diff --git a/README.md b/README.md index 8af8c66..e1bdc70 100644 --- a/README.md +++ b/README.md @@ -1,3 +1,36 @@ -# Niver configuration +# Niver -This repository contains configuration files required by Niver or it's dependencies. +Niver's sources ares split between 3 repositories: + +* [`system`](https://code.antopie.org/Niver/system): Documentation and configuration files you'll need to setup a Niver server +* [`niver-php`](https://code.antopie.org/Niver/niver-php): The Web interface in PHP +* [`maniver`](https://code.antopie.org/Niver/maniver): The Rust privileged program to do root actions from niver-php + +## Installation + +Install Debian 11 (bullseye) . + +The following steps assumes you've done the following: + +``` +# apt install sudo git +# git clone https://code.antopie.org/Niver/system /root/niver-system +``` + +1. [ufw.md](ufw.md) UFW (optionnal, not required for a working setup) +2. [openssh.md](openssh.md) OpenSSH +3. [quota.md](quota.md) Quota +4. [knot.md](knot.md) Knot DNS +5. [tor.md](tor.md) Tor +6. [twins.md](twins.md) Twins +7. [nginx.md](nginx.md) Nginx +8. [certbot.md](certbot.md) Certbot +9. [php.md](php.md) PHP-FPM +10. [maniver.md](maniver.md) maniver +11. [niver-php.md](niver-php.md) niver-php + +## Create system users + +``` +# useradd -U -r -s /usr/sbin/nologin +``` diff --git a/certbot.md b/certbot.md new file mode 100644 index 0000000..54cb9af --- /dev/null +++ b/certbot.md @@ -0,0 +1,5 @@ +# Certbot + +``` +# apt install certbot python3-certbot-nginx +``` diff --git a/knot.conf b/config/knot.conf similarity index 100% rename from knot.conf rename to config/knot.conf diff --git a/nginx/dhparam b/config/nginx/dhparam similarity index 100% rename from nginx/dhparam rename to config/nginx/dhparam diff --git a/nginx/inc/errors.conf b/config/nginx/inc/errors.conf similarity index 100% rename from nginx/inc/errors.conf rename to config/nginx/inc/errors.conf diff --git a/nginx/inc/fastcgi.conf b/config/nginx/inc/fastcgi.conf similarity index 100% rename from nginx/inc/fastcgi.conf rename to config/nginx/inc/fastcgi.conf diff --git a/nginx/inc/intermediate.conf b/config/nginx/inc/intermediate.conf similarity index 100% rename from nginx/inc/intermediate.conf rename to config/nginx/inc/intermediate.conf diff --git a/nginx/inc/modern.conf b/config/nginx/inc/modern.conf similarity index 100% rename from nginx/inc/modern.conf rename to config/nginx/inc/modern.conf diff --git a/nginx/inc/niver-csp.conf b/config/nginx/inc/niver-csp.conf similarity index 100% rename from nginx/inc/niver-csp.conf rename to config/nginx/inc/niver-csp.conf diff --git a/nginx/inc/security.conf b/config/nginx/inc/security.conf similarity index 100% rename from nginx/inc/security.conf rename to config/nginx/inc/security.conf diff --git a/nginx/mimetypes/full.conf b/config/nginx/mimetypes/full.conf similarity index 100% rename from nginx/mimetypes/full.conf rename to config/nginx/mimetypes/full.conf diff --git a/nginx/mimetypes/strict.conf b/config/nginx/mimetypes/strict.conf similarity index 100% rename from nginx/mimetypes/strict.conf rename to config/nginx/mimetypes/strict.conf diff --git a/nginx/nginx.conf b/config/nginx/nginx.conf