.infineon/_-Review/beelink.ubuntu-and-podman-july-2024.md

created, type, updated

created	type	updated
2024-11-05T18:26:20.000Z	note	2024-11-05T18:26:20.000Z

Beelink Ubuntu and Podman July 2024

authorized_keys

sudo -i
cat /root/.ssh/authorized_keys
nano /root/.ssh/authorized_keys

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIK7khmvc9lTWHALZ/IOMcJNz/1SuvrU53fI43v4PxIJN # 92532396 2023-12-27 mikep@DESKTOP-VP94SPB
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGq7b8qtm4fgNxW2lxm+qoxm8Wz7+1uhLQCg7xSlKYL1 # 92683771 2024-01-01 mikep@DESKTOP-BMV4V66
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIJqLFW9kYMp9lOTXXYafxLiUADFFKeM5KDzt02E3XeRP # 92691378 2024-01-01 cphar@DESKTOP-KA0LMMJ
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIBkS+uvWevmhYNos6MJKVi2auAx6x+xlyOnnvbdEstsz # 92797978 2024-01-03 mikep@DESKTOP-GNECR7R
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIKf5fo63+vyYa8E06+HOPg24e9VMsvv/kBsHKGjBBUyz # 92895319 2024-01-05 mike@mike-B365M-DS3H
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIGM6ANLH/4dS0YqlsCyoXkznzkgIsDqCTk3YX01XVWd8 # 92909911 2024-01-06 mikep@DESKTOP-H6JG91B
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOwAv1vrRA29GYL0DFSE8nmD5q3gL+vVtFSwhrXObDo4 # 93288214 2024-01-13 infineon\phares@ISCN5CG3256CPS
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIH1xPVOisKwW6Xwo/Yh1kx2smt2HJU2/pRjTJf4KdGXo # 97267150 2024-03-28 mike@mike-Default-string
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEDz5WqCKsoaxV+LG/kufLNuiE9K3lqp+B3AqeKXGusX # 97442032 2024-04-01 lphar@DESKTOP-1238PEQ
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAID09PhrjIpeNBmUeycnT3xKF8F5TcGL3ZKAvU9YdLj7H # 98747144 2024-04-25 mike@mike-Default-string
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIIaZyTLpafZta8W8Uv6uWpgbbj4QL5dde9Rlf06PfdYc # 98824914 2024-04-26 k0308@DESKTOP-0UJ8DD5
# ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIEFpucyp3FAHn8/9cXvfRegi09DkR6XLugoniEyQ9w0T # 98824924 2024-04-26 mille@DESKTOP-QL2HGEH
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIOn/Ptg/k3rOJn32GxrL2J3Bazt/3M9fGWjzP+CW1qXK # 100900455 2024-06-03 lphares0907@penguin
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPMIxGucViHMHFXoM2VBPlvLvMgqNi2BUtTE/D4n778M # 101638217 2024-06-14 mikep@DESKTOP-VVO6KCM

exit

Timezone

timedatectl set-timezone America/Phoenix
date
# Thu Jul 25 04:03:08 PM MST 2024

apt-get update
apt upgrade -y

Create Users

adduser pihole
adduser podman
mkdir /home/podman/.ssh
cp /root/.ssh/authorized_keys /home/podman/.ssh/authorized_keys
chown podman:podman -R /home/podman
#
adduser lphares
#
mkdir /home/lphares/.ssh
cp /root/.ssh/authorized_keys /home/lphares/.ssh/authorized_keys
chown lphares:lphares -R /home/lphares
#
adduser bmiller
#
mkdir /home/bmiller/.ssh
cp /root/.ssh/authorized_keys /home/bmiller/.ssh/authorized_keys
chown bmiller:bmiller -R /home/bmiller

Directory Share

adduser bmiller lphares
sudo usermod -a -G lphares bmiller
newgrp lphares
systemctl restart ssh

Podman Quadlet Rootless Example

apt-get install podman -y
apt-cache rdepends podman-compose
apt-get install podman-compose -y
# apt-get remove podman-compose -y
# apt-get purge podman-compose -y
adduser podman sudo
sudo -iu podman
loginctl enable-linger
# 2.
podman --version
# podman version 4.9.3
# https://www.redhat.com/sysadmin/quadlet-podman
cd ~/
mkdir -p .config/containers/systemd/
nano .config/containers/systemd/mysleep.container

