12 KiB
12 KiB
type, created, updated
| type | created | updated |
|---|---|---|
| topic | 2024-01-06T01:25:36.042Z | 2024-01-06T01:25:36.042Z |
moved-bee
apt-get update
apt-get upgrade
apt-get install links unzip net-tools ufw nginx git ncdu -y
reboot
ip a
lsb_release -a
ufw enable
ufw allow from 192.168.0.0/24 comment "04) 192.168.0.0/24"
ufw status numbered
cd /home/ubuntu/
wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh
chmod +x ./dotnet-install.sh
./dotnet-install.sh --channel 8.0
ln -s /home/ubuntu/.dotnet/dotnet /usr/local/bin/dotnet
dotnet --info
export DOTNET_ROOT=$HOME/.dotnet
export PATH=$PATH:$HOME/.dotnet:$HOME/.dotnet/tools
dotnet --info
timedatectl set-timezone America/Phoenix
snap install dashkiosk
snap restart dashkiosk
snap install ubuntu-frame wpe-webkit-mir-kiosk
snap set wpe-webkit-mir-kiosk url=http://localhost:9400/receiver
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
/snap/wpe-webkit-mir-kiosk/current/bin/setup.sh
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
snap set ubuntu-frame daemon=true
apt-get install -y ca-certificates
openssl s_client -showcerts -connect DESKTOP-H6JG91B:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >DESKTOP-H6JG91B.crt
apt-get install nano
nano /etc/hosts
nano /etc/nginx/sites-available/default
echo >/etc/nginx/sites-available/default && nano /etc/nginx/sites-available/default
server {
listen 80 default_server;
listen [::]:80 default_server;
root /var/www/html;
index index.html index.htm index.nginx-debian.html;
server_name _;
location / {
try_files $uri $uri/ =404;
}
}
server {
ssl_certificate 'localhost.crt';
ssl_certificate_key 'localhost.key';
listen 443 default_server ssl http2;
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
listen [::]:443 default_server ssl http2;
server_name _;
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:3000/;
proxy_read_timeout 600s;
proxy_send_timeout 600s;
}
}
systemctl restart nginx
nginx -t
nginx -s reload
nano /home/ubuntu/localhost.conf
echo >/home/ubuntu/localhost.conf && nano /home/ubuntu/localhost.conf
[req]
default_bits = 2048
default_keyfile = localhost.key
distinguished_name = req_distinguished_name
req_extensions = req_ext
x509_extensions = v3_ca
[req_distinguished_name]
countryName = Country Name (2 letter code)
countryName_default = US
stateOrProvinceName = State or Province Name (full name)
stateOrProvinceName_default = Arizona
localityName = Locality Name (eg, city)
localityName_default = Mesa
organizationName = Organization Name (eg, company)
organizationName_default = Infineon Technologies Americas Corp.
