msnie
356 lines
8.3 KiB
Markdown
356 lines
8.3 KiB
Markdown
## Server Setup
|
||
|
||
```sh
|
||
ssh-keygen -t ed25519 -C "null" -f ~/.ssh/id_gitlab_home
|
||
|
||
cat .ssh/id_gitlab_home.pub
|
||
|
||
sudo apt install docker
|
||
sudo apt install docker-compose
|
||
sudo apt install nfs-kernel-server
|
||
sudo apt install nfs-common
|
||
sudo apt install nfs-utils
|
||
sudo apt install nmap
|
||
sudo apt install sshfs
|
||
sudo apt install libnfs-utils
|
||
sudo apt install fail2ban
|
||
sudo apt install ncdu
|
||
sudo apt install ddclient
|
||
|
||
|
||
sudo systemctl start fail2ban.service
|
||
sudo systemctl enable fail2ban.service
|
||
docker network create traefik
|
||
|
||
docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data
|
||
sudo usermod -aG docker $USER
|
||
```
|
||
|
||
## Add Key To config
|
||
|
||
```sh
|
||
nano .ssh/config
|
||
|
||
Host gitlab.com
|
||
IdentityFile ~/.ssh/id_gitlab_home
|
||
|
||
```
|
||
|
||
## PROJECTS
|
||
|
||
```sh
|
||
git clone git@gitlab.com:null4bl3/home_server.git
|
||
git clone git@gitlab.com:null4bl3/server-scripts.git
|
||
git clone git@gitlab.com:null4bl3/bitbot_ai.git
|
||
git clone git@gitlab.com:null4bl3/madplan_simple.git
|
||
git clone git@gitlab.com:null4bl3/tinkersynth.git
|
||
|
||
```
|
||
|
||
## UFW
|
||
|
||
```sh
|
||
sudo ufw allow 80
|
||
sudo ufw allow 443
|
||
sudo ufw allow 22
|
||
sudo ufw allow 8096
|
||
sudo ufw allow 8097
|
||
sudo ufw allow 8384
|
||
sudo ufw allow 3040
|
||
sudo ufw allow 51820
|
||
sudo ufw allow 51821
|
||
sudo ufw allow 21027
|
||
sudo ufw allow 32400
|
||
sudo ufw allow 2222
|
||
sudo ufw allow 8888
|
||
sudo ufw allow 4444
|
||
sudo ufw allow 22000
|
||
sudo ufw allow 21027
|
||
```
|
||
|
||
## FSTAB
|
||
|
||
```sh
|
||
192.168.1.110:/i-data/b695a7f6/nfs/media /home/null/shares/disk1 nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0
|
||
```
|
||
|
||
|
||
## SSH
|
||
|
||
```sh
|
||
sudo nano /etc/ssh/sshd_config
|
||
|
||
Port 8888
|
||
|
||
|
||
|
||
```
|
||
|
||
## Directories in /srv
|
||
|
||
```bash
|
||
➜ /srv ls -la
|
||
total 64
|
||
drwxr-xr-x 16 null null 4096 Jul 15 06:23 .
|
||
drwxr-xr-x 26 root root 4096 Jun 24 06:11 ..
|
||
drwxr-xr-x 4 root root 4096 Dec 22 2020 convos
|
||
drwxrwxr-x 2 null null 4096 Jul 15 06:23 file_browser
|
||
drwxr-xr-x 5 root root 4096 Aug 8 2020 gitlab
|
||
drwxrwxr-x 3 root root 4096 Aug 7 2020 gitlab-runner
|
||
drwxrwxr-x 2 999 root 4096 Jun 10 11:33 hastebin
|
||
drwxrwxr-x 4 root root 4096 Aug 7 2020 jackett
|
||
drwxr-xr-x 3 root root 4096 Jan 7 2021 jellyfin
|
||
drwxrwxr-x 4 root root 4096 Aug 7 2020 mongodata
|
||
drwxr-xr-x 8 root root 4096 Aug 9 2020 nextcloud
|
||
drwxrwxr-x 4 root root 4096 Aug 7 2020 sonarr
|
||
drwx------ 4 null null 4096 May 8 19:30 syncthing
|
||
drwxrwxr-x 3 null null 4096 Oct 1 2020 traefik
|
||
drwxrwxr-x 3 null null 4096 Jan 28 12:25 xbs
|
||
drwxrwxr-x 5 null null 4096 Aug 7 2020 znc
|
||
```
|
||
|
||
Create the `traefik` network
|
||
|
||
```sh
|
||
docker network create traefik
|
||
```
|
||
|
||
|
||
## Docker Swarm
|
||
|
||
```sh
|
||
docker swarm init
|
||
```
|
||
|
||
## Mount NFS NAS Share
|
||
|
||
We need the `nfs-utils` package installed.