[Unit]
Description=The sleep container
After=local-fs.target

[Container]
Image=registry.access.redhat.com/ubi9-minimal:latest
Exec=sleep 1000

[Install]
# Start by default on boot
WantedBy=multi-user.target default.target

exit
exit
reboot

# cp -R /run/user/0/ /run/user/1002/
mkdir -p /run/user/1002/
chown -R podman:podman /run/user/1002/
sudo -iu podman
cd ~/
mkdir -p ~/.bashrc.d
echo "export XDG_RUNTIME_DIR=/run/user/$(id -u)" > ~/.bashrc.d/systemd
source ~/.bashrc.d/systemd
loginctl enable-linger 1002
systemctl --user daemon-reload
podman ps -a --sort names
systemctl --user enable --now podman.socket
systemctl --user status mysleep.service
systemctl --user start mysleep.service
exit
reboot

Pi-hole

# https://canyoublockit.com/
adduser pihole
cd /tmp
curl -sSL https://install.pi-hole.net | bash
pihole -a -p 484C889D0ED1EA4AB930AA518FE3B15E
exit
reboot

apt install unbound -y
# https://docs.pi-hole.net/guides/dns/unbound/
nano /etc/unbound/unbound.conf.d/pi-hole.conf

server:
    # If no logfile is specified, syslog is used
    # logfile: "/var/log/unbound/unbound.log"
    verbosity: 0

    interface: 127.0.0.1
    port: 5335
    do-ip4: yes
    do-udp: yes
    do-tcp: yes

    # May be set to yes if you have IPv6 connectivity
    do-ip6: no

    # You want to leave this to no unless you have *native* IPv6. With 6to4 and
    # Terredo tunnels your web browser should favor IPv4 for the same reasons
    prefer-ip6: no

    # Use this only when you downloaded the list of primary root servers!
    # If you use the default dns-root-data package, unbound will find it automatically
    #root-hints: "/var/lib/unbound/root.hints"

    # Trust glue only if it is within the server's authority
    harden-glue: yes

    # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
    harden-dnssec-stripped: yes

    # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
    # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
    use-caps-for-id: no

    # Reduce EDNS reassembly buffer size.
    # IP fragmentation is unreliable on the Internet today, and can cause
    # transmission failures when large DNS messages are sent via UDP. Even
    # when fragmentation does work, it may not be secure; it is theoretically
    # possible to spoof parts of a fragmented DNS message, without easy
    # detection at the receiving end. Recently, there was an excellent study
    # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
    # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
    # in collaboration with NLnet Labs explored DNS using real world data from the
    # the RIPE Atlas probes and the researchers suggested different values for
    # IPv4 and IPv6 and in different scenarios. They advise that servers should
    # be configured to limit DNS messages sent over UDP to a size that will not
    # trigger fragmentation on typical network links. DNS servers can switch
    # from UDP to TCP when a DNS response is too big to fit in this limited
    # buffer size. This value has also been suggested in DNS Flag Day 2020.
    edns-buffer-size: 1232

    # Perform prefetching of close to expired message cache entries
    # This only applies to domains that have been frequently queried
    prefetch: yes

    # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
    num-threads: 1

    # Ensure kernel buffer is large enough to not lose messages in traffic spikes
    so-rcvbuf: 1m

    # Ensure privacy of local IP ranges
    private-address: 192.168.0.0/16
    private-address: 169.254.0.0/16
    private-address: 172.16.0.0/12
    private-address: 10.0.0.0/8
    private-address: fd00::/8
    private-address: fe80::/10

service unbound restart
nano /etc/lighttpd/lighttpd.conf

...
server.port = 8005
...

pihole -up
service lighttpd restart
dig fail01.dnssec.works @127.0.0.1 -p 5335
dig dnssec.works @127.0.0.1 -p 5335
exit
reboot