organizationalUnitName = organizationalunit
organizationalUnitName_default = Development
commonName = Common Name (e.g. server FQDN or YOUR name)
commonName_default = phares3757.ddns.net
commonName_max = 64
[req_ext]
subjectAltName = @alt_names
[v3_ca]
subjectAltName = @alt_names
[alt_names]
DNS.1 = phares3757.ddns.net
DNS.2 = beelink
DNS.3 = localhost
DNS.4 = 127.0.0.1
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/localhost.key -out /etc/nginx/localhost.crt -config /home/ubuntu/localhost.conf
ls /etc/nginx
apt install update-manager-core
exit
do-release-upgrade
exit
adduser gogs
cd /home/gogs
wget https://dl.gogs.io/0.13.0/gogs_0.13.0_linux_amd64.tar.gz
tar -xvzf gogs_0.13.0_linux_amd64.tar.gz
rm gogs_0.13.0_linux_amd64.tar.gz
cd gogs
ufw status numbered
./gogs web
mkdir /home/gogs/gogs-repositories
chown gogs /home/gogs -R
chgrp gogs /home/gogs -R
nano /home/gogs/gogs/custom/conf/app.ini
nano /etc/systemd/system/gogs-daemon.service
systemctl enable gogs-daemon
systemctl start gogs-daemon
systemctl status gogs-daemon.service
systemctl daemon-reload
journalctl -fu gogs-daemon.service
journalctl --rotate
journalctl --vacuum-time=1s
cd /home/gogs
git clone https://github.com/Kos-M/GogsThemes
exit
cp ~/.bash_history /home/ubuntu/bash-history-2023-10-17.txt
chown mike /home/ubuntu -R
chgrp mike /home/ubuntu -R
exit
adduser pi-hole
cd pi-hole
curl -sSL https://install.pi-hole.net | bash
# http://pi.hole/admin
# http://192.168.0.118/admin
fUiY4SYS
nano /etc/lighttpd/lighttpd.conf
server.port = 8005
service lighttpd restart
pihole -a -p 4hink
apt install unbound
; https://docs.pi-hole.net/guides/dns/unbound/
nano /etc/unbound/unbound.conf.d/pi-hole.conf
server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0
interface: 127.0.0.1
port: 5335
do-ip4: yes
do-udp: yes
do-tcp: yes
# May be set to yes if you have IPv6 connectivity
do-ip6: no
# You want to leave this to no unless you have *native* IPv6. With 6to4 and
# Terredo tunnels your web browser should favor IPv4 for the same reasons
prefer-ip6: no
# Use this only when you downloaded the list of primary root servers!
# If you use the default dns-root-data package, unbound will find it automatically
#root-hints: "/var/lib/unbound/root.hints"
# Trust glue only if it is within the server's authority
harden-glue: yes
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes
# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no
# Reduce EDNS reassembly buffer size.
# IP fragmentation is unreliable on the Internet today, and can cause
# transmission failures when large DNS messages are sent via UDP. Even
# when fragmentation does work, it may not be secure; it is theoretically
# possible to spoof parts of a fragmented DNS message, without easy
# detection at the receiving end. Recently, there was an excellent study
# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
# in collaboration with NLnet Labs explored DNS using real world data from the
# the RIPE Atlas probes and the researchers suggested different values for
# IPv4 and IPv6 and in different scenarios. They advise that servers should
# be configured to limit DNS messages sent over UDP to a size that will not
# trigger fragmentation on typical network links. DNS servers can switch
# from UDP to TCP when a DNS response is too big to fit in this limited
# buffer size. This value has also been suggested in DNS Flag Day 2020.
edns-buffer-size: 1232
# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes
# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
num-threads: 1
# Ensure kernel buffer is large enough to not lose messages in traffic spikes
so-rcvbuf: 1m
