ssh-keygen -t ed25519 -C "null" -f ~/.ssh/id_gitlab_home

cat .ssh/id_gitlab_home.pub

sudo apt install docker
sudo apt install docker-compose
sudo apt install nfs-kernel-server
sudo apt install nfs-common
sudo apt install nfs-utils
sudo apt install nmap
sudo apt install sshfs
sudo apt install libnfs-utils
sudo apt install fail2ban
sudo apt install ncdu
sudo apt install ddclient


sudo systemctl start fail2ban.service
sudo systemctl enable fail2ban.service
docker network create traefik

docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data
sudo usermod -aG docker $USER

Add Key To config

nano .ssh/config

Host gitlab.com
  IdentityFile ~/.ssh/id_gitlab_home

PROJECTS

git clone git@gitlab.com:null4bl3/home_server.git
git clone git@gitlab.com:null4bl3/server-scripts.git
git clone git@gitlab.com:null4bl3/bitbot_ai.git
git clone git@gitlab.com:null4bl3/madplan_simple.git
git clone git@gitlab.com:null4bl3/tinkersynth.git

UFW

sudo ufw allow 80
sudo ufw allow 443
sudo ufw allow 22
sudo ufw allow 8096
sudo ufw allow 8097
sudo ufw allow 8384
sudo ufw allow 3040
sudo ufw allow 51820
sudo ufw allow 51821
sudo ufw allow 21027
sudo ufw allow 32400
sudo ufw allow 2222
sudo ufw allow 8888
sudo ufw allow 4444
sudo ufw allow 22000
sudo ufw allow 21027

FSTAB

192.168.1.110:/i-data/b695a7f6/nfs/media       /home/null/shares/disk1    nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0

SSH

sudo nano /etc/ssh/sshd_config

Port 8888

Directories in /srv

➜  /srv ls -la            
total 64
drwxr-xr-x 16 null null 4096 Jul 15 06:23 .
drwxr-xr-x 26 root root 4096 Jun 24 06:11 ..
drwxr-xr-x  4 root root 4096 Dec 22  2020 convos
drwxrwxr-x  2 null null 4096 Jul 15 06:23 file_browser
drwxr-xr-x  5 root root 4096 Aug  8  2020 gitlab
drwxrwxr-x  3 root root 4096 Aug  7  2020 gitlab-runner
drwxrwxr-x  2  999 root 4096 Jun 10 11:33 hastebin
drwxrwxr-x  4 root root 4096 Aug  7  2020 jackett
drwxr-xr-x  3 root root 4096 Jan  7  2021 jellyfin
drwxrwxr-x  4 root root 4096 Aug  7  2020 mongodata
drwxr-xr-x  8 root root 4096 Aug  9  2020 nextcloud
drwxrwxr-x  4 root root 4096 Aug  7  2020 sonarr
drwx------  4 null null 4096 May  8 19:30 syncthing
drwxrwxr-x  3 null null 4096 Oct  1  2020 traefik
drwxrwxr-x  3 null null 4096 Jan 28 12:25 xbs
drwxrwxr-x  5 null null 4096 Aug  7  2020 znc

Create the traefik network

docker network create traefik

Docker Swarm

docker swarm init

We need the nfs-utils package installed.

sudo mount -t nfs -o nfsvers=4 192.168.1.110:/media /WHERE/TO/MOUNT
sudo mount -t nfs -v 192.168.1.110:/media /home/knast/shares/disk1

if mounting on host, add to fstab

192.168.1.110:/media       /home/null/shares/disk1    nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0

Or create a docker volume for the nfs mount that can then be accessed in compose file:

docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data

The volume can then be mounted in the compose file in the following way:

version: "3" 
services: 
  web-server: 
    image: nginx:latest 
    ports: 
      - 1212:80 
    volumes:
      - nfs_data:/usr/share/nginx/html

volumes:
  nfs_data:
    external: true

networks:
  traefik:
    external: true

Firewall

sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/tcp
sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/udp

Fstab

using the blkid command to mount an external drive in fstab to use for restic backups

