var="${BASH_REMATCH[1]}"
    else
      continue  # Doesn't match variable assignment format
    fi
    if [[ "${var}" = "ENV_VERSION" ]]; then
      continue
    fi

    __get_value_from_env "${var}" "${__env_file}.source" "__value"
    if [[ "${__found}" -eq 1 ]]; then  # Only if variable isn't new in default.env
      if [[ "${var}" = "COMPOSE_FILE" ]]; then
        __migrate_compose_file
      fi
      if [[ "${var}" = "CL_QUIC_PORT" ]]; then
        __get_value_from_env "CL_P2P_PORT" "${__env_file}.source" "CL_P2P_PORT"
        if [[ -n "${CL_P2P_PORT}" && "${CL_P2P_PORT}" = "${__value}" ]]; then
          __value=$((__value + 1))
          echo "Adjusted CL_QUIC_PORT to ${__value} so it does not conflict with CL_P2P_PORT"
        fi
        __get_value_from_env "PRYSM_UDP_PORT" "${__env_file}.source" "PRYSM_UDP_PORT"
        if [[ -n "${PRYSM_UDP_PORT}" && "${PRYSM_UDP_PORT}" = "${__value}" ]]; then  # just in case this is one ahead
          __value=$((__value + 1))
          echo "Adjusted CL_QUIC_PORT to ${__value} so it does not conflict with PRYSM_UDP_PORT"
        fi
      fi

      if [[ "${__keep_targets}" -eq 0 && "${var}" =~ (_TAG|_REPO|_TARGET|_DOCKERFILE)$ && ! "${var}" = "PG_DOCKER_TAG" ]]; then
        __get_value_from_env "${var}" "default.env" "__value"  # Reset build target to default.env __value
      fi
      __update_value_in_env "${var}" "${__value}" "${__env_file}"
    else  # New variables, but they need to be adjusted
      # Remove after Glamsterdam
      if [[ "${__source_ver}" -lt "48" && "${var}" = "EL_NODE_TYPE" ]]; then
        __get_value_from_env "EL_ARCHIVE_NODE" "${__env_file}.source" "EL_ARCHIVE_NODE"
        if [[ "${EL_ARCHIVE_NODE}" = "true" ]]; then
          __value=archive
        else
          __get_value_from_env "EL_MINIMAL_NODE" "${__env_file}.source" "EL_MINIMAL_NODE"
          case "${EL_MINIMAL_NODE}" in
            true ) __value=pre-merge-expiry;;
            aggressive ) __value=aggressive-expiry;;
            rolling ) __value=rolling-expiry;;
            * ) __value=full;;
          esac
        fi
        __update_value_in_env "${var}" "${__value}" "${__env_file}"
      fi
      # Remove after Glamsterdam
      if [[ "${__source_ver}" -lt "48" && "${var}" = "CL_NODE_TYPE" ]]; then
        __get_value_from_env "CL_ARCHIVE_NODE" "${__env_file}.source" "CL_ARCHIVE_NODE"
        if [[ "${CL_ARCHIVE_NODE}" = "true" ]]; then
          __value=archive
        else
          __get_value_from_env "CL_MINIMAL_NODE" "${__env_file}.source" "CL_MINIMAL_NODE"
          case "${CL_MINIMAL_NODE}" in
            true ) __value=pruned;;
            * ) __value=full;;
          esac
        fi
        __update_value_in_env "${var}" "${__value}" "${__env_file}"
      fi
    fi
  done < "./default.env"

  # Move __value from old variable name(s) to new one(s)
  for index in "${!old_vars[@]}"; do
    var=${old_vars[index]}
    __get_value_from_env "${var}" "${__env_file}.source" "__value"
    if [[ "${__found}" -eq 1 ]]; then
      __update_value_in_env "${new_vars[index]}" "${__value}" "${__env_file}"
    fi
  done
  # Check whether we run a CL or VC, if so nag about FEE_RECIPIENT
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  # It's CL&VC, CL-only, or VC-only
# I do mean to match literally
# shellcheck disable=SC2076
  if [[ "${__value}" =~ (prysm\.yml|lighthouse\.yml|teku\.yml|nimbus\.yml|lodestar\.yml|-cl-only\.yml|-allin1\.yml|-vc-only\.yml) ]]; then
    # Check for rewards
    var="FEE_RECIPIENT"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ -z "${__value}" || ${__value} != 0x* || ${#__value} -ne 42 ]]; then
      if [[ "${__non_interactive}" -eq 0 ]]; then
        whiptail --msgbox "A fee recipient ETH wallet address is required in order to start the client. This is \
  for priority fees and, optionally, MEV. Please enter a valid ETH address in the next screen. Refer to \
  ${__project_name} docs (https://ethdocker.com/About/Rewards) for more information.\n\nCAUTION: \"${__me} up\" will fail if no \
  valid address is set" 12 75
        __query_coinbase
        __update_value_in_env "${var}" "${!var}" "${__env_file}"
      else
        echo "A fee recipient ETH wallet address is required in order to start the client. Please set one in \".env\"."
        echo "CAUTION: \"${__me} up\" will fail if no valid address is set."
      fi
    fi
  fi

  __during_env_migrate=0
  echo "${__env_file} updated successfully"
}


# Both tells the user that their OS is old, and sets __eol_os for code that requires a min version
__nag_os_version() {
  if [[ "${__distro}" = "ubuntu" && "${__os_major_version}" -lt "${__min_ubuntu}" ]]; then
     echo
     echo "Ubuntu ${__os_major_version} is older than the recommended ${__suggest_ubuntu} version."
     echo
     echo "Upgrading is highly recommended, so that up-to-date Docker packages are available."
     echo
     echo "Guide to upgrading to ${__upgrade_ubuntu}"
     __eol_os=1
  fi

  if [[ "${__distro}" =~ "debian" ]]; then
    if [[ "${__os_major_version}" -lt "${__min_debian}" ]]; then
     echo
     echo "Debian ${__os_major_version} is older than the recommended ${__suggest_debian} version."
     echo
     echo "Upgrading is highly recommended, so that up-to-date Docker packages are available."
     echo
     echo "Guide to upgrading to ${__upgrade_debian}"
     __eol_os=1
    fi
  fi
}


__nag_os_update() {
  if [[ ! "${__distro}" =~ (ubuntu|debian) ]]; then
    return 0
  fi

  local line
  local logdir="/var/log/"
  local dpkg_logs=()
  local dpkg_log
  local oldest_log
  local grep_cmd
  local cat_cmd
  local last_upgrade_line=""
  local last_upgrade_date=""
  local last_epoch
  local now_epoch
  local days_diff

  mapfile -t dpkg_logs < <(
    find "${logdir}" -maxdepth 1 -type f -name 'dpkg.log*' -printf '%T@ %p\n' 2>/dev/null |
      sort -n |  # Numeric sort of UNIX timestamps, oldest first
      cut -d' ' -f2-
  )
  if [[ ${#dpkg_logs[@]} -eq 0 ]]; then
    return 0
  fi

  for dpkg_log in "${dpkg_logs[@]}"; do  # Oldest to newest, end up with the newest upgrade line
    if [[ "${dpkg_log}" = *.gz ]]; then
      if [[ -z "$(command -v zgrep)" ]]; then
        return 0
      fi
      grep_cmd="zgrep"
    else
      grep_cmd="grep"
    fi
    line=$(${grep_cmd} 'upgrade ' "${dpkg_log}" | tail -n1 || true)
    if [[ -n "${line}" ]]; then
      last_upgrade_line="${line}"
    fi
  done
  if [[ -z "${last_upgrade_line}" ]]; then  # No upgrade line found; use the oldest file timestamp or log entry
    oldest_log="${dpkg_logs[0]}"
    if [[ -n "${oldest_log}" && -f "${oldest_log}" ]]; then
      if [[ "${oldest_log}" = *.gz ]]; then
        if [[ -z "$(command -v zcat)" ]]; then
          return 0
        fi
        cat_cmd="zcat"
      else
        cat_cmd="cat"
      fi
      last_upgrade_date=$(stat -c %y "${oldest_log}" 2>/dev/null | cut -d' ' -f1 \
        || ${cat_cmd} "${oldest_log}" | head -n1 | cut -d' ' -f1)
    fi
  else
    last_upgrade_date=$(awk '{print $1}' <<< "${last_upgrade_line}")
  fi
  if [[ ! "${last_upgrade_date}" =~ ^[0-9]{4}-[0-9]{2}-[0-9]{2}$ ]]; then  # Verify we have a YYYY-MM-DD date
    return 0
  fi

  last_epoch=$(date -d "${last_upgrade_date}" +%s)
  now_epoch=$(date +%s)
  days_diff=$(( (now_epoch - last_epoch) / 86400 ))

  if [[ "${days_diff}" -gt 300 ]]; then
    if [[ -n "${last_upgrade_line}" ]]; then
      echo "Your ${__distro} Linux was last updated ${days_diff} days ago on ${last_upgrade_date}."
    else
      echo "Your ${__distro} Linux was last updated more than ${days_diff} days ago."
    fi
    echo "Please run \"sudo apt update && sudo apt dist-upgrade\" to bring in security updates and bug fixes."
  fi

  if [[ -f "/var/run/reboot-required" ]]; then
    echo "A previous OS update requires you to reboot this machine to complete the update."
    echo "Please run \"sudo reboot\" to activate the updated components, like for example the kernel."
  fi
}


__pull_and_build() {
  echo "Building local client images"
  __dodocker system prune --force
  __docompose --profile tools pull
  __source_build
  __docompose --profile tools build --pull
}

# Run optional pre-update hook script for custom actions before update/config.
# Users can create pre-ethd-update.sh to run validation or preparation steps.
__run_pre_update_script() {
  local exitstatus
  local pre_update_script

  pre_update_script="$(dirname "$(realpath "${BASH_SOURCE[0]}")")/pre-ethd-update.sh"
  if [[ -f "${pre_update_script}" ]]; then
    if [[ -x "${pre_update_script}" ]]; then
      echo "[ethd] Running pre-ethd-update.sh..."
      set +e
      "${pre_update_script}"
      exitstatus=$?
      set -e
      if [[ ${exitstatus} -ne 0 ]]; then
        echo "[ethd] pre-ethd-update.sh exited with code ${exitstatus}"
        echo "[ethd] Aborting due to pre-update script failure."
        exit ${exitstatus}
      fi
    else
      echo "[ethd] ERROR: pre-ethd-update.sh exists but is not executable."
      echo "[ethd] Please make it executable with: chmod +x pre-ethd-update.sh"
      echo "[ethd] Or remove it if it's not needed."
      exit 1
    fi
  fi
}


# Run optional post-update hook script for custom actions after update/config.
# Users can create post-ethd-update.sh to run additional setup steps.
__run_post_update_script() {
  local exitstatus
  local post_update_script

  post_update_script="$(dirname "$(realpath "${BASH_SOURCE[0]}")")/post-ethd-update.sh"
  if [[ -f "${post_update_script}" ]]; then
    if [[ -x "${post_update_script}" ]]; then
      echo "[ethd] Running post-ethd-update.sh..."
      set +e
      "${post_update_script}"
      exitstatus=$?
      set -e
      if [[ ${exitstatus} -ne 0 ]]; then
        echo "[ethd] post-ethd-update.sh exited with code ${exitstatus}"
      fi
    else
      echo "[ethd] ERROR: post-ethd-update.sh exists but is not executable."
      echo "[ethd] Please make it executable with: chmod +x post-ethd-update.sh"
      echo "[ethd] Or remove it if it's not needed."
    fi
  fi
}


# Arguments are passed, but shellcheck doesn't recognize that
# shellcheck disable=SC2120
update() {
  local targetcli
  local script_dir
  local uniq_id
  local lock_file
  local screen_session
  local old_sessions
  local session_id
  local log
  local no_screen_cmd
  local dirty
  local branch

  if [[ "$*" =~ "--debug" ]]; then
    __debug=1
  fi
  if [[ "$*" =~ "--trace" ]]; then
    __debug=1
    set -x
  fi

  if [[ ! "$OSTYPE" = "darwin"* ]]; then
# Only one copy of update() should run per Eth Docker stack
    script_dir="$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
    uniq_id="${script_dir//\//_}"
    lock_file="${uniq_id}_lock"
    ${__as_owner} touch "/tmp/${lock_file}"
    exec 200<"/tmp/${lock_file}"
    if ! flock -n 200; then
        echo "Another instance of \"${__me} update\" is running. Aborting."
        exit 1
    fi
  fi

  __during_update=1
  __final_msg=""

  if [[ -z "${ETHDSECUNDO:-}" ]]; then
    __run_pre_update_script
  fi

  if [[ $(${__as_owner} git status --porcelain) ]]; then
    dirty=1
  else
    dirty=0
  fi

  __free_space=$(df -P "$(pwd)" | awk '/[0-9]%/{print $(NF-2)}')

  __regex='^[0-9]+$'
  if ! [[ "${__free_space}" =~ ${__regex} ]] ; then
    echo "Unable to determine free disk space. This is likely a bug."
    echo "df reports $(df -P "$(pwd)") and __free_space is ${__free_space}"
    exit 70
  elif [[ "$(df -P "$(pwd)" | awk '/[0-9]%/{print $(NF-2)}')" -lt 1024 ]]; then
    echo "You have less than 1 MiB of space left on $(pwd)."
    echo "Aborting, as an update is not safe."
    exit 1
  fi

  __get_docker_free_space
  if [[ "${__free_space}" -lt 1048576 ]]; then
    echo "You have less than 1 GiB of space left for Docker volumes."
    echo "Aborting, as an update is not safe."
    exit 1
  fi

# This is long-running, and it's better if we're in a protected session if interactive
  if [[ -z "${STY:-}" && -z "${TMUX:-}" && ! "$*" =~ "--non-interactive" && ! "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    no_screen_cmd=0
    echo "\"${__me} update\" benefits from running in a session that protects it against disconnects."
    if [[ -z "$(command -v screen)" ]]; then
      if [[ "${__cannot_sudo}" -eq 0 && "${__distro}" =~ (ubuntu|debian) ]]; then
        echo "Installing screen"
        ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get -y install screen
      else
        echo "\"screen\" command not found, continuing as-is"
        no_screen_cmd=1
      fi
    fi
    if [[ -z "${SSH_CONNECTION:-}" ]]; then
      no_screen_cmd=1
      echo "You are in a local terminal session, not starting screen"
    fi

    if [[ "${no_screen_cmd}" -eq 0 ]]; then
      local screen_session="${uniq_id}"
# Find old lingering screen sessions and close them
      set +e
      old_sessions=$(screen -ls 2>/dev/null | awk -v name="${screen_session}" -v status="Detached" '$0 ~ name && $0 ~ status {print $1}')
      set -e
      if [[ -n "${old_sessions}" ]]; then
        echo "Closing old, detached screen sessions"
        while IFS= read -r session_id; do
          if [[ -n "${session_id}" ]]; then
            echo "Closing screen session ${session_id}"
            screen -S "${session_id}" -X quit
          fi
        done <<< "${old_sessions}"
        echo
      fi

# Screen should run with login shell so that .profile gets loaded and aliases work
      if [[ ! -f "${HOME}/.screenrc" ]] || ! grep -q 'shell' "${HOME}/.screenrc"; then
# Intentional, I want this verbatim
# shellcheck disable=SC2016
        echo 'shell -$SHELL' >>"${HOME}/.screenrc"
      fi
      echo "Starting a new screen session with identifier ${screen_session}"
      echo "If you get disconnected, reconnect with \"screen -r ${screen_session}\""
      if [[ "${__debug}" -eq 1 ]]; then
        echo "A log of the update run can be found in \"/tmp/${screen_session}.log\""
      fi
      exec 200<&-
# Launch a new detached screen session and attach to it.
# Use bash -c to run 'ethd update', and pass along "$@"
#
#     ${BASH_SOURCE[0]} update "\$@"; exec bash
#   Escape \$@ so the outer shell doesn't expand it. Inner shell expands it.
#
#   "dummy" becomes $0 in the inner shell; "$@" parameters are assigned to $1, $2, etc.
#
#   exec bash replaces bash -c , so that the user is still inside screen at the end
#
      if [[ "${__debug}" -eq 1 ]]; then
        log="-L -Logfile /tmp/${screen_session}.log"
      else
        ${__as_owner} rm -f "/tmp/${screen_session}.log"
        log=""
      fi
# shellcheck disable=SC2086
      screen -S "${screen_session}" ${log} -dma bash -c "${BASH_SOURCE[0]} update \"\$@\"; exec bash --login" dummy "$@"
      screen -RR "${screen_session}"
      exit 0
    fi
  fi

  if [[ -z "${ETHDSECUNDO-}" ]]; then
    set +e
    ${__as_owner} git config pull.rebase false
    var="ETH_DOCKER_TAG"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ -z "${__value}" || "${__value}" = "latest" ]]; then
      export ETHDPINNED=""
      branch=$(git rev-parse --abbrev-ref HEAD)
      if [[ "${branch}" =~ ^tag-* ]]; then
        git checkout main
      fi
      ${__as_owner} git pull origin main
    else
      export ETHDPINNED="${__value}"
      ${__as_owner} git fetch --tags
      ${__as_owner} git checkout -B "tag-${__value}" "tags/${__value}"
    fi
    export GITEXITCODE=$?
    set -e
    # BASH_SOURCE so newer code gets to do the update. Use an ENV var
    # to avoid infinite loop
    export ETHDSECUNDO=1
    exec "${BASH_SOURCE[0]}" update "$@"
  fi


  __keep_targets=1
  targetcli=""
  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --keep-targets)
        if [[ -n "${targetcli}" ]]; then
          echo "Error: --keep-targets and --refresh-targets cannot be used together; use either option once only"
          exit 1
        fi
        __keep_targets=1
        targetcli="--keep-targets"
        shift
        ;;
      --refresh-targets|--reset-targets)
        if [[ -n "${targetcli}" ]]; then
          echo "Error: --keep-targets and --refresh-targets cannot be used together; use either option once only"
          exit 1
        fi
        __keep_targets=0
        targetcli="--refresh-targets"
        shift
        ;;
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      --debug | --trace)
        __debug=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        shift
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  __env_migrate
  if [[ "${__env_migrated}" -eq 1 ]] && ! cmp -s "${__env_file}" "${__env_file}".source; then  # Create .bak early
    ${__as_owner} cp "${__env_file}".source "${__env_file}".bak
  fi
  __pull_and_build

  __upgrade_postgres

  echo
  if [[ "${__env_migrated}" -eq 1 ]] && ! cmp -s "${__env_file}" "${__env_file}".source; then
    ${__as_owner} rm "${__env_file}".source  # .bak was created earlier
    echo "Your ${__env_file} configuration settings have been migrated to a fresh copy. You can \
find the original contents in ${__env_file}.bak."
    if [[ "${__keep_targets}" -eq 0 ]]; then
      echo "NB: If you made changes to the source or binary build targets, these have been \
reset to defaults."
    fi
    echo
    echo "List of changes made to ${__env_file} during migration - current on left, original on right:"
    echo
    diff -y --suppress-common-lines "${__env_file}" "${__env_file}".bak || true
  else
    echo "No changes made to ${__env_file} during update"
    if [[ -f "${__env_file}".source ]]; then
      ${__as_owner} rm "${__env_file}".source || true
    fi
  fi
  echo
  if [[ -z "${GITEXITCODE+x}" || "${GITEXITCODE}" -eq 0 ]]; then
    echo "An \"${__me} up\" command will start using the new images and configuration."
  else
    echo "WARNING"
    echo
    echo "Updating ${__project_name} failed during \"git pull\""
    echo
    echo "Please try \"git pull\" manually."
    echo "Do not run \"${__me} up\" until git can update ${__project_name}."
    echo "The current partial update risks startup failure."
  fi

