--- type: "topic" created: "2024-01-06T01:25:36.074Z" updated: "2024-01-06T01:25:36.074Z" --- # game-slug ```bash apt-get update apt-get upgrade apt-get install links unzip net-tools ufw nginx git -y reboot ip a ncdu lsb_release -a ufw enable ufw allow from 192.168.0.0/24 comment "04) 192.168.0.0/24" ufw status numbered cd /home/ubuntu/ wget https://dot.net/v1/dotnet-install.sh -O dotnet-install.sh chmod +x ./dotnet-install.sh ./dotnet-install.sh --channel 8.0 ln -s /home/ubuntu/.dotnet/dotnet /usr/local/bin/dotnet dotnet --info export DOTNET_ROOT=$HOME/.dotnet export PATH=$PATH:$HOME/.dotnet:$HOME/.dotnet/tools dotnet --info timedatectl set-timezone America/Phoenix snap install dashkiosk snap restart dashkiosk snap install ubuntu-frame wpe-webkit-mir-kiosk snap set wpe-webkit-mir-kiosk url=http://localhost:9400/receiver wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver /snap/wpe-webkit-mir-kiosk/current/bin/setup.sh wpe-webkit-mir-kiosk.cog http://localhost:9400/receiver snap set ubuntu-frame daemon=true apt-get install -y ca-certificates openssl s_client -showcerts -connect DESKTOP-H6JG91B:443 /dev/null|openssl x509 -outform PEM >DESKTOP-H6JG91B.crt apt-get install nano nano /etc/hosts nano /etc/nginx/sites-available/default echo >/etc/nginx/sites-available/default && nano /etc/nginx/sites-available/default ``` ```conf server { listen 80 default_server; listen [::]:80 default_server; root /var/www/html; index index.html index.htm index.nginx-debian.html; server_name _; location / { try_files $uri $uri/ =404; } } server { ssl_certificate 'localhost.crt'; ssl_certificate_key 'localhost.key'; listen 443 default_server ssl http2; ssl_protocols TLSv1.2 TLSv1.1 TLSv1; listen [::]:443 default_server ssl http2; server_name _; location / { proxy_set_header Host $host; proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Forwarded-Proto $scheme; proxy_pass http://localhost:3000/; proxy_read_timeout 600s; proxy_send_timeout 600s; } } ``` ```bash systemctl restart nginx nginx -t nginx -s reload nano /home/ubuntu/localhost.conf echo >/home/ubuntu/localhost.conf && nano /home/ubuntu/localhost.conf ``` ```conf [req] default_bits = 2048 default_keyfile = localhost.key distinguished_name = req_distinguished_name req_extensions = req_ext x509_extensions = v3_ca [req_distinguished_name] countryName = Country Name (2 letter code) countryName_default = US stateOrProvinceName = State or Province Name (full name) stateOrProvinceName_default = Arizona localityName = Locality Name (eg, city) localityName_default = Mesa organizationName = Organization Name (eg, company) organizationName_default = Infineon Technologies Americas Corp. organizationalUnitName = organizationalunit organizationalUnitName_default = Development commonName = Common Name (e.g. server FQDN or YOUR name) commonName_default = phares3757.ddns.net commonName_max = 64 [req_ext] subjectAltName = @alt_names [v3_ca] subjectAltName = @alt_names [alt_names] DNS.1 = phares3757.ddns.net DNS.2 = beelink DNS.3 = localhost DNS.4 = 127.0.0.1 ``` ```bash openssl req -x509 -nodes -days 365 -newkey rsa:2048 -keyout /etc/nginx/localhost.key -out /etc/nginx/localhost.crt -config /home/ubuntu/localhost.conf ls /etc/nginx apt install update-manager-core exit do-release-upgrade exit adduser gogs cd /home/gogs wget https://dl.gogs.io/0.13.0/gogs_0.13.0_linux_amd64.tar.gz tar -xvzf gogs_0.13.0_linux_amd64.tar.gz rm gogs_0.13.0_linux_amd64.tar.gz cd gogs ufw status numbered ./gogs web mkdir /home/gogs/gogs-repositories chown gogs /home/gogs -R chgrp gogs /home/gogs -R nano /home/gogs/gogs/custom/conf/app.ini nano /etc/systemd/system/gogs-daemon.service systemctl enable gogs-daemon systemctl start gogs-daemon systemctl status gogs-daemon.service systemctl daemon-reload journalctl -fu gogs-daemon.service journalctl --rotate journalctl --vacuum-time=1s cd /home/gogs git clone https://github.com/Kos-M/GogsThemes exit cp ~/.bash_history /home/ubuntu/bash-history-2023-10-17.txt chown mike /home/ubuntu -R chgrp mike /home/ubuntu -R exit adduser pi-hole cd pi-hole curl -sSL https://install.pi-hole.net | bash ``` ```conf # http://pi.hole/admin # http://192.168.0.118/admin fUiY4SYS ``` ```conf nano /etc/lighttpd/lighttpd.conf ``` ```conf server.port = 8005 ``` ```conf service lighttpd restart pihole -a -p 4hink apt install unbound ; https://docs.pi-hole.net/guides/dns/unbound/ nano /etc/unbound/unbound.conf.d/pi-hole.conf ``` ```conf server: # If no logfile is specified, syslog is used # logfile: "/var/log/unbound/unbound.log" verbosity: 0 interface: 127.0.0.1 port: 5335 do-ip4: yes do-udp: yes do-tcp: yes # May be set to yes if you have IPv6 connectivity do-ip6: no # You want to leave this to no unless you have *native* IPv6. With 6to4 and # Terredo tunnels your web browser should favor IPv4 for the same reasons prefer-ip6: no # Use this only when you downloaded the list of primary root servers! # If you use the default dns-root-data package, unbound will find it automatically #root-hints: "/var/lib/unbound/root.hints" # Trust glue only if it is within the server's authority harden-glue: yes # Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS harden-dnssec-stripped: yes # Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes # see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details use-caps-for-id: no # Reduce EDNS reassembly buffer size. # IP fragmentation is unreliable on the Internet today, and can cause # transmission failures when large DNS messages are sent via UDP. Even # when fragmentation does work, it may not be secure; it is theoretically # possible to spoof parts of a fragmented DNS message, without easy # detection at the receiving end. Recently, there was an excellent study # >>> Defragmenting DNS - Determining the optimal maximum UDP response size for DNS <<< # by Axel Koolhaas, and Tjeerd Slokker (https://indico.dns-oarc.net/event/36/contributions/776/) # in collaboration with NLnet Labs explored DNS using real world data from the # the RIPE Atlas probes and the researchers suggested different values for # IPv4 and IPv6 and in different scenarios. They advise that servers should # be configured to limit DNS messages sent over UDP to a size that will not # trigger fragmentation on typical network links. DNS servers can switch # from UDP to TCP when a DNS response is too big to fit in this limited # buffer size. This value has also been suggested in DNS Flag Day 2020. edns-buffer-size: 1232 # Perform prefetching of close to expired message cache entries # This only applies to domains that have been frequently queried prefetch: yes # One thread should be sufficient, can be increased on beefy machines. In reality for most users running on small networks or on a single machine, it should be unnecessary to seek performance enhancement by increasing num-threads above 1. num-threads: 1 # Ensure kernel buffer is large enough to not lose messages in traffic spikes so-rcvbuf: 1m # Ensure privacy of local IP ranges private-address: 192.168.0.0/16 private-address: 169.254.0.0/16 private-address: 172.16.0.0/12 private-address: 10.0.0.0/8 private-address: fd00::/8 private-address: fe80::/10 ``` ```conf service unbound restart # http://beelink:8005/admin/settings.php?tab=dns # https://docs.pi-hole.net/guides/dns/unbound/ 127.0.0.1#5335 ``` ```bash apt-get install syncthing apt-get install apt-transport-https adduser syncthing cat /etc/passwd | cut -d: -f1 systemctl enable syncthing@syncthing.service systemctl start syncthing@syncthing.service systemctl status syncthing@syncthing.service journalctl -e -u syncthing@syncthing.service nano /home/syncthing/.config/syncthing/config.xml ``` ```xml