# /etc/fstab: static file system information.

UUID=6fb3bc60-e984-43ce-a688-151b49f558e0 /home/null/shares/disk2 auto defaults,nofail,x-systemd.automount 0 2

Gitlab

After adding the domain name to the docker-compose.yml and the gitlab configuration:

        hostname: 'gitlab.knast.cc'
        environment:
            GITLAB_OMNIBUS_CONFIG: |
              external_url 'https://gitlab.knast.cc'

We also need to please the dark lords of reverse proxying by adding the following lines to the gitlab.rb configuration:

nginx['listen_port'] = 80
nginx['listen_https'] = false

Nextcloud

edit the nextcloud config.php to use the https protocol

nano /srv/nextcloud/config/config.php

We also use traefik and docker. I have added the following traefik label in our docker-compose.yml:

- "traefik.http.middlewares.nc-header.headers.customRequestHeaders.X-Forwarded-Proto=https"

And in the config.php, I’ve also added some values regarding reverse proxies:

  'forwarded_for_headers' => 
  array (
    1 => 'HTTP_X_FORWARDED',
    2 => 'HTTP_FORWARDED_FOR',
    3 => 'HTTP_FORWARDED',
    0 => 'HTTP_X_FORWARDED_FOR',
  ),
  'trusted_proxies' => 
  array (
    0 => '10.0.0.0/8',
  ),

Connecting a container directly to an NFS mount

version: "3" 
services: 
web-server: 
   image: nginx:latest 
   ports: 
      - 80:80 
   volumes: 
      - type: volume 
      source: nfs-volume 
      target: /nfs 
      volume: 
      nocopy: true 
volumes: 
   nfs-volume: 
   driver_opts: 
   type: "nfs" 
   o: "addr=192.168.1.110,nolock,soft,rw" 
   device: ":/var/data"

NOTE: Just switch to syncthing

* * * * * /usr/bin/flock -n /tmp/classics.lockfile /home/$USER/home_server/scripts/sync_classics.sh
* * * * * /usr/bin/flock -n /tmp/flims.lockfile /home/$USER/home_server/scripts/sync_flims.sh
* * * * * /usr/bin/flock -n /tmp/tv.lockfile /home/$USER/home_server/scripts/sync_tv.sh

#!/bin/bash
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/movies/_movies' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_movies' '/home/null/shares/disk2/media/movies/_movies' >> /home/null/logs/film_cron.log
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log

#SYNC TV FROM UNITY TO DISK 2
# CRON JOB
* * * * * /usr/bin/flock -n /tmp/fcj.lockfile /home/null/scrpts/tv_sync.sh

@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log

#@reboot /usr/bin/mount -t nfs 192.168.1.110:/media /home/knast/shares/disk1

0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log

*/5 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/film/* > /home/knast/logs/film_chmod.log

*/15 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/classics/* > /home/knast/logs/classic_chmod.log

*/25 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/tv/* > /home/knast/logs/tv_chmod.log

#!/bin/bash
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/tv' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_tv' '/home/null/shares/disk2/media/tv' >> /home/null/logs/tv_cron.log
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log

Dynamic IP for namecheap domains

in config file /etc/ddclient.conf

use=web, web=dynamicdns.park-your-domain.com/getip
protocol=namecheap
server=dynamicdns.park-your-domain.com
login=knast.cc
password=<NAMECHEAP_GENERATED_TOKEN>
@

# Configuration file for ddclient generated by debconf
#
# /etc/ddclient.conf

protocol=namecheap \
use=web, web=https://api.ipify.org/ \
login=kattemonster \
password='686559cf45c34d82820f0851a2cb6f0d' \

protocol=namecheap \
use=web, web=https://api.ipify.org/ \
login=kattemonster \
password='8ba0d60246904f93ab77d4c80c79f8c0' \

protocol=namecheap \
use=web, web=https://api.ipify.org/ \
login=kattemonster \
password='e347224ae801444dae7e48b4f4e40556' \

and in the root crontab:

@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log

0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log

Languages

TypeScript 30.5%

HTML 24.8%

Shell 23.7%

JavaScript 12.7%

Dockerfile 7.8%

Other 0.5%

README.md Unescape Escape

Server Setup