  __nag_os_version
  __nag_os_update
  __upgrade_docker

  unset ETHDSECUNDO
  unset GITEXITCODE
  if [[ "${dirty}" -eq 1 ]]; then
    echo
    echo "WARNING"
    echo
    echo "You have uncommitted local changes to ${__project_name}, which may interfere with updates."
    echo "Please undo these changes or \"git commit\" them."
    echo "These are the files with local changes:"
    echo
    ${__as_owner} git status --porcelain
  fi
  if [[ -n "${ETHDPINNED:-}" ]]; then
    echo "${__project_name} version is pinned to ${ETHDPINNED} in \".env\"."
    echo "Please make sure to run compatible client versions."
  fi

  if [[ ! "$OSTYPE" = "darwin"* ]]; then
# Release lock and remove lock file
    exec 200<&-
    ${__as_owner} rm -f "/tmp/${lock_file}"
  fi

  if [[ -n "${STY:-}" || -n "${TMUX:-}" ]]; then
    echo
    echo "You are in a screen or tmux session. This is good!"
    echo "\"${__me} update\" may have started screen for you to ensure the update finishes."
    if [[ -n "${STY:-}" ]]; then
      echo "You can scroll through the update messages with arrow keys. Get into scrollback mode first, with \"Ctrl-a ESC\"."
    else
      echo "You can scroll through the update messages with arrow keys. Get into scrollback mode first, with \"Ctrl-b [\"."
    fi
    echo
    echo "When you are done, remember to \"exit\" the session."
    echo
  fi

  echo -e "${__final_msg-}"

  __during_update=0

  __run_post_update_script
}


__verify_ancient_dir() {
  if [[ -z "$1" ]]; then
    return 1
  fi
  local dir="$1"
  local all_files=true
  local entries
  local entry

  if [[ ! -d "${dir}" ]]; then
    echo "ANCIENT_DIR ${dir} is not a directory. This is a configuration error."
    return 1
  fi

  if ! mapfile -t entries < <(${__auto_sudo} find "${dir}" -mindepth 1 -maxdepth 1 -exec basename {} \;); then
    echo "ANCIENT_DIR ${dir} contents could not be listed. This is unexpected and may be a configuration error, or a bug."
    return 1
  fi

  # Check if all entries are files - this is Reth
  for entry in "${entries[@]}"; do
    if [[ -d "${dir}/${entry}" ]]; then
      all_files=false
      break
    fi
  done

  if [[ "${all_files}" = "true" ]]; then
    return 0
  else
    # Check for exactly two directories: 'chain' and 'state' - this is Geth
    if [[ ${#entries[@]} -eq 2 && \
          -d "${dir}/chain" && -d "${dir}/state" ]]; then
      return 0
    fi
  fi

   echo "ANCIENT_DIR ${dir} looks like neither a Geth nor Reth directory: Leaving it alone out of caution"
   return 1
}


resync-execution() {
  local el_volume
  local el_client
  local extra_msg
  local yn
  local volume_id
  local legacy_volume

# Check for EL client
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"

  case "${__value}" in
    *erigon.yml*)
      el_volume='erigon-el-data'
      el_client="Erigon"
      extra_msg="A full resync should take 6-8 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *geth.yml*)
      el_volume='geth-el-data'
      el_client="Geth"
      extra_msg="A full resync should take 6-8 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *reth.yml*)
      el_volume='reth-el-data'
      el_client="Reth"
      extra_msg="A full resync should take 4 days.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *besu.yml*)
      el_volume='besu-el-data'
      el_client="Besu"
      extra_msg="A full resync should take 30 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *nethermind.yml*)
      el_volume='nethermind-el-data'
      el_client="Nethermind"
      extra_msg="A full resync should take 1-2 hours to where attestations work.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *nimbus-el.yml*)
      el_volume='nimbus-el-data'
      el_client="Nimbus"
      extra_msg="A full resync should take 5 days.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *ethrex.yml*)
      el_volume='ethrex-el-data'
      el_client="Ethrex"
      extra_msg="A full resync should take a few hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      ;;
    *) echo "You do not appear to be running an execution layer client. Nothing to do."; return 0;;
  esac

  if ! __dodocker volume ls -q | grep -qi "$(basename "$(realpath .)")[_-]${el_volume}"; then
    echo "Did not find Docker volume for ${el_client}. Nothing to do."
    return 0
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    echo "This will stop ${el_client} and delete its database to force a resync."
    if [[ -n "${extra_msg:-}" ]]; then
      echo -e "${extra_msg}"
    fi
    read -rp "WARNING - resync will take validators offline unless rescue node is used. Do you wish to continue? (No/yes) " yn
    case "${yn}" in
      [Yy][Ee][Ss]) ;;
      *) echo "Aborting."; exit 130;;
    esac
  fi

  el_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_${el_volume}"
  echo "Stopping ${el_client} container"
  __docompose stop execution && __docompose rm -f execution
  __dodocker volume rm "$(__dodocker volume ls -q -f "name=${el_volume}")"
  volume_id=""
  if [[ "${el_volume}" =~ geth-el-data ]]; then
    legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_geth-eth1-data"
    volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
  elif [[ "${el_volume}" =~ besu-el-data ]]; then
    legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_besu-eth1-data"
    volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
  elif [[ "${el_volume}" =~ nethermind-el-data ]]; then
    legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_nm-eth1-data"
    volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
  fi
  if [[ -n "${volume_id}" ]]; then
    __dodocker volume rm "${volume_id}"
  fi
  var="ANCIENT_DIR"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if __verify_ancient_dir "${__value}"; then
    echo "Removing contents of ancient/static directory ${__value}"
    ${__auto_sudo} rm -rf "${__value%/}/"*
  fi
  echo
  echo "${el_client} stopped and database deleted."
  echo
  echo "Restarting for resync."
  up
}


resync-consensus() {
  local cl_volume
  local cl_client
  local volume_id
  local legacy_volume
  local yn

  # Check for CL client
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"

  case "${__value}" in
    *lighthouse.yml*|*lighthouse-cl-only.yml*) cl_volume='lhconsensus-data'; cl_client="lighthouse";;
    *teku-allin1.yml*) cl_volume='wipe-db'; cl_client="teku";;
    *teku.yml*|*teku-cl-only.yml*) cl_volume='tekuconsensus-data'; cl_client="teku";;
    *nimbus-allin1.yml*) cl_volume='wipe-db'; cl_client="nimbus";;
    *nimbus.yml*|*nimbus-cl-only.yml*) cl_volume='nimbus-consensus-data'; cl_client="nimbus";;
    *lodestar.yml*|*lodestar-cl-only.yml*) cl_volume='lsconsensus-data'; cl_client="lodestar";;
    *prysm.yml*|*prysm-cl-only.yml*) cl_volume='prysmconsensus-data'; cl_client="prysm";;
    *grandine-plugin.yml*|*grandine-plugin-allin1.yml*) cl_volume='wipe-db'; cl_client="grandine-plugin";;
    *grandine-allin1.yml*) cl_volume='wipe-db'; cl_client="grandine";;
    *grandine.yml*|*grandine-cl-only.yml*) cl_volume='grandineconsensus-data'; cl_client="grandine";;
    *erigon.yml*) cl_volume='wipe-db'; cl_client="caplin";;
    *) echo "You do not appear to be running a consensus layer client. Nothing to do."; return;;
  esac

  if [[ ! "${cl_volume}" = "wipe-db" ]] && ! __dodocker volume ls -q \
      | grep -qi "$(basename "$(realpath .)")[_-]${cl_volume}"; then
    echo "Did not find Docker volume for ${cl_client}. Nothing to do."
    return 0
  fi

  if [[ "${cl_client}" =~ grandine ]]; then
    __adjust_grandine_permissions
  fi

  # Can we checkpoint sync?
  var="CHECKPOINT_SYNC_URL"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  echo "This will stop ${cl_client} and delete its database to force a resync."
  if [[ -z "${__value}" ]]; then
    read -rp "WARNING - CHECKPOINT_SYNC_URL not set, resync may take days. Do you wish to continue? (No/yes) " yn
  else
    read -rp "CHECKPOINT_SYNC_URL set, resync should finish in minutes. Do you wish to continue? (No/yes) " yn
  fi
  case "${yn}" in
    [Yy][Ee][Ss]) ;;
    *) echo "Aborting."; exit 130;;
  esac

  echo "Stopping ${cl_client} container"
  if [[ "${cl_client}" =~ (caplin|grandine-plugin) ]]; then
    __docompose stop execution && __docompose rm -f execution
  else
    __docompose stop consensus && __docompose rm -f consensus
  fi
  if [[ "${cl_volume}" = "wipe-db" ]]; then
    __docompose run --rm wipe-db
  else
    cl_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_${cl_volume}"
    __dodocker volume rm "$(__dodocker volume ls -q -f "name=${cl_volume}")"
    volume_id=""
    if [[ "${cl_volume}" =~ lhconsensus-data ]]; then
      legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_lhbeacon-data"
      volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
    elif [[ "${cl_volume}" =~ prysmconsensus-data ]]; then
      legacy_volume="$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_prysmbeacon-data"
      volume_id="$(__dodocker volume ls -q -f "name=${legacy_volume}")"
    fi
    if [[ -n "${volume_id}" ]]; then
      __dodocker volume rm "${volume_id}"
    fi
  fi
  echo
  echo "${cl_client} stopped and database deleted."
  echo
  echo "Restarting for resync."
  up
}


attach-geth() {
  local legacy_datadir

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__env_file} configuration file not found, aborting."
    exit 1
  fi

  if ! grep -q '^COMPOSE_FILE=.*geth\.yml' "${__env_file}" 2>/dev/null ; then
    echo "You do not appear to be using Geth, aborting."
    exit 1
  fi
  legacy_datadir=$(__dodocker run --rm -v "$(__dodocker volume ls -q -f \
    "name=$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')[_-]geth-eth1-data")":"/var/lib/goethereum" \
    alpine:3 sh -c 'if [ -d "/var/lib/goethereum/geth/chaindata" ]; then echo true; else echo false; fi')

  if [[ "${legacy_datadir}" = "true" ]]; then
    __docompose exec -it execution bash -c "geth attach /var/lib/goethereum/geth.ipc"
  else
    __docompose exec -it execution bash -c "geth attach /var/lib/geth/geth.ipc"
  fi
}


prune-besu() {
  local var
  local rpc_line
  local rpc_port
  local sync_status
  local exitstatus
  local regex
  local yn

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__env_file} configuration file not found, aborting."
    exit 1
  fi

  if ! grep -q '^COMPOSE_FILE=.*besu\.yml' "${__env_file}" 2>/dev/null ; then
    echo "You do not appear to be using Besu, aborting."
    exit 1
  fi

  # Check for archive node
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "archive" ]]; then
    echo "Besu is an archive node: Aborting."
    exit 1
  fi

  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" \
  --header 'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Besu: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "Besu is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      read -rp "WARNING - this will stop Besu and prune its trie-logs. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Besu prune"
  echo
  __docompose run --rm set-prune-marker "touch /var/lib/besu/prune-marker"
  __docompose stop execution && __docompose rm -f execution
  start
  echo
  echo "Prune is running, you can observe it with '${__me} logs -f execution'"
  echo
  echo "When prune is done, Besu will automatically start again."
  echo
}


prune-reth() {
  local rpc_line
  local rpc_port
  local var
  local regex
  local sync_status
  local exitstatus
  local yn

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [ ! -f "${__env_file}" ]; then
    echo "${__env_file} configuration file not found, aborting."
    exit 1
  fi

  if ! grep -q '^COMPOSE_FILE=.*reth\.yml' "${__env_file}" 2>/dev/null ; then
    echo "You do not appear to be using Reth, aborting."
    exit 1
  fi

  # Check for archive node
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "archive" ]]; then
    echo "Reth is an archive node: Aborting."
    exit 1
  fi

  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" \
  --header 'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Reth: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "Reth is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      read -rp "WARNING - this will stop Reth and prune its database. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Reth prune"
  echo
  __docompose run --rm set-prune-marker "touch /var/lib/reth/prune-marker"
  __docompose stop execution && __docompose rm -f execution
  start
  echo
  echo "Prune is running, you can observe it with '${__me} logs -f execution'"
  echo
  echo "When prune is done, Reth will automatically start again."
  echo
}


prune-nethermind() {
  local exitstatus
  local var
  local min_free
  local min_gib
  local threshold
  local rpc_line
  local rpc_port
  local regex
  local yn
  local sync_status
  local exitstatus
  local prune_result

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__env_file} configuration file not found, aborting."
    exit 1
  fi

  if ! grep -q '^COMPOSE_FILE=.*nethermind\.yml' "${__env_file}" 2>/dev/null ; then
    echo "You do not appear to be using Nethermind, aborting."
    exit 1
  fi

  # Check for archive node
  var="EL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "archive" ]]; then
    echo "Nethermind is an archive node: Aborting."
    exit 1
  fi

  __get_docker_free_space

  var="NETWORK"
  __get_value_from_env "${var}" "${__env_file}" "NETWORK"

  if [[ "${NETWORK}" =~ ^(mainnet|gnosis)$ ]]; then
    min_free=262144000
    min_gib=250
  else
    min_free=26214400
    min_gib=25
  fi

  if [[ "${__free_space}" -lt ${min_free} ]]; then
    echo "You do not have enough free disk space. Make sure this reads at least ${min_gib}G free (Avail):"
    echo
    __display_docker_dir
    echo
    echo "Aborting."
    exit 1
  fi

  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" --header \
    'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Nethermind: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "Nethermind is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  var="AUTOPRUNE_NM"
  __get_value_from_env "${var}" "${__env_file}" "AUTOPRUNE_NM"

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      if [[ "${AUTOPRUNE_NM}" = true ]]; then
        if [[ "${NETWORK}" =~ ^(mainnet|gnosis)$ ]]; then
          threshold="350"
        else
          threshold="50"
        fi
        echo "Nethermind should auto-prune below ${threshold} GiB free. Check logs with \"${__me} logs -f --tail 500 \
execution | grep Full\" to see whether it is."
      fi
      read -rp "WARNING - this will prune Nethermind's database in the background. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Nethermind prune"
  echo

  set +e
  prune_result=$(__docompose exec -T execution wget -qO- "http://localhost:1337" --header \
  'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"admin_prune","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to start prune, error code ${exitstatus}. This is likely a bug."
    echo "An attempt to run it returned this: ${prune_result}"
    # shellcheck disable=SC2028
    echo 'The command attempted was: docker compose run --rm set-prune-marker "curl -s \
--data {\\\"method\\\":\\\"admin_prune\\\",\\\"params\\\":[],\\\"id\\\":1,\\\"jsonrpc\\\":\\\"2.0\\\"} \
-H Content-Type:\ application/json http://execution:8545"'
    exit ${exitstatus}
  fi
  echo "Nethermind returns ${prune_result}"
  if [[ ! "${prune_result}" =~ [Ss]tarting ]]; then
    echo "Unable to start prune. This is likely a bug."
    exit 70
  fi
  echo
  echo "Prune is running, you can observe it with \"${__me} logs -f --tail 500 execution | grep Full\""
  echo
  echo "Please do not restart the node or restart Nethermind until prune is done."
  echo
  echo "When prune is done, Nethermind will automatically re-start."
  echo
}


prune-history() {
  local var
  local rpc_line
  local regex
  local client
  local min_ver
  local extra_msg
  local prune_marker
  local warning
  local yn
  local choices
  local num_items
  local menu_height
  local target
  local target_level
  local current_level
  local must_resync

  target=""

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      --pre-merge)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=pre-merge
        shift
        ;;
      --pre-cancun)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=pre-cancun
        shift
        ;;
      --rolling)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=rolling
        shift
        ;;
      --aggressive)
        if [[ -n "${target}" ]]; then
          echo "Only one history expiry mode can be specified, and you already have ${target}."
          echo "Aborting."
          exit 1
        fi
        target=aggressive
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done

  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__env_file} configuration file not found, aborting."
    exit 1
  fi

# pre-cancun and pre-merge are only meaningful on mainnet or sepolia
  var=NETWORK
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${target}" =~ ^(pre-merge|pre-cancun)$ && ! "${__value}" =~ ^(mainnet|sepolia)$ ]]; then
    echo "There is no ${target} history for ${__value} network."
    echo "Nothing to do. Aborting."
    exit 0
  fi

# Check whether this has already been done
  var=EL_NODE_TYPE
  __get_value_from_env "${var}" "${__env_file}" "EL_NODE_TYPE"
  if [[ "${EL_NODE_TYPE}" = "${target}-expiry" ]]; then
    echo "This node is already configured for \"${var}=${EL_NODE_TYPE}\"."
    echo "Nothing to do. Aborting."
    exit 0
  fi
  if [[ "${EL_NODE_TYPE}" = "archive" ]]; then
    echo "This node is an archive node, and should not use expired history."
    echo "Nothing to do. Aborting."
    exit 0
  fi

  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "COMPOSE_FILE"

  if [[ -z "${target}" ]]; then
    if [[ "${__non_interactive}" -eq 1 ]]; then
      echo "You need to specify a pruning mode when running in non-interactive mode."
      echo "Aborting."
      exit 1
    fi

    choices=()

    choices+=("pre-merge" "Pre-merge expiry")

    case "${COMPOSE_FILE}" in
      *besu.yml*)
        choices+=("rolling" "Rolling expiry (experimental)")
        choices+=("aggressive" "Aggressive expiry (experimental)")
        ;;
      *erigon.yml*)
        choices+=("rolling" "Rolling expiry")
        choices+=("aggressive" "Aggressive expiry")
        ;;
      *nethermind.yml*)
        choices+=("pre-cancun" "Pre-Cancun expiry")
        choices+=("rolling" "Rolling expiry (experimental)")
        ;;
      *reth.yml*)
        choices+=("pre-cancun" "Pre-Cancun expiry")
        choices+=("rolling" "Rolling expiry")
        choices+=("aggressive" "Aggressive expiry")
        ;;
    esac

    num_items=$(( ${#choices[@]} / 2 ))
    menu_height=$(( 8 + num_items ))

    target=$(whiptail --notags --title "Select history expiry extent" --menu \
    "How much history do you wish to prune?" "${menu_height}" 65 "${num_items}" \
    "${choices[@]}" 3>&1 1>&2 2>&3)
  fi

  case "${target}" in
    pre-merge)
      target_level=1
      ;;
    pre-cancun)
      target_level=2
      ;;
    rolling)
      target_level=3
      ;;
    aggressive)
      target_level=4
      ;;
    *)
      echo "Unable to parse ${target} expiry. This is a bug. Aborting"
      exit 70
      ;;
  esac

  case "${EL_NODE_TYPE}" in
    full)
      current_level=0
      ;;
    pre-merge-expiry)
      current_level=1
      ;;
    pre-cancun-expiry)
      current_level=2
      ;;
    rolling-expiry)
      current_level=3
      ;;
    aggressive-expiry)
      current_level=4
      ;;
    *)
      echo "Unable to parse node type ${EL_NODE_TYPE}. This is a bug. Aborting"
      exit 70
      ;;
  esac

