## Server Setup

```sh
ssh-keygen -t ed25519 -C "null" -f ~/.ssh/id_gitlab_home

cat .ssh/id_gitlab_home.pub

sudo apt install docker
sudo apt install docker-compose
sudo apt install nfs-kernel-server
sudo apt install nfs-common
sudo apt install nfs-utils
sudo apt install nmap
sudo apt install sshfs
sudo apt install libnfs-utils
sudo apt install fail2ban
sudo apt install ncdu
sudo apt install ddclient


sudo systemctl start fail2ban.service
sudo systemctl enable fail2ban.service
docker network create traefik

docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data
sudo usermod -aG docker $USER
```

## Add Key To config

```sh
nano .ssh/config

Host gitlab.com
  IdentityFile ~/.ssh/id_gitlab_home

```

## PROJECTS

```sh
git clone git@gitlab.com:null4bl3/home_server.git
git clone git@gitlab.com:null4bl3/server-scripts.git
git clone git@gitlab.com:null4bl3/bitbot_ai.git
git clone git@gitlab.com:null4bl3/madplan_simple.git
git clone git@gitlab.com:null4bl3/tinkersynth.git

```

## UFW

```sh
sudo ufw allow 80
sudo ufw allow 443
sudo ufw allow 22
sudo ufw allow 8096
sudo ufw allow 8097
sudo ufw allow 8384
sudo ufw allow 3040
sudo ufw allow 51820
sudo ufw allow 51821
sudo ufw allow 21027
sudo ufw allow 32400
sudo ufw allow 2222
sudo ufw allow 8888
sudo ufw allow 4444
sudo ufw allow 22000
sudo ufw allow 21027
```

## FSTAB

```sh
192.168.1.110:/i-data/b695a7f6/nfs/media       /home/null/shares/disk1    nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0
```


## SSH

```sh
sudo nano /etc/ssh/sshd_config

Port 8888



```

## Directories in /srv

```bash
➜  /srv ls -la            
total 64
drwxr-xr-x 16 null null 4096 Jul 15 06:23 .
drwxr-xr-x 26 root root 4096 Jun 24 06:11 ..
drwxr-xr-x  4 root root 4096 Dec 22  2020 convos
drwxrwxr-x  2 null null 4096 Jul 15 06:23 file_browser
drwxr-xr-x  5 root root 4096 Aug  8  2020 gitlab
drwxrwxr-x  3 root root 4096 Aug  7  2020 gitlab-runner
drwxrwxr-x  2  999 root 4096 Jun 10 11:33 hastebin
drwxrwxr-x  4 root root 4096 Aug  7  2020 jackett
drwxr-xr-x  3 root root 4096 Jan  7  2021 jellyfin
drwxrwxr-x  4 root root 4096 Aug  7  2020 mongodata
drwxr-xr-x  8 root root 4096 Aug  9  2020 nextcloud
drwxrwxr-x  4 root root 4096 Aug  7  2020 sonarr
drwx------  4 null null 4096 May  8 19:30 syncthing
drwxrwxr-x  3 null null 4096 Oct  1  2020 traefik
drwxrwxr-x  3 null null 4096 Jan 28 12:25 xbs
drwxrwxr-x  5 null null 4096 Aug  7  2020 znc
```

Create the `traefik` network

```sh
docker network create traefik
```


## Docker Swarm

```sh
docker swarm init
```

## Mount NFS NAS Share

We need the `nfs-utils` package installed.

```sh
sudo mount -t nfs -o nfsvers=4 192.168.1.110:/media /WHERE/TO/MOUNT
sudo mount -t nfs -v 192.168.1.110:/media /home/knast/shares/disk1
```

if mounting on host, add to `fstab`

```sh
192.168.1.110:/media       /home/null/shares/disk1    nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0
```

Or create a docker volume for the nfs mount that can then be accessed in compose file:

```sh
docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data
```

The volume can then be mounted in the compose file in the following way:

```yml
version: "3" 
services: 
  web-server: 
    image: nginx:latest 
    ports: 
      - 1212:80 
    volumes:
      - nfs_data:/usr/share/nginx/html

volumes:
  nfs_data:
    external: true

networks:
  traefik:
    external: true

```


### Firewall

```sh
sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/tcp
sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/udp
```

