diff options
27 files changed, 746 insertions, 77 deletions
diff --git a/content/auth.md b/content/auth.md index 3f88a90..88a5fee 100644 --- a/content/auth.md +++ b/content/auth.md @@ -133,4 +133,4 @@ Now check your configuration with `nginx -t` Reload nginx and you\'re good to go! -**Contributor** - [tomfasano.co](https://tomfasano.co){target="_blank"} +**Contributor** - [tomfasano.net](https://tomfasano.net) diff --git a/content/basic/certbot.md b/content/basic/certbot.md index 7cb18cd..3b60ea7 100644 --- a/content/basic/certbot.md +++ b/content/basic/certbot.md @@ -31,7 +31,7 @@ certificates that allow encrypted connections. It used to be painful {{< img alt="website without https/ssl" src="/pix/nginx-website.png" link="/pix/nginx-website.png" >}} Note in this picture that a browser accessing your site will say \"Not -secure\" or something else to notify you that we are using and +secure\" or something else to notify you that we are using an unencrypted HTTP connection rather than an encrypted HTTPS one. ## Installation diff --git a/content/basic/nginx.md b/content/basic/nginx.md index 47a08c1..fb8f15a 100644 --- a/content/basic/nginx.md +++ b/content/basic/nginx.md @@ -20,7 +20,7 @@ Now on Vultr\'s site, you can click on your VPS and you will see that there is an area that shows you the password for your server at the bottom here. - +{{< img alt="Find your password" src="/pix/nginx-password.png" link="/pix/nginx-password.png" >}} Now pull up a terminal and type: @@ -206,7 +206,7 @@ date](maintenance.html#update) to get the latest security fixes! At this point you can now type in your website in your browser and this webpage will appear! - +{{< img alt="The webpage as it appears." src="/pix/nginx-website.png" link="/pix/nginx-website.png" >}} Note the \"Not secure\" notification. The next brief step is securing encrypted connections to your website. diff --git a/content/basic/server.md b/content/basic/server.md index e68af8f..6b6e233 100644 --- a/content/basic/server.md +++ b/content/basic/server.md @@ -47,8 +47,7 @@ your audience might be, but if you host a server in Singapore for an American audience, they won\'t have to be waiting a perceptibly longer time to load the site. -[](pix/server-location.png) +{{< img alt="Pick your servers's location" src="/pix/server-location.png" link="/pix/server-location.png" >}} **Some locations might have different abilities and plans than others. For example, in Vultr, their New York location has optional DDOS diff --git a/content/coturn.md b/content/coturn.md index 25c1a34..5dd60b3 100644 --- a/content/coturn.md +++ b/content/coturn.md @@ -1,13 +1,14 @@ --- title: "Coturn" date: 2022-03-29 +short_desc: 'A STUN and TURN server that allows users to perform WebRTC calls while being behind NATs.' icon: "webrtc.svg" img: "webrtc.svg" tags: ['service'] --- [Coturn](https://github.com/coturn/coturn) is a libre **STUN** and -**TURN** server software that allows users of chat protcols (Such as +**TURN** server software that allows users of chat protocols (Such as [XMPP](/prosody) and [Matrix](/matrix)) to perform WebRTC **voice and video calls** despite them being behind NATs. diff --git a/content/dns-over-http.md b/content/dns-over-http.md new file mode 100644 index 0000000..fd03f95 --- /dev/null +++ b/content/dns-over-http.md @@ -0,0 +1,148 @@ +--- +title: "Run your own DNS over HTTPS server." +tags: ['service'] +draft: true +--- + +Encrypted DNS can be a great tool for your online privacy if it\'s +hosted by a trustworthy entity, and who can you trust more with your +data than yourself? + +## Installing Unbound. + +First of all, we need to install our DNS server, Unbound. Unbound is a +validating, recursive and caching DNS server. + +```sh +apt install -y unbound +``` + +### Now that Unbound is installed, we will configure it a bit. + +Using your favorite editor, edit the file `/etc/unbound/unbound.conf` +and add the following values, if they don\'t exist already: + +``` +include-toplevel: "/etc/unbound/unbound.conf.d/*.conf" +server: + log-queries: no + log-replies: no + aggressive-nsec: yes + ratelimit: 150 + verbosity: 1 + ``` + +Now restart Unbound to activate your new configuration: + + ```sh + systemctl restart unbound + ``` + +To test to see if your DNS server is resolving, add +`nameserver 127.0.0.1` to your `/etc/resolv.conf`. If you are able to +resolve domains, Unbound is working. + +## Installing DNSS. + +Now we need to install a program to convert HTTP requests to DNS +queries. `dnss` accomplishes that goal very well. + +To install DNSS, run the following command: + +```sh +apt install -y dnss +``` + +### Configuring DNSS. + +DNSS comes with a bad default configuration, disable it using the +following command: + +```sh +systemctl disable --now dnss dnss.socket +``` + +Now, using your favorite text editor, create a new file in +`/etc/systemd/system` named `doh.service`. This will be the new DNSS +configuration file. Add the following values to the file: + +```systemd +[Unit] +Description=DNSS DNS over HTTPS Proxy +[Service] +ExecStart=/usr/bin/dnss \ + -enable_https_to_dns \ + -https_server_addr 127.0.0.1:8080 \ + -insecure_http_server \ + -dns_upstream 127.0.0.1:53 + +Type=simple +Restart=always +User=dnss +Group=dnss + +CapabilityBoundingSet=CAP_NET_BIND_SERVICE +ProtectSystem=full + +[Install] +WantedBy=multi-user.target +``` + +Close the file and enable/start it using the command: + +```sh +systemctl enable --now doh.service +``` + +## Setting up Nginx. + +To set up Nginx with HTTPS, follow [these](/basic/nginx) [guides](/basic/certbot). + +Once