diff options
| -rw-r--r-- | nextcloud.html | 2 | ||||
| -rw-r--r-- | rsync.html | 2 | ||||
| -rw-r--r-- | tor.html | 7 | ||||
| -rw-r--r-- | ufw.html | 2 | ||||
| -rw-r--r-- | xmpp.html | 57 |
5 files changed, 57 insertions, 13 deletions
diff --git a/nextcloud.html b/nextcloud.html index 6ce665c..274d854 100644 --- a/nextcloud.html +++ b/nextcloud.html @@ -57,7 +57,7 @@ server { listen 443 ssl http2; listen [::]:443 ssl http2; server_name <strong>example.org</strong>; - ssl_certificate /etc/letsencrypt/live/<strong>example.org</strong>/cert.pem ; + ssl_certificate /etc/letsencrypt/live/<strong>example.org</strong>/fullchain.pem ; ssl_certificate_key /etc/letsencrypt/live/<strong>example.org</strong>/privkey.pem ; root /var/www; @@ -48,7 +48,7 @@ <p>You may just as easily download files and directories from your server with rsync:</p> <pre><code>rsync -rtvzP <strong>root@example.org:/path/to/file</strong> <strong>/path/to/file</strong></code></pre> <h2 id="contribution">Contribution</h2> -<ul><li>el3ctr0lyte: <a href="https://github.com/el3ctr0lyte">github</a>, XMR: <code class=crypto>86DBJdiG83ZDea6kJgsbVN5tMae5ScfuhJ3PihEMTHatCrGEw2gctyUB92V2fz4R4YhwRaQeAGL5M4gPRXvVvtkULJi4ayk</code></li><li>Substantial revisions by <a href="https://lukesmith.xyz">Luke</a></li></ul> +<a href="https://lukesmith.xyz">Luke</a> </main> <footer><a href="https://landchad.net">LandChad.net</a></br>Because Everyone should be an Internet LandChad.</br><a href="index.html"><li><img src="pix/chad.gif" alt="chad"></li></a><a href="rss.xml"><li><img src="pix/rss.svg" alt="RSS"></li></a><a href="donate-bitcoin.html"><li><img src="pix/btc.svg" alt="BTC"></li></a><a href="donate-monero.html"><li><img src="pix/xmr.svg" alt="XMR"></li></a><a href="https://github.com/lukesmithxyz/landchad"><li><img src="pix/git.svg" alt="Github"></li></a></footer> </body> @@ -58,11 +58,8 @@ HiddenServicePort 80 127.0.0.1:80</code></pre> <p>If the next command outputs <q>active</q> in green you're golden!</p> <pre><code> systemctl status tor</code></pre> - - <p>Finally, if you have a firewall running, remember to open port 9050:</p> - <pre><code>ufw allow 9050</code></pre> - - <p>Now your server is on the dark web. The following command will give you your onion address:</p> + + <p>Now your server is on the dark web. The following command will give you your onion address:</p> <pre><code> cat /var/lib/tor/hidden_service/hostname</code></pre> <h2>Adding the Nginx Config</h2> @@ -59,7 +59,7 @@ ufw enable</code></pre> </aside> <p> - With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. + With the firewall enabled and allowing only SSH in, all other ports are protected from incoming requests. To view all your rules, run: </p> @@ -114,12 +114,52 @@ You can see other settings for this module <a href="https://prosody.im/doc/modul Note also that Prosody comes with the <code>carbons</code> activated module by default, which is related. This will send received messages to <em>all</em> active clients (your phone and desktop), although it will not save messages like MAM for clients not online or to be added later. </p> +<h3>File sharing</h3> + +<p>With this we can bring XMPP to the level of other popular instant messaging applications like Matrix and whatsapp. It is extremely easy to setup. This part is optional, but it can make XMPP more normie-friendly if you plan on moving family members and friends over to XMPP.</p> + +<p>First we need to install extra prosody modules. Run the following command: </p> +<pre><code>apt install prosody-modules</code></pre> + +<p>Then we can add the following line to you prosody config file to enable file uploads: </p> +<pre><code>Component "<strong>uploads.example.org</strong>" "http_upload"</code></pre> + +<p>As you will notice, you need another subdomain for this. We will add an ssl certficate for this later.</p> + +<p>You will also need to go back to <code>modules_enabled</code> and uncomment the <code>http_files</code> module. This is used to actually serve the files to users.