similarity index 100% rename from nginx/nginx.conf rename to config/nginx/nginx.conf diff --git a/nginx/sites/niver.atope.art.conf b/config/nginx/sites/niver.atope.art.conf similarity index 100% rename from nginx/sites/niver.atope.art.conf rename to config/nginx/sites/niver.atope.art.conf diff --git a/php-fpm/errors.conf b/config/php-fpm/errors.conf similarity index 100% rename from php-fpm/errors.conf rename to config/php-fpm/errors.conf diff --git a/php-fpm/niver.conf b/config/php-fpm/niver.conf similarity index 100% rename from php-fpm/niver.conf rename to config/php-fpm/niver.conf diff --git a/share/banner.txt b/config/share/banner.txt similarity index 100% rename from share/banner.txt rename to config/share/banner.txt diff --git a/share/knot.template b/config/share/knot.template similarity index 100% rename from share/knot.template rename to config/share/knot.template diff --git a/share/nginx/dns.template b/config/share/nginx/dns.template similarity index 100% rename from share/nginx/dns.template rename to config/share/nginx/dns.template diff --git a/share/nginx/onion.template b/config/share/nginx/onion.template similarity index 100% rename from share/nginx/onion.template rename to config/share/nginx/onion.template diff --git a/share/skel/about.txt b/config/share/skel/about.txt similarity index 100% rename from share/skel/about.txt rename to config/share/skel/about.txt diff --git a/sshd_config b/config/sshd_config similarity index 100% rename from sshd_config rename to config/sshd_config diff --git a/gmnisrv.md b/gmnisrv.md new file mode 100644 index 0000000..50b13e1 --- /dev/null +++ b/gmnisrv.md @@ -0,0 +1,52 @@ +# gmnisrv + +``` +# apt install git make pkg-config libssl-dev scdoc +$ git clone https://git.sr.ht/~sircmpwn/gmnisrv # Download gmnisrv sources +$ mkdir gmnisrv/build +$ cd gmnisrv/build +$ ../configure --prefix=/usr # Check gmnisrv dependencies and setup files needed for building +$ make # Build gmnisrv +# make install # Install gmnisrv binary and manpages on the system +# useradd -U -r -s /usr/sbin/nologin gmnisrv # Add the gmnisrv system user and group +# vim /etc/systemd/system/gmnisrv.service +``` + +``` +[Unit] +Description=Gmnisrv, a Gemini server +After=network.target +Wants=network.target + +[Service] +Type=simple +ExecStart=/usr/local/bin/gmnisrv +Restart=always +User=gmnisrv +Group=gmnisrv +WorkingDirectory=/srv/ht + +[Install] +WantedBy=multi-user.target +``` +``` +# systemctl daemon-reload +# mkdir -p /srv/gmi/niver.4.niv.re +# echo "This is a testing Gemini capsule" > /srv/gmi/niver.4.niv.re/index.gmi +# mkdir /var/lib/gemini +# chmod -R 700 /var/lib/gemini +# chown -R gmnisrv:gmnisrv /var/lib/gemini +# vim /etc/gmnisrv.ini +``` + +``` +# Space-separated list of hosts +listen=0.0.0.0:1965 [::]:1965 + +[:tls] +# Path to store certificates on disk +store=/var/lib/gemini + +[niver.4.niv.re] +root=/srv/gmi/niver.4.niv.re +``` diff --git a/install.md b/install.md deleted file mode 100755 index e167aa2..0000000 --- a/install.md +++ /dev/null @@ -1,144 +0,0 @@ -# Niver setup on Debian 11 (bullseye) - -``` -# apt install tor knot openssh-server sudo nginx certbot python3-certbot-nginx php7.4-fpm php-sqlite3 quota -``` - -## Create system users - -``` -# useradd -U -r -s /usr/sbin/nologin -``` - -## Twins - -``` -$ wget https://golang.org/dl/go1.16.7.linux-amd64.tar.gz -o go.tar.gz -$ tar -xf go.tar.gz -$ go/bin/go get code.rocketnine.space/tslocum/twins -$ cp go/bin/twins /usr/local/bin/ -``` - -## maniver - -Installation -``` -# apt install gcc git -$ git clone https://code.antopie.org/Niver/maniver && cd maniver -$ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -$ cargo build --release -# cp target/release/maniver /usr/local/bin/ -# chown root:php-niver /usr/local/bin/maniver -# chmod 750 /usr/local/bin/maniver -``` - -Update -``` -$ git fetch -$ rustup update -$ cargo update -$ cargo build --release -# cp target/release/maniver /usr/local/bin/ -``` - -## gmnisrv - -``` -# apt install git make pkg-config libssl-dev scdoc -$ git clone https://git.sr.ht/~sircmpwn/gmnisrv # Download gmnisrv sources -$ mkdir gmnisrv/build -$ cd gmnisrv/build -$ ../configure --prefix=/usr # Check gmnisrv dependencies and setup files needed for building -$ make # Build gmnisrv -# make install # Install gmnisrv binary and manpages on the system -# useradd -U -r -s /usr/sbin/nologin gmnisrv # Add the gmnisrv system user and group -# vim /etc/systemd/system/gmnisrv.service -``` - -``` -[Unit] -Description=Gmnisrv, a Gemini server -After=network.target -Wants=network.target - -[Service] -Type=simple -ExecStart=/usr/local/bin/gmnisrv -Restart=always -User=gmnisrv -Group=gmnisrv -WorkingDirectory=/srv/ht - -[Install] -WantedBy=multi-user.target -``` -``` -# systemctl daemon-reload -# mkdir -p /srv/gmi/niver.4.niv.re -# echo "This is a testing Gemini capsule" > /srv/gmi/niver.4.niv.re/index.gmi -# mkdir /var/lib/gemini -# chmod -R 700 /var/lib/gemini -# chown -R gmnisrv:gmnisrv /var/lib/gemini -# vim /etc/gmnisrv.ini -``` - -``` -# Space-separated list of hosts -listen=0.0.0.0:1965 [::]:1965 - -[:tls] -# Path to store certificates on disk -store=/var/lib/gemini - -[niver.4.niv.re] -root=/srv/gmi/niver.4.niv.re -``` - - -## SFTP - -``` -# groupadd ht -``` - -## Quota - -``` -# quotacheck -cm / -# vim /etc/fstab -``` - -UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx / ext4 usrquota,grpquota,errors=remount-ro 0 1 - -## Knot DNS - -``` -# sudo -u knot knotc conf-init -# sudo -u knot knotc conf-import -``` - -## Nginx - -Generate a self-signed certificate for default Nginx site. -``` -# openssl req -subj '/' -new -newkey RSA:3072 -days 3650 -nodes -x509 -keyout /etc/ssl/private/niver.key -out /etc/ssl/certs/niver.crt -``` - -## Niver-PHP - -``` -# chown -R root:root /usr/local/share/niver -# chmod -R u=rwX,go=rX /usr/local/share/niver -# mkdir /etc/nginx/ht -# chown -R php-niver:php-niver /etc/nginx/ht -# chmod -R 775 /etc/nginx/ht -``` - -Increase `session.gc_maxlifetime` in /etc/php/7.4/fpm/php.ini to avoid sessions being cleared too soon. - -## Tor - -This command only exist on Debian -``` -# tor-instance-create niver -``` diff --git a/knot.md b/knot.md new file mode 100644 index 0000000..ac6f069 --- /dev/null +++ b/knot.md @@ -0,0 +1,7 @@ +# Knot DNS + +``` +# apt install knot +# sudo -u knot knotc conf-init +# sudo -u knot knotc conf-import +``` diff --git