Log

ln -s /var/log/nginx /var/www/html/log-nginx
ls -la /var/www/html
exit

cp ~/.bash_history /etc/bash_history_2024-07-25.txt
cat /etc/bash_history_2024-07-25.txt
exit

apt install smartmontools
smartctl -i /dev/sda

Device Model:     minisforum
Serial Number:    L9MLCHC11280472
LU WWN Device Id: 0 000000 000000000
Firmware Version: SBFMJ1.3
User Capacity:    256,060,514,304 bytes [256 GB]
Sector Size:      512 bytes logical/physical
Rotation Rate:    Solid State Device
Form Factor:      M.2
TRIM Command:     Available
Device is:        Not in smartctl database 7.3/5528
ATA Version is:   ACS-4 (minor revision not indicated)
SATA Version is:  SATA 3.2, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is:    Thu Jul 25 16:38:33 2024 MST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

Dashkiosk

apt install snapd -y
apt install sudo links unzip nginx git nano ncdu -y
snap install dashkiosk
snap install ubuntu-frame wpe-webkit-mir-kiosk
snap set wpe-webkit-mir-kiosk daemon=true
snap set wpe-webkit-mir-kiosk url=http://localhost:9400/receiver
exit

wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
# ^C
/snap/wpe-webkit-mir-kiosk/current/bin/setup.sh
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
# ^C
snap set ubuntu-frame daemon=true
exit
reboot

Podman Verify

# apt install systemd-container -y
# machinectl --help
sudo -iu podman
cd ~/
mkdir -p ~/.bashrc.d
echo "export XDG_RUNTIME_DIR=/run/user/$(id -u)" > ~/.bashrc.d/systemd
source ~/.bashrc.d/systemd
loginctl enable-linger 1002
systemctl --user daemon-reload
podman ps -a --sort names
podman image prune
podman volume prune
podman container prune
chown -R podman:podman /home/podman/.config/containers/systemd/
rm -R /home/podman/.config/containers/systemd/*.ignore
rm -R /home/podman/.config/containers/systemd/*.volume
rm -R /home/podman/.config/containers/systemd/*.container

Free File Sync - * Select - A

# sftp://root@free.file.sync.root/etc|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# L:\Git\Linux-Ubuntu-Server\etc

Backup

• Rescuezilla Fri Jul 26 2024 10:45:27 GMT-0700 (Mountain Standard Time)

Restore

• Rescuezilla Fri Jul 26 2024 10:45:27 GMT-0700 (Mountain Standard Time)

Disable IPv6 (Move up next time!!!)

# https://intercom.help/privatevpn/en/articles/6440374-how-to-disable-ipv6-on-ubuntu-and-fedora-linux
nano /etc/sysctl.conf

net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1

sysctl -p
cat /proc/sys/net/ipv6/conf/all/disable_ipv6
exit
reboot

nano /etc/default/grub

# https://opensource.com/article/22/8/disable-ipv6
# GRUB_CMDLINE_LINUX_DEFAULT=""
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1 quiet splash"
# GRUB_CMDLINE_LINUX=""
GRUB_CMDLINE_LINUX="ipv6.disable=1"

grub-mkconfig
exit
reboot

Fix Unbound (Move up next time!!!)

service unbound restart
# http://beelink:8005/admin/settings.php?tab=dns
# https://docs.pi-hole.net/guides/dns/unbound/#configure-pi-hole
127.0.0.1#5335

journalctl -fu unbound-resolvconf.service
systemctl disable --now unbound-resolvconf.service
service unbound restart

Cockpit (Move up next time!!!)

• cockpit
• podman

# apt install chkservice -y
apt-cache rdepends cockpit
apt install cockpit -y
passwd phares
# https://192.168.11.2:9090
# https://blog.while-true-do.io/podman-web-ui-via-cockpit/
apt-get install cockpit cockpit-podman -y
systemctl enable --now cockpit.socket