# Some clients support changing history expiry without resync. This can only ever throw away more history.
# If the user wants more history now, that requires a resync
  if [[ "${target_level}" -lt "${current_level}" ]]; then
    must_resync=1
  else
    must_resync=0
  fi

  case "${COMPOSE_FILE}" in
    *geth.yml*)
      client="Geth"
      if [[ "${target}" =~ ^(pre-cancun|rolling|aggressive)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      min_ver="v1.16.0"
      if [[ "${must_resync}" -eq 0 ]]; then
        extra_msg="History can be pruned by Geth without requiring a full resync. You can observe pruning with \"./ethd logs -f execution\"."
        prune_marker="/var/lib/geth/prune-marker"
      else
        extra_msg="To move from ${EL_NODE_TYPE} to ${target} expiry requires a full resync, which should take 6-8 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
        prune_marker=""
      fi
      ;;
    *nimbus-el.yml*)
      client="Nimbus"
      if [[ "${target}" =~ ^(pre-cancun|rolling|aggressive)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      min_ver="v0.10.0"
      extra_msg="To switch to ${target} expiry requires a full resync, which should take 5 days.\nYou can use https://rescuenode.com to keep attesting during resync."
      prune_marker=""
      ;;
    *nethermind.yml*)
      client="Nethermind"
      if [[ "${target}" =~ ^(aggressive)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      min_ver="v1.35.2"
      if [[ "${must_resync}" -eq 0 ]]; then
        extra_msg="${target} expiry does not require a resync and should be immediate."
        prune_marker="/var/lib/nethermind/minimal-node"
      else
        extra_msg="To move from ${EL_NODE_TYPE} to ${target} expiry requires a full resync, which should take 1-2 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
        prune_marker=""
      fi
      ;;
    *besu.yml*)
      client="Besu"
      if [[ "${target}" =~ ^(pre-cancun)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      min_ver="25.11.0"
      extra_msg="To switch to ${target} expiry requires a full resync, which should take 16-24 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      prune_marker=""
      ;;
    *reth.yml*)
      client="Reth"
      min_ver="v1.8.0"
      if [[ "${must_resync}" -eq 0 ]]; then
        extra_msg="${target} expiry does not require a resync and should be immediate.\nA resync saves more space than a prune: You can set \"EL_NODE_TYPE=${target}-expiry\" manually with \"nano .env\" and then resync with \"./ethd resync-execution\"."
        prune_marker="/var/lib/reth/minimal-node"
      else
        extra_msg="To move from ${EL_NODE_TYPE} to ${target} expiry requires a full resync, which should take 1-2 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
        prune_marker=""
      fi
      ;;
    *erigon.yml*)
      client="Erigon"
      if [[ "${target}" =~ ^(pre-cancun)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      min_ver="v3.0.12"
      extra_msg="To switch to ${target} expiry requires a full resync, which should take 2-3 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
      prune_marker=""
      ;;
    *ethrex.yml*)
      client="Ethrex"
      if [[ "${target}" =~ ^(pre-cancun|rolling|aggressive)$ ]]; then
        echo "${target} expiry is not supported by ${client}, or ${__project_name} doesn't know how to configure it."
        echo "Aborting."
        exit 1
      fi
      min_ver="v1.0.0"
      if [[ "${target}" = "pre-merge" ]]; then
        extra_msg="Ethrex always expires pre-merge history. This command will have no effect."
        prune_marker="/var/lib/ethrex/minimal-node"
      else
        extra_msg="To switch to ${target} expiry requires a full resync, which should take 16-24 hours.\nYou can use https://rescuenode.com to keep attesting during resync."
        prune_marker=""
      fi
      ;;
    *)
      echo "${__project_name} does not know how to prune pre-merge history on ${client:-MysteryClient},"
      echo "nor how to configure it for pre-merge history expiry on fresh sync."
      exit 0
      ;;
  esac

  echo "${target} history expiry requires ${client} ${min_ver} or later."
  echo
  if [[ -n "${extra_msg:-}" ]]; then
    echo -e "${extra_msg}"
    echo
  fi
  if [[ -z "${prune_marker}" ]]; then  # Full resync
    if [[ "${__non_interactive}" -eq 0 ]]; then
      warning="WARNING - this will stop ${client} and resync it from scratch without pre-merge history. Do you wish to continue? (No/Yes) "
      while true; do
        read -rp "${warning}" yn
        case "${yn}" in
          [Yy][Ee][Ss]) break;;
          *) echo "Aborting, no changes made"; exit 130;;
        esac
      done
    fi
    var=EL_NODE_TYPE
    EL_NODE_TYPE=${target}-expiry
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
    __non_interactive=1
    resync-execution
    return 0
  fi

# We only get here if the client can prune
  rpc_line=$(grep '^EL_RPC_PORT=' "${__env_file}")
  regex='^EL_RPC_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine EL_RPC_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T execution wget -qO- "http://localhost:${rpc_port}" \
  --header 'Content-Type: application/json' --post-data '{"jsonrpc":"2.0","method":"eth_syncing","params":[],"id":1}')
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to ${client}: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ ! "${sync_status}" =~ "false" ]]; then
    echo "${client} is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    warning="WARNING - this will stop ${client} and remove pre-merge history. Do you wish to continue? (No/Yes) "
    while true; do
      read -rp "${warning}" yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  var=EL_NODE_TYPE
  EL_NODE_TYPE=${target}-expiry
  __update_value_in_env "${var}" "${!var}" "${__env_file}"
  echo
  echo "Starting ${client} ${target} history prune"
  __docompose run --rm set-prune-marker "touch ${prune_marker}"
  restart execution
  echo
  echo "${target} history prune is running, you can observe it with \"${__me} logs -f execution\""
  echo
  echo "When prune is done, ${client} will automatically start again."
  echo
}


prune-lighthouse() {
  local var
  local rpc_line
  local rpc_port
  local sync_status
  local exitstatus
  local regex
  local yn

  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --non-interactive)
        __non_interactive=1
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__env_file} configuration file not found, aborting."
    exit 1
  fi

  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ ! "${__value}" =~ (lighthouse.\yml|lighthouse-cl-only\.yml) ]]; then
    echo "You do not appear to be using Lighthouse, aborting."
    exit 1
  fi

  # Check for archive node
  var="CL_NODE_TYPE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ "${__value}" = "archive" ]]; then
    echo "Lighthouse is an archive node: Aborting."
    exit 1
  fi

  rpc_line=$(grep '^CL_REST_PORT=' "${__env_file}")
  regex='^CL_REST_PORT=([0-9]+)'
  if [[ ! "${rpc_line}" =~ ${regex} ]]; then
    echo "Unable to determine CL_REST_PORT, aborting."
    exit 1
  else
    rpc_port="${BASH_REMATCH[1]}"
  fi

  set +e
  sync_status=$(__docompose exec -T consensus wget -qO- "http://localhost:${rpc_port}/eth/v1/node/syncing")
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Unable to connect to Lighthouse: Is it running?"
    echo "Output: ${sync_status}"
    echo "Aborting."
    exit 1
  fi

  if [[ "${sync_status}" =~ "true" ]]; then # Avoid jq - if el_offline or is_optimistic or is_syncing, don't proceed
    echo "Lighthouse is not done syncing yet. Sync status:"
    echo "${sync_status}"
    echo
    echo "Aborting."
    exit 1
  fi

  if [[ "${__non_interactive}" -eq 0 ]]; then
    while true; do
      read -rp "WARNING - this will stop Lighthouse and prune its state. Do you wish to continue? (No/Yes) " yn
      case "${yn}" in
        [Yy][Ee][Ss]) break;;
        *) echo "Aborting, no changes made"; exit 130;;
      esac
    done
  fi

  echo
  echo "Starting Lighthouse prune"
  echo
  __docompose run --rm set-cl-prune-marker "touch /var/lib/lighthouse/beacon/prune-marker"
  __docompose stop consensus && __docompose rm -f consensus
  start
  echo
  echo "Prune is running, you can observe it with '${__me} logs -f consensus'"
  echo
  echo "When prune is done, Lighthouse will automatically start again."
  echo
}


__prep-keyimport() {
  local var
  local files

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__env_file} configuration file not found, aborting."
    exit 1
  fi

  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ ! "${__value}" =~ (prysm\.yml|lighthouse\.yml|teku\.yml|nimbus\.yml|lodestar\.yml|-allin1\.yml|vc-only\.yml) ]]; then
    echo "You do not appear to be running a validator client. Aborting."
    exit 1
  fi

  __keys_args=""
  while :
  do
    if [[ -z "${1+x}" ]]; then
      break
    fi
    case "$1" in
      --path)
        if [[ -z "${2+x}" ]]; then
          echo "--path requires a directory path, aborting"
          exit 1
        fi
        if [[ ! -d "$2" ]]; then
          echo "$2 is not a directory"
          exit 1
        fi
        if [[ "$(realpath "$2")" = "$(realpath ".eth/validator_keys")" ]]; then
          echo "$2 is the default path, doing nothing special"
          shift 2
          continue
        fi
        IFS=$'\n'
        files=$(find "$2" -maxdepth 1 -name '*.json')
        # Unset restores default
        unset IFS
        if [[ -z "${files}" ]]; then
          echo "No .json files found in $2, aborting"
          exit 1
        fi
        IFS=$'\n'
        files=$(find ./.eth/validator_keys -maxdepth 1 -name '*.json')
        # Unset restores default
        unset IFS
        if [[ -n "${files}" ]]; then
          ${__as_owner} mkdir -p ./.eth/validator_keys/keybackup
          ${__as_owner} mv -uf ./.eth/validator_keys/*.json ./.eth/validator_keys/keybackup
          ${__as_owner} rm -f ./.eth/validator_keys/*.json
          echo "Moved existing json files to .eth/validator_keys/keybackup"
        fi
        ${__as_owner} cp "$2"/*.json .eth/validator_keys/
        shift 2
        ;;
      --non-interactive)
        if [[ -z "${KEYSTORE_PASSWORD+x}" ]]; then
          echo "KEYSTORE_PASSWORD not set or empty, aborting"
          exit 1
        fi
        __keys_args+="${__keys_args:+ }--interactive"
        shift
        ;;
      --debug)
        __keys_args+="${__keys_args:+ }--debug"
        shift
        ;;
      --trace)
        __keys_args+="${__keys_args:+ }--trace"
        shift
        ;;
      *)
        echo "Error: Unknown option: $1" >&2
        exit 1
        ;;
    esac
  done
  if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
    __non_interactive=1
  fi
}


__i_haz_deposit_cli() {
  local var

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__project_name} has not been configured. Please run \"${__me} config\" first."
    exit 0
  fi
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
# Literal match intended
# shellcheck disable=SC2076
  if [[ ! "${__value}" =~ "deposit-cli.yml" ]]; then
    echo "Please edit the ${__env_file} file and make sure \":deposit-cli.yml\" is added to the \"COMPOSE_FILE\" line"
    echo "For example, \"nano ${__env_file}\" will open the nano text editor with the \"${__env_file}\" file loaded."
    echo "Without it, this step cannot be run"
    echo
    var="NETWORK"
    __get_value_from_env "${var}" "${__env_file}" "__value"
    if [[ "${__value}" = "mainnet" ]]; then
      echo "WARNING: On Ethereum mainnet, best practice is to run key generation on an air-gapped live USB,"
      echo "such as Ubuntu Live or Tails."
      echo
    fi
    exit 1
  fi
}


__i_haz_ethdo() {
  local var
  local yn

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__project_name} has not been configured. Please run \"${__me} config\" first."
    exit 0
  fi
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
# Literal match intended
# shellcheck disable=SC2076
  if [[ ! "${__value}" =~ "ethdo.yml" ]]; then
    echo "Please edit the ${__env_file} file and make sure \":ethdo.yml\" is added to the \"COMPOSE_FILE\" line"
    echo "For example, \"nano ${__env_file}\" will open the nano text editor with the \"${__env_file}\" file loaded."
    echo "Without it, this step cannot be run"
    echo
    read -rp "Do you want me to make this change for you? (n/y)" yn
    case "${yn}" in
      [Yy]);;
      *) exit 130;;
    esac
    if [[ -n "${__value}" ]]; then
      COMPOSE_FILE="${__value}:ethdo.yml"
    else
      COMPOSE_FILE="ethdo.yml"
      echo "You do not have a CL in ${__project_name}. Please make sure CL_NODE in ${__env_file} points at an available one"
    fi
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
    echo "Your COMPOSE_FILE now reads ${COMPOSE_FILE}"
  fi
}


__i_haz_web3signer() {
  local var
  local yn

  if [[ ! -f "${__env_file}" ]]; then
    echo "${__project_name} has not been configured. Please run \"${__me} config\" first."
    exit 0
  fi

  var="WEB3SIGNER"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ ! "${__value}" = "true" ]]; then
    return 0
  fi

  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
# Literal match intended
# shellcheck disable=SC2076
  if [[ ! "${__value}" =~ "web3signer.yml" ]]; then
    echo "WEB3SIGNER=true in ${__env_file}, but web3signer.yml is not in use"
    echo "Please edit the ${__env_file} file and make sure \":web3signer.yml\" is added to the \"COMPOSE_FILE\" line"
    echo "For example, \"nano ${__env_file}\" will open the nano text editor with the \"${__env_file}\" file loaded."
    echo "Without it, \"${__me} keys\" cannot be run"
    echo
    read -rp "Do you want me to make this change for you? (n/y)" yn
    case "${yn}" in
      [Yy]);;
      *) exit 130;;
    esac
    if [[ -n "${__value}" ]]; then
      COMPOSE_FILE="${__value}:web3signer.yml"
    else
      echo "You do not have a validator client in ${__project_name}. web3signer cannot be used without one."
      exit 1
    fi
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
    echo "Your COMPOSE_FILE now reads ${COMPOSE_FILE}"
  fi
}


__i_haz_keys_service() {
# This caused issues and is currently not being called
  if ! __docompose --profile tools config --services | grep -q validator-keys; then
    if [[ "${1:-}" = "silent" ]]; then
      return 1
    fi
    echo "The validator-keys service is not defined. Are you running only a consensus layer client?"
    echo "Key management happens on the validator client / web3signer, not the consensus layer client."
    echo "You can however do things like send an exit message, prep a withdrawal credentials change,"
    echo "sign exit messages with ethdo."
    echo
    echo "Aborting."
    exit 1
  fi
  return 0
}


__keys_usage() {
  echo "Call keymanager with an ACTION, one of:"
  echo "  create-for-csm"
  echo "      Create keys for Lido CSM"
  echo "  list"
  echo "      Lists the public keys of all validators currently loaded into your validator client"
  echo "  count"
  echo "      Counts the keys currently loaded into your validator client"
  echo "  import"
  echo "      Import all keystore*.json in .eth/validator_keys while loading slashing protection data"
  echo "      in slashing_protection*.json files that match the public key(s) of the imported validator(s)"
  echo "  delete 0xPUBKEY | all"
  echo "      Deletes the validator with public key 0xPUBKEY from the validator client, and exports its"
  echo "      slashing protection database."
  echo "      \"all\" deletes all detected validators."
  echo "  register"
  echo "      For use with web3signer only: Re-register all keys in web3signer with the validator client"
  echo
  echo "  get-recipient 0xPUBKEY"
  echo "      List fee recipient set for the validator with public key 0xPUBKEY"
  echo "      Validators will use FEE_RECIPIENT in ${__env_file} by default, if not set individually"
  echo "  set-recipient 0xPUBKEY 0xADDRESS"
  echo "      Set individual fee recipient for the validator with public key 0xPUBKEY"
  echo "  delete-recipient 0xPUBKEY"
  echo "      Delete individual fee recipient for the validator with public key 0xPUBKEY"
  echo
  echo "  get-gas 0xPUBKEY"
  echo "      List execution gas limit set for the validator with public key 0xPUBKEY"
  echo "      Validators will use the client's default, if not set individually"
  echo "  set-gas 0xPUBKEY amount"
  echo "      Set individual execution gas limit for the validator with public key 0xPUBKEY"
  echo "  delete-gas 0xPUBKEY"
  echo "      Delete individual execution gas limit for the validator with public key 0xPUBKEY"
  echo
  echo "  get-graffiti 0xPUBKEY"
  echo "      List graffiti set for the validator with public key 0xPUBKEY"
  echo "      Validators will use GRAFFITI in .env by default, if not set individually"
  echo "  set-graffiti 0xPUBKEY amount"
  echo "      Set individual graffiti for the validator with public key 0xPUBKEY"
  echo "  delete-graffiti 0xPUBKEY"
  echo "      Delete individual graffiti for the validator with public key 0xPUBKEY"
  echo
  echo "  get-api-token"
  echo "      Print the token for the keymanager API running on port ${KEY_API_PORT:-7500}."
  echo "      This is also the token for the Prysm Web UI"
  echo
  echo "  create-prysm-wallet"
  echo "      Create a new Prysm wallet to store keys in"
  echo "  get-prysm-wallet"
  echo "      Print Prysm's wallet password"
  echo
  echo "  get-grandine-wallet"
  echo "      Print Grandine's wallet password"
  echo
  echo "  prepare-address-change"
  echo "      Create an offline-preparation.json with ethdo"
  echo "  send-address-change"
  echo "      Send a change-operations.json with ethdo, setting the withdrawal address"
  echo
  echo "  sign-exit 0xPUBKEY | all"
  echo "      Create pre-signed exit message for the validator with public key 0xPUBKEY"
  echo "      \"all\" signs an exit message for all detected validators"
  echo "  sign-exit from-keystore [--offline]"
  echo "      Create pre-signed exit messages with ethdo, from keystore files in ./.eth/validator_keys"
  echo "  send-exit"
  echo "      Send pre-signed exit messages in ./.eth/exit_messages to the Ethereum chain"
  echo
  echo " Commands can be appended with \"--debug\" to see debug output"
}


# Call with repo and expected suffix as well as directory and target name.
__get_github_release() {
  local repo=$1
  local suffix=$2
  local dirname=$3
  local targetname=$4

  ${__as_owner} mkdir -p "${dirname}"
  if [[ "${targetname}" = "__untar__" ]]; then
    wget -q -O- https://api.github.com/repos/"${repo}"/releases/latest | grep "browser_download_url.*${suffix}" \
      | head -1 \
      | cut -d : -f 2,3 \
      | tr -d \" \
      | wget -qi- -O- \
      | ${__as_owner} tar zxf - -C "${dirname}" \
      || echo "-> Could not download the latest version of '${suffix}' from github '${repo}'."
  else
    wget -q -O- https://api.github.com/repos/"${repo}"/releases/latest | grep "browser_download_url.*${suffix}" \
      | head -1 \
      | cut -d : -f 2,3 \
      | tr -d \" \
      | ${__as_owner} wget -qi- -O "${dirname}/${targetname}" \
      && ${__as_owner} chmod +x "${dirname}/${targetname}" \
      || echo "-> Could not download the latest version of '${suffix}' from github '${repo}'."
  fi
}


keys() {
  local var
  local owner_uid
  local offline
  local pubkey
  local num_files
  local keyfile
  local json
  local justone
  local network_name
  local password
  local password2
  local created
  local failed
  local exitstatus
  local yn

  if [[ "$#" -eq 0 || "$1" =~ (help|-h|--help) ]]; then
    __keys_usage
    return 0
  fi

