Directories in /srv

➜  /srv ls -la            
total 64
drwxr-xr-x 16 null null 4096 Jul 15 06:23 .
drwxr-xr-x 26 root root 4096 Jun 24 06:11 ..
drwxr-xr-x  4 root root 4096 Dec 22  2020 convos
drwxrwxr-x  2 null null 4096 Jul 15 06:23 file_browser
drwxr-xr-x  5 root root 4096 Aug  8  2020 gitlab
drwxrwxr-x  3 root root 4096 Aug  7  2020 gitlab-runner
drwxrwxr-x  2  999 root 4096 Jun 10 11:33 hastebin
drwxrwxr-x  4 root root 4096 Aug  7  2020 jackett
drwxr-xr-x  3 root root 4096 Jan  7  2021 jellyfin
drwxrwxr-x  4 root root 4096 Aug  7  2020 mongodata
drwxr-xr-x  8 root root 4096 Aug  9  2020 nextcloud
drwxrwxr-x  4 root root 4096 Aug  7  2020 sonarr
drwx------  4 null null 4096 May  8 19:30 syncthing
drwxrwxr-x  3 null null 4096 Oct  1  2020 traefik
drwxrwxr-x  3 null null 4096 Jan 28 12:25 xbs
drwxrwxr-x  5 null null 4096 Aug  7  2020 znc

OR tree:

.
├── cube
│   └── schema
├── dim
├── emby
│   ├── cache
│   ├── config
│   ├── data
│   ├── logs
│   ├── metadata
│   ├── plugins
│   ├── root
│   └── transcoding-temp
├── emu
│   ├── config
│   └── data
├── file_browser
├── ftp
├── gitea
│   ├── git
│   ├── gitea
│   └── ssh
├── gitlab
│   ├── config
│   ├── data
│   └── logs
├── gitlab-runner
├── http
├── jellyfin
│   └── config
├── kuma
│   ├── kuma.db
│   ├── kuma.db.bak0
│   ├── kuma.db-shm.bak0
│   ├── kuma.db-wal.bak0
│   └── upload
├── mastodon
│   ├── postgres14
│   ├── redis
│   ├── sidekiq
│   └── web
├── nextcloud
│   ├── apps
│   ├── config
│   ├── data
│   └── database
├── plausible-clickhouse
│   ├── clickhouse-config.xml
│   ├── clickhouse-user-config.xml
│   └── event-data
├── plausible-db-data  [error opening dir]
├── plausible-geoip
├── plex
├── portainer
│   └── portainer-data
├── syncthing
│   ├── cert.pem
│   ├── config.xml
│   ├── config.xml.v0
│   ├── csrftokens.txt
│   ├── https-cert.pem
│   ├── https-key.pem
│   ├── index-v0.14.0.db
│   ├── key.pem
│   └── Sync
├── tmm
├── traefik
├── vaultwarden_data
│   ├── attachments
│   ├── db.sqlite3
│   ├── db.sqlite3-shm
│   ├── db.sqlite3-wal
│   ├── icon_cache
│   ├── rsa_key.pem
│   ├── rsa_key.pub.pem
│   ├── sends
│   ├── tmp
│   └── vaultwarden.log
├── vaultwarden_data_backup  [error opening dir]
├── youtube_dl
│   ├── appdata
│   ├── db
│   └── users
└── znc
    ├── configs
    ├── moddata
    ├── users
    └── znc.pem

Create the traefik network

docker network create traefik

Docker Swarm

docker swarm init

Mount NFS NAS Share

We need the nfs-utils package installed.

sudo mount -t nfs -o nfsvers=4 192.168.1.110:/media /WHERE/TO/MOUNT
sudo mount -t nfs -v 192.168.1.110:/media /home/knast/shares/disk1

if mounting on host, add to fstab

192.168.1.110:/media       /home/null/shares/disk1    nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0