## Fstab 

using the `blkid` command to mount an external drive in fstab to use for restic backups

```sh
# /etc/fstab: static file system information.

UUID=6fb3bc60-e984-43ce-a688-151b49f558e0 /home/null/shares/disk2 auto defaults,nofail,x-systemd.automount 0 2
```



# Gitlab

After adding the domain name to the docker-compose.yml and the gitlab configuration:

```yaml
        hostname: 'gitlab.knast.cc'
        environment:
            GITLAB_OMNIBUS_CONFIG: |
              external_url 'https://gitlab.knast.cc'
```
We also need to please the dark lords of reverse proxying by adding the following lines to the gitlab.rb configuration:

```bash
nginx['listen_port'] = 80
nginx['listen_https'] = false
```



## Nextcloud

edit the nextcloud config.php to use the https protocol

```sh
nano /srv/nextcloud/config/config.php
```


We also use traefik and docker. I have added the following traefik label in our docker-compose.yml:

```yml
- "traefik.http.middlewares.nc-header.headers.customRequestHeaders.X-Forwarded-Proto=https" 
```

```sh
And in the config.php, I’ve also added some values regarding reverse proxies:

  'forwarded_for_headers' => 
  array (
    1 => 'HTTP_X_FORWARDED',
    2 => 'HTTP_FORWARDED_FOR',
    3 => 'HTTP_FORWARDED',
    0 => 'HTTP_X_FORWARDED_FOR',
  ),
  'trusted_proxies' => 
  array (
    0 => '10.0.0.0/8',
  ),

```

#### Connecting a container directly to an NFS mount

```yml
version: "3" 
services: 
web-server: 
   image: nginx:latest 
   ports: 
      - 80:80 
   volumes: 
      - type: volume 
      source: nfs-volume 
      target: /nfs 
      volume: 
      nocopy: true 
volumes: 
   nfs-volume: 
   driver_opts: 
   type: "nfs" 
   o: "addr=192.168.1.110,nolock,soft,rw" 
   device: ":/var/data"
```



NOTE: Just switch to syncthing

```sh
* * * * * /usr/bin/flock -n /tmp/classics.lockfile /home/$USER/home_server/scripts/sync_classics.sh
* * * * * /usr/bin/flock -n /tmp/flims.lockfile /home/$USER/home_server/scripts/sync_flims.sh
* * * * * /usr/bin/flock -n /tmp/tv.lockfile /home/$USER/home_server/scripts/sync_tv.sh
```


```sh
#!/bin/bash
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/movies/_movies' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_movies' '/home/null/shares/disk2/media/movies/_movies' >> /home/null/logs/film_cron.log
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log
```

```sh
#SYNC TV FROM UNITY TO DISK 2
# CRON JOB
* * * * * /usr/bin/flock -n /tmp/fcj.lockfile /home/null/scrpts/tv_sync.sh
```


```sh
@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log

#@reboot /usr/bin/mount -t nfs 192.168.1.110:/media /home/knast/shares/disk1

0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log

*/5 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/film/* > /home/knast/logs/film_chmod.log

*/15 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/classics/* > /home/knast/logs/classic_chmod.log

*/25 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/tv/* > /home/knast/logs/tv_chmod.log

```

```sh
#!/bin/bash
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/tv' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_tv' '/home/null/shares/disk2/media/tv' >> /home/null/logs/tv_cron.log
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log

```

### Dynamic IP for namecheap domains

in config file `/etc/ddclient.conf`

```conf
use=web, web=dynamicdns.park-your-domain.com/getip
protocol=namecheap
server=dynamicdns.park-your-domain.com
login=knast.cc
password=<NAMECHEAP_GENERATED_TOKEN>
@
```

```sh
# Configuration file for ddclient generated by debconf
#
# /etc/ddclient.conf

protocol=namecheap \
use=web, web=https://api.ipify.org/ \
login=kattemonster \
password='686559cf45c34d82820f0851a2cb6f0d' \

protocol=namecheap \
use=web, web=https://api.ipify.org/ \
login=kattemonster \
password='8ba0d60246904f93ab77d4c80c79f8c0' \

protocol=namecheap \
use=web, web=https://api.ipify.org/ \
login=kattemonster \
password='e347224ae801444dae7e48b4f4e40556' \




```


and in the root crontab:

```sh
@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log

0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log
```