  __i_haz_web3signer

  owner_uid=$(id -u "${__owner}")
  if [[ "${1:-}" = "import" ]]; then
    #__i_haz_keys_service
    shift
    __prep-keyimport "$@"
    __docompose run --rm -e OWNER_UID="${owner_uid}" validator-keys import "${__keys_args}"
  elif [ "${1:-}" = "create-prysm-wallet" ]; then
    var="COMPOSE_FILE"
    __get_value_from_env "${var}" "${__env_file}" "__value"
# Literal match intended
# shellcheck disable=SC2076
    if [[ ! "${__value}" =~ (prysm\.yml|prysm-vc-only\.yml) ]]; then
      echo "You do not appear to be using a Prysm validator. Aborting."
      exit 1
    fi
    if __docompose run --rm create-wallet; then
      __docompose stop validator
      __docompose rm --force validator
      up
    fi
  elif [[ "${1:-}" = "create-for-csm" ]]; then
    __i_haz_deposit_cli
    var="NETWORK"
    __get_value_from_env "${var}" "${__env_file}" "NETWORK"
    __query_lido_keys_generation
  elif [[ "${1:-}" = "prepare-address-change" ]]; then
    __i_haz_ethdo
    echo "Generating offline prep file"
    set +e
    __docompose run --rm ethdo validator credentials set --prepare-offline
    exitstatus=$?
    set -e
    if [[ "${exitstatus}" -ne 0 ]]; then
      echo "Running ethdo failed, unfortunately. Is the CL running and synced?"
      echo "Please try again after fixing root cause. Aborting."
      exit 1
    fi
    echo
    echo "Downloading ethdo"
    __get_github_release wealdtech/ethdo linux-amd64.tar.gz ./.eth/ethdo/amd64 __untar__
    __get_github_release wealdtech/ethdo linux-arm64.tar.gz ./.eth/ethdo/arm64 __untar__
    echo
    echo "Downloading jq"
    __get_github_release jqlang/jq jq-linux-amd64 ./.eth/ethdo/amd64 jq
    __get_github_release jqlang/jq jq-linux-arm64 ./.eth/ethdo/arm64 jq
    echo
    echo "Copy the contents of ./.eth/ethdo to a USB drive, and prepare a Linux Live USB to safely enter your mnemonic."
    echo "Please see https://ethdocker.com/Support/ChangingWithdrawalCredentials for details"
  elif [[ "${1:-}" = "send-address-change" ]]; then
    __i_haz_ethdo
    __docompose run --rm ethdo validator credentials set
  elif [[ "${1:-}" = "sign-exit" && "${2:-}" = "from-keystore" ]]; then
    __i_haz_ethdo

    if echo "$@" | grep -q '.*--offline.*' 2>/dev/null ; then
      offline="--offline"
    else
      offline=""
    fi

    if echo "$@" | grep -q '.*--non-interactive.*' 2>/dev/null ; then
      __non_interactive=1
    fi
    if [[ "${ETHD_FRONTEND:-}" = "noninteractive" ]]; then
      __non_interactive=1
    fi

    if [[ ${__non_interactive} -eq 1 ]]; then
      password="${KEYSTORE_PASSWORD}"
      justone=1
    else
      num_files=$(find .eth/validator_keys -maxdepth 1 -type f -name 'keystore*.json' | wc -l)
      if [[ "${num_files}" -eq 0 ]]; then
        echo "No keystore*.json files found in .eth/validator_keys/"
        echo "Nothing to do"
        exit 0
      fi

      if [[ "${num_files}" -gt 1 ]]; then
        while true; do
          read -rp "Do all validator keys have the same password? (y/n) " yn
          case "${yn}" in
            [Yy]*) justone=1; break;;
            [Nn]*) justone=0; break;;
            *) echo "Please answer yes or no.";;
          esac
        done
      else
        justone=1
      fi
      if [[ "${justone}" -eq 1 ]]; then
        while true; do
          read -srp "Please enter the password for your validator key(s): " password
          echo
          read -srp "Please re-enter the password: " password2
          echo
          if [[ "${password}" = "${password2}" ]]; then
            break
          else
            echo "The two entered passwords do not match, please try again."
            echo
          fi
        done
        echo
      fi
    fi

    created=0
    failed=0
    for keyfile in .eth/validator_keys/keystore-*.json; do
      [[ -f "${keyfile}" ]] || continue  # Should always evaluate true - just in case
      if [[ "${justone}" -eq 0 ]]; then
        while true; do
          read -srp "Please enter the password for your validator key stored in ${keyfile}: " password
          echo
          read -srp "Please re-enter the password: " password2
          echo
          if [[ "${password}" = "${password2}" ]]; then
            break
          else
            echo "The two entered passwords do not match, please try again."
            echo
          fi
          echo
        done
      fi

      pubkey="$(sed -E 's/.*"pubkey":\s*"([0-9a-fA-F]+)".*/\1/' < "${keyfile}")"
      if [[ -z "${pubkey}" ]]; then
        echo "Unable to read public key from ${keyfile}. Is it the right format?"
        continue
      else
          pubkey="0x${pubkey}"
      fi
      set +e
      # offline may be empty, don't quote it
      # shellcheck disable=SC2086
      json=$(__docompose run --rm ethdo validator exit --validator "${keyfile}" --json --timeout 2m \
        --passphrase "${password}" ${offline})
      exitstatus=$?
      if [[ "${exitstatus}" -eq 0 ]]; then
        echo "${json}" >".eth/exit_messages/${pubkey::10}--${pubkey:90}-exit.json"
# shellcheck disable=SC2320
        exitstatus=$?
        if [[ "${exitstatus}" -eq 0 ]]; then
          echo "Creating an exit message for validator ${pubkey} into file \
./.eth/exit_messages/${pubkey::10}--${pubkey:90}-exit.json succeeded"
          (( created++ ))
        else
          echo "Error writing exit json to file ./.eth/exit_messages/${pubkey::10}--${pubkey:90}-exit.json"
          (( failed++ ))
        fi
      else
        echo "Creating an exit message for validator ${pubkey} from file ${keyfile} failed"
        (( failed++ ))
      fi
      set -e
    done
    echo
    echo "Created pre-signed exit messages for ${created} validators"
    if [[ "${created}" -gt 0 ]]; then
      echo "You can find them in ./.eth/exit_messages"
    fi
    if [[ "${failed}" -gt 0 ]]; then
      echo "Failed for ${failed} validators"
    fi
  #elif [[ "${1:-}" = "send-exit" ]] && ! __i_haz_keys_service silent; then
  elif [[ "${1:-}" = "send-exit" ]]; then
    var="CL_NODE"
    __get_value_from_env "${var}" "${__env_file}" "CL_NODE"
    CL_NODE="${CL_NODE%%,*}"
    network_name="$(__docompose config | awk '
      BEGIN {
          found_networks=0;
          found_default=0;
      }
      /networks:/ {
          found_networks=1;
          next;
      }
      found_networks && /default:/ {
          found_default=1;
          next;
      }
      found_default && /^ *name:/ {
          print $2;
          exit;
      }
      ')"
    if ! __dodocker image ls --format "{{.Repository}}:{{.Tag}}" | grep -q "vc-utils:local"; then
      if ! dpkg-query -W -f='${Status}' docker-ce 2>/dev/null | grep -q "ok installed"; then
        __dodocker build -t vc-utils:local ./vc-utils
      else
        if ! dpkg-query -W -f='${Status}' docker-buildx-plugin 2>/dev/null | grep -q "ok installed"; then
          ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install -y docker-buildx-plugin
        fi
        __dodocker buildx build -t vc-utils:local ./vc-utils
      fi
    fi
    __dodocker run --rm \
      -u 1000:1000 \
      --network "${network_name}" \
      --name send-exit \
      -v "$(pwd)/.eth/exit_messages:/exit_messages" \
      -v "/etc/localtime:/etc/localtime:ro" \
      -e "CL_NODE=${CL_NODE}" \
      --entrypoint "keymanager.sh" \
      vc-utils:local /var/lib/lighthouse/nonesuch.txt eth2 send-exit
  else
    #__i_haz_keys_service
    __docompose run --rm -e OWNER_UID="${owner_uid}" validator-keys "$@"
  fi
}


__adjust_grandine_permissions() {
  local datadir_owner
  local datadir_volume

  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  if [[ ! "${__value}" =~ grandine ]]; then
    return 0
  fi

  if [[ "${__value}" =~ grandine-plugin ]]; then
    datadir_owner=10001
  else
    datadir_owner=10002
  fi

  datadir_volume="$(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_grandineconsensus-data$")"
  if [[ -z "${datadir_volume}" ]]; then
    return 0
  fi

  __dodocker run --rm \
    --user root \
    -v "${datadir_volume}:/var/lib/grandine" \
    alpine:3 \
    sh -c "
      if find /var/lib/grandine \( \! -user ${datadir_owner} -o \! -group ${datadir_owner} \) -print -quit | grep -q .; then
        echo 'Fixing ownership of Grandine volume'
        chown -R ${datadir_owner}:${datadir_owner} /var/lib/grandine
      fi
    "
}


upgrade() {
  update
}


start() {
  __adjust_grandine_permissions
  __docompose up -d --remove-orphans "$@"
}

# Passed by user
# shellcheck disable=SC2120
up() {
  start "$@"
}


run() {
  start "$@"
}


stop() {
  __docompose down --remove-orphans "$@"
}


down() {
  stop "$@"
}


restart() {
  stop "$@"
  start "$@"
}


logs() {
  __docompose logs "$@"
}


cmd() {
  __docompose "$@"
}


terminate() {
  local yn

  # Assume project name and volume are delimited by _ and there is no _ in the volume name. Done to avoid catching project-2 while looking at project
  if [[ -z "$(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_[^_]+$")" ]]; then
    echo "There are no data stores - Docker volumes - left to remove for this Ethereum node."
    stop
    return 0
  fi

  while true; do
    read -rp "WARNING - this action will destroy all data stores for this Ethereum node. Do you wish to continue? \
(No/Yes) " yn
    case "${yn}" in
      [Yy][Ee][Ss]) break;;
      *) echo "Aborting, no changes made"; exit 130;;
    esac
  done

  stop
# In this case I want the word splitting, so rm can remove all volumes
# shellcheck disable=SC2046
  __dodocker volume rm $(__dodocker volume ls -q -f "name=^$(basename "$(realpath .)" | tr '[:upper:]' '[:lower:]')_[^_]+$")
  echo
  echo "All containers stopped and all volumes deleted"
  echo
}


__query_network() {
  local var

  var="NETWORK"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  NETWORK=$(whiptail --notags --title "Select Network" --menu \
  "Which network do you want to run on?" 14 65 6 \
  "hoodi" "Hoodi Testnet" \
  "ephemery" "Ephemery Testnet" \
  "mainnet" "Ethereum Mainnet" \
  "gnosis" "Gnosis Chain" \
  "sepolia" "Sepolia Testnet (permissioned validators)" \
  "custom" "Custom Testnet (needs a URL)" 3>&1 1>&2 2>&3)

  case "${NETWORK}" in
    mainnet)
      echo "You chose to run on Ethereum mainnet"
      ;;
    gnosis)
      echo "You chose to run on Gnosis Chain"
      ;;
    sepolia|hoodi)
      echo "You chose to run on ${NETWORK} testnet"
      ;;
    custom)
      while true; do
        NETWORK=$(whiptail --title "Configure testnet URL" --inputbox "What is github URL of your custom testnet \
spec? (right-click to paste)" 10 60 3>&1 1>&2 2>&3)
        if [[ ${NETWORK} =~ ^https?:// ]]; then
          echo "Your custom testnet URL is: ${NETWORK}"
          break
        else
          whiptail --msgbox "${NETWORK} is not a valid URL. You can try again or Cancel on the next \
screen.\n\nCustom testnets only work with a URL to fetch their configuration from." 12 65
        fi
      done
      ;;
  esac
# shellcheck disable=SC2154
  if [[ ! "${NETWORK}" = "${__value}" ]]; then
    __network_change=1
  else
    __network_change=0
  fi
}


__query_deployment() {
  if [[ "${NETWORK}" = "gnosis" ]]; then
    if uname -m | grep -q riscv64; then
      echo "Gnosis network has no available client combos on RISC-V. Aborting."
      exit 1
    fi
    __deployment=$(whiptail --notags --title "Select deployment type" --menu \
    "What kind of deployment do you want to run?" 11 65 3 \
    "node" "Ethereum node - consensus, execution and validator client" \
    "rpc" "Ethereum RPC node - consensus and execution client" \
    "validator" "Validator client only" 3>&1 1>&2 2>&3)
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    if uname -m | grep -q riscv64; then
      echo "Ephemery network has no available client combos on RISC-V. Aborting."
      exit 1
    fi
    __deployment=$(whiptail --notags --title "Select deployment type" --menu \
    "What kind of deployment do you want to run?" 11 65 3 \
    "node" "Ethereum node - consensus, execution and validator client" \
    "rpc" "Ethereum RPC node - consensus and execution client" \
    "validator" "Validator client only" 3>&1 1>&2 2>&3)
  elif uname -m | grep -q aarch64 || uname -m | grep -q arm64; then
    __deployment=$(whiptail --notags --title "Select deployment type" --menu \
    "What kind of deployment do you want to run?" 12 65 4 \
    "node" "Ethereum node - consensus, execution and validator client" \
    "rpc" "Ethereum RPC node - consensus and execution client" \
    "lido_comp" "Lido-compatible node (Community Staking / Simple DVT)" \
    "rocket" "Validator client only - integrate with RocketPool" \
    "ssv" "SSV node - consensus, execution and ssv-node" \
    3>&1 1>&2 2>&3)
  elif uname -m | grep -q riscv64; then
    __deployment=$(whiptail --notags --title "Select deployment type" --menu \
    "What kind of deployment do you want to run?" 11 65 3 \
    "node" "Ethereum node - consensus, execution and validator client" \
    "rpc" "Ethereum RPC node - consensus and execution client" \
    "rocket" "Validator client only - integrate with RocketPool" 3>&1 1>&2 2>&3)
  elif uname -m | grep -q x86_64; then
    __deployment=$(whiptail --notags --title "Select deployment type" --menu \
    "What kind of deployment do you want to run?" 13 65 5 \
    "node" "Ethereum node - consensus, execution and validator client" \
    "rpc" "Ethereum RPC node - consensus and execution client" \
    "lido_comp" "Lido-compatible node (Community Staking / Simple DVT)" \
    "rocket" "Validator client only - integrate with RocketPool" \
    "ssv" "SSV node - consensus, execution and ssv-node" 3>&1 1>&2 2>&3)
  else
    echo "${__project_name} does not recognize this CPU architecture. Aborting."
    echo "Output of uname -m"
    uname -m
    exit 1
  fi

  if [[ "${__deployment}" = "lido_comp" ]]; then
    if uname -m | grep -q aarch64 || uname -m | grep -q arm64; then
      __deployment=$(whiptail --notags --title "Select deployment type for Lido" --menu \
      "What kind of deployment to participate in Lido protocol do you want to run?" 11 90 3 \
      "lido_csm" "[Community Staking] CSM node - Consensus, execution and validator client" \
      "lido_ssv" "[Simple DVT] SSV node - Consensus, execution and ssv-node" \
      "lido_obol" "[Simple DVT] Obol node - Nodes, validator client and charon node (obol middleware)" 3>&1 1>&2 2>&3)
    elif uname -m | grep -q x86_64; then
      __deployment=$(whiptail --notags --title "Select deployment type for Lido" --menu \
      "What kind of deployment to participate in Lido protocol do you want to run?" 11 90 3 \
      "lido_csm" "[Community Staking] CSM node - Consensus, execution and validator client" \
      "lido_ssv" "[Simple DVT] SSV node - Consensus, execution and ssv-node" \
      "lido_obol" "[Simple DVT] Obol node - Nodes, validator client and charon node (obol middleware)" 3>&1 1>&2 2>&3)
    else
      echo "${__project_name} does not support Lido on this CPU architecture. Aborting."
      echo "Output of uname -m"
      uname -m
      exit 1
    fi
  fi

  echo "Your deployment choice is: ${__deployment}"
}


__query_validator_client() {
  if [[ "${NETWORK}" = "gnosis" ]]; then
    VALIDATOR_CLIENT=$(whiptail --notags --title "Select validator client" --menu \
    "Which validator client do you want to run?" 12 65 4 \
    "lighthouse-vc-only.yml" "Lighthouse validator client" \
    "teku-vc-only.yml" "Teku validator client" \
    "lodestar-vc-only.yml" "Lodestar validator client" \
    "nimbus-vc-only.yml" "Nimbus validator client" 3>&1 1>&2 2>&3)
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    VALIDATOR_CLIENT=$(whiptail --notags --title "Select validator client" --menu \
    "Which validator client do you want to run?" 9 65 2 \
    "teku-vc-only.yml" "Teku validator client" \
    "lodestar-vc-only.yml" "Lodestar validator client" \
    3>&1 1>&2 2>&3)
  elif [[ "${__deployment}" = "rocket" ]]; then
    if uname -m | grep -q aarch64 || uname -m | grep -q arm64; then
      VALIDATOR_CLIENT=$(whiptail --notags --title "Select validator client" --menu \
      "Which validator client do you want to run?" 12 65 4 \
      "lighthouse-vc-only.yml" "Lighthouse validator client" \
      "teku-vc-only.yml" "Teku validator client" \
      "lodestar-vc-only.yml" "Lodestar validator client" \
      "nimbus-vc-only.yml" "Nimbus validator client" 3>&1 1>&2 2>&3)
    else
      VALIDATOR_CLIENT=$(whiptail --notags --title "Select validator client" --menu \
      "Which validator client do you want to run?" 12 65 4 \
      "teku-vc-only.yml" "Teku validator client" \
      "lighthouse-vc-only.yml" "Lighthouse validator client" \
      "lodestar-vc-only.yml" "Lodestar validator client" \
      "nimbus-vc-only.yml" "Nimbus validator client" 3>&1 1>&2 2>&3)
    fi
  elif uname -m | grep -q aarch64 || uname -m | grep -q arm64; then
    VALIDATOR_CLIENT=$(whiptail --notags --title "Select validator client" --menu \
    "Which validator client do you want to run?" 13 65 5 \
    "lighthouse-vc-only.yml" "Lighthouse validator client" \
    "teku-vc-only.yml" "Teku validator client" \
    "lodestar-vc-only.yml" "Lodestar validator client" \
    "nimbus-vc-only.yml" "Nimbus validator client" \
    "prysm-vc-only.yml" "Prysm validator client" 3>&1 1>&2 2>&3)
  else
    VALIDATOR_CLIENT=$(whiptail --notags --title "Select validator client" --menu \
    "Which validator client do you want to run?" 13 65 5 \
    "teku-vc-only.yml" "Teku validator client" \
    "lighthouse-vc-only.yml" "Lighthouse validator client" \
    "lodestar-vc-only.yml" "Lodestar validator client" \
    "nimbus-vc-only.yml" "Nimbus validator client" \
    "prysm-vc-only.yml" "Prysm validator client" 3>&1 1>&2 2>&3)
  fi

  echo "Your validator client file is:" "${VALIDATOR_CLIENT}"
}


__query_consensus_client() {
  if [[ "${NETWORK}" = "gnosis" ]]; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 13 65 5 \
    "teku.yml" "Teku (Java) - consensus and validator client" \
    "lighthouse.yml" "Lighthouse (Rust) - consensus and validator client" \
    "lodestar.yml" "Lodestar (TypeScript) - consensus and validator client" \
    "nimbus.yml" "Nimbus (Nim) - consensus and validator client" \
    "caplin.yml" "Caplin (Go) - Erigon's built-in CL" \
    3>&1 1>&2 2>&3)
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 9 65 2 \
    "teku.yml" "Teku (Java) - consensus and validator client" \
    "lodestar.yml" "Lodestar (TypeScript) - consensus and validator client" \
    3>&1 1>&2 2>&3)
  elif uname -m | grep -q aarch64 || uname -m | grep -q arm64; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 15 65 7 \
    "nimbus.yml" "Nimbus (Nim) - consensus and validator client" \
    "grandine-allin1.yml" "Grandine (Rust) - consensus with built-in validator client" \
    "lodestar.yml" "Lodestar (TypeScript) - consensus and validator client" \
    "teku.yml" "Teku (Java) - consensus and validator client" \
    "lighthouse.yml" "Lighthouse (Rust) - consensus and validator client" \
    "prysm.yml" "Prysm (Go) - consensus and validator client" \
    "caplin.yml" "Caplin (Go) - Erigon's built-in CL" \
     3>&1 1>&2 2>&3)
  elif uname -m | grep -q riscv64; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 9 65 1 \
    "nimbus.yml" "Nimbus (Nim) - consensus and validator client" 3>&1 1>&2 2>&3)
  else
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 15 65 7 \
    "teku.yml" "Teku (Java) - consensus and validator client" \
    "grandine-allin1.yml" "Grandine (Rust) - consensus with built-in validator client" \
    "lodestar.yml" "Lodestar (TypeScript) - consensus and validator client" \
    "nimbus.yml" "Nimbus (Nim) - consensus and validator client" \
    "lighthouse.yml" "Lighthouse (Rust) - consensus and validator client" \
    "prysm.yml" "Prysm (Go) - consensus and validator client" \
    "caplin.yml" "Caplin (Go) - Erigon's built-in CL" \
    3>&1 1>&2 2>&3)
  fi

