2024-06-03
This commit is contained in:
339
_-Review/game-slug.md
Normal file
339
_-Review/game-slug.md
Normal file
@ -0,0 +1,339 @@
|
||||
---
|
||||
type: "topic"
|
||||
created: "2024-01-06T01:25:36.074Z"
|
||||
updated: "2024-01-06T01:25:36.074Z"
|
||||
---
|
||||
|
||||
# game-slug
|
||||
|
||||
```bash
|
||||
apt-get update
|
||||
apt-get upgrade
|
||||
apt-get install links unzip net-tools ufw nginx git -y
|
||||
reboot
|
||||
|
||||
|
||||
|
||||
|
||||
|
||||
ip a
|
||||
ncdu
|
||||
lsb_release -a
|
||||
ufw enable
|
||||
ufw allow from 192.168.0.0/24 comment "04) 192.168.0.0/24"
|
||||
ufw status numbered
|
||||
cd /home/ubuntu/
|
||||
wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh
|
||||
chmod +x ./dotnet-install.sh
|
||||
./dotnet-install.sh --channel 8.0
|
||||
ln -s /home/ubuntu/.dotnet/dotnet /usr/local/bin/dotnet
|
||||
dotnet --info
|
||||
export DOTNET_ROOT=$HOME/.dotnet
|
||||
export PATH=$PATH:$HOME/.dotnet:$HOME/.dotnet/tools
|
||||
dotnet --info
|
||||
timedatectl set-timezone America/Phoenix
|
||||
snap install dashkiosk
|
||||
snap restart dashkiosk
|
||||
snap install ubuntu-frame wpe-webkit-mir-kiosk
|
||||
snap set wpe-webkit-mir-kiosk url=http://localhost:9400/receiver
|
||||
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
|
||||
/snap/wpe-webkit-mir-kiosk/current/bin/setup.sh
|
||||
wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver
|
||||
snap set ubuntu-frame daemon=true
|
||||
apt-get install -y ca-certificates
|
||||
openssl s_client -showcerts -connect DESKTOP-H6JG91B:443 </dev/null 2>/dev/null|openssl x509 -outform PEM >DESKTOP-H6JG91B.crt
|
||||
apt-get install nano
|
||||
nano /etc/hosts
|
||||
nano /etc/nginx/sites-available/default
|
||||
echo >/etc/nginx/sites-available/default && nano /etc/nginx/sites-available/default
|
||||
```
|
||||
|
||||
```conf
|
||||
server {
|
||||
listen 80 default_server;
|
||||
listen [::]:80 default_server;
|
||||
root /var/www/html;
|
||||
index index.html index.htm index.nginx-debian.html;
|
||||
server_name _;
|
||||
location / {
|
||||
try_files $uri $uri/ =404;
|
||||
}
|
||||
}
|
||||
server {
|
||||
ssl_certificate 'localhost.crt';
|
||||
ssl_certificate_key 'localhost.key';
|
||||
listen 443 default_server ssl http2;
|
||||
ssl_protocols TLSv1.2 TLSv1.1 TLSv1;
|
||||
listen [::]:443 default_server ssl http2;
|
||||
server_name _;
|
||||
location / {
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
proxy_pass http://localhost:3000/;
|
||||
proxy_read_timeout 600s;
|
||||
proxy_send_timeout 600s;
|
||||
}
|
||||
}
|
||||
```
|
||||
|
||||
```bash
|
||||
systemctl restart nginx
|
||||
nginx -t
|
||||
nginx -s reload
|
||||
nano /home/ubuntu/localhost.conf
|
||||
echo >/home/ubuntu/localhost.conf && nano /home/ubuntu/localhost.conf
|
||||
```
|
||||
|
||||
```conf
|
||||
[req]
|
||||
default_bits = 2048
|
||||
default_keyfile = localhost.key
|
||||
distinguished_name = req_distinguished_name
|
||||
req_extensions = req_ext
|
||||
x509_extensions = v3_ca
|
||||
|
||||
[req_distinguished_name]
|
||||
countryName = Country Name (2 letter code)
|
||||
countryName_default = US
|
||||
stateOrProvinceName = State or Province Name (full name)
|
||||
stateOrProvinceName_default = Arizona
|
||||
localityName = Locality Name (eg, city)
|
||||
localityName_default = Mesa
|
||||
organizationName = Organization Name (eg, company)
|
||||
organizationName_default = Infineon Technologies Americas Corp.