</p> + +<p>And the last part of the setup is to enable the built in proxy server. This helps with file transfers for devices behind a NAT, and unless you are using XMPP in a LAN, you probably need this. Enable the proxy by adding the following line to the config: </p> + +<pre><code>Component "<strong>proxy.example.org</strong>" "proxy65"</code></pre> + +<p>As you can see, another subdomain is needed. We will add ssl certificates for this later.</p> + +<p>At this point, file sharing is now setup and ready to be used. Although there are some concerns that should be addressed.</p> + +<p>A big concern with file sharing is large files, seeing as all files shared over XMPP will be stored on your server. This can become a problem when many (and large) files are being shared. We can put a cap on large files by adding the following line to our config:</p> +<pre><code>http_upload_file_size_limit = 20971520</code></pre> + +<p>This puts a 20MB cap on all files being shared. The value is specified in bytes. You can also specify after how long files should be deleted by adding the following line:</p> +<pre><code>http_upload_expire_after = 60 * 60 * 24 * 7</code></pre> + +<p>The value is specified in seconds. The above line will make prosody delete files after a week.</p> + +<p>If it is for some reason neccessary, you can also manually invoke expiry with the following command:</p> + +<pre><code>prosodyctl mod_http_upload expire</code></pre> + <h3>Other things to check</h3> <p>Check the config file for other settings you might want to change. For example, if you want to run a general public XMPP server, you can allow anyone to create an account by changing <code>allow_registration</code> to <code>true</code>. </p> +<p>Another thing you can do is enable the <code>csi_simple</code> module, which will add some optimizations for mobile devices.</p> + +<p>Another thing worth noting is the <code>archive_expires_after = "1w"</code> line. This specifies after how long message archives will be deleted.</p> + +<p>Also the <code>smacks</code> module helps a lot with slow internet connections.</p> + <h2>Certificates</h2> <p> @@ -135,6 +175,13 @@ Include the <code>--nginx</code> option assuming you have an Nginx server runnin <pre><code>certbot -d <strong>chat.example.org</strong> --nginx</code></pre> <p> +<strong>If you have file sharing enabled, be sure to get a certificate for those subdomains as well.</strong> +</p> +<pre><code>certbot -d <strong>uploads.example.org</strong> --nginx +certbot -d <strong>proxy.example.org</strong> --nginx +</code></pre> + +<p> Once you have the certificates for encryption, run the following to import them into Prosody. </p> @@ -142,13 +189,13 @@ Once you have the certificates for encryption, run the following to import them <p> Note that you might get an error that a certificate has not been found if your <code>muc</code> subdomain and your main domain share a certificate. -It should still work, this is just notifying you that no specific +It should still work, this is just notifying you that no specific certificate for the subdomain. </p> +<p><strong>Note:</strong> The above command will need to be rerun when certificates are renewed. +You may want to create a <a href="cron.html">cronjob</a> to have this done automatically.</p> + -<p> -For user privacy, we will definitely want to install and enable encryption with OMEMO. -</p> <h2 id=user>Creating users/admins manually</h2> @@ -179,7 +226,7 @@ Once your server is set up, you just need an XMPP client to use your new and sec <ul> <li>GNU/Linux: <a href="https://dino.im/">Dino</a> or <a href="https://gajim.org/">Gajim</a></li> <li>Windows: <a href="https://gajim.org/">Gajim</a> also runs on Windows.</li> - <li>Android: <a href="https://conversations.im/">Conversations.im</a></li> + <li>Android: <a href="https://conversations.im/">Conversations.im</a> or <a href="https://snikket.org/">snikket</a></li> <li>Mac/iOS: <a href="https://monal.im/">Monal IM</a> or <a href="https://siskin.im/">Siskin</a> for iOS alone</li> <li>command-line (GNU/Linux, MacOS, Windows): <a href="https://profanity-im.github.io/">Profanity</a></li> <li><a href="https://xmpp.org/software/clients.html">See a more complete list kept by XMPP</a></li> |