  if [[ "${__deployment}" = "lido_obol" && "${CONSENSUS_CLIENT}" = "lodestar.yml" ]]; then
    CONSENSUS_CLIENT="lodestar-cl-only.yml"  # Charon does not handle SSZ
    VALIDATOR_CLIENT="lodestar-vc-only.yml"
  fi

  echo "Your consensus client file is:" "${CONSENSUS_CLIENT}"
}


__query_consensus_only_client() {
  if [[ "${NETWORK}" = "gnosis" ]]; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 13 65 5 \
    "lighthouse-cl-only.yml" "Lighthouse (Rust) - consensus client" \
    "teku-cl-only.yml" "Teku (Java) - consensus client" \
    "lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client" \
    "nimbus-cl-only.yml" "Nimbus (Nim) - consensus client" \
    3>&1 1>&2 2>&3)
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 9 65 2 \
    "teku-cl-only.yml" "Teku (Java) - consensus client" \
    "lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client" \
    3>&1 1>&2 2>&3)
  elif uname -m | grep -q aarch64 || uname -m | grep -q arm64; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 13 65 7 \
    "nimbus-cl-only.yml" "Nimbus (Nim) - consensus client" \
    "grandine-cl-only.yml" "Grandine (Rust) - consensus client" \
    "lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client" \
    "lighthouse-cl-only.yml" "Lighthouse (Rust) - consensus client" \
    "teku-cl-only.yml" "Teku (Java) - consensus client" \
    "prysm-cl-only.yml" "Prysm (Go) - consensus client" \
    3>&1 1>&2 2>&3)
  elif uname -m | grep -q riscv64; then
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 9 65 1 \
    "nimbus-cl-only.yml" "Nimbus (Nim) - consensus client" 3>&1 1>&2 2>&3)
  else
    CONSENSUS_CLIENT=$(whiptail --notags --title "Select consensus client" --menu \
    "Which consensus client do you want to run?" 14 65 7 \
    "teku-cl-only.yml" "Teku (Java) - consensus client" \
    "grandine-cl-only.yml" "Grandine (Rust) - consensus client" \
    "lighthouse-cl-only.yml" "Lighthouse (Rust) - consensus client" \
    "nimbus-cl-only.yml" "Nimbus (Nim) - consensus client" \
    "lodestar-cl-only.yml" "Lodestar (TypeScript) - consensus client" \
    "prysm-cl-only.yml" "Prysm (Go) - consensus client" \
    3>&1 1>&2 2>&3)
  fi

  echo "Your consensus client file is:" "${CONSENSUS_CLIENT}"
}


__query_custom_execution_client() {
  local var

  if [[ "${__minty_fresh}" -eq 1 ]]; then
    EL_CUSTOM_NODE=""
    JWT_SECRET=""
  else
    var="EL_NODE"
    __get_value_from_env "${var}" "${__env_file}" "EL_CUSTOM_NODE"
    var="JWT_SECRET"
    __get_value_from_env "${var}" "${__env_file}" "JWT_SECRET"
  fi
  EL_CUSTOM_NODE=$(whiptail --title "Configure custom execution client" --inputbox "What is the URL for your custom \
execution client? (right-click to paste)" 10 65 "${EL_CUSTOM_NODE}" 3>&1 1>&2 2>&3)

  echo "Your custom execution client is: $EL_CUSTOM_NODE"

  while true; do
    JWT_SECRET=$(whiptail --title "Configure JWT secret" --inputbox "What is the JWT secret shared with the \
execution client? (right-click to paste)" 10 60 "${JWT_SECRET}" 3>&1 1>&2 2>&3)

    # Remove '0x' prefix if present
    JWT_SECRET=${JWT_SECRET#0x}

    # Check if the JWT_SECRET is exactly 64 hex characters long
    if [[ $JWT_SECRET =~ ^[0-9A-Fa-f]{64}$ ]]; then
      echo "JWT Secret set. Please make sure it matches on CL and EL."
      break
    else
      whiptail --msgbox "The JWT secret needs to be exactly 32 bytes, 64 hex characters long. You can try \
again or Cancel on the next screen." 10 65
    fi
  done
}


__query_execution_client() {
  local choices
  local arch
  local num_items
  local menu_height

  if [[ "${CONSENSUS_CLIENT}" = "caplin.yml" ]]; then
    EXECUTION_CLIENT="erigon.yml"
    echo "Your execution client file is:" "${EXECUTION_CLIENT}"
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
    EL_NODE="http://execution:8551"
    return 0
  fi

  choices=()
  arch=$(uname -m)

  if [[ "${NETWORK}" = "gnosis" ]]; then
    choices+=("nethermind.yml" "Nethermind (.NET)")
    choices+=("erigon.yml" "Erigon (Go)")
  elif [[ "${NETWORK}" = "ephemery" ]]; then
    if [[ "${arch}" != *"riscv64"* ]]; then
      choices+=("besu.yml" "Besu (Java)")
    else
      echo "Epheremy testnet is not supported on ${arch}"
      exit 1
    fi
  elif [[ "${arch}" =~ (aarch64|arm64) ]] ; then
    choices+=("besu.yml" "Besu (Java)")
    choices+=("nethermind.yml" "Nethermind (.NET)")
    choices+=("erigon.yml" "Erigon (Go)")
    choices+=("geth.yml" "Geth (Go)")
  elif [[ "${arch}" = *"riscv64"* ]]; then
    choices+=("geth.yml" "Geth (Go)")
  else
    choices+=("reth.yml" "Reth (Rust)")
    choices+=("besu.yml" "Besu (Java)")
    choices+=("nethermind.yml" "Nethermind (.NET)")
    choices+=("erigon.yml" "Erigon (Go)")
    choices+=("geth.yml" "Geth (Go)")
    choices+=("ethrex.yml" "Ethrex (Rust)")
  fi

  if [[ "${arch}" != *"riscv64"* && "${NETWORK}" =~ (hoodi|sepolia) ]]; then
    choices+=("nimbus-el.yml" "Nimbus (Nim) - alpha")
  fi

  choices+=("NONE" "Custom - Distributed")
  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  EXECUTION_CLIENT=$(whiptail --notags --title "Select execution client" --menu \
  "Which execution client do you want to run?" "${menu_height}" 65 "${num_items}" \
  "${choices[@]}" 3>&1 1>&2 2>&3)

  if [[ "${EXECUTION_CLIENT}" = "NONE" ]]; then
    unset EXECUTION_CLIENT
    __query_custom_execution_client
    EL_NODE="${EL_CUSTOM_NODE}"
  else
    echo "Your execution client file is:" "${EXECUTION_CLIENT}"
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
    EL_NODE="http://execution:8551"
  fi
}


__query_ssv_client() {
  local choices
  local num_items
  local menu_height

  choices=()

  choices+=("ssv.yml" "SSV Node (Go)")
  choices+=("anchor.yml" "Anchor (Rust)")

  num_items=$(( ${#choices[@]} / 2 ))
  menu_height=$(( 8 + num_items ))

  SSV_CLIENT=$(whiptail --notags --title "Select SSV client" --menu \
  "Which SSV client do you want to run?" "${menu_height}" 65 "${num_items}" \
  "${choices[@]}" 3>&1 1>&2 2>&3)

  echo "Your SSV client file is:" "${SSV_CLIENT}"
}


__query_4444() {  # Call with with --defaultno for RPC
  if (whiptail --title "History expiry" --yesno "Do you want to expire pre-merge history? Good for a validator node, but makes eth_getLogs RPC calls impossible pre-merge" 10 65 "$1") then
    EL_NODE_TYPE=pre-merge-expiry
  else
# shellcheck disable=SC2034
    EL_NODE_TYPE=full
  fi
}


__query_grafana() {
  if (whiptail --title "Grafana" --yesno "Do you want to use Grafana dashboards?" 10 65) then
      if [[ "$OSTYPE" = "darwin"* ]]; then
      # macOS doesn't do well with / bind mount - leave node-exporter, cadvisor and loki/promtail off by default
        GRAFANA_CLIENT="grafana-rootless.yml:grafana-shared.yml"
      else
        GRAFANA_CLIENT="grafana.yml:grafana-shared.yml"
      fi
  else
    unset GRAFANA_CLIENT
  fi
}


__query_remote_beacon() {
  local var

  if [[ "${__minty_fresh}" -eq 1 ]]; then
    if [[ "${__deployment}" = "rocket" ]]; then
      REMOTE_BEACON="http://eth2:5052"
    else
      REMOTE_BEACON=""
    fi
  else
    var="CL_NODE"
    __get_value_from_env "${var}" "${__env_file}" "REMOTE_BEACON"
  fi
  REMOTE_BEACON=$(whiptail --title "Configure remote consensus client" --inputbox "What is the URL for your remote \
consensus client? (right-click to paste)" 10 60 "${REMOTE_BEACON}" 3>&1 1>&2 2>&3)

  echo "Your remote consensus client is:" "${REMOTE_BEACON}"
}


__query_checkpoint_beacon() {
  local var

  if [[ "${__minty_fresh}" -eq 1 || "${__network_change}" -eq 1 ]]; then
    CHECKPOINT_SYNC_URL=""
  else
    var="CHECKPOINT_SYNC_URL"
    __get_value_from_env "${var}" "${__env_file}" "CHECKPOINT_SYNC_URL"
  fi
  if [[ -z "${CHECKPOINT_SYNC_URL}" ]]; then
    case "${NETWORK}" in
      sepolia)
        CHECKPOINT_SYNC_URL="https://sepolia.beaconstate.info"
        ;;
      hoodi)
        CHECKPOINT_SYNC_URL="https://hoodi.checkpoint.sigp.io"
        ;;
      ephemery)
        CHECKPOINT_SYNC_URL="https://ephemery.beaconstate.ethstaker.cc/"
        ;;
      mainnet)
        CHECKPOINT_SYNC_URL="https://beaconstate.info"
        ;;
      gnosis)
        CHECKPOINT_SYNC_URL="https://checkpoint.gnosischain.com"
        ;;
      *)
        CHECKPOINT_SYNC_URL=""
        ;;
    esac
  fi

  CHECKPOINT_SYNC_URL=$(whiptail --title "Configure CL checkpoint sync URL" --inputbox "What is the URL for your CL \
checkpoint sync provider? (right-click to paste)" 10 65 "${CHECKPOINT_SYNC_URL}" 3>&1 1>&2 2>&3)

  echo "Your checkpoint sync URL is:" "${CHECKPOINT_SYNC_URL}"
}


__query_graffiti() {
  local var

  var="GRAFFITI"
  __get_value_from_env "${var}" "${__env_file}" "GRAFFITI"
  var="DEFAULT_GRAFFITI"
  __get_value_from_env "${var}" "${__env_file}" "DEFAULT_GRAFFITI"

  while true; do
    GRAFFITI=$(whiptail --title "Configure Graffiti" --inputbox "What optional Graffiti do you want to send with your blocks? \
(up to 32 characters)" 10 65 "${GRAFFITI}" 3>&1 1>&2 2>&3)

    if [[ $(echo -n "${GRAFFITI}" | wc -c) -gt 32 ]]; then
      whiptail --msgbox "The graffiti string cannot be longer than 32 characters. Emojis count as 4, each." 16 65
    else
      break
    fi
  done

  if [[ -n "${GRAFFITI}" ]]; then
    DEFAULT_GRAFFITI="false"
  fi
  if [[ "${DEFAULT_GRAFFITI}" = "true" ]]; then
    echo "You are using the client's default Graffiti"
  else
    echo "your Graffiti is:" "${GRAFFITI}"
  fi
}


__query_checkpoint_sync() {
  if [[ "${NETWORK}" =~ ^https?:// ]]; then
    CHECKPOINT_SYNC_URL=""
    return
  fi
  __query_checkpoint_beacon
}


__query_coinbase() {
  local var
  local exitstatus

  var="FEE_RECIPIENT"
  __get_value_from_env "${var}" "${__env_file}" "FEE_RECIPIENT"

  while true; do
    set +e # Can't rely on the error handler here because of the special-casing below for update()
    if [[  "${__during_update}" -eq 0 && "${__deployment}" =~ "lido_" ]]; then  # Lido Execution Layer Rewards Vault
      case "${NETWORK}" in
        mainnet)
          FEE_RECIPIENT="0x388C818CA8B9251b393131C08a736A67ccB19297"
          ;;
        hoodi)
          FEE_RECIPIENT="0x9b108015fe433F173696Af3Aa0CF7CDb3E104258"
          ;;
        *)
          FEE_RECIPIENT="0x0000000000000000000000000000000000000000"
          ;;
      esac
    elif [[ "${__during_update}" -eq 1 || ! "${__deployment}" = rpc ]]; then
      FEE_RECIPIENT=$(whiptail --title "Configure rewards address" --inputbox "What is the address you want \
transaction rewards to be sent to by default? (right-click to paste, CANNOT be an ENS)" 10 65 "${FEE_RECIPIENT}" \
3>&1 1>&2 2>&3)
    else
      FEE_RECIPIENT=$(whiptail --title "Configure fallback fee recipient" --inputbox "What is the fallback fee recipient \
address? Required so that a) the CL doesn't print warnings and b) you can use the CL REST API for validators. \
(right-click to paste, CANNOT be an ENS)" 10 65 \
"${FEE_RECIPIENT}" 3>&1 1>&2 2>&3)
    fi

    exitstatus=$?
    set -e
    if [[ "${exitstatus}" -eq 0 ]]; then
      if [[ "${FEE_RECIPIENT}" = 0x* && "${#FEE_RECIPIENT}" -eq 42 ]]; then
        echo "Your rewards address is: ${FEE_RECIPIENT}"
        break
      else
        whiptail --msgbox "${FEE_RECIPIENT} is not a valid ETH address. You can try again or Cancel on the next \
screen.\n\nThe client will not start successfully until a valid ETH rewards address has been set." 16 65
      fi
    else
      if [[ "${__during_update}" -eq 1 ]]; then
        echo
        echo "Please make requested changes manually or run \"${__me} update\" again"
        echo "before running \"${__me} up\"."
        echo
        echo "Without a FEE_RECIPIENT set in \"${__env_file}\", containers will not"
        echo "start successfully. Already running containers will keep running with the"
        echo "old configuration until you are ready to restart them."
      else
        echo "Canceled config wizard."
      fi
      echo
      exit 130
    fi
  done
}


__query_mev() {
  local var
  local selected
  local -A relays=()
  local -A optional_relays=()
  local message
  local default
  local formatted_mev_relays
  local exitstatus

