340 lines
12 KiB
Markdown
340 lines
12 KiB
Markdown
---
|
|
created: 2024-01-06T01:25:36.042Z
|
|
draft: true;
|
|
type: topic
|
|
updated: 2024-07-15T23:43:36.398Z
|
|
---
|
|
|
|
# moved-bee
|
|
|
|
```bash
|
|
apt-get update
|
|
apt-get upgrade
|
|
apt-get install links unzip net-tools ufw nginx git ncdu -y
|
|
reboot
|
|
|
|
|
|
|
|
|
|
|
|
ip a
|
|
lsb_release -a
|
|
ufw enable
|
|
ufw allow from 192.168.0.0/24 comment "04) 192.168.0.0/24"
|
|
ufw status numbered
|
|
cd /home/ubuntu/
|
|
wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh
|
|
chmod +x ./dotnet-install.sh
|
|
./dotnet-install.sh --channel 8.0
|
|
ln -s /home/ubuntu/.dotnet/dotnet /usr/local/bin/dotnet
|
|
dotnet --info
|
|
export DOTNET_ROOT=$HOME/.dotnet
|
|
export PATH=$PATH:$HOME/.dotnet:$HOME/.dotnet/tools
|
|
dotnet --info
|
|
timedatectl set-timezone America/Phoenix
|
|
snap install dashkiosk
|
|
snap restart dashkiosk
|
|
snap install ubuntu-frame wpe-webkit-mir-kiosk
|
|
snap set wpe-webkit-mir-kiosk url=http://localhost:9400/receiver
|
|
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
|
|
/snap/wpe-webkit-mir-kiosk/current/bin/setup.sh
|
|
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
|
|
snap set ubuntu-frame daemon=true
|
|
apt-get install -y ca-certificates
|
|
openssl s_client -showcerts -connect DESKTOP-H6JG91B:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >DESKTOP-H6JG91B.crt
|
|
apt-get install nano
|
|
nano /etc/hosts
|
|
nano /etc/nginx/sites-available/default
|
|
echo >/etc/nginx/sites-available/default && nano /etc/nginx/sites-available/default
|
|
```
|
|
|
|
```conf
|
|
server {
|
|
listen 80 default_server;
|
|
listen [::]:80 default_server;
|
|
root /var/www/html;
|
|
index index.html index.htm index.nginx-debian.html;
|
|
server_name _;
|
|
location / {
|
|
try_files $uri $uri/ =404;
|
|
}
|
|
}
|
|
server {
|
|
ssl_certificate 'localhost.crt';
|
|
ssl_certificate_key 'localhost.key';
|
|
listen 443 default_server ssl http2;
|
|
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
|
|
listen [::]:443 default_server ssl http2;
|
|
server_name _;
|
|
location / {
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
proxy_pass http://localhost:3000/;
|
|
proxy_read_timeout 600s;
|
|
proxy_send_timeout 600s;
|
|
}
|
|
}
|
|
```
|
|
|
|
```bash
|
|
systemctl restart nginx
|
|
nginx -t
|
|
nginx -s reload
|
|
nano /home/ubuntu/localhost.conf
|
|
echo >/home/ubuntu/localhost.conf && nano /home/ubuntu/localhost.conf
|
|
```
|
|
|
|
```conf
|
|
[req]
|
|
default_bits = 2048
|
|
default_keyfile = localhost.key
|
|
distinguished_name = req_distinguished_name
|
|
req_extensions = req_ext
|
|
x509_extensions = v3_ca
|
|
|
|
[req_distinguished_name]
|
|
countryName = Country Name (2 letter code)
|
|
countryName_default = US
|
|
stateOrProvinceName = State or Province Name (full name)
|
|
stateOrProvinceName_default = Arizona
|
|
localityName = Locality Name (eg, city)
|
|
localityName_default = Mesa
|
|
organizationName = Organization Name (eg, company)
|
|
organizationName_default = Infineon Technologies Americas Corp.