Or create a docker volume for the nfs mount that can then be accessed in compose file:

docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data

The volume can then be mounted in the compose file in the following way:

version: "3" 
services: 
  web-server: 
    image: nginx:latest 
    ports: 
      - 1212:80 
    volumes:
      - nfs_data:/usr/share/nginx/html

volumes:
  nfs_data:
    external: true

networks:
  traefik:
    external: true

Firewall

sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/tcp
sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/udp

Fstab

using the blkid command to mount an external drive in fstab to use for restic backups

# /etc/fstab: static file system information.

UUID=6fb3bc60-e984-43ce-a688-151b49f558e0 /home/null/shares/disk2 auto defaults,nofail,x-systemd.automount 0 2

Gitlab

After adding the domain name to the docker-compose.yml and the gitlab configuration:

        hostname: 'gitlab.knast.cc'
        environment:
            GITLAB_OMNIBUS_CONFIG: |
              external_url 'https://gitlab.knast.cc'

We also need to please the dark lords of reverse proxying by adding the following lines to the gitlab.rb configuration:

nginx['listen_port'] = 80
nginx['listen_https'] = false

Nextcloud

edit the nextcloud config.php to use the https protocol

nano /srv/nextcloud/config/config.php

We also use traefik and docker. I have added the following traefik label in our docker-compose.yml:

- "traefik.http.middlewares.nc-header.headers.customRequestHeaders.X-Forwarded-Proto=https" 

And in the config.php, I’ve also added some values regarding reverse proxies:

  'forwarded_for_headers' => 
  array (
    1 => 'HTTP_X_FORWARDED',
    2 => 'HTTP_FORWARDED_FOR',
    3 => 'HTTP_FORWARDED',
    0 => 'HTTP_X_FORWARDED_FOR',
  ),
  'trusted_proxies' => 
  array (
    0 => '10.0.0.0/8',
  ),

Connecting a container directly to an NFS mount

version: "3" 
services: 
web-server: 
   image: nginx:latest 
   ports: 
      - 80:80 
   volumes: 
      - type: volume 
      source: nfs-volume 
      target: /nfs 
      volume: 
      nocopy: true 
volumes: 
   nfs-volume: 
   driver_opts: 
   type: "nfs" 
   o: "addr=192.168.1.110,nolock,soft,rw" 
   device: ":/var/data"

NOTE: Just switch to syncthing

* * * * * /usr/bin/flock -n /tmp/classics.lockfile /home/$USER/home_server/scripts/sync_classics.sh
* * * * * /usr/bin/flock -n /tmp/flims.lockfile /home/$USER/home_server/scripts/sync_flims.sh
* * * * * /usr/bin/flock -n /tmp/tv.lockfile /home/$USER/home_server/scripts/sync_tv.sh

#!/bin/bash
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/movies/_movies' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_movies' '/home/null/shares/disk2/media/movies/_movies' >> /home/null/logs/film_cron.log
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log

#SYNC TV FROM UNITY TO DISK 2
# CRON JOB
* * * * * /usr/bin/flock -n /tmp/fcj.lockfile /home/null/scrpts/tv_sync.sh

@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log

#@reboot /usr/bin/mount -t nfs 192.168.1.110:/media /home/knast/shares/disk1

0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log

*/5 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/film/* > /home/knast/logs/film_chmod.log

*/15 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/classics/* > /home/knast/logs/classic_chmod.log

*/25 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/tv/* > /home/knast/logs/tv_chmod.log

#!/bin/bash
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/tv' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_tv' '/home/null/shares/disk2/media/tv' >> /home/null/logs/tv_cron.log
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log

Dynamic IP for namecheap domains

in config file /etc/ddclient.conf

use=web, web=dynamicdns.park-your-domain.com/getip
protocol=namecheap
server=dynamicdns.park-your-domain.com
login=knast.cc
password=<NAMECHEAP_GENERATED_TOKEN>
@

and in the root crontab:

@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log

0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log