  if [[ "${NETWORK}" = "gnosis" ]]; then
    return 0
  fi
  if [[ "${__deployment}" = "ssv" ]]; then
    MEV_BOOST="true"
    case "${NETWORK}" in
      hoodi)
        MEV_RELAYS="https://0xaa58208899c6105603b74396734a6263cc7d947f444f396a90f7b7d3e65d102aec7e5e5291b27e08d02c50a050825c2f@hoodi.titanrelay.xyz,https://0x98f0ef62f00780cf8eb06701a7d22725b9437d4768bb19b363e882ae87129945ec206ec2dc16933f31d983f8225772b6@hoodi.aestus.live,https://0xafa4c6985aa049fb79dd37010438cfebeb0f2bd42b115b89dd678dab0670c1de38da0c4e9138c9290a398ecd9a0b3110@boost-relay-hoodi.flashbots.net,https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-hoodi.ultrasound.money"
        ;;
      mainnet)
        MEV_RELAYS="https://0xac6e77dfe25ecd6110b8e780608cce0dab71fdd5ebea22a16c0205200f2f8e2e3ad3b71d3499c54ad14d6c21b41a37ae@boost-relay.flashbots.net,\
https://0x8b5d2e73e2a3a55c6c87b8b6eb92e0149a125c852751db1422fa951e42a09b82c142c3ea98d0d9930b056a3bc9896b8f@bloxroute.max-profit.blxrbdn.com,\
https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay.ultrasound.money,\
https://0xa15b52576bcbf1072f4a011c0f99f9fb6c66f3e1ff321f11f461d15e31b1cb359caa092c71bbded0bae5b5ea401aab7e@aestus.live,\
https://0x98650451ba02064f7b000f5768cf0cf4d4e492317d82871bdc87ef841a0743f69f0f1eea11168503240ac35d101c9135@mainnet-relay.securerpc.com"
        ;;
    esac
    return 0
  fi
  var="MEV_BOOST"
  __get_value_from_env "${var}" "${__env_file}" "__value"
  # I do mean to match literally
  # shellcheck disable=SC2076
  if [[ "${__deployment}" =~ (validator|rocket) ]]; then
    if (whiptail --title "MEV Boost" --yesno "Is MEV Boost configured on your remote consensus client and do you \
want to use MEV Boost?" 10 65); then
        MEV_BOOST="true"
        MEV_RELAYS=""
      fi
      return 0
  fi
  if [[ "${__deployment}" =~ "lido_" ]]; then
    MEV_BOOST="true"
    while true; do
      MEV_RELAYS=""
      selected=""
      case "${NETWORK}" in
          mainnet)
              relays=(
                  ['Agnostic']="https://0xa7ab7a996c8584251c8f925da3170bdfd6ebc75d50f5ddc4050a6fdc77f2a3b5fce2cc750d0865e05d7228af97d69561@agnostic-relay.net"
                  ['bloXroute']="https://0xb0b07cd0abef743db4260b0ed50619cf6ad4d82064cb4fbec9d3ec530f7c5e6793d9f286c4e082c0244ffb9f2658fe88@bloxroute.regulated.blxrbdn.com"
                  ['Aestus']="https://0xa15b52576bcbf1072f4a011c0f99f9fb6c66f3e1ff321f11f461d15e31b1cb359caa092c71bbded0bae5b5ea401aab7e@aestus.live"
                  ['bloXroute Max-Profit']="https://0x8b5d2e73e2a3a55c6c87b8b6eb92e0149a125c852751db1422fa951e42a09b82c142c3ea98d0d9930b056a3bc9896b8f@bloxroute.max-profit.blxrbdn.com"
                  ['Flashbots']="https://0xac6e77dfe25ecd6110b8e780608cce0dab71fdd5ebea22a16c0205200f2f8e2e3ad3b71d3499c54ad14d6c21b41a37ae@boost-relay.flashbots.net"
                  ['Ultra Sound']="https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay.ultrasound.money"
              )
              optional_relays=(
                  ['Titan Relay Global']="https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@global.titanrelay.xyz"
                  ['Titan Relay Regional']='https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@regional.titanrelay.xyz'
                  ['Manifold Finance']="https://0x98650451ba02064f7b000f5768cf0cf4d4e492317d82871bdc87ef841a0743f69f0f1eea11168503240ac35d101c9135@mainnet-relay.securerpc.com/"
              )
              selected=$(whiptail --title "Relays list" --checklist \
                  "Choose relays (use spacebar to unselect)" 16 50 9 \
                  "Agnostic" "" ON \
                  "bloXroute" "" ON \
                  "Aestus" "" ON \
                  "bloXroute Max-Profit" "" ON \
                  "Flashbots" "" ON \
                  "Ultra Sound" "" ON \
                  "Titan Relay Global" "(optional)" ON \
                  "Titan Relay Regional" "(optional)" ON \
                  "Manifold Finance" "(optional)" ON 3>&1 1>&2 2>&3)
              ;;
          hoodi)
              relays=(
                  ['Aestus']="https://0x98f0ef62f00780cf8eb06701a7d22725b9437d4768bb19b363e882ae87129945ec206ec2dc16933f31d983f8225772b6@hoodi.aestus.live"
                  ['Titan']="https://0xaa58208899c6105603b74396734a6263cc7d947f444f396a90f7b7d3e65d102aec7e5e5291b27e08d02c50a050825c2f@hoodi.titanrelay.xyz"
                  ['Flashbots']="https://0xafa4c6985aa049fb79dd37010438cfebeb0f2bd42b115b89dd678dab0670c1de38da0c4e9138c9290a398ecd9a0b3110@boost-relay-hoodi.flashbots.net"
                  ['Ultrasound']="https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-hoodi.ultrasound.money"
              )
              selected=$(whiptail --title "Relays list" --checklist \
                  "Choose relays" 12 30 5 \
                  "Aestus" "" ON \
                  "Titan" "" ON \
                  "Flashbots" "" ON \
                  "Ultrasound" "" ON \
                  3>&1 1>&2 2>&3)
              ;;
            *)
              echo "No MEV RELAYS configured for ${NETWORK}"
              return
              ;;
      esac
      for i in "${!relays[@]}"; do
          if [[ ${selected} =~ ${i} ]]; then
              if [[ -z "${MEV_RELAYS}" ]]; then
                  MEV_RELAYS="${relays[$i]}"
              else
                  MEV_RELAYS="${MEV_RELAYS},${relays[$i]}"
              fi
          fi
      done
      exitstatus=$?
      if [[ $exitstatus -eq 0 ]]; then
          if [[ -z "${MEV_RELAYS}" ]]; then
            whiptail --msgbox "At least one mandatory relay should be chosen" 10 75
            continue
          fi
      else
          echo "You chose Cancel."
          exit 1
      fi
      for i in "${!optional_relays[@]}"; do
          if [[ ${selected} =~ ${i} ]]; then
              if [[ -z "${MEV_RELAYS}" ]]; then
                  MEV_RELAYS="${optional_relays[$i]}"
              else
                  MEV_RELAYS="${MEV_RELAYS},${optional_relays[$i]}"
              fi
          fi
      done
      break
    done
    return 0
  fi
  if [[ "${__deployment}" = "rpc" ]]; then
    message="Do you want to use MEV Boost, e.g. because you will connect validators to CL REST API?"
    default="--defaultno"
  else
    message="Do you want to use MEV Boost?"
    default=""
  fi
  if (whiptail --title "MEV Boost" --yesno "${message}" 10 65 "${default}") then
    MEV_BOOST="true"
    if [[ "${__value}" = "true" ]]; then  # MEV_BOOST=true was already configured
      var="MEV_RELAYS"
      __get_value_from_env "${var}" "${__env_file}" "MEV_RELAYS"
    else
      case "${NETWORK}" in
        sepolia)
          MEV_RELAYS=https://0x845bd072b7cd566f02faeb0a4033ce9399e42839ced64e8b2adcfc859ed1e8e1a5a293336a49feac6d9a5edb779be53a@boost-relay-sepolia.flashbots.net
          ;;
        hoodi)
          MEV_RELAYS="https://0xaa58208899c6105603b74396734a6263cc7d947f444f396a90f7b7d3e65d102aec7e5e5291b27e08d02c50a050825c2f@hoodi.titanrelay.xyz,https://0x98f0ef62f00780cf8eb06701a7d22725b9437d4768bb19b363e882ae87129945ec206ec2dc16933f31d983f8225772b6@hoodi.aestus.live,https://0xafa4c6985aa049fb79dd37010438cfebeb0f2bd42b115b89dd678dab0670c1de38da0c4e9138c9290a398ecd9a0b3110@boost-relay-hoodi.flashbots.net,https://0xb1559beef7b5ba3127485bbbb090362d9f497ba64e177ee2c8e7db74746306efad687f2cf8574e38d70067d40ef136dc@relay-hoodi.ultrasound.money"
          ;;
        mainnet)
          MEV_RELAYS=https://0xac6e77dfe25ecd6110b8e780608cce0dab71fdd5ebea22a16c0205200f2f8e2e3ad3b71d3499c54ad14d6c21b41a37ae@boost-relay.flashbots.net,\
https://0x8b5d2e73e2a3a55c6c87b8b6eb92e0149a125c852751db1422fa951e42a09b82c142c3ea98d0d9930b056a3bc9896b8f@bloxroute.max-profit.blxrbdn.com,\
https://0x8c4ed5e24fe5c6ae21018437bde147693f68cda427cd1122cf20819c30eda7ed74f72dece09bb313f2a1855595ab677d@global.titanrelay.xyz,\
https://0xa1559ace749633b997cb3fdacffb890aeebdb0f5a3b6aaa7eeeaf1a38af0a8fe88b9e4b1f61f236d2e64d95733327a62@relay.ultrasound.money,\
https://0xa15b52576bcbf1072f4a011c0f99f9fb6c66f3e1ff321f11f461d15e31b1cb359caa092c71bbded0bae5b5ea401aab7e@aestus.live,\
https://0xa7ab7a996c8584251c8f925da3170bdfd6ebc75d50f5ddc4050a6fdc77f2a3b5fce2cc750d0865e05d7228af97d69561@agnostic-relay.net,\
https://0x98650451ba02064f7b000f5768cf0cf4d4e492317d82871bdc87ef841a0743f69f0f1eea11168503240ac35d101c9135@mainnet-relay.securerpc.com,\
https://0x8c7d33605ecef85403f8b7289c8058f440cbb6bf72b055dfe2f3e2c6695b6a1ea5a9cd0eb3a7982927a463feb4c3dae2@relay.wenmerge.com
          ;;
        *)
          MEV_RELAYS=""
          ;;
      esac
    fi
    # Replace newlines with "\n" for the whiptail input
    formatted_mev_relays=$(printf '%s' "${MEV_RELAYS}" | sed ':a;N;$!ba;s/\n/\\n/g')

    formatted_mev_relays=$(whiptail --title "Configure MEV relays" --inputbox "What MEV relay(s) do you want to use? \
(right-click to paste)" 15 65 "${formatted_mev_relays}" 3>&1 1>&2 2>&3)

    # Replace "\n" back to newlines to restore multi-line format
    MEV_RELAYS=$(printf '%s' "${formatted_mev_relays}" | sed 's/\\n/\n/g')
    echo "Your MEV relay(s): ${MEV_RELAYS}"
    __final_msg+="\nYou are configured to get block building bids remotely via relay(s)."
  else
    MEV_BOOST="false"
    MEV_RELAYS=""
    __final_msg+="\nYou are configured to build blocks locally, only.\nPlease ensure you have 200 Mbit/s upload bandwidth or more."
  fi
}


__query_mev_factor() {
  local var
  local message
  local default
  local speed_json
  local down_speed
  local up_speed
  local max_blobs

  var="MEV_BUILD_FACTOR"
  __get_value_from_env "${var}" "${__env_file}" "MEV_BUILD_FACTOR"
#shellcheck disable=SC2076
  if [[ -n "${MEV_BUILD_FACTOR}" || ! "${MEV_BOOST}" = "true" || "${CONSENSUS_CLIENT}" =~ "-cl-only.yml" ]]; then
    return
  fi

  if ! [[ "${__distro}" =~ (ubuntu|debian) ]]; then
    __final_msg+="\nCannot measure network speed on ${__distro}. Please ensure you have 112 Mbit/s up or set MEV_BUILD_FACTOR=100 or set MAX_BLOBS."
    return
  fi

  if ! dpkg-query -W -f='${Status}' speedtest-cli 2>/dev/null | grep -q "ok installed"; then
    echo "Installing speedtest-cli"
    ${__auto_sudo} apt-get update && ${__auto_sudo} apt-get install -y --no-install-recommends speedtest-cli
  fi
  echo "Running speedtest"
  set +e
  speed_json=$(speedtest-cli --secure --json)
  exitstatus=$?
  set -e
  if [[ "${exitstatus}" -ne 0 ]]; then
    echo "Speedtest failed, skipping MEV Build Factor query"
    return
  fi
  down_speed=$(jq -r '.download' <<< "${speed_json}" | awk '{print int($1 / 1000000)}')
  up_speed=$(jq -r '.upload' <<< "${speed_json}" | awk '{print int($1 / 1000000)}')
  echo "Measured download speed is ${down_speed} Mbit/s."
  echo
  __final_msg+="\nYour measured upload speed is ${up_speed} Mbit/s.\nYour measured download speed is ${down_speed} Mbit/s."
  if [[ "${up_speed}" -lt 112 ]]; then  # This should be adjusted as BPOs come in
    echo "Your upload speed is less than 112 Mbit/s, it is ${up_speed} Mbit/s"
    max_blobs=$(echo "${up_speed}" | awk '{print int($1 / 5.33)}')
    if [[ "${max_blobs}" -eq 0 ]]; then
      echo "Your upload speed is too low to upload any blobs"
      echo "Disabling local block building by setting MEV_BUILD_FACTOR to 100"
      MEV_BUILD_FACTOR="100"
      MAX_BLOBS="0"
      __final_msg+="\nLocal block building was disabled, because your upload speed is low."
    else
      echo "You can upload up to ${max_blobs} with your upload speed"
      echo "Setting default MEV_BUILD_FACTOR and MAX_BLOBS=${max_blobs}"
      MEV_BUILD_FACTOR=""
# shellcheck disable=SC2034
      MAX_BLOBS="${max_blobs}"
      __final_msg+="\nBlobs were restricted to ${max_blobs} max, because your upload speed is low."
    fi
  else
    message="Your upload speed is ${up_speed} Mbit/s. Do you want to build local blocks, when the relay pays less than 10% more?"
    if (whiptail --title "MEV Build Factor" --yesno "${message}" 10 65) then
      MEV_BUILD_FACTOR="90"
      __final_msg+="\nLocal block building is preferred, when the relay pays less than 10% more."
    else
      MEV_BUILD_FACTOR="100"
      __final_msg+="\nLocal block building is disabled."
    fi
  fi
}


__lido_withdrawal_credentials_address() {
    local lido_address=""
    case "${NETWORK}" in  # Lido Withdrawal Vault
        mainnet)
            lido_address="0xB9D7934878B5FB9610B3fE8A5e441e8fad7E293f"
            ;;
        hoodi)
            lido_address="0x4473dCDDbf77679A643BdB654dbd86D67F8d32f2"
            ;;
        *)
            lido_address="0x0000000000000000000000000000000000000000"
            ;;
    esac
    echo "${lido_address}"
}

__lido_keys_attention_message() {
  local num_validators
  local keystore_password
  local keystore_password_confirm
  local exitstatus

  whiptail --title "Attention" --msgbox "Please, make sure that you set 32 ETH when generated deposit data\nAnd right execution address for your validator keys: $(__lido_withdrawal_credentials_address)\nOtherwise, your keys will not be valid!" 10 80
}

__query_lido_keys_generation() {
  local num_validators
  local keystore_password
  local keystore_password_confirm
  local mnemonic
  local exitstatus

  if [[ "${NETWORK}" = "mainnet" ]]; then
    if (whiptail --title "Security warning" --yesno "Key generation is not recommended on MAINNET for security reasons.\n\nIt is recommended to Select 'No' to skip the step and generate keys in a more secure way later (ex. on an airgapped live USB)\n\nOtherwise, Select 'Yes' to proceed with key generation on this machine" 13 85) then
       echo "Proceeding with key generation on MAINNET."
    else
       __lido_keys_attention_message
       return 0
    fi
  fi

  num_validators="1"
  keystore_password=""
  keystore_password_confirm=""
  num_validators=$(whiptail --title "Validators count" --inputbox "Enter the number of validators" 8 60 "${num_validators}" 3>&1 1>&2 2>&3)
  while true; do
    keystore_password=$(whiptail --title "Keystore password" --passwordbox "Enter validators keystore password (at least 12 chars)" 8 60 "${keystore_password}" 3>&1 1>&2 2>&3)

    exitstatus=$?
    if [[ $exitstatus -eq 0 ]]; then
      if [[ ${#keystore_password} -ge 12 ]]; then
        keystore_password_confirm=$(whiptail --title "Keystore password" --passwordbox "Confirm validators keystore password" 8 60 "${keystore_password_confirm}" 3>&1 1>&2 2>&3)
        if [[ "${keystore_password}" = "${keystore_password_confirm}" ]]; then
          echo "Keystore password set."
          break
        else
          whiptail --msgbox "Passwords do not match. Please try again." 10 60
        fi
      else
        whiptail --msgbox "The keystore password secret needs to be at least 12 characters long. You can try \
again or Cancel on the next screen." 10 75
      fi
    else
      echo "You chose Cancel."
      exit 1
    fi
  done

  exitstatus=$?
  if [[ $exitstatus -eq 0 ]]; then
    echo "Your number of validators is:" "${num_validators}"
    mnemonic="existing"
    if (whiptail --title "Mnemonic" --yesno "Do you want to generate new mnemonic?" 8 60) then
      mnemonic="new"
    fi
    export NETWORK=${NETWORK} && __docompose --profile tools run --rm deposit-cli-${mnemonic} \
      --uid "$(id -u)" \
      --execution_address "$(__lido_withdrawal_credentials_address)" \
      --num_validators "${num_validators}" \
      --keystore_password "${keystore_password}" \
      --non_interactive
  else
    echo "You chose Cancel."
    exit 1
  fi
}


__query_lido_obol_enr() {
  local outcome
  local lido_obol_operator_enr

  ${__as_owner} mkdir -p ./.eth/charon
  outcome=$(__docompose -f ./lido-obol.yml run -u "$(id -u)":"$(id -g)" --rm charon-create-enr)
  if [[ "${outcome}" =~ "Created ENR private key:" ]]; then
    lido_obol_operator_enr=$(echo "${outcome}" | grep -e 'enr:')
  else
    echo "Something went wrong. Please, try again."
    exit 1
  fi

  echo "Your created ENR is:" "${lido_obol_operator_enr}"
  echo "${lido_obol_operator_enr}" >> "./.eth/charon-enr-public-key"
  whiptail --title "Lido Obol operator ENR creation outcome" --msgbox "Your ENR is created!\n\n1. Backup your private key (path: .eth/charon-enr-private-key)!\n2. Copy your public ENR for the further steps\n\nYour public ENR is:\n\n${lido_obol_operator_enr}" 16 80
}

__query_lido_obol_cluster_definition() {
  local cluster_definition_url
  local cluster_definition_is_valid
  local exitstatus

    cluster_definition_url=$(whiptail --title "Lido Obol cluster creation" --inputbox "\nPut your cluster definition link below:" 10 80 "https://api.obol.tech/dv/example_link_to_your_definition" 3>&1 1>&2 2>&3)
    if [[ -z "${cluster_definition_url}" ]]; then
      echo "Cluster definition URL can't be empty"
      exit 1
    fi
    exitstatus=$?
    if [[ $exitstatus -eq 0 ]]; then
        ${__as_owner} curl -o ./.eth/cluster-definition.tmp -s "${cluster_definition_url}" -H "Accept: application/json"
# shellcheck disable=SC2086
        cluster_definition_is_valid=$(__docompose -f ./lido-obol.yml run --rm -v "$(pwd)"/.eth/cluster-definition.tmp:/cluster-definition.json:ro curl-jq sh -c \
          "cat /cluster-definition.json | jq -r 'all(.validators[]; (.fee_recipient_address | ascii_downcase) == (\"'${FEE_RECIPIENT}'\" | ascii_downcase) and (.withdrawal_address | ascii_downcase) == (\"'$(__lido_withdrawal_credentials_address)'\" | ascii_downcase))'" | tail -n 1)
        set -e
        if [[ "${cluster_definition_is_valid}" = "true" ]]; then
            echo "Your cluster definition url is:" "${cluster_definition_url}"
            ${__as_owner} mv ./.eth/cluster-definition.tmp ./.eth/cluster-definition.json
        else
            whiptail --title "Lido Obol cluster creation" --msgbox "Your cluster definition is not valid.\n\nCheck that every validator has \`fee_recipient_address\` and \`withdrawal_address\` equal to Lido contracts and try again.\n\nLido fee recipient: '${FEE_RECIPIENT}'\nLido withdrawal credentials: '$(__lido_withdrawal_credentials_address)'" 14 90
            echo "Your cluster definition is NOT valid."
            ${__as_owner} rm ./.eth/cluster-definition.tmp
            exit 1
        fi
    else
        echo "You chose Cancel."
        exit 1
    fi
}

__query_lido_obol_cluster_dkg() {
    local folder_postfix=""
    local outcome
    local exitstatus

    if [[ -d ./.eth/validator_keys ]]; then
        folder_postfix=${EPOCHSECONDS}
        ${__as_owner} mkdir "./.eth_backup_${folder_postfix}"
        ${__as_owner} cp -vr ./.eth/validator_keys "./.eth_backup_${folder_postfix}/validator_keys"
        ${__as_owner} rm -rf ./.eth/validator_keys
    fi
    if (whiptail --title "DKG ceremony" --yesno "Do you want to start DKG ceremony?\n\nMake sure all participants are ready!" 10 60) then
        outcome=$(__docompose -f ./lido-obol.yml run -u "$(id -u)":"$(id -g)" --rm charon-run-dkg)
        exitstatus=$?
        if [[ "${exitstatus}" -ne 0 ]]; then
            echo "Something went wrong. Please, try again."
            exit 1
        fi
        echo "DKG ceremony finished successfully"
        whiptail --title "Finish" --msgbox "\nThe DKG is finished!" 10 40
    else
        whiptail --title "DKG ceremony" --msgbox "You should start DKG ceremony before proceeding further" 8 60
        echo "DKG ceremony starting is canceled"
        exit 1
    fi
}

__query_dkg() {
  local key_file_content
  local public_key

  if uname -m | grep -q aarch64 || uname -m | grep -q arm64; then  # No multi-arch image for ssvlabs/ssv-dkg as of July 16th 2025
    return
  fi

  __ssv_operator_id=-1
  if (whiptail --title "DKG ceremony" --yesno "Do you want to participate in DKG ceremonies as an operator?" 10 60); then
    key_file_content=$(${__auto_sudo} cat ./ssv-config/encrypted_private_key.json)
    public_key=$(__docompose -f ./ssv-dkg.yml run --rm curl-jq sh -c \
      "echo '${key_file_content}' | jq -r '.pubKey'" | tail -n 1)
    echo "Your SSV node public key is: ${public_key}"
    __ssv_operator_id=$(whiptail --title "Register SSV operator" --inputbox "\n1. Your SSV node public key:\n\n${public_key}\n\n2. Register your operator in the SSV network with the public key\n\n3. Input your Operator ID \
(right-click to paste)" 22 85 3>&1 1>&2 2>&3)
    if [[ -n "${__ssv_operator_id}" && ! "${__ssv_operator_id}" = "-1" ]]; then
      sed -i'.original' "s|operatorID: .*|operatorID: ${__ssv_operator_id}|" ./ssv-config/dkg-config.yaml
      echo "Your SSV Operator ID is: ${__ssv_operator_id}"
    else
      echo "Please manually edit \"./ssv-config/dkg-config.yaml\" with your SSV Operator ID"
      echo "and add \":ssv-dkg.yml\" to \"COMPOSE_FILE\" in \".env\" after registering your operator."
    fi
  fi
  rm -f ssv-config/dkg-config.yaml.original
}