|
|
organizationalUnitName = organizationalunit
|
|
organizationalUnitName_default = Development
|
|
commonName = Common Name (e.g. server FQDN or YOUR name)
|
|
commonName_default = phares3757.ddns.net
|
|
commonName_max = 64
|
|
|
|
[req_ext]
|
|
subjectAltName = @alt_names
|
|
|
|
[v3_ca]
|
|
subjectAltName = @alt_names
|
|
|
|
[alt_names]
|
|
DNS.1 = phares3757.ddns.net
|
|
DNS.2 = beelink
|
|
DNS.3 = localhost
|
|
DNS.4 = 127.0.0.1
|
|
```
|
|
|
|
```bash
|
|
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/localhost.key -out /etc/nginx/localhost.crt -config /home/ubuntu/localhost.conf
|
|
ls /etc/nginx
|
|
apt install update-manager-core
|
|
exit
|
|
do-release-upgrade
|
|
exit
|
|
adduser gogs
|
|
cd /home/gogs
|
|
wget https://dl.gogs.io/0.13.0/gogs_0.13.0_linux_amd64.tar.gz
|
|
tar -xvzf gogs_0.13.0_linux_amd64.tar.gz
|
|
rm gogs_0.13.0_linux_amd64.tar.gz
|
|
cd gogs
|
|
ufw status numbered
|
|
./gogs web
|
|
mkdir /home/gogs/gogs-repositories
|
|
chown gogs /home/gogs -R
|
|
chgrp gogs /home/gogs -R
|
|
nano /home/gogs/gogs/custom/conf/app.ini
|
|
nano /etc/systemd/system/gogs-daemon.service
|
|
systemctl enable gogs-daemon
|
|
systemctl start gogs-daemon
|
|
systemctl status gogs-daemon.service
|
|
systemctl daemon-reload
|
|
journalctl -fu gogs-daemon.service
|
|
journalctl --rotate
|
|
journalctl --vacuum-time=1s
|
|
cd /home/gogs
|
|
git clone https://github.com/Kos-M/GogsThemes
|
|
exit
|
|
cp ~/.bash_history /home/ubuntu/bash-history-2023-10-17.txt
|
|
chown mike /home/ubuntu -R
|
|
chgrp mike /home/ubuntu -R
|
|
exit
|
|
adduser pi-hole
|
|
cd pi-hole
|
|
curl -sSL https://install.pi-hole.net | bash
|
|
```
|
|
|
|
```conf
|
|
# http://pi.hole/admin
|
|
# http://192.168.0.118/admin
|
|
fUiY4SYS
|
|
```
|
|
|
|
```conf
|
|
nano /etc/lighttpd/lighttpd.conf
|
|
```
|
|
|
|
```conf
|
|
server.port = 8005
|
|
```
|
|
|
|
```conf
|
|
service lighttpd restart
|
|
pihole -a -p 4hink
|
|
apt install unbound
|
|
; https://docs.pi-hole.net/guides/dns/unbound/
|
|
nano /etc/unbound/unbound.conf.d/pi-hole.conf
|
|
```
|
|
|
|
```conf
|
|
server:
|
|
# If no logfile is specified, syslog is used
|
|
# logfile: "/var/log/unbound/unbound.log"
|
|
verbosity: 0
|
|
|
|
interface: 127.0.0.1
|
|
port: 5335
|
|
do-ip4: yes
|
|
do-udp: yes
|
|
do-tcp: yes
|
|
|
|
# May be set to yes if you have IPv6 connectivity
|
|
do-ip6: no
|
|
|
|
# You want to leave this to no unless you have *native* IPv6. With 6to4 and
|
|
# Terredo tunnels your web browser should favor IPv4 for the same reasons
|
|
prefer-ip6: no
|
|
|
|
# Use this only when you downloaded the list of primary root servers!
|
|
# If you use the default dns-root-data package, unbound will find it automatically
|
|
#root-hints: "/var/lib/unbound/root.hints"
|
|
|
|
# Trust glue only if it is within the server's authority
|
|
harden-glue: yes
|
|
|
|
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
|
|
harden-dnssec-stripped: yes
|
|
|
|
# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
|
|
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
|
|
use-caps-for-id: no
|
|
|
|
# Reduce EDNS reassembly buffer size.
|
|
# IP fragmentation is unreliable on the Internet today, and can cause
|
|
# transmission failures when large DNS messages are sent via UDP. Even
|
|
# when fragmentation does work, it may not be secure; it is theoretically
|
|
# possible to spoof parts of a fragmented DNS message, without easy
|
|
# detection at the receiving end. Recently, there was an excellent study
|
|
# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
|
|
# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
|
|
# in collaboration with NLnet Labs explored DNS using real world data from the
|
|
# the RIPE Atlas probes and the researchers suggested different values for
|
|
# IPv4 and IPv6 and in different scenarios. They advise that servers should
|
|
# be configured to limit DNS messages sent over UDP to a size that will not
|
|
# trigger fragmentation on typical network links. DNS servers can switch
|
|
# from UDP to TCP when a DNS response is too big to fit in this limited
|
|
# buffer size. This value has also been suggested in DNS Flag Day 2020.
|
|
edns-buffer-size: 1232
|
|
|
|
# Perform prefetching of close to expired message cache entries
|
|
# This only applies to domains that have been frequently queried
|
|
prefetch: yes
|
|
|
|
# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
|
|
num-threads: 1
|
|
|
|
# Ensure kernel buffer is large enough to not lose messages in traffic spikes
|
|
so-rcvbuf: 1m
|
|
|
|
# Ensure privacy of local IP ranges
|
|
private-address: 192.168.0.0/16
|
|
private-address: 169.254.0.0/16
|
|
private-address: 172.16.0.0/12
|
|
private-address: 10.0.0.0/8
|
|
private-address: fd00::/8
|
|
private-address: fe80::/10
|
|
```
|
|
|
|
```conf
|
|
service unbound restart
|
|
# http://beelink:8005/admin/settings.php?tab=dns
|
|
# https://docs.pi-hole.net/guides/dns/unbound/
|
|
127.0.0.1#5335
|
|
```
|
|
|
|
```bash
|
|
apt-get install syncthing
|
|
apt-get install apt-transport-https
|
|
adduser syncthing
|
|
cat /etc/passwd | cut -d: -f1
|
|
systemctl enable syncthing@syncthing.service
|
|
systemctl start syncthing@syncthing.service
|
|
systemctl status syncthing@syncthing.service
|
|
journalctl -e -u syncthing@syncthing.service
|
|
nano /home/syncthing/.config/syncthing/config.xml
|
