## Server Setup ```sh ssh-keygen -t ed25519 -C "null" -f ~/.ssh/id_gitlab_home cat .ssh/id_gitlab_home.pub sudo apt install docker sudo apt install docker-compose sudo apt install nfs-kernel-server sudo apt install nfs-common sudo apt install nfs-utils sudo apt install nmap sudo apt install sshfs sudo apt install libnfs-utils sudo apt install fail2ban sudo apt install ncdu sudo apt install ddclient sudo systemctl start fail2ban.service sudo systemctl enable fail2ban.service docker network create traefik docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data sudo usermod -aG docker $USER ``` ## Add Key To config ```sh nano .ssh/config Host gitlab.com IdentityFile ~/.ssh/id_gitlab_home ``` ## PROJECTS ```sh git clone git@gitlab.com:null4bl3/home_server.git git clone git@gitlab.com:null4bl3/server-scripts.git git clone git@gitlab.com:null4bl3/bitbot_ai.git git clone git@gitlab.com:null4bl3/madplan_simple.git git clone git@gitlab.com:null4bl3/tinkersynth.git ``` ## UFW ```sh sudo ufw allow 80 sudo ufw allow 443 sudo ufw allow 22 sudo ufw allow 8096 sudo ufw allow 8097 sudo ufw allow 8384 sudo ufw allow 3040 sudo ufw allow 51820 sudo ufw allow 51821 sudo ufw allow 21027 sudo ufw allow 32400 sudo ufw allow 2222 sudo ufw allow 8888 sudo ufw allow 4444 sudo ufw allow 22000 sudo ufw allow 21027 ``` ## FSTAB ```sh 192.168.1.110:/i-data/b695a7f6/nfs/media /home/null/shares/disk1 nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0 ``` ## SSH ```sh sudo nano /etc/ssh/sshd_config Port 8888 ``` ## Directories in /srv ```bash ➜ /srv ls -la total 64 drwxr-xr-x 16 null null 4096 Jul 15 06:23 . drwxr-xr-x 26 root root 4096 Jun 24 06:11 .. drwxr-xr-x 4 root root 4096 Dec 22 2020 convos drwxrwxr-x 2 null null 4096 Jul 15 06:23 file_browser drwxr-xr-x 5 root root 4096 Aug 8 2020 gitlab drwxrwxr-x 3 root root 4096 Aug 7 2020 gitlab-runner drwxrwxr-x 2 999 root 4096 Jun 10 11:33 hastebin drwxrwxr-x 4 root root 4096 Aug 7 2020 jackett drwxr-xr-x 3 root root 4096 Jan 7 2021 jellyfin drwxrwxr-x 4 root root 4096 Aug 7 2020 mongodata drwxr-xr-x 8 root root 4096 Aug 9 2020 nextcloud drwxrwxr-x 4 root root 4096 Aug 7 2020 sonarr drwx------ 4 null null 4096 May 8 19:30 syncthing drwxrwxr-x 3 null null 4096 Oct 1 2020 traefik drwxrwxr-x 3 null null 4096 Jan 28 12:25 xbs drwxrwxr-x 5 null null 4096 Aug 7 2020 znc ``` Create the `traefik` network ```sh docker network create traefik ``` ## Docker Swarm ```sh docker swarm init ``` ## Mount NFS NAS Share We need the `nfs-utils` package installed. ```sh sudo mount -t nfs -o nfsvers=4 192.168.1.110:/media /WHERE/TO/MOUNT sudo mount -t nfs -v 192.168.1.110:/media /home/knast/shares/disk1 ``` if mounting on host, add to `fstab` ```sh 192.168.1.110:/media /home/null/shares/disk1 nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0 ``` Or create a docker volume for the nfs mount that can then be accessed in compose file: ```sh docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data ``` The volume can then be mounted in the compose file in the following way: ```yml version: "3" services: web-server: image: nginx:latest ports: - 1212:80 volumes: - nfs_data:/usr/share/nginx/html volumes: nfs_data: external: true networks: traefik: external: true ``` ### Firewall ```sh sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/tcp sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/udp ``` ## Fstab using the `blkid` command to mount an external drive in fstab to use for restic backups ```sh # /etc/fstab: static file system information. UUID=6fb3bc60-e984-43ce-a688-151b49f558e0 /home/null/shares/disk2 auto defaults,nofail,x-systemd.automount 0 2 ``` # Gitlab After adding the domain name to the docker-compose.yml and the gitlab