__handle_error() {
  if [[ ! $- =~ e ]]; then
# set +e, do nothing
    return 0
  fi

  local exitstatus=$1
  if [[ "${exitstatus}" -eq 0 ]]; then
    return 0
  fi

  if [[ "${__handler_ran}" -eq 1 ]]; then
    return 0
  fi
  __handler_ran=1

  echo
  if [[ "${exitstatus}" -eq 130 && "${__during_update}" -ne 1 ]]; then
    echo "${__me} terminated by user"
  elif [[ "${__during_config}" -eq 1 && "${exitstatus}" -eq 1 ]]; then
    echo "Canceled config wizard."
  else
    echo "${__me} terminated with exit code ${exitstatus} on line $2"
    if [[ -n "${__command}" ]]; then
      echo "This happened during ${__me} ${__command} ${__params}"
    fi
  fi
  if [[ "${__during_update}" -eq 1 && "${__during_env_migrate}" -eq 1 ]]; then
    cp "${__env_file}" "${__env_file}".partial
    cp "${__env_file}".source "${__env_file}"
    echo
    echo "Restored your ${__env_file} file, to undo partial migration. Please verify it looks correct."
    echo "The partially migrated file is in ${__env_file}.partial for troubleshooting."
  fi
  if [[ "${__during_postgres}" -eq 1 ]]; then
    echo
    if [[ "${__during_pg_migrate}" -eq 1 && "${__pg_migrated}" -eq 0 ]]; then
      echo "Web3signer slashing protection database migration failed, while switching to the migrated data."
      echo
      echo "WARNING: You are no longer protected by the slashing protection database."
      echo "Starting the node again could get you slashed."
      echo "Please look through the upgrade messages and remedy the fault."
      echo
      echo "Marking Web3signer as unsafe to start."
      __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 touch /var/lib/web3signer/.migration_fatal_error
    elif [[ "${__pg_migrated}" -eq 1 ]]; then
      echo "Web3signer slashing protection database migration failed, after switching to the migrated data."
      echo
      echo "The slashing protection database itself is likely fine, but switching to PostgreSQL ${__target_pg}"
      echo "in \"${__env_file}\" through its \"PG_DOCKER_TAG\" variable failed, which is likely to keep your node from functioning correctly."
      echo "Please look through the upgrade messages and remedy the fault."
      echo
      echo "Marking Web3signer with a migration error."
      __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 touch /var/lib/web3signer/.migration_error
    else
      if __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 [ -f /var/lib/web3signer/.migration_error ]; then
        echo "A previous PostgreSQL upgrade attempt failed after switching to the migrated data, and while switching"
        echo "to PostgreSQL ${__target_pg} in \"${__env_file}\"."
        echo "Web3signer has a marker file \".migration_error\" inside its Docker volume."
        echo
        echo "Please look through the upgrade messages and remedy the fault."
        echo "And only then remove the marker file in the volume."
      elif __dodocker run --rm -v "$(__dodocker volume ls -q -f "name=web3signer-keys")":/var/lib/web3signer \
        alpine:3 [ -f /var/lib/web3signer/.migration_fatal_error ]; then
        echo "A previous PostgreSQL upgrade attempt failed and left you unprotected by slashing data."
        echo "Web3signer is marked as unsafe to start, by the file \".migration_fatal_error\" inside its Docker volume"
        echo
        echo "Please look through the upgrade messages and remedy the fault."
        echo "Exercise utmost caution, so you do not accidentally get slashed."
        echo "And only then remove the marker file in the volume."
      else
        echo "Web3signer slashing protection database migration failed, but before removing the original data."
        echo "Please look through the logs of the attempted upgrade, and remedy the fault."
        echo
        echo "Your original Web3signer slashing protection database remains in place."
        echo "If you want an updated node and handle PostgreSQL issues later, you can safely update the node again,"
        echo "this time without migration, and start it."
      fi
    fi
    if [[ -n "${STY:-}" || -n "${TMUX:-}" ]]; then
      echo
      if [[ -n "${STY:-}" ]]; then
        echo "You can scroll through the upgrade messages with arrow keys. Get into scrollback mode first, with \"Ctrl-a ESC\"."
      else
        echo "You can scroll through the upgrade messages with arrow keys. Get into scrollback mode first, with \"Ctrl-b [\"."
      fi
    fi
  fi
}


__check_legacy() {
  local var
  local client

  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"

# Literal match intended
# shellcheck disable=SC2076
if [[ "${__value}" =~ "-allin1.yml" && ! "${__value}" =~ (grandine-allin1\.yml|grandine-plugin-allin1\.yml) ]]; then # Warn re Grandine once VC
    if [[ "${__value}" =~ "teku-allin1.yml" ]]; then
      client="Teku"
    elif [[ "${__value}" =~ "nimbus-allin1.yml" ]]; then
      client="Nimbus"
    elif [[ "${__value}" =~ (grandine-allin1\.yml|grandine-plugin-allin1\.yml) ]]; then
      client="Grandine"
    else
      client="Mystery"
    fi
    if ! (whiptail --title "All-In-One detected" --yesno "All-In-One client ${client} detected. Re-configuration requires re-import of the keys, which has to be treated like a move with 15 minutes downtime, to avoid slashing. Do you wish to continue, regardless?" 10 65 --defaultno) then
      echo "Aborting config"
      exit 0
    fi
  fi
}

config() {
  local lido_csm_url
  local cluster_lock_is_valid
  local obol_prom_remote_token

  # Create ENV file if needed
  if ! [[ -f "${__env_file}" ]]; then
    ${__as_owner} cp default.env "${__env_file}"
    __minty_fresh=1
  else
    __minty_fresh=0
  fi

  __during_config=1
  __final_msg=""

  __run_pre_update_script

  __check_legacy
  __query_network
  __query_deployment
  case "${__deployment}" in
    node|lido_csm)
      __query_consensus_client
      ;;
    lido_obol)
      __query_consensus_client
      ;;
    validator|rocket)
      __query_validator_client
      ;;
    ssv|lido_ssv)
      if [[ "${NETWORK}" = "hoodi" ]]; then
        sed -i'.original' 's/  Network: .*/  Network: hoodi/' ssv-config/config.yaml
      elif [[ "${NETWORK}" = "mainnet" ]]; then
        sed -i'.original' 's/  Network: .*/  Network: mainnet/' ssv-config/config.yaml
      else
        echo "${NETWORK} is not something that works with SSV."
        echo "Please choose Hoodi or Mainnet when running \"${__me} config\" again"
        echo "Aborting."
        exit 1
      fi
      rm ssv-config/config.yaml.original
      __query_ssv_client
      if [[ ! -f "./ssv-config/password.pass" ]]; then
        echo "Creating password file for encrypted SSV secret key"
        head -c 16 /dev/urandom | base64 | tr -d '[:space:]' >./ssv-config/password.pass
        ${__auto_sudo} chown 12000:12000 ./ssv-config/password.pass
        ${__auto_sudo} chmod 600 ./ssv-config/password.pass
      fi
      if [[ ! -f "./ssv-config/encrypted_private_key.json" ]]; then
        echo "Creating encrypted operator private key"
        case "${SSV_CLIENT}" in
          ssv.yml )
            __dodocker run --name ssv-node-key-generation -v "$(pwd)/ssv-config/password.pass":/password.pass \
              ssvlabs/ssv-node:latest /go/bin/ssvnode generate-operator-keys --password-file=/password.pass && \
            __dodocker cp ssv-node-key-generation:/encrypted_private_key.json ./ssv-config/encrypted_private_key.json && \
            __dodocker rm ssv-node-key-generation
            ;;
          anchor.yml )
            __dodocker run --name anchor-key-generation -v "$(pwd)/ssv-config/password.pass":/password.pass \
              sigp/anchor:latest keygen --password-file=/password.pass --encrypt && \
            __dodocker cp anchor-key-generation:/encrypted_private_key.json ./ssv-config/encrypted_private_key.json && \
            __dodocker rm anchor-key-generation
            ;;
          * )
            echo "Unknown SSV client \"${SSV_CLIENT}\". This is a bug."
            exit 70
            ;;
        esac
        ${__auto_sudo} chown 12000:12000 ./ssv-config/encrypted_private_key.json
      fi
      __query_dkg
      __query_consensus_only_client
      ;;
    rpc)
      __query_consensus_only_client
      ;;
    *)
      echo "Unknown deployment ${__deployment}, this is a bug."
      exit 70
      ;;
  esac

  MEV_BOOST=false
# I do mean to match literally
# shellcheck disable=SC2076
  if [[ ! "${__deployment}" =~ ^(validator|rocket)$  ]]; then
    if [[ "${CONSENSUS_CLIENT}" = "caplin.yml" ]]; then
      CL_NODE=http://execution:5052
      __query_execution_client
      if [[ ! "${__deployment}" =~ ^(ssv|lido_ssv|rpc)$  ]]; then
        __query_validator_client
      fi
    else
      CL_NODE="http://consensus:5052"
      __query_execution_client
    fi

    if [[ -n "${EXECUTION_CLIENT+x}" && "${NETWORK}" =~ (mainnet|sepolia) ]]; then
      if [[ "${__deployment}" = "rpc" ]]; then
        __query_4444 --defaultno
      else
        __query_4444 ""
      fi
    else  # On all other networks, disable
#shellcheck disable=SC2034
      EL_NODE_TYPE=full
    fi

    __query_checkpoint_sync
    __query_mev
    __query_mev_factor
    __query_grafana
    __query_coinbase
    if [[ "${__deployment}" = "node" || "${__deployment}" = "lido_csm" ]]; then
      __query_graffiti
    fi
    if [[ "${__deployment}" = "lido_csm" ]]; then
      if (whiptail --title "Keys generation" --yesno "Do you want to generate validator keys?" 10 60) then
        __query_lido_keys_generation
      else
        __lido_keys_attention_message
      fi
      if [[ "${NETWORK}" = "hoodi" ]]; then
        lido_csm_url="https://csm.testnet.fi/?ref=ethdocker"
      else
        lido_csm_url="https://csm.lido.fi/?ref=ethdocker"
      fi
      whiptail --title "Finish" --msgbox "Final steps!\n\n1. Run your node './ethd start'\n\n2. Wait until your node is fully synchronized\n\n4. Open ${lido_csm_url} to submit your keys with '.eth/validator_keys/deposit-data-*.json' file content\n\n5. Wait for keys validation\n\n6. Import your keys by './ethd keys import'" 19 85
    fi
  else
    unset EXECUTION_CLIENT
    unset GRAFANA_CLIENT

    __query_remote_beacon
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
    CL_NODE="${REMOTE_BEACON}"
    __query_mev
    __query_coinbase
    __query_graffiti
  fi

  __during_config=0

  if [[ "${__deployment}" = "lido_obol" ]]; then
    CL_NODE="http://charon:3600"
    case "${NETWORK}" in  # Lido Locator, and oracle allowlist for exits
      mainnet)
# We are using the variable
# shellcheck disable=SC2034
        VE_LOCATOR_ADDRESS="0xC1d0b3DE6792Bf6b4b37EccdcC24e45978Cfd2Eb"
# We are using the variable
# shellcheck disable=SC2034
        VE_ORACLE_ADDRESSES_ALLOWLIST='["0x73181107c8D9ED4ce0bbeF7A0b4ccf3320C41d12","0x285f8537e1dAeEdaf617e96C742F2Cf36d63CcfB","0x404335BcE530400a5814375E7Ec1FB55fAff3eA2","0x946D3b081ed19173dC83Cd974fC69e1e760B7d78","0x007DE4a5F7bc37E2F26c0cb2E8A95006EE9B89b5","0xc79F702202E3A6B0B6310B537E786B9ACAA19BAf","0x61c91ECd902EB56e314bB2D5c5C07785444Ea1c8","0xe57B3792aDCc5da47EF4fF588883F0ee0c9835C9","0x4118DAD7f348A4063bD15786c299De2f3B1333F3"]'
# We are using the variable
# shellcheck disable=SC2034
        VE_STAKING_MODULE_ID="2"
# We are using the variable
# shellcheck disable=SC2034
        LIDO_DV_EXIT_EXIT_EPOCH="194048" # capella
        ;;
      hoodi)
# We are using the variable
# shellcheck disable=SC2034
        VE_LOCATOR_ADDRESS="0xe2EF9536DAAAEBFf5b1c130957AB3E80056b06D8"
# We are using the variable
# shellcheck disable=SC2034
        VE_ORACLE_ADDRESSES_ALLOWLIST='["0xcA80ee7313A315879f326105134F938676Cfd7a9","0xf03B8DC8762B97F13Ac82e6F94bE3Ed002FF7459","0x1932f53B1457a5987791a40Ba91f71c5Efd5788F","0xf7aE520e99ed3C41180B5E12681d31Aa7302E4e5","0x99B2B75F490fFC9A29E4E1f5987BE8e30E690aDF","0x219743f1911d84B32599BdC2Df21fC8Dba6F81a2","0xD3b1e36A372Ca250eefF61f90E833Ca070559970","0x4c75FA734a39f3a21C57e583c1c29942F021C6B7","0x948A62cc0414979dc7aa9364BA5b96ECb29f8736","0xfe43A8B0b481Ae9fB1862d31826532047d2d538c","0x43C45C2455C49eed320F463fF4f1Ece3D2BF5aE2"]'
# We are using the variable
# shellcheck disable=SC2034
        VE_STAKING_MODULE_ID="2"
# We are using the variable
# shellcheck disable=SC2034
        LIDO_DV_EXIT_EXIT_EPOCH="256" # capella
        ;;
      *)
        ;;
    esac

    if [[ -f ./.eth/cluster-lock.json ]]; then
      if (whiptail --title "Lido Obol cluster exists" --yesno "Your cluster has already been created. Continue with it?" 10 60); then
# shellcheck disable=SC2086
        cluster_lock_is_valid=$(__docompose -f ./lido-obol.yml run --rm -v "$(pwd)"/.eth/cluster-lock.json:/cluster-lock.json:ro curl-jq sh -c \
          "cat /cluster-lock.json | jq -r 'all(.cluster_definition.validators[]; (.fee_recipient_address | ascii_downcase) == (\"'${FEE_RECIPIENT}'\" | ascii_downcase) and (.withdrawal_address | ascii_downcase) == (\"'$(__lido_withdrawal_credentials_address)'\" | ascii_downcase))'" | tail -n 1)
        if [[ "${cluster_lock_is_valid}" =~ "true" ]]; then
          echo "Your cluster lock is valid."
        else
          whiptail --title "Lido Obol cluster definition" --msgbox "Your cluster lock file './.eth/cluster-lock.json' is not valid.\n\nCheck that every validator has \`fee_recipient_address\` and \`withdrawal_address\` equal to Lido contracts and try again.\n\nLido fee recipient: '${FEE_RECIPIENT}'\nLido withdrawal credentials: '$(__lido_withdrawal_credentials_address)'" 14 90
          echo "Your cluster lock is NOT valid."
          exit 1
        fi
      elif (whiptail --title "Lido Obol cluster creation" --yesno "Backup a previously created cluster to create a new one?" 10 80); then
        ${__as_owner} cp -vr ./.eth "./.eth_backup_${EPOCHSECONDS}"
        ${__as_owner} rm -rf ./.eth
        __query_lido_obol_enr
        __query_lido_obol_cluster_definition
        __query_lido_obol_cluster_dkg
      else
        whiptail --title "Lido Obol cluster creation" --msgbox "The \`.eth\` folder must be empty or non-existent to continue" 10 80
        echo "The \`.eth\` folder must be empty to create a new cluster"
        exit 1
      fi
    else
      if [[ -f "./.eth/charon-enr-private-key" && -f "./.eth/charon-enr-public-key" ]]; then
        if (whiptail --title "Lido Obol operator ENR creation" --yesno "You already have ENR. Use it?" 8 50); then
          echo "Use existing ENR"
        else
          ${__as_owner} cp -vr ./.eth "./.eth_backup_${EPOCHSECONDS}"
          ${__as_owner} rm -rf ./.eth
          __query_lido_obol_enr
        fi
      else
        __query_lido_obol_enr
      fi

      if [[ -f ./.eth/cluster-definition.json ]]; then
        if (whiptail --title "Lido Obol cluster creation in process" --yesno "You already have cluster definition. Use it?" 10 60); then
# shellcheck disable=SC2086
          cluster_definition_is_valid=$(__docompose -f ./lido-obol.yml run --rm -v "$(pwd)"/.eth/cluster-definition.json:/cluster-definition.json:ro curl-jq sh -c \
            "cat /cluster-definition.json | jq -r 'all(.validators[]; (.fee_recipient_address | ascii_downcase) == (\"'${FEE_RECIPIENT}'\" | ascii_downcase) and (.withdrawal_address | ascii_downcase) == (\"'$(__lido_withdrawal_credentials_address)'\" | ascii_downcase))'" | tail -n 1)
          if [[ "${cluster_definition_is_valid}" = "true" ]]; then
            echo "Your cluster definition is valid."
          else
            whiptail --title "Lido Obol cluster creation" --msgbox "Your cluster definition is not valid.\n\nCheck that every validator has \`fee_recipient_address\` and \`withdrawal_address\` equal to Lido contracts and try again.\n\nLido fee recipient: '${FEE_RECIPIENT}'\nLido withdrawal credentials: '$(__lido_withdrawal_credentials_address)'" 14 90
            echo "Your cluster definition is NOT valid."
            exit 1
          fi
        else
          __query_lido_obol_cluster_definition
        fi
      else
        __query_lido_obol_cluster_definition
      fi
      __query_lido_obol_cluster_dkg
    fi