# Ensure privacy of local IP ranges
private-address: 192.168.0.0/16
private-address: 169.254.0.0/16
private-address: 172.16.0.0/12
private-address: 10.0.0.0/8
private-address: fd00::/8
private-address: fe80::/10
service unbound restart
# http://beelink:8005/admin/settings.php?tab=dns
# https://docs.pi-hole.net/guides/dns/unbound/
127.0.0.1#5335
apt-get install syncthing
apt-get install apt-transport-https
adduser syncthing
cat /etc/passwd | cut -d: -f1
systemctl enable syncthing@syncthing.service
systemctl start syncthing@syncthing.service
systemctl status syncthing@syncthing.service
journalctl -e -u syncthing@syncthing.service
nano /home/syncthing/.config/syncthing/config.xml
<address>0.0.0.0:8384</address>
systemctl restart syncthing@syncthing.service
chown syncthing /home/syncthing -R
chgrp syncthing /home/syncthing -R
ufw allow from 192.168.0.0/24 to any port 22 comment "01) SSH"
ufw allow to 0.0.0.0/0 port 80 comment "02) HTTP"
ufw allow to 0.0.0.0/0 port 443 comment "03) HTTPS"
ufw allow from 192.168.0.0/24 to any port 8005 comment "04) Pi-hole"
ufw allow from 192.168.0.0/24 to any port 53 comment "05) DNS"
ufw allow from 192.168.0.0/24 to any port 67 comment "06) Unknown"
ufw allow from 192.168.0.0/24 to any port 9400 comment "07) dashkiosk"
ufw allow from 192.168.0.0/24 to any port 3000 comment "08) gogs"
ufw allow from 192.168.0.0/24 to any port 8384 comment "09) syncthing"
ufw allow from 192.168.0.0/24 to any port 22000 comment "10) syncthing"
To Action From
-- ------ ----
22 ALLOW IN 192.168.0.0/24 # 01) SSH
80 ALLOW IN Anywhere # 02) HTTP
443 ALLOW IN Anywhere # 03) HTTPS
8005 ALLOW IN 192.168.0.0/24 # 04) Pi-hole
53 ALLOW IN 192.168.0.0/24 # 05) DNS
67 ALLOW IN 192.168.0.0/24 # 06) Unknown
9400 ALLOW IN 192.168.0.0/24 # 07) dashkiosk
3000 ALLOW IN 192.168.0.0/24 # 08) gogs
8384 ALLOW IN 192.168.0.0/24 # 09) syncthing
22000 ALLOW IN 192.168.0.0/24 # 10) syncthing
echo >/etc/hosts && nano /etc/hosts
127.0.0.1 localhost
127.0.0.1 beelink
127.0.1.1 phares3757.ddsn.net
# The following lines are desirable for IPv6 capable hosts
::1 ip6-localhost ip6-loopback
fe00::0 ip6-localnet
ff00::0 ip6-mcastprefix
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters
adduser twingate
curl -s https://binaries.twingate.com/client/linux/install.sh | bash
twingate setup
twingate start
curl "https://binaries.twingate.com/connector/setup.sh" | sudo TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMDc3IiwiZGlkIjoiMTAwMzc4OSIsImp0aSI6IjIyNTJmMjIwLWNkNjQtNDlhYy04YjRhLTE0NDFjOWUyM2U5ZSIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDE0Mzc4LCJpYXQiOjE2OTgwMTA3NzgsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAxMTA3OCwicm5ldGlkIjoiNzIyNzcifQ.aQnQMUGqM5fBEbR781u-lCPjltfmb1TdZUJTNJ_GYiiSJiemJiIrVK80xHQlIpPB2kot34nxmpvVK4kZK64X3w" TWINGATE_REFRESH_TOKEN="AWOLHa11QFXENAyov_w-KQ5ZC-keHm2w_ActZP8M7hBpy2NOC7EDT2bkEpBCO-YLTd40Pp-pdplIJu0lvdvNBAGINHopYnX2XOgaMxS5tbPPTsHRlnQpckaXYuOwu28W0ORs8g" TWINGATE_NETWORK="phares" bash
curl "https://binaries.twingate.com/connector/setup.sh" | TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMjIxIiwiZGlkIjoiMTAwNDI3NCIsImp0aSI6ImQxMWIwYWIzLWJjZTgtNDIxZS05MzAwLTA1ZmFkZDk5YjllMiIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDM3MTgzLCJpYXQiOjE2OTgwMzM1ODMsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAzMzg4Mywicm5ldGlkIjoiNzIyNzcifQ.7YqB5iz1lzsfb6adLPx53NNA3dJ1NnuzmNhyyi4FzPdMTGxn3qbHD1olvWpEEi69D8gAvF5K77DPwE1BHxo4Qw" TWINGATE_REFRESH_TOKEN="HypbNsUdue5Dh3s5W4ePR9RIkFDsjEGiNJFJDf_cLdixkn94ieMypUZMH_XIc4-13L_PuQ61M7RWG5rF21ZRAgFf1MuIMf5kJGhuQq_VG7_E_6Q8NMLAajP5W05jTofB-sY3Ig" TWINGATE_NETWORK="phares" bash