|
||
|
||
```sh
|
||
sudo mount -t nfs -o nfsvers=4 192.168.1.110:/media /WHERE/TO/MOUNT
|
||
sudo mount -t nfs -v 192.168.1.110:/media /home/knast/shares/disk1
|
||
```
|
||
|
||
if mounting on host, add to `fstab`
|
||
|
||
```sh
|
||
192.168.1.110:/media /home/null/shares/disk1 nfs rw,auto,vers=3,nofail,noatime,nolock,timeo=14 0 0
|
||
```
|
||
|
||
Or create a docker volume for the nfs mount that can then be accessed in compose file:
|
||
|
||
```sh
|
||
docker volume create --driver local --opt type=nfs --opt o=addr=192.168.1.110,rw,vers=4 --opt device=:/media --name nfs_data
|
||
```
|
||
|
||
The volume can then be mounted in the compose file in the following way:
|
||
|
||
```yml
|
||
version: "3"
|
||
services:
|
||
web-server:
|
||
image: nginx:latest
|
||
ports:
|
||
- 1212:80
|
||
volumes:
|
||
- nfs_data:/usr/share/nginx/html
|
||
|
||
volumes:
|
||
nfs_data:
|
||
external: true
|
||
|
||
networks:
|
||
traefik:
|
||
external: true
|
||
|
||
```
|
||
|
||
|
||
### Firewall
|
||
|
||
```sh
|
||
sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/tcp
|
||
sudo ufw allow 80,443,22,8096,8097,8384,3040,51820,51821,21027,32400,2222,8888,4444,22000/udp
|
||
```
|
||
|
||
## Fstab
|
||
|
||
using the `blkid` command to mount an external drive in fstab to use for restic backups
|
||
|
||
```sh
|
||
# /etc/fstab: static file system information.
|
||
|
||
UUID=6fb3bc60-e984-43ce-a688-151b49f558e0 /home/null/shares/disk2 auto defaults,nofail,x-systemd.automount 0 2
|
||
```
|
||
|
||
|
||
|
||
# Gitlab
|
||
|
||
After adding the domain name to the docker-compose.yml and the gitlab configuration:
|
||
|
||
```yaml
|
||
hostname: 'gitlab.knast.cc'
|
||
environment:
|
||
GITLAB_OMNIBUS_CONFIG: |
|
||
external_url 'https://gitlab.knast.cc'
|
||
```
|
||
We also need to please the dark lords of reverse proxying by adding the following lines to the gitlab.rb configuration:
|
||
|
||
```bash
|
||
nginx['listen_port'] = 80
|
||
nginx['listen_https'] = false
|
||
```
|
||
|
||
|
||
|
||
## Nextcloud
|
||
|
||
edit the nextcloud config.php to use the https protocol
|
||
|
||
```sh
|
||
nano /srv/nextcloud/config/config.php
|
||
```
|
||
|
||
|
||
We also use traefik and docker. I have added the following traefik label in our docker-compose.yml:
|
||
|
||
```yml
|
||
- "traefik.http.middlewares.nc-header.headers.customRequestHeaders.X-Forwarded-Proto=https"
|
||
```
|
||
|
||
```sh
|
||
And in the config.php, I’ve also added some values regarding reverse proxies:
|
||
|
||
'forwarded_for_headers' =>
|
||
array (
|
||
1 => 'HTTP_X_FORWARDED',
|
||
2 => 'HTTP_FORWARDED_FOR',
|
||
3 => 'HTTP_FORWARDED',
|
||
0 => 'HTTP_X_FORWARDED_FOR',
|
||
),
|
||
'trusted_proxies' =>
|
||
array (
|
||
0 => '10.0.0.0/8',
|
||
),
|
||
|
||
```
|
||
|
||
#### Connecting a container directly to an NFS mount
|
||
|
||
```yml
|
||
version: "3"
|
||
services:
|
||
web-server:
|
||
image: nginx:latest
|
||
ports:
|
||
- 80:80
|
||
volumes:
|
||
- type: volume
|
||
source: nfs-volume
|
||
target: /nfs
|
||
volume:
|
||
nocopy: true
|
||
volumes:
|
||
nfs-volume:
|
||
driver_opts:
|
||
type: "nfs"
|
||
o: "addr=192.168.1.110,nolock,soft,rw"
|
||
device: ":/var/data"