|
```
|
|
|
|
```xml
|
|
<address>0.0.0.0:8384</address>
|
|
```
|
|
|
|
```bash
|
|
systemctl restart syncthing@syncthing.service
|
|
chown syncthing /home/syncthing -R
|
|
chgrp syncthing /home/syncthing -R
|
|
```
|
|
|
|
```bash
|
|
ufw allow from 192.168.0.0/24 to any port 22 comment "01) SSH"
|
|
ufw allow to 0.0.0.0/0 port 80 comment "02) HTTP"
|
|
ufw allow to 0.0.0.0/0 port 443 comment "03) HTTPS"
|
|
ufw allow from 192.168.0.0/24 to any port 8005 comment "04) Pi-hole"
|
|
ufw allow from 192.168.0.0/24 to any port 53 comment "05) DNS"
|
|
ufw allow from 192.168.0.0/24 to any port 67 comment "06) Unknown"
|
|
ufw allow from 192.168.0.0/24 to any port 9400 comment "07) dashkiosk"
|
|
ufw allow from 192.168.0.0/24 to any port 3000 comment "08) gogs"
|
|
ufw allow from 192.168.0.0/24 to any port 8384 comment "09) syncthing"
|
|
ufw allow from 192.168.0.0/24 to any port 22000 comment "10) syncthing"
|
|
```
|
|
|
|
```conf
|
|
To Action From
|
|
-- ------ ----
|
|
22 ALLOW IN 192.168.0.0/24 # 01) SSH
|
|
80 ALLOW IN Anywhere # 02) HTTP
|
|
443 ALLOW IN Anywhere # 03) HTTPS
|
|
8005 ALLOW IN 192.168.0.0/24 # 04) Pi-hole
|
|
53 ALLOW IN 192.168.0.0/24 # 05) DNS
|
|
67 ALLOW IN 192.168.0.0/24 # 06) Unknown
|
|
9400 ALLOW IN 192.168.0.0/24 # 07) dashkiosk
|
|
3000 ALLOW IN 192.168.0.0/24 # 08) gogs
|
|
8384 ALLOW IN 192.168.0.0/24 # 09) syncthing
|
|
22000 ALLOW IN 192.168.0.0/24 # 10) syncthing
|
|
|
|
```
|
|
|
|
```bash
|
|
echo >/etc/hosts && nano /etc/hosts
|
|
```
|
|
|
|
```conf
|
|
127.0.0.1 localhost
|
|
127.0.0.1 beelink
|
|
127.0.1.1 phares3757.ddsn.net
|
|
# The following lines are desirable for IPv6 capable hosts
|
|
::1 ip6-localhost ip6-loopback
|
|
fe00::0 ip6-localnet
|
|
ff00::0 ip6-mcastprefix
|
|
ff02::1 ip6-allnodes
|
|
ff02::2 ip6-allrouters
|
|
```
|
|
|
|
```bash
|
|
adduser twingate
|
|
curl -s https://binaries.twingate.com/client/linux/install.sh | bash
|
|
twingate setup
|
|
twingate start
|
|
|
|
|
|
curl "https://binaries.twingate.com/connector/setup.sh" | sudo TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMDc3IiwiZGlkIjoiMTAwMzc4OSIsImp0aSI6IjIyNTJmMjIwLWNkNjQtNDlhYy04YjRhLTE0NDFjOWUyM2U5ZSIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDE0Mzc4LCJpYXQiOjE2OTgwMTA3NzgsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAxMTA3OCwicm5ldGlkIjoiNzIyNzcifQ.aQnQMUGqM5fBEbR781u-lCPjltfmb1TdZUJTNJ_GYiiSJiemJiIrVK80xHQlIpPB2kot34nxmpvVK4kZK64X3w" TWINGATE_REFRESH_TOKEN="AWOLHa11QFXENAyov_w-KQ5ZC-keHm2w_ActZP8M7hBpy2NOC7EDT2bkEpBCO-YLTd40Pp-pdplIJu0lvdvNBAGINHopYnX2XOgaMxS5tbPPTsHRlnQpckaXYuOwu28W0ORs8g" TWINGATE_NETWORK="phares" bash
|
|
|
|
curl "https://binaries.twingate.com/connector/setup.sh" | TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMjIxIiwiZGlkIjoiMTAwNDI3NCIsImp0aSI6ImQxMWIwYWIzLWJjZTgtNDIxZS05MzAwLTA1ZmFkZDk5YjllMiIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDM3MTgzLCJpYXQiOjE2OTgwMzM1ODMsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAzMzg4Mywicm5ldGlkIjoiNzIyNzcifQ.7YqB5iz1lzsfb6adLPx53NNA3dJ1NnuzmNhyyi4FzPdMTGxn3qbHD1olvWpEEi69D8gAvF5K77DPwE1BHxo4Qw" TWINGATE_REFRESH_TOKEN="HypbNsUdue5Dh3s5W4ePR9RIkFDsjEGiNJFJDf_cLdixkn94ieMypUZMH_XIc4-13L_PuQ61M7RWG5rF21ZRAgFf1MuIMf5kJGhuQq_VG7_E_6Q8NMLAajP5W05jTofB-sY3Ig" TWINGATE_NETWORK="phares" bash
|
|
```
|