0.0.0.0:8384
``` ```bash systemctl restart syncthing@syncthing.service chown syncthing /home/syncthing -R chgrp syncthing /home/syncthing -R ``` ```bash ufw allow from 192.168.0.0/24 to any port 22 comment "01) SSH" ufw allow to 0.0.0.0/0 port 80 comment "02) HTTP" ufw allow to 0.0.0.0/0 port 443 comment "03) HTTPS" ufw allow from 192.168.0.0/24 to any port 8005 comment "04) Pi-hole" ufw allow from 192.168.0.0/24 to any port 53 comment "05) DNS" ufw allow from 192.168.0.0/24 to any port 67 comment "06) Unknown" ufw allow from 192.168.0.0/24 to any port 9400 comment "07) dashkiosk" ufw allow from 192.168.0.0/24 to any port 3000 comment "08) gogs" ufw allow from 192.168.0.0/24 to any port 8384 comment "09) syncthing" ufw allow from 192.168.0.0/24 to any port 22000 comment "10) syncthing" ``` ```conf To Action From -- ------ ---- 22 ALLOW IN 192.168.0.0/24 # 01) SSH 80 ALLOW IN Anywhere # 02) HTTP 443 ALLOW IN Anywhere # 03) HTTPS 8005 ALLOW IN 192.168.0.0/24 # 04) Pi-hole 53 ALLOW IN 192.168.0.0/24 # 05) DNS 67 ALLOW IN 192.168.0.0/24 # 06) Unknown 9400 ALLOW IN 192.168.0.0/24 # 07) dashkiosk 3000 ALLOW IN 192.168.0.0/24 # 08) gogs 8384 ALLOW IN 192.168.0.0/24 # 09) syncthing 22000 ALLOW IN 192.168.0.0/24 # 10) syncthing ``` ```bash echo >/etc/hosts && nano /etc/hosts ``` ```conf 127.0.0.1 localhost 127.0.0.1 beelink 127.0.1.1 phares3757.ddsn.net # The following lines are desirable for IPv6 capable hosts ::1 ip6-localhost ip6-loopback fe00::0 ip6-localnet ff00::0 ip6-mcastprefix ff02::1 ip6-allnodes ff02::2 ip6-allrouters ``` ```bash adduser twingate curl -s https://binaries.twingate.com/client/linux/install.sh | bash twingate setup twingate start curl "https://binaries.twingate.com/connector/setup.sh" | sudo TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMDc3IiwiZGlkIjoiMTAwMzc4OSIsImp0aSI6IjIyNTJmMjIwLWNkNjQtNDlhYy04YjRhLTE0NDFjOWUyM2U5ZSIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDE0Mzc4LCJpYXQiOjE2OTgwMTA3NzgsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAxMTA3OCwicm5ldGlkIjoiNzIyNzcifQ.aQnQMUGqM5fBEbR781u-lCPjltfmb1TdZUJTNJ_GYiiSJiemJiIrVK80xHQlIpPB2kot34nxmpvVK4kZK64X3w" TWINGATE_REFRESH_TOKEN="AWOLHa11QFXENAyov_w-KQ5ZC-keHm2w_ActZP8M7hBpy2NOC7EDT2bkEpBCO-YLTd40Pp-pdplIJu0lvdvNBAGINHopYnX2XOgaMxS5tbPPTsHRlnQpckaXYuOwu28W0ORs8g" TWINGATE_NETWORK="phares" bash curl "https://binaries.twingate.com/connector/setup.sh" | TWINGATE_ACCESS_TOKEN="eyJhbGciOiJFUzI1NiIsImtpZCI6IjlZSlNUMGR6YU5pRDhZR0h5SUdyTG1SVDZKTmMwbHJGMVFsNklseVJ6X1UiLCJ0eXAiOiJEQVQifQ.eyJudCI6IkFOIiwiYWlkIjoiMTczMjIxIiwiZGlkIjoiMTAwNDI3NCIsImp0aSI6ImQxMWIwYWIzLWJjZTgtNDIxZS05MzAwLTA1ZmFkZDk5YjllMiIsImlzcyI6InR3aW5nYXRlIiwiYXVkIjoicGhhcmVzIiwiZXhwIjoxNjk4MDM3MTgzLCJpYXQiOjE2OTgwMzM1ODMsInZlciI6IjQiLCJ0aWQiOiI1NzgzOSIsInJudyI6MTY5ODAzMzg4Mywicm5ldGlkIjoiNzIyNzcifQ.7YqB5iz1lzsfb6adLPx53NNA3dJ1NnuzmNhyyi4FzPdMTGxn3qbHD1olvWpEEi69D8gAvF5K77DPwE1BHxo4Qw" TWINGATE_REFRESH_TOKEN="HypbNsUdue5Dh3s5W4ePR9RIkFDsjEGiNJFJDf_cLdixkn94ieMypUZMH_XIc4-13L_PuQ61M7RWG5rF21ZRAgFf1MuIMf5kJGhuQq_VG7_E_6Q8NMLAajP5W05jTofB-sY3Ig" TWINGATE_NETWORK="phares" bash ```