|
||
```
|
||
|
||
|
||
|
||
NOTE: Just switch to syncthing
|
||
|
||
```sh
|
||
* * * * * /usr/bin/flock -n /tmp/classics.lockfile /home/$USER/home_server/scripts/sync_classics.sh
|
||
* * * * * /usr/bin/flock -n /tmp/flims.lockfile /home/$USER/home_server/scripts/sync_flims.sh
|
||
* * * * * /usr/bin/flock -n /tmp/tv.lockfile /home/$USER/home_server/scripts/sync_tv.sh
|
||
```
|
||
|
||
|
||
```sh
|
||
#!/bin/bash
|
||
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log
|
||
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/movies/_movies' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_movies' '/home/null/shares/disk2/media/movies/_movies' >> /home/null/logs/film_cron.log
|
||
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/film_cron.log
|
||
```
|
||
|
||
```sh
|
||
#SYNC TV FROM UNITY TO DISK 2
|
||
# CRON JOB
|
||
* * * * * /usr/bin/flock -n /tmp/fcj.lockfile /home/null/scrpts/tv_sync.sh
|
||
```
|
||
|
||
|
||
```sh
|
||
@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log
|
||
|
||
#@reboot /usr/bin/mount -t nfs 192.168.1.110:/media /home/knast/shares/disk1
|
||
|
||
0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug -query > /home/knast/logs/dynamic_dns.log
|
||
|
||
*/5 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/film/* > /home/knast/logs/film_chmod.log
|
||
|
||
*/15 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/classics/* > /home/knast/logs/classic_chmod.log
|
||
|
||
*/25 * * * * /usr/bin/chmod -v 0777 -R /home/knast/shares/disk1/tv/* > /home/knast/logs/tv_chmod.log
|
||
|
||
```
|
||
|
||
```sh
|
||
#!/bin/bash
|
||
echo "STARTING TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log
|
||
/usr/bin/rsync -ravz --bwlimit=5000 --stats --progress --exclude='/home/null/shares/disk2/media/tv' -e "ssh -i /home/null/.ssh/id_rsa_sync " 'invalid@unity.whatbox.ca:/home/invalid/files/_tv' '/home/null/shares/disk2/media/tv' >> /home/null/logs/tv_cron.log
|
||
echo "CRON TV FILE SYNC RAN AT: " `date '+%Y-%m-%d %H:%M:%S'` >> /home/null/logs/tv_cron.log
|
||
|
||
```
|
||
|
||
### Dynamic IP for namecheap domains
|
||
|
||
in config file `/etc/ddclient.conf`
|
||
|
||
```conf
|
||
use=web, web=dynamicdns.park-your-domain.com/getip
|
||
protocol=namecheap
|
||
server=dynamicdns.park-your-domain.com
|
||
login=knast.cc
|
||
password=<NAMECHEAP_GENERATED_TOKEN>
|
||
@
|
||
```
|
||
|
||
```sh
|
||
# Configuration file for ddclient generated by debconf
|
||
#
|
||
# /etc/ddclient.conf
|
||
|
||
protocol=namecheap \
|
||
use=web, web=https://api.ipify.org/ \
|
||
login=kattemonster \
|
||
password='686559cf45c34d82820f0851a2cb6f0d' \
|
||
|
||
protocol=namecheap \
|
||
use=web, web=https://api.ipify.org/ \
|
||
login=kattemonster \
|
||
password='8ba0d60246904f93ab77d4c80c79f8c0' \
|
||
|
||
protocol=namecheap \
|
||
use=web, web=https://api.ipify.org/ \
|
||
login=kattemonster \
|
||
password='e347224ae801444dae7e48b4f4e40556' \
|
||
|
||
|
||
|
||
|
||
```
|
||
|
||
|
||
and in the root crontab:
|
||
|
||
```sh
|
||
@reboot /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log
|
||
|
||
0 */2 * * * /usr/sbin/ddclient -daemon=0 -noquiet -debug > /home/null/dynamic_dns.log
|
||
```
|