|
||||
organizationalUnitName = organizationalunit
|
||||
organizationalUnitName_default = Development
|
||||
commonName = Common Name (e.g. server FQDN or YOUR name)
|
||||
commonName_default = phares3757.ddns.net
|
||||
commonName_max = 64
|
||||
|
||||
[req_ext]
|
||||
subjectAltName = @alt_names
|
||||
|
||||
[v3_ca]
|
||||
subjectAltName = @alt_names
|
||||
|
||||
[alt_names]
|
||||
DNS.1 = phares3757.ddns.net
|
||||
DNS.2 = beelink
|
||||
DNS.3 = localhost
|
||||
DNS.4 = 127.0.0.1
|
||||
```
|
||||
|
||||
```bash
|
||||
openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/localhost.key -out /etc/nginx/localhost.crt -config /home/ubuntu/localhost.conf
|
||||
ls /etc/nginx
|
||||
apt install update-manager-core
|
||||
exit
|
||||
do-release-upgrade
|
||||
exit
|
||||
adduser gogs
|
||||
cd /home/gogs
|
||||
wget https://dl.gogs.io/0.13.0/gogs_0.13.0_linux_amd64.tar.gz
|
||||
tar -xvzf gogs_0.13.0_linux_amd64.tar.gz
|
||||
rm gogs_0.13.0_linux_amd64.tar.gz
|
||||
cd gogs
|
||||
ufw status numbered
|
||||
./gogs web
|
||||
mkdir /home/gogs/gogs-repositories
|
||||
chown gogs /home/gogs -R
|
||||
chgrp gogs /home/gogs -R
|
||||
nano /home/gogs/gogs/custom/conf/app.ini
|
||||
nano /etc/systemd/system/gogs-daemon.service
|
||||
systemctl enable gogs-daemon
|
||||
systemctl start gogs-daemon
|
||||
systemctl status gogs-daemon.service
|
||||
systemctl daemon-reload
|
||||
journalctl -fu gogs-daemon.service
|
||||
journalctl --rotate
|
||||
journalctl --vacuum-time=1s
|
||||
cd /home/gogs
|
||||
git clone https://github.com/Kos-M/GogsThemes
|
||||
exit
|
||||
cp ~/.bash_history /home/ubuntu/bash-history-2023-10-17.txt
|
||||
chown mike /home/ubuntu -R
|
||||
chgrp mike /home/ubuntu -R
|
||||
exit
|
||||
adduser pi-hole
|
||||
cd pi-hole
|
||||
curl -sSL https://install.pi-hole.net | bash
|
||||
```
|
||||
|
||||
```conf
|
||||
# http://pi.hole/admin
|
||||
# http://192.168.0.118/admin
|
||||
fUiY4SYS
|
||||
```
|
||||
|
||||
```conf
|
||||
nano /etc/lighttpd/lighttpd.conf
|
||||
```
|
||||
|
||||
```conf
|
||||
server.port = 8005
|
||||
```
|
||||
|
||||
```conf
|
||||
service lighttpd restart
|
||||
pihole -a -p 4hink
|
||||
apt install unbound
|
||||
; https://docs.pi-hole.net/guides/dns/unbound/
|
||||
nano /etc/unbound/unbound.conf.d/pi-hole.conf
|
||||
```
|
||||
|
||||
```conf
|
||||
server:
|
||||
# If no logfile is specified, syslog is used
|
||||
# logfile: "/var/log/unbound/unbound.log"
|
||||
verbosity: 0
|
||||
|
||||
interface: 127.0.0.1
|
||||
port: 5335
|
||||
do-ip4: yes
|
||||
do-udp: yes
|
||||
do-tcp: yes
|
||||
|
||||
# May be set to yes if you have IPv6 connectivity
|
||||
do-ip6: no
|
||||
|
||||
# You want to leave this to no unless you have *native* IPv6. With 6to4 and
|
||||
# Terredo tunnels your web browser should favor IPv4 for the same reasons
|
||||
prefer-ip6: no
|
||||
|
||||
# Use this only when you downloaded the list of primary root servers!
|
||||
# If you use the default dns-root-data package, unbound will find it automatically
|
||||
#root-hints: "/var/lib/unbound/root.hints"
|
||||
|
||||
# Trust glue only if it is within the server's authority
|
||||
harden-glue: yes
|
||||
|
||||
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
|
||||
harden-dnssec-stripped: yes
|
||||
|
||||
# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
|
||||
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
|
||||
use-caps-for-id: no
|
||||
|
||||
# Reduce EDNS reassembly buffer size.
|
||||
# IP fragmentation is unreliable on the Internet today, and can cause
|
||||
# transmission failures when large DNS messages are sent via UDP. Even
|
||||
# when fragmentation does work, it may not be secure; it is theoretically
|
||||
# possible to spoof parts of a fragmented DNS message, without easy
|
||||
# detection at the receiving end. Recently, there was an excellent study
|
||||
# >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<<
|
||||
# by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/)
|
||||
# in collaboration with NLnet Labs explored DNS using real world data from the
|
||||
# the RIPE Atlas probes and the researchers suggested different values for
|
||||
# IPv4 and IPv6 and in different scenarios. They advise that servers should
|
||||
# be configured to limit DNS messages sent over UDP to a size that will not
|
||||
# trigger fragmentation on typical network links. DNS servers can switch
|
||||
# from UDP to TCP when a DNS response is too big to fit in this limited
|
||||
# buffer size. This value has also been suggested in DNS Flag Day 2020.
|
||||
edns-buffer-size: 1232
|
||||
|
||||
# Perform prefetching of close to expired message cache entries
|
||||
# This only applies to domains that have been frequently queried
|
||||
prefetch: yes
|
||||
|
||||
# One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1.
|
||||
num-threads: 1
|
||||
|
||||
# Ensure kernel buffer is large enough to not lose messages in traffic spikes
|
||||
so-rcvbuf: 1m
|
||||
|
||||
# Ensure privacy of local IP ranges
|
||||
private-address: 192.168.0.0/16
|
||||
private-address: 169.254.0.0/16
|
||||
private-address: 172.16.0.0/12
|
||||
private-address: 10.0.0.0/8
|
||||
private-address: fd00::/8
|
||||
private-address: fe80::/10
|
||||
```
|
||||
|
||||
```conf
|
||||
service unbound restart
|
||||
# http://beelink:8005/admin/settings.php?tab=dns
|
||||
# https://docs.pi-hole.net/guides/dns/unbound/
|
||||
127.0.0.1#5335
|
||||
```
|
||||
|
||||
```bash
|
||||
apt-get install syncthing
|
||||
apt-get install apt-transport-https
|
||||
adduser syncthing
|
||||
cat /etc/passwd | cut -d: -f1
|
||||
systemctl enable syncthing@syncthing.service
|
||||
systemctl start syncthing@syncthing.service
|
||||
systemctl status syncthing@syncthing.service
|
||||
journalctl -e -u syncthing@syncthing.service
|
||||
nano /home/syncthing/.config/syncthing/config.xml