Podman Create

# apt install systemd-container -y
# machinectl --help
sudo -iu podman
cd ~/
mkdir -p ~/.bashrc.d
echo "export XDG_RUNTIME_DIR=/run/user/$(id -u)" > ~/.bashrc.d/systemd
source ~/.bashrc.d/systemd
loginctl enable-linger 1002
systemctl --user daemon-reload
podman ps -a --sort names
podman pull docker.io/dpage/pgadmin4:latest
podman pull docker.io/gitea/act_runner:nightly
podman pull docker.io/gitea/gitea:latest
podman pull docker.io/library/postgres:13
podman pull docker.io/library/postgres:14
podman pull docker.io/library/postgres:16
podman pull docker.io/library/postgres:16
podman pull docker.io/library/redis:6.2-alpine@sha256:d6c2911ac51b289db208767581a5d154544f2b2fe4914ea5056443f62dc6e900
podman pull docker.io/odoo:15.0
podman pull docker.io/odoo:16.0
podman pull docker.io/vaultwarden/server:latest
podman pull ghcr.io/immich-app/immich-machine-learning:release
podman pull ghcr.io/immich-app/immich-server:release

# sftp://root@free.file.sync.root/home/podman|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# L:\Git\Linux-Ubuntu-Server\home\podman

# ... .service is transient or generated.
# WantedBy=multi-user.target
systemctl --user daemon-reload
systemctl --user start gitea-db
# systemctl --user start gitea-runner
systemctl --user start gitea-server
systemctl --user start immich-db
systemctl --user start immich-learning
systemctl --user start immich-redis
# systemctl --user start immich-server
systemctl --user start odoo-db
systemctl --user start odoo-server
systemctl --user start pgadmin
systemctl --user start vaultwarden-server
podman ps -a --sort names --sort names
smartctl -i /dev/sda

Device Model:     256GB SSD
Serial Number:    CM42ABH1005410
LU WWN Device Id: 5 3a5a27 0100c22ca
Firmware Version: SN11842
User Capacity:    256,060,514,304 bytes [256 GB]
Sector Size:      512 bytes logical/physical
Rotation Rate:    Solid State Device
Form Factor:      M.2
TRIM Command:     Available, deterministic, zeroed
Device is:        Not in smartctl database 7.3/5528
ATA Version is:   ACS-4 (minor revision not indicated)
SATA Version is:  SATA 3.2, 6.0 Gb/s (current: 6.0 Gb/s)
Local Time is:    Fri Jul 26 11:55:12 2024 MST
SMART support is: Available - device has SMART capability.
SMART support is: Enabled

Copy Slideshow Photos

lvs -a
lsblk -I 8 -o NAME,SIZE,TYPE,FSUSED,FSUSE%
mkdir /mnt/usb
mount /dev/sdb2 /mnt/usb

# cp -R ... ...
# sftp://root@free.file.sync.root/mnt/usb/var/www/html/Images-c9dbce3b-Results/thumbs|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# sftp://root@free.file.sync.root/var/www/html/Images-c9dbce3b-Results/thumbs|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519

OS-var-thumbs-server  7/26/2024  11:59:57 AM
Completed successfully
Warnings:		2
Items processed:		156,388 (35.7 GB)
Total time:		01:31:53
Errors and warnings:
11:59:58 AM	Warning:	The following folders do not yet exist:
sftp://root@free.file.sync.root/var/www/html/Images-c9dbce3b-Results/thumbs
The folders are created automatically when needed.
12:00:30 PM	Warning:	Database file is not av

umount /mnt/usb
# http://192.168.11.2:9400/admin
# Slideshow
# http://127.0.0.1:8080/slideshow/index.html?nocache=2024-07-01-11-36
# Local
# http://192.168.11.2:8080/slideshow/index.html?nocache=2024-07-01-11-36

Free File Sync - * Select - B

# sftp://root@free.file.sync.root/etc|chan=10|keyfile=C:\Users\phares\.ssh\id_ed25519
# L:\Git\Linux-Ubuntu-Server\etc

cp ~/.bash_history /etc/bash_history_2024-07-26.txt
exit
shutdown now

Backup

• Rescuezilla Fri Jul 26 2024 13:35:04 GMT-0700 (Mountain Standard Time)