a/maniver.md b/maniver.md new file mode 100644 index 0000000..240974e --- /dev/null +++ b/maniver.md @@ -0,0 +1,21 @@ +# maniver + +Installation +``` +# apt install gcc +$ git clone https://code.antopie.org/Niver/maniver && cd maniver +$ curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh +$ cargo build --release +# cp target/release/maniver /usr/local/bin/ +# chown root:php-niver /usr/local/bin/maniver +# chmod 750 /usr/local/bin/maniver +``` + +Update +``` +$ git fetch +$ rustup update +$ cargo update +$ cargo build --release +# cp target/release/maniver /usr/local/bin/ +``` diff --git a/nginx.md b/nginx.md new file mode 100644 index 0000000..d320b99 --- /dev/null +++ b/nginx.md @@ -0,0 +1,12 @@ +# Nginx + +``` +# apt install nginx libnginx-mod-http-headers-more-filter +``` + +`libnginx-mod-http-headers-more-filter` is required in order to make `more_set_headers` instructions work + +Generate a self-signed certificate for default Nginx site. +``` +# openssl req -subj '/' -new -newkey RSA:3072 -days 3650 -nodes -x509 -keyout /etc/ssl/private/niver.key -out /etc/ssl/certs/niver.crt +``` diff --git a/niver-php.md b/niver-php.md new file mode 100644 index 0000000..40dc2a1 --- /dev/null +++ b/niver-php.md @@ -0,0 +1,11 @@ +# Niver-PHP + +``` +# chown -R root:root /usr/local/share/niver +# chmod -R u=rwX,go=rX /usr/local/share/niver +# mkdir /etc/nginx/ht +# chown -R php-niver:php-niver /etc/nginx/ht +# chmod -R 775 /etc/nginx/ht +``` + +Increase `session.gc_maxlifetime` in /etc/php/7.4/fpm/php.ini to avoid sessions being cleared too soon. diff --git a/openssh.md b/openssh.md new file mode 100644 index 0000000..dd142b5 --- /dev/null +++ b/openssh.md @@ -0,0 +1,6 @@ +# OpenSSH + +``` +# apt install openssh-server +# groupadd ht +``` diff --git a/php.md b/php.md new file mode 100644 index 0000000..ac08f40 --- /dev/null +++ b/php.md @@ -0,0 +1,5 @@ +# PHP + +``` +# apt install php7.4-fpm php-sqlite3 +``` diff --git a/quota.md b/quota.md new file mode 100644 index 0000000..d38eae3 --- /dev/null +++ b/quota.md @@ -0,0 +1,9 @@ +# Quota + +``` +# apt install quota +# quotacheck -cm / +# vim /etc/fstab +``` + +UUID=xxxxxxxx-xxxx-xxxx-xxxx-xxxxxxxxxxxx / ext4 usrquota,grpquota,errors=remount-ro 0 1 diff --git a/tor.md b/tor.md new file mode 100644 index 0000000..76ffd81 --- /dev/null +++ b/tor.md @@ -0,0 +1,10 @@ +# Tor + +`tor-instance-create` is specific to Debian + +``` +# apt install tor +# tor-instance-create niver +# systemctl start tor@niver +# systemctl enable tor@niver +``` diff --git a/twins.md b/twins.md new file mode 100644 index 0000000..b585953 --- /dev/null +++ b/twins.md @@ -0,0 +1,8 @@ +# Twins + +``` +$ wget https://golang.org/dl/go1.16.7.linux-amd64.tar.gz -o go.tar.gz +$ tar -xf go.tar.gz +$ go/bin/go get code.rocketnine.space/tslocum/twins +$ cp go/bin/twins /usr/local/bin/ +``` diff --git a/ufw.md b/ufw.md new file mode 100644 index 0000000..a340e10 --- /dev/null +++ b/ufw.md @@ -0,0 +1,11 @@ +# Firewall + +``` +# apt install ufw +# ufw allow in 22 # SSH +# ufw allow in 53 # DNS +# ufw allow in 80 # Display an error message for unsecure HTTP +# ufw allow in 443 # HTTPS +# ufw allow in 1965 # Gemini +# ufw enable +```