# We are using the variable
# shellcheck disable=SC2034
    VE_OPERATOR_ID=$(whiptail --title "Lido Operator ID" --inputbox "Put your Operator ID from Lido Operators dashboard \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
    obol_prom_remote_token=$(whiptail --title "Obol Prometheus" --inputbox "Put Obol Prometheus remote write token \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
    cat ./prometheus/obol-prom.yml.sample > ./prometheus/custom-prom.yml
    sed -i'.original' "s|      credentials: <PROM_REMOTE_WRITE_TOKEN>|      credentials: ${obol_prom_remote_token}|" ./prometheus/custom-prom.yml
    rm -f ./prometheus/custom-prom.yml.original
    OBOL_CHARON_REMOTE_LOKI_ADDRESSES=$(whiptail --title "Obol Loki" --inputbox "Put Obol Loki remote URL \
(right-click to paste)" 10 60 3>&1 1>&2 2>&3)
    if [[ -n "${OBOL_CHARON_REMOTE_LOKI_ADDRESSES}" ]]; then
      OBOL_CLUSTER_NAME=$(whiptail --title "Obol cluster name" --inputbox "Put your Obol cluster name \
(right-click to paste)" 10 60 "${__project_name}" 3>&1 1>&2 2>&3)
      OBOL_CLUSTER_PEER=$(whiptail --title "Obol cluster peer" --inputbox "Put your Obol cluster peer \
(right-click to paste)" 10 60 "eth-docker" 3>&1 1>&2 2>&3)
    else
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
      OBOL_CLUSTER_NAME=""
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
      OBOL_CLUSTER_PEER=""
      echo "Obol Loki remote URL is empty, skipping"
    fi
  fi

  if [[ -n "${CONSENSUS_CLIENT+x}" ]]; then
    COMPOSE_FILE="${CONSENSUS_CLIENT}"
    if [[ -n "${VALIDATOR_CLIENT+x}" ]]; then
      COMPOSE_FILE="${COMPOSE_FILE}:${VALIDATOR_CLIENT}"
    fi
  elif [[ -n "${VALIDATOR_CLIENT+x}" ]]; then
    COMPOSE_FILE="${VALIDATOR_CLIENT}"
  else
    echo "No consensus client or validator client selected. This is a bug. Aborting"
    exit 70
  fi
  if [[ -n "${EXECUTION_CLIENT+x}" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:${EXECUTION_CLIENT}"
  fi
  if [[ "${__deployment}" = "ssv" || "${__deployment}" = "lido_ssv" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:${SSV_CLIENT}"
    if [[ -n "${__ssv_operator_id}" && ! "${__ssv_operator_id}" = "-1" ]]; then
      COMPOSE_FILE="${COMPOSE_FILE}:ssv-dkg.yml"
    fi
  fi
  if [[ -n "${GRAFANA_CLIENT+x}" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:${GRAFANA_CLIENT}"
  fi
  if [[ "${MEV_BOOST}" = "true" && ! "${__deployment}" = "rocket" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:mev-boost.yml"
  fi
  if [[ "${__deployment}" = "lido_obol" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:lido-obol.yml"
    if [[ -n "${OBOL_CHARON_REMOTE_LOKI_ADDRESSES}" ]]; then
      COMPOSE_FILE="${COMPOSE_FILE}:lido-obol-promtail.yml"
    fi
  fi
  if [[ ("${__deployment}" = "node" || "${__deployment}" = "rocket") \
       && "${NETWORK}" = "hoodi" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:deposit-cli.yml"
  fi
  if [[ "${__deployment}" = "lido_csm" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:deposit-cli.yml"
  fi
# Not multi-arch, this would break on ARM64

#    COMPOSE_FILE="${COMPOSE_FILE}:ethdo.yml"
  if [[ "${__deployment}" = "rocket" ]]; then
    COMPOSE_FILE="${COMPOSE_FILE}:ext-network.yml"
# This gets used, but shellcheck doesn't recognize that
# shellcheck disable=SC2034
    DOCKER_EXT_NETWORK="rocketpool_net"
    __final_msg+="\nYou are connected to the \"rocketpool_net\" Docker bridge network"
  fi

  echo "Your COMPOSE_FILE is:" "${COMPOSE_FILE}"
  __final_msg+="\nYou are using these service files: ${COMPOSE_FILE}"

  var=FEE_RECIPIENT
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=GRAFFITI
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=DEFAULT_GRAFFITI
  __update_value_in_env "${var}" "${!var:-"true"}" "${__env_file}"
  var=CL_NODE
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=CHECKPOINT_SYNC_URL
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=COMPOSE_FILE
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=EL_NODE
  __update_value_in_env "${var}" "${!var:-"http://execution:8551"}" "${__env_file}"
  var=JWT_SECRET
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=NETWORK
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  if [[ ${NETWORK} =~ ^https?:// ]]; then  # The aliases need to not use ${NETWORK}
    var=W3S_ALIAS
    __update_value_in_env "${var}" "custom-web3signer" "${__env_file}"
    var=PG_ALIAS
    __update_value_in_env "${var}" "custom-postgres" "${__env_file}"
    var=CL_ALIAS
    __update_value_in_env "${var}" "custom-consensus" "${__env_file}"
    var=EL_ALIAS
    __update_value_in_env "${var}" "custom-execution" "${__env_file}"
    var=MEV_ALIAS
    __update_value_in_env "${var}" "custom-mev" "${__env_file}"
  fi
  var=MEV_BOOST
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=MEV_BUILD_FACTOR
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=MAX_BLOBS
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=MEV_RELAYS
  __update_value_in_env "${var}" "${!var-}" "${__env_file}"
  var=EL_NODE_TYPE
  __update_value_in_env "${var}" "${!var-false}" "${__env_file}"
  var=DOCKER_EXT_NETWORK
  __update_value_in_env "${var}" "${!var:-"rocketpool_net"}" "${__env_file}"
  if [[ "${__deployment}" = "lido_obol" ]]; then
    var=LIDO_DV_EXIT_EXIT_EPOCH
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
    var=VE_OPERATOR_ID
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
    var=VE_LOCATOR_ADDRESS
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
    var=VE_ORACLE_ADDRESSES_ALLOWLIST
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
    var=VE_STAKING_MODULE_ID
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
    var=OBOL_CHARON_REMOTE_LOKI_ADDRESSES
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
    var=OBOL_CLUSTER_NAME
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
    var=OBOL_CLUSTER_PEER
    __update_value_in_env "${var}" "${!var-}" "${__env_file}"
# We are using the variable
# shellcheck disable=SC2034
    ENABLE_DIST_ATTESTATION_AGGR="true"
    var=ENABLE_DIST_ATTESTATION_AGGR
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
  fi
  if [[ "${NETWORK}" = "gnosis" && "${CONSENSUS_CLIENT}" =~ "nimbus" ]] ; then
# We are using the variable
# shellcheck disable=SC2034
    NIM_DOCKERFILE=Dockerfile.sourcegnosis
    var=NIM_DOCKERFILE
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
  fi
  if uname -m | grep -q riscv64; then
# We are using the variable
# shellcheck disable=SC2034
    NIM_DOCKERFILE=Dockerfile.source
    var=NIM_DOCKERFILE
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
# We are using the variable
# shellcheck disable=SC2034
    GETH_DOCKERFILE=Dockerfile.source
    var=GETH_DOCKERFILE
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
  fi
  var="SIREN_PASSWORD"
  __get_value_from_env "${var}" "${__env_file}" "SIREN_PASSWORD"
  if [[ -z "${SIREN_PASSWORD}" ]]; then
    SIREN_PASSWORD=$(head -c 8 /dev/urandom | od -A n -t u8 | tr -d '[:space:]' | sha256sum | head -c 32)
    __update_value_in_env "${var}" "${!var}" "${__env_file}"
  fi

  __enable_v6

  __pull_and_build
  __nag_os_version

  echo -e "${__final_msg-}"
  echo
  echo "Your configuration file is: $(dirname "$(realpath "${BASH_SOURCE[0]}")")/${__env_file}"
  echo "You can change advanced config items with \"nano .env\" when in the $(dirname "$(realpath "${BASH_SOURCE[0]}")") directory."
  echo

  __run_post_update_script
}


version() {
  local var

  grep "^This is" README.md
  echo
  var="COMPOSE_FILE"
  __get_value_from_env "${var}" "${__env_file}" "__value"

  # CL versions
  case "${__value}" in
    *lighthouse.yml*|*lighthouse-cl-only*)
      __docompose exec consensus lighthouse --version
      echo
      ;;
    *lodestar.yml*|*lodestar-cl-only*)
      __docompose exec consensus node /usr/app/packages/cli/bin/lodestar --version
      echo
      ;;
    *prysm.yml*)
      __docompose exec consensus beacon-chain --version
      echo
      __docompose exec validator validator --version
      echo
      ;;
    *prysm-cl-only*)
      __docompose exec consensus beacon-chain --version
      echo
      ;;
    *nimbus.yml*|*nimbus-allin1.yml*|*nimbus-cl-only*)
      __docompose exec consensus nimbus_beacon_node --version
      echo
      ;;
    *teku.yml*|*teku-allin1.yml*|*teku-cl-only*)
      __docompose exec consensus /opt/teku/bin/teku --version
      echo
      ;;
    *grandine.yml*|*grandine-allin1.yml*|*grandine-cl-only*)
      __docompose exec consensus grandine --version
      echo
      ;;
  esac

  # EL versions
  case "${__value}" in
    *geth.yml*)
      __docompose exec execution geth version
      echo
      ;;
    *reth.yml*)
      __docompose exec execution reth --version
      echo
      ;;
    *besu.yml*)
      __docompose exec execution /opt/besu/bin/besu --version
      echo
      ;;
    *nethermind.yml*)
      echo "Nethermind version"
      __docompose exec execution /nethermind/nethermind --version
      echo
      ;;
    *erigon.yml*)
      __docompose exec execution erigon --version
      echo
      ;;
    *nimbus-el.yml*)
      __docompose exec execution nimbus_execution_client --version
      echo
      ;;
    *ethrex.yml*)
      __docompose exec execution ethrex --version
      echo
      ;;
  esac

  # VC versions
  case "${__value}" in
    *lighthouse-vc-only*)
      __docompose exec validator lighthouse --version
      echo
      ;;
    *lodestar-vc-only*)
      __docompose exec validator node /usr/app/packages/cli/bin/lodestar --version
      echo
      ;;
    *prysm-vc-only*)
      __docompose exec validator validator --version
      echo
      ;;
    *nimbus-vc-only*)
      __docompose exec validator nimbus_validator_client --version
      echo
      ;;
    *teku-vc-only*)
      __docompose exec validator /opt/teku/bin/teku --version
      echo
      ;;
    *grandine-vc-only*)
      __docompose exec validator grandine --version
      echo
      ;;
    *vero-vc-only*)
      __docompose exec validator python main.py --version
      echo
      ;;
  esac

  # DVT versions
  case "${__value}" in
    *lido-obol.yml*)
      __docompose exec charon charon version
      echo
      ;;
    *ssv.yml*)
      __docompose exec ssv-node /go/bin/ssvnode --version
      echo
      ;;
    *anchor.yml*)
      __docompose exec anchor anchor node --version
      echo
      ;;
  esac

  # Web3signer version
  case "${__value}" in
    *web3signer.yml*)
      __docompose exec web3signer /opt/web3signer/bin/web3signer --version
      echo
      __docompose exec postgres pg_config --version
      echo
      ;;
  esac

  # PBS versions
  case "${__value}" in
    *mev-boost.yml*)
      __docompose exec mev-boost /app/mev-boost -version
      echo
      ;;
    *commit-boost-pbs.yml*)
      __docompose exec cb-pbs commit-boost-pbs --version
      echo
      ;;
  esac

  # RPC proxy version
  case "${__value}" in
    *nimbus-vp.yml*)
      __docompose exec rpc-proxy nimbus_verified_proxy --version
      echo
      ;;
  esac

  # Grafana version
  case "${__value}" in
    *grafana.yml*)
      __docompose exec prometheus /bin/prometheus --version
      echo
      echo -n "Grafana "
      __docompose exec grafana /run.sh -v
      echo
      ;;
  esac

  # Traefik version
  case "${__value}" in
    *traefik-*.yml*)
      echo "Traefik"
      __docompose exec traefik traefik version
      echo
      ;;
  esac

  # Contributoor version
  case "${__value}" in
    *contributoor.yml*)
      echo -n "Contributoor "
      __docompose exec contributoor sentry --release
      echo
      ;;
  esac
}


__update_help() {
  echo "usage: ${__me} update [--refresh-targets] [--non-interactive]"
  echo
  echo "Updates ${__project_name} itself, as required the contents of \".env\", and the clients."
  echo
  echo "A combination of \"git pull\" for ${__project_name}, some bash scripting to bring new variables from \"default.env\","
  echo "and \"docker compose pull\" as well as \"docker compose build\" for the clients."
  echo
  echo "If warranted, will also offer resync when clients require it, or upgrade of PostgreSQL version."
  echo
  echo "\"--refresh-targets\" sets Docker tags, source targets, and repos of clients back to the defaults in \"default.env\"."
  echo "\"--non-interactive\" does not ask questions and assumes Yes for database resyncs and migrations."
  echo
}


__full_help() {
  echo "usage: ${__me} [-h|--help] <command>"
  echo
  echo "commands:"
  echo "  install"
  echo "    attempts to install Docker and Docker Compose for you"
  echo "  config"
  echo "    configures ${__project_name} with your choice of Ethereum clients"
  echo "  keys ACTION [--non-interactive] [--debug]"
  echo "    list, count, delete, import keys; their fee recipients; and gas fees"
  echo "    Run without ACTION to get help text"
  echo "  update [--refresh-targets] [--non-interactive] [--debug] [--trace]"
  echo "    updates all client versions and ${__project_name} itself"
  echo "    --refresh-targets will reset your custom build targets in ${__env_file} to defaults"
  echo "  up|start [service-name]"
  echo "    starts the Ethereum node, or restarts containers that had their image or"
  echo "    configuration changed. Can also start a specific service by name"
  echo "  down|stop [service-name]"
  echo "    stops the Ethereum node, or a specific service by name"
  echo "  restart [service-name]"
  echo "    restarts the Ethereum node, or a specific service by name, a combination of down and up"
  echo "  version"
  echo "    prints the version(s) of currently running client(s)"
  echo "  logs"
  echo "    shows logs"
  echo "  cmd <compose-command>"
  echo "    executes an arbitrary Docker Compose command. Use \"cmd help\" to list them"
  echo "  terminate"
  echo "    stops the Ethereum node and destroys all data stores"
  echo "  prune-nethermind [--non-interactive]"
  echo "    restarts the Nethermind execution client and prunes its DB."
  echo "  prune-besu [--non-interactive]"
  echo "    stops the Besu execution client and prunes trie-logs."
  echo "  prune-reth [--non-interactive]"
  echo "    stops the Reth execution client and prunes its DB."
  echo "  prune-history [--non-interactive] [--pre-merge|--pre-cancun|--rolling|--aggressive]"
  echo "    stops the execution client and configures history expiry."
  echo "  prune-lighthouse [--non-interactive]"
  echo "    stops the Lighthouse consensus client and prunes state."
  echo "  repair-reth"
  echo "    stops the Reth execution client and repairs its database."
  echo "  resync-execution"
  echo "    removes the execution layer database and forces a resync."
  echo "  resync-consensus"
  echo "    removes the consensus layer database and forces a resync."
  echo "  space"
  echo "    show Docker volume space usage"
  echo "  attach-geth"
  echo "    launches an interactive geth attach repl"
  echo "  help"
  echo "    print this help screen"
  echo
  echo "  Instead of \"--non-interactive\" you may also use the \"ETHD_FRONTEND=noninteractive\" environment variable"
  echo
  echo "The logs command can be appended by flags and specify the container(s). Example: "
  echo
  echo "  ${__me} logs -f --tail 50 execution"
  echo "    shows logs only for execution service"
  echo
  echo "✍️ Give feedback and report issues on GitHub:"
  echo "  * https://github.com/ethstaker/eth-docker"
  echo "🤗 Get support on Discord:"
  echo "  * http://discord.gg/ethstaker"
}


help() {
  case $* in
    *update*) __update_help;;
    *) __full_help;;
  esac
}


# Main body from here
__me=$(basename "${BASH_SOURCE[0]}")
if [[ ! -f ~/.profile ]] || ! grep -q "alias ethd" ~/.profile; then
  __me="./${__me}"
fi

trap '__handle_error $? $LINENO' ERR
trap '__handle_error $? $LINENO' EXIT

if [[ "$#" -eq 0 || "$*" = "--help" || "$*" = "-h" || "$*" = "update --help" || "$*" = "update -h" ]]; then
  help "$@"
  exit 0
fi

cd "$(dirname "$(realpath "${BASH_SOURCE[0]}")")"
# Use this to make sure root doesn't end up owning files
# shellcheck disable=SC2012
__owner=$(ls -ld . | awk '{print $3}')
__owner_group=$(id -gn "${__owner}")

if [[ "${__owner}" = "root" ]]; then
  echo "Please install ${__project_name} as a non-root user."
  exit 0
fi

__command="$1"
shift
__params=$*

__handle_root
__determine_distro
__prep_conffiles

__check_for_snap

# Don't check for Docker before it's installed
if [[ "${__command}" = "install" ]]; then
  ${__command} "$@"
  exit "$?"
fi

__handle_docker
__check_compose_version

if [[ "${__old_compose}" -eq 1 && "${__compose_major}" -eq 1 ]]; then
  exit 0
fi

if [[ "${__old_docker}" -eq 1 ]]; then
  echo
  echo "Docker version ${__docker_version} detected. This version is no longer supported."
  echo "Please update to a current version. Supported versions can be seen at https://endoflife.date/docker-engine."
  if [[ "$__distro" = *"debian"* ]]; then
    echo
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      if [[ "${__os_major_version}" -lt 13 ]]; then
        echo "Debian ${__os_major_version}'s docker.io is old. Please replace docker.io with docker-ce"
        echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
        echo "Alternatively, upgrade to Debian 13 or later."
      else
        echo "Debian ${__os_major_version} ships with a newer docker.io."
        echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
        echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
      fi
    else
      echo "This should be as simple as \"sudo apt update && sudo apt dist-upgrade\""
    fi
  elif [[ "${__distro}" = "ubuntu" ]]; then
    echo
    if dpkg-query -W -f='${Status}' docker.io 2>/dev/null | grep -q "ok installed"; then
      if [[ "$__os_major_version" -lt 25 ]]; then
        echo "Ubuntu ${__os_major_version}.${__os_minor_version}'s docker.io is old. Please replace docker.io with docker-ce"
        echo "See https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce"
        echo "Alternatively, upgrade to Ubuntu 26.04 or later."
      else
        echo "Ubuntu ${__os_major_version}.${__os_minor_version} ships with a newer docker.io."
        echo "This is very unexpected, and ${__project_name} is not sure what to recommend."
        echo "Please come to ethstaker Discord: http://discord.gg/ethstaker"
      fi
    else
      echo "This should be as simple as \"sudo apt update && sudo apt dist-upgrade\""
    fi
  else
    echo
    echo "${__project_name} doesn't know what to recommend on ${__distro}, to effect a Docker upgrade."
  fi
  exit 0
fi

if ! type -P whiptail >/dev/null 2>&1; then
  echo "Please install the package whiptail or newt before running ${__project_name}."
  exit 0
fi

if ! __dodocker images >/dev/null 2>&1; then
  echo "Please ensure you can call ${__docker_exe} before running ${__project_name}."
  exit 0
fi

if ! __docompose --help >/dev/null 2>&1; then
  echo "Please ensure you can call ${__compose_exe} before running ${__project_name}."
  exit 0
fi

case "${__command}" in
  help|config|keys|update|up|start|down|stop|restart|version|logs|cmd|terminate|prune-nethermind\
|prune-besu|prune-reth|prune-history|prune-lighthouse|resync-execution|resync-consensus|attach-geth\
|repair-reth|keyimport|space)
    ${__command} "$@";;
  *)
    echo "Unrecognized command ${__command}"
    help
    ;;
esac

__check_disk_space

if [[ "${__compose_upgraded}" -eq 1 ]]; then
  echo
  echo "You updated Docker Compose to V2."
  echo "The \"docker-compose\" command is gone and replaced with \"docker compose\"."
  echo
  echo "Optionally, you can switch to docker-ce."
  echo "Please see https://ethdocker.com/Usage/Prerequisites#switching-from-dockerio-to-docker-ce for instructions."
fi

if [[ "${__old_compose}" -eq 1 && "${__compose_major}" -eq 2 ]]; then
  echo "You are using Docker Compose ${__compose_version}, which has been shown to cause issues with new features"
  echo "${__project_name} may require Compose v2.18.1 or later in future"
  echo
  echo "It is recommended that you update Compose."
  if [[ "${__distro}" =~ (debian|ubuntu) ]]; then
    echo "Please do so by running: \"sudo apt update && sudo apt dist-upgrade\""
  fi
fi