nginx

nginx -t
systemctl start nginx
nginx -s reload

certbot

# https://certbot.eff.org/instructions?ws=nginx&os=ubuntufocal
# apt-get install certbot
snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot
mkdir -p /var/www/certbot/.well-known/acme-challenge
touch /var/www/certbot/.well-known/acme-challenge/smwqgmeNx04tA3HC05I8_gtpqLTkjRAotHdfp0E5LnM
# certbot --nginx
certbot certonly --nginx
# mikepharesjr@msn.com
# 1: affirm.ddns.net
# 2: codeserver.ddns.net
# 3: dashkiosk.ddns.net
# 4: dockge.ddns.net
# 5: docmost.ddns.net
# 6: gitea.ddns.net
# 7: immich.ddns.net
# 8: incus.ddns.net
# 9: kestra.ddns.net
# 10: lxconsole.ddns.net
# 11: music.ddns.net
# 12: phares.ddns.net
# 13: phares3757.ddns.net
# 14: quartz.ddns.net
# 15: vaultwarden.ddns.net
# 16: phares.duckdns.org
# 17: docmost.phares.duckdns.org
# 18: gitea.phares.duckdns.org
# 19: immich.phares.duckdns.org
# 20: music.phares.duckdns.org
# 21: quartz.phares.duckdns.org
# 22: vaultwarden.phares.duckdns.org
# always pick phares3757 first!
# 11 1 14 15 16 17 18 19
# http://immich3757.ddns.net/.well-known/acme-challenge/smwqgmeNx04tA3HC05I8_gtpqLTkjRAotHdfp0E5LnM
systemctl list-timers
# q
# /etc/crontab/
# /etc/cron.*/*
certbot renew --dry-run
# https://www.f5.com/company/blog/nginx/using-free-ssltls-certificates-from-lets-encrypt-with-nginx
nano /etc/logrotate.d/letsencrypt

/var/log/letsencrypt/*.log {
    rotate 12
    weekly
    compress
    missingok
}

nginx -t
systemctl start nginx
nginx -s reload

how to run a shell scripts at every login (Move up next time!!!)

• how-to-run-a-shell-scripts-at-every-login

nano ~/.bash_profile
cd ~/
echo "export XDG_RUNTIME_DIR=/run/user/$(id -u)" > ~/.bashrc.d/systemd
source ~/.bashrc.d/systemd
loginctl enable-linger 1002
systemctl --user daemon-reload
podman ps -a --sort names

Setup and Backup Docker Gitea

# https://docs.gitea.com/administration/config-cheat-sheet?_highlight=enable_push_create_org/administration/config-cheat-sheet#repository-repository
systemctl --user daemon-reload
systemctl --user stop gitea-server
systemctl --user stop gitea-db
podman volume prune
systemctl --user daemon-reload
systemctl --user start gitea-db
systemctl --user start gitea-server
podman exec -ti gitea-server /bin/bash
exit
mkdir backup-gitea
cd backup-gitea
podman cp gitea-server:/etc/gitea/app.ini .

Username: gitea
Email: gitea@phares.duckdns.org
Username: mikep
Email: mikepharesjr@msn.com
Username: phares
Email: mike.phares@infineon.com
Organization: phares3757
Full Name: Mike Phares

cd backup-gitea
podman volume export systemd-gitea-db-data --output gitea-db-data-2024-07-26-21-55.tar
podman volume export systemd-gitea-server-data --output gitea-server-data-2024-07-26-22-45.tar
podman volume export systemd-gitea-server-config --output gitea-server-config-2024-07-26-22-46.tar
systemctl --user daemon-reload
systemctl --user stop gitea-server
systemctl --user stop gitea-db
systemctl --user start gitea-db
systemctl --user start gitea-server
podman cp pgadmin:/var/lib/pgadmin/storage/mikepharesjr_msn.com/gitea-2024-07-26-20-06.sql .
podman cp pgadmin:/var/lib/pgadmin/storage/mikepharesjr_msn.com/gitea-2024-07-26-20-23.sql .
podman cp pgadmin:/var/lib/pgadmin/storage/mikepharesjr_msn.com/gitea-2024-07-26-21-42.sql .
podman cp pgadmin:/var/lib/pgadmin/storage/mikepharesjr_msn.com/gitea-2024-07-26-22-47.sql .