|
||||
```
|
||||
|
||||
```xml
|
||||
<address>0.0.0.0:8384</address>
|
||||
```
|
||||
|
||||
```bash
|
||||
systemctl restart syncthing@syncthing.service
|
||||
chown syncthing /home/syncthing -R
|
||||
chgrp syncthing /home/syncthing -R
|
||||
```
|
||||
|
||||
```bash
|
||||
ufw allow from 192.168.0.0/24 to any port 22 comment "01) SSH"
|
||||
ufw allow to 0.0.0.0/0 port 80 comment "02) HTTP"
|
||||
ufw allow to 0.0.0.0/0 port 443 comment "03) HTTPS"
|
||||
ufw allow from 192.168.0.0/24 to any port 8005 comment "04) Pi-hole"
|
||||
ufw allow from 192.168.0.0/24 to any port 53 comment "05) DNS"
|
||||
ufw allow from 192.168.0.0/24 to any port 67 comment "06) Unknown"
|
||||
ufw allow from 192.168.0.0/24 to any port 9400 comment "07) dashkiosk"
|
||||
ufw allow from 192.168.0.0/24 to any port 3000 comment "08) gogs"
|
||||
ufw allow from 192.168.0.0/24 to any port 8384 comment "09) syncthing"
|
||||
ufw allow from 192.168.0.0/24 to any port 22000 comment "10) syncthing"
|
||||
```
|
||||
|
||||
```conf
|
||||
To Action From
|
||||
-- ------ ----
|
||||
22 ALLOW IN 192.168.0.0/24 # 01) SSH
|
||||
80 ALLOW IN Anywhere # 02) HTTP
|
||||
443 ALLOW IN Anywhere # 03) HTTPS
|
||||
8005 ALLOW IN 192.168.0.0/24 # 04) Pi-hole
|
||||
53 ALLOW IN 192.168.0.0/24 # 05) DNS
|
||||
67 ALLOW IN 192.168.0.0/24 # 06) Unknown
|
||||
9400 ALLOW IN 192.168.0.0/24 # 07) dashkiosk
|
||||
3000 ALLOW IN 192.168.0.0/24 # 08) gogs
|
||||
8384 ALLOW IN 192.168.0.0/24 # 09) syncthing
|
||||
22000 ALLOW IN 192.168.0.0/24 # 10) syncthing
|
||||
|
||||
```
|
||||
|
||||
```bash
|
||||
echo >/etc/hosts && nano /etc/hosts
|
||||
```
|
||||
|
||||
```conf
|
||||
127.0.0.1 localhost
|
||||
127.0.0.1 beelink
|
||||
127.0.1.1 phares3757.ddsn.net
|
||||
# The following lines are desirable for IPv6 capable hosts
|
||||
::1 ip6-localhost ip6-loopback
|
||||
fe00::0 ip6-localnet
|
||||
ff00::0 ip6-mcastprefix
|
||||
ff02::1 ip6-allnodes
|
||||
ff02::2 ip6-allrouters
|
||||
```
|
||||
|
||||
```bash
|
||||
adduser twingate
|
||||
curl -s https://binaries.twingate.com/client/linux/install.sh | bash
|
||||
twingate setup
|
||||
twingate start
|
||||
|
||||
|
||||
curl "https://binaries.twingate.com/connector/setup.sh" | sudo TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMDc3IiwiZGlkIjoiMTAwMzc4OSIsImp0aSI6IjIyNTJmMjIwLWNkNjQtNDlhYy04YjRhLTE0NDFjOWUyM2U5ZSIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDE0Mzc4LCJpYXQiOjE2OTgwMTA3NzgsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAxMTA3OCwicm5ldGlkIjoiNzIyNzcifQ.aQnQMUGqM5fBEbR781u-lCPjltfmb1TdZUJTNJ_GYiiSJiemJiIrVK80xHQlIpPB2kot34nxmpvVK4kZK64X3w" TWINGATE_REFRESH_TOKEN="AWOLHa11QFXENAyov_w-KQ5ZC-keHm2w_ActZP8M7hBpy2NOC7EDT2bkEpBCO-YLTd40Pp-pdplIJu0lvdvNBAGINHopYnX2XOgaMxS5tbPPTsHRlnQpckaXYuOwu28W0ORs8g" TWINGATE_NETWORK="phares" bash
|
||||
|
||||
curl "https://binaries.twingate.com/connector/setup.sh" | TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMjIxIiwiZGlkIjoiMTAwNDI3NCIsImp0aSI6ImQxMWIwYWIzLWJjZTgtNDIxZS05MzAwLTA1ZmFkZDk5YjllMiIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDM3MTgzLCJpYXQiOjE2OTgwMzM1ODMsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAzMzg4Mywicm5ldGlkIjoiNzIyNzcifQ.7YqB5iz1lzsfb6adLPx53NNA3dJ1NnuzmNhyyi4FzPdMTGxn3qbHD1olvWpEEi69D8gAvF5K77DPwE1BHxo4Qw" TWINGATE_REFRESH_TOKEN="HypbNsUdue5Dh3s5W4ePR9RIkFDsjEGiNJFJDf_cLdixkn94ieMypUZMH_XIc4-13L_PuQ61M7RWG5rF21ZRAgFf1MuIMf5kJGhuQq_VG7_E_6Q8NMLAajP5W05jTofB-sY3Ig" TWINGATE_NETWORK="phares" bash
|
||||
```
|
||||
Reference in New Issue
Block a user