configuration: ```yaml hostname: 'gitlab.knast.cc' environment: GITLAB_OMNIBUS_CONFIG: | external_url 'https://gitlab.knast.cc' ``` We also need to please the dark lords of reverse proxying by adding the following lines to the gitlab.rb configuration: ```bash nginx['listen_port'] = 80 nginx['listen_https'] = false ``` ## Nextcloud edit the nextcloud config.php to use the https protocol ```sh nano /srv/nextcloud/config/config.php ``` We also use traefik and docker. I have added the following traefik label in our docker-compose.yml: ```yml - "traefik.http.middlewares.nc-header.headers.customRequestHeaders.X-Forwarded-Proto=https" ``` ```sh And in the config.php, I’ve also added some values regarding reverse proxies: 'forwarded_for_headers' => array ( 1 => 'HTTP_X_FORWARDED', 2 => 'HTTP_FORWARDED_FOR', 3 => 'HTTP_FORWARDED', 0 => 'HTTP_X_FORWARDED_FOR', ), 'trusted_proxies' => array ( 0 => '10.0.0.0/8', ), ``` #### Connecting a container directly to an NFS mount ```yml version: "3" services: web-server: image: nginx:latest ports: - 80:80 volumes: - type: volume source: nfs-volume target: /nfs volume: nocopy: true volumes: nfs-volume: driver_opts: type: "nfs" o: "addr=192.168.1.110,nolock,soft,rw" device: ":/var/data" ``` NOTE: Just switch to syncthing ```sh * * * * * /usr/bin/flock -n /tmp/classics.lockfile /home/$USER/home_server/scripts/sync_classics.sh * * * * * /usr/bin/flock -n /tmp/flims.lockfile /home/$USER/home_server/scripts/sync_flims.sh * * * * * /usr/bin/flock -n /tmp/tv.lockfile /home/$USER/home_server/scripts/sync_tv.sh ``` ```sh #!/bin/bash echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log /usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/movies/_movies' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_movies' '/home/null/shares/disk2/media/movies/_movies' >> /home/null/logs/film_cron.log echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log ``` ```sh #SYNC TV FROM UNITY TO DISK 2 # CRON JOB * * * * * /usr/bin/flock -n /tmp/fcj.lockfile /home/null/scrpts/tv_sync.sh ``` ```sh @reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log #@reboot /usr/bin/mount -t nfs 192.168.1.110:/media /home/knast/shares/disk1 0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log */5 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/film/* > /home/knast/logs/film_chmod.log */15 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/classics/* > /home/knast/logs/classic_chmod.log */25 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/tv/* > /home/knast/logs/tv_chmod.log ``` ```sh #!/bin/bash echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log /usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/tv' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_tv' '/home/null/shares/disk2/media/tv' >> /home/null/logs/tv_cron.log echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log ``` ### Dynamic IP for namecheap domains in config file `/etc/ddclient.conf` ```conf use=web, web=dynamicdns.park-your-domain.com/getip protocol=namecheap server=dynamicdns.park-your-domain.com login=knast.cc password= @ ``` ```sh # Configuration file for ddclient generated by debconf # # /etc/ddclient.conf protocol=namecheap \ use=web, web=https://api.ipify.org/ \ login=kattemonster \ password='686559cf45c34d82820f0851a2cb6f0d' \ protocol=namecheap \ use=web, web=https://api.ipify.org/ \ login=kattemonster \ password='8ba0d60246904f93ab77d4c80c79f8c0' \ protocol=namecheap \ use=web, web=https://api.ipify.org/ \ login=kattemonster \ password='e347224ae801444dae7e48b4f4e40556' \ ``` and in the root crontab: ```sh @reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log 0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log ```