L:/DevOps/Mesa_FI/File-Folder-Helper/bin/Release/net8.0/win-x64/publish/File-Folder-Helper.exe

podman volume export systemd-gitea-db-data --output gitea-db-data-2024-07-26-23-00.tar
podman cp pgadmin:/var/lib/pgadmin/storage/mikepharesjr_msn.com/gitea-2024-07-26-23-00.sql .
podman volume export systemd-gitea-server-data --output gitea-server-data-2024-07-26-23-01.tar
podman volume export systemd-gitea-server-config --output gitea-server-config-2024-07-26-23-01.tar
systemctl --user daemon-reload
systemctl --user stop gitea-server
systemctl --user stop gitea-db
systemctl --user start gitea-db
systemctl --user start gitea-server

Backup

• Rescuezilla Sat Jul 27 2024 07:47:40 GMT-0700 (Mountain Standard Time)

Import passwords to VaultWarden

Email: vaultwarden@phares.duckdns.org
Email: mikepharesjr@msn.com
Email: mike.phares@infineon.com
Email: kphares501@gmail.com
Email: lphares0907@outlook.com
Email: cphares0917@outlook.com
Organization: phares3757

mkdir backup-vaultwarden
cd backup-vaultwarden
# https://github.com/dani-garcia/vaultwarden/wiki/Enabling-admin-page#secure-the-admin_token
apt-cache rdepends argon2
apt install argon2
echo -n "mikepharesjr" | argon2 "$(openssl rand -base64 32)" -e -id -k 65540 -t 3 -p 4 | sed 's#\$#\$\$#g'
systemctl --user daemon-reload
systemctl --user stop vaultwarden-server
systemctl --user stop vaultwarden-db
podman volume prune
systemctl --user start vaultwarden-db
systemctl --user start vaultwarden-server
podman exec -ti vaultwarden-server /bin/bash
# podman cp vaultwarden-server:/data/db.sqlite3 .
podman cp pgadmin:/var/lib/pgadmin/storage/mikepharesjr_msn.com/vaultwarden-2024-07-27-09-10.sql .
podman volume export systemd-vaultwarden-db-data --output vaultwarden-db-data-2024-07-27-09-10.tar
podman volume export systemd-vaultwarden-server-data --output vaultwarden-db-data-2024-07-27-09-10.tar

ADGuard

• adguard

snap install adguard-home

certbot

# https://certbot.eff.org/instructions?ws=nginx&os=ubuntufocal
apt-get remove certbot -y
snap install --classic certbot
ln -s /snap/bin/certbot /usr/bin/certbot
mkdir -p /var/www/certbot/.well-known/acme-challenge
touch /var/www/certbot/.well-known/acme-challenge/Yx5DGIJAmlnqCPrcxlS0fwsBTuR2XKpjdJB_ljDZ9BE
cd /var/www/certbot/.well-known/acme-challenge
ls
# certbot --nginx
certbot certonly --nginx
# 3 1 4 5 6 7 8 9 10 11 12 13 14 15 16 17 18 19 20 21
# always pick phares3757 first!
cd /etc/
mkdir /etc/duckdns
cd /etc/duckdns
nano duck.sh

echo url="https://www.duckdns.org/update?domains=affirm&token=1d3fc707-7052-4459-a624-fb01250f00b9&verbose=true&ip=" | curl -k -o /etc/duckdns/duck.log -K -
# echo url="https://www.duckdns.org/update?domains=ha-phares&token=1d3fc707-7052-4459-a624-fb01250f00b9&verbose=true&ip=" | curl -k -o /etc/duckdns/duck.log -K -
echo url="https://www.duckdns.org/update?domains=phares&token=1d3fc707-7052-4459-a624-fb01250f00b9&verbose=true&ip=" | curl -k -o /etc/duckdns/duck.log -K -
echo url="https://www.duckdns.org/update?domains=synology-phares&token=1d3fc707-7052-4459-a624-fb01250f00b9&verbose=true&ip=" | curl -k -o /etc/duckdns/duck.log -K -

chmod 700 duck.sh
./duck.sh
cat duck.log
curl https://get.acme.sh | sh -s email=mikepharesjr@msn.com
crontab -e

*/5 * * * * /etc/duckdns/duck.sh >/dev/null 2>&1

# https://www.snbforums.com/threads/duckdns-with-letsencrypt.86114/
curl https://get.acme.sh | sh -s email=mikepharesjr@msn.com
find / -name "acme.sh" 2>/dev/null
# /root/.acme.sh/acme.sh
# /root/acme.sh-master/acme.sh
cd /root/acme.sh-master
export DuckDNS_Token=1d3fc707-7052-4459-a624-fb01250f00b9
./acme.sh --register-account -m mikepharesjr@msn.com
./acme.sh --set-default-ca --server letsencrypt
# ./acme.sh --issue --dns dns_duckdns -d phares.duckdns.org --ecc --home ~/acme.sh-master
# ./acme.sh --issue --dns dns_duckdns -d phares.duckdns.org --dnssleep 120 --days 90 --ecc --server https://acme-v02.api.letsencrypt.org/directory
./acme.sh --issue --dns dns_duckdns -d '*.phares.duckdns.org' --dnssleep 120 --days 90 --ecc --server https://acme-v02.api.letsencrypt.org/directory
./acme.sh --issue --dns dns_duckdns -d affirm.duckdns.org --dnssleep 120 --days 90 --ecc --server https://acme-v02.api.letsencrypt.org/directory
# ./acme.sh --issue --dns dns_duckdns -d ha-phares.duckdns.org --dnssleep 120 --days 90 --ecc --server https://acme-v02.api.letsencrypt.org/directory
# ./acme.sh --issue --dns dns_duckdns -d synology-phares.duckdns.org --dnssleep 120 --days 90 --ecc --server https://acme-v02.api.letsencrypt.org/directory

certbot certonly --nginx

3 1 2 4 5 6 7 8 9 10 11 13 14 15 16 17 20

DNS Name: phares3757.ddns.net
DNS Name: affirm.ddns.net
DNS Name: chat.phares.duckdns.org
DNS Name: drive.phares.duckdns.org
DNS Name: gitea.phares.duckdns.org
DNS Name: ha.phares.duckdns.org
DNS Name: immich.phares.duckdns.org
DNS Name: music.phares.duckdns.org
DNS Name: phares.duckdns.org
DNS Name: photos.phares.duckdns.org
DNS Name: quartz.phares.duckdns.org
DNS Name: traccar.phares.duckdns.org
DNS Name: vaultwarden.phares.duckdns.org

Backup Docker Immich

Restore DB for Immich

Gitea Runner

cd /tmp
wget https://gitea.com/gitea/act_runner/releases/download/v0.2.10/act_runner-0.2.10-linux-amd64
chmod +x act_runner-0.2.10-linux-amd64
./act_runner-0.2.10-linux-amd64 -v
./act_runner-0.2.10-linux-amd64 register --no-interactive --instance http://192.168.11.2:3000/ --token asdf
./act_runner-0.2.10-linux-amd64 daemon

cd /home/phares
cat .runner
./act_runner-0.2.10-linux-amd64 daemon

cp /home/phares/act_runner-0.2.10-linux-amd64 /usr/local/bin/act_runner
./act_runner-0.2.10-linux-amd64 register --no-interactive --config /etc/act_runner/config.yaml --instance http://192.168.11.2:3000/ --name beelink-cmd-phares3757 --token asdf

# gitea-runner
version: "3.8"
services:
  runner:
    environment:
      # CONFIG_FILE: /config.yaml
      GITEA_INSTANCE_URL: ${INSTANCE_URL}
      GITEA_RUNNER_LABELS: ${RUNNER_LABELS}
      GITEA_RUNNER_NAME: ${RUNNER_NAME}
      GITEA_RUNNER_REGISTRATION_TOKEN: ${REGISTRATION_TOKEN}
    image: gitea/act_runner:nightly
    volumes:
      # - ./config.yaml:/config.yaml
      - runner-data:/data
      - /var/run/docker.sock:/var/run/docker.sock
networks: {}
volumes:
  runner-data:
    driver: local

Common

nginx -t
nginx -s reload
cat /etc/crontab
systemctl restart nginx
cat /etc/ssh/sshd_config
lsof -i -P -n | grep LISTEN
netstat -tulpn | grep LISTEN
lsblk -I 8 -o NAME,SIZE,TYPE,FSUSED,FSUSE%
(echo >/dev/tcp/localhost/5433) &>/dev/null && echo "Open 5433" || echo "Close 5433"