you\'ve gotten all of that set up, we\'ll reverse proxy our HTTPS +to DNS proxy. Open up your Nginx config file, and add the following +values: + +```nginx +location /dns-query { + proxy_pass http://127.0.0.1:8080/; +} +``` + +Now, your configuration should look something like this: + +```nginx +server { + listen 80; + server_name landchad.net; + return 301 https://$host$request_uri; +} +server { + listen 443 ssl http2; + server_name landchad.net; + root /var/www/landchad; + ssl_certificate /etc/letsencrypt/live/landchad.net/fullchain.pem; + ssl_certificate_key /etc/letsencrypt/live/landchad.net/privkey.pem; + location /dns-query { + proxy_pass http://127.0.0.1:8080/; + } +} +``` + +Finally, you can check your Nginx config using `nginx -t`, if the check +passes, restart Nginx using the command: + +```sh +systemctl restart nginx +``` + +## Using your DNS over HTTPS server. + +To use your new DNS over HTTPS server, go to your browser\'s settings +and navigate to the \"Network Settings\" area. You should be able to set +a custom secure DNS url. Once set, you can check to see if it\'s working +by attempting to resolve domains, and by testing your browser with +[whatismydnsserver.com](http://www.whatsmydnsserver.com/). + +## Contributor + +[Josiah.](https://ioens.is) diff --git a/content/ejabberd.md b/content/ejabberd.md index 7f024f1..0a7f3a8 100644 --- a/content/ejabberd.md +++ b/content/ejabberd.md @@ -243,11 +243,11 @@ your turnserver: secret: "your_auth_secret" services: - - host: turn.example.org + host: turn.example.org type: stun - - host: turn.example.org - type: turn + host: turn.example.org + type: turn ``` And with that, you\'ve successfully setup your ejabberd XMPP server! diff --git a/content/fosspay.md b/content/fosspay.md index 9414179..f7e3ae9 100644 --- a/content/fosspay.md +++ b/content/fosspay.md @@ -3,8 +3,9 @@ title: "Fosspay" tags: ['service'] icon: 'devault.jpg' short_desc: "A self-hosted payment and donation gateway interfaced with Stripe." -draft: true +date: 2022-06-30 --- + [Fosspay](https://sr.ht/~sircmpwn/fosspay/) is a free-software web frontend for receiving donations and subscriptions, similar to Patreon or Liberapay, but which can be hosted on your own server. It can also interface with Patreon or Github @@ -12,35 +13,21 @@ Sponsors to aggregate all your donations. ## Stripe Setup -Fosspay uses [Stripe](https://stripe.com) as a payment processor, which -is a less annoying and more serious and extensible equivalent of PayPal. -You must set up an account with them to be able to receive card payments -through Fosspay. - -Note that with Stripe, these payments can be arranged to go directly to -a bank account within a day or so. +Fosspay uses [Stripe](https://stripe.com) as a payment processor. You first must go to [their website](https://stripe.com) and create an account. -Be sure to check out or configure all the Stripe settings you want -before hand. For example, Stripe will automatically include your phone -number on invoices by default, so you might want to change that if you -are not using a dummy number. +Once you set everything up, you can go to [https://dashboard.stripe.com/account/apikeys](https://dashboard.stripe.com/account/apikeys) and get your "Publishable Key" and "Secret Key" which will be all you need to set up Fosspay. -### Note +<aside> -LandChad.net strives for free software, privacy and internet -independence. Using Stripe is better than using companies with a bad -reputation like PayPal, but it is still a large company with can -compromise the privacy of you and others and ban people. +### Note on Free Software -Stripe does do a good job making payments very easy for you: you do not -have to do legally difficult things like storing credit card numbers -(they are sent directly to Stripe via Javascript code). They are also good at -catching fraudulent transactions and other issues that might arise. +Stripe is perhaps the best way to transact in the legacy financial system +online, but you are still not using free and privacy respecting software. +Fosspay is an open source payment gateway, but it still connects to Stripe. +The only way to transact value over the internet on all free software is +[crypto-currency](/monero/). -But if you want a truly and fully free and open source monetary system -and will not compromise for less, please use Bitcoin or Monero -exclusively. Compared to any other fiat service, Stripe is about the -best, and Fosspay is a great way to self-host a payment gateway. +</aside> ## Dependencies @@ -70,11 +57,6 @@ cd /var/www/fosspay pip install -r requirements.txt ``` -The `install` command, at the time of this writing, *might* produce many -errors related to the `psycopg2` package. If it does, you can ignore -them, let the command complete and run `apt install python3-psycopg2` to -get the package globally. - Be sure you are still in `/var/www/fosspay`, then we will build the package and create the configuration file. @@ -85,7 +67,7 @@ cp config.ini.example config.ini ## Create a Database -Fosspay uses a postgresql database to store donation information, so +Fosspay uses a PostgreSQL database to store donation information, so let\'s create a database and user for it. First, become the `postgres` user and run the `psql` command: @@ -114,20 +96,21 @@ whatever reason, change them in the command above, but also in the Now open up `/var/www/fosspay/config.ini` and we will set things up. Here are a list of things to edit. -- `domain` should be set to `donate.example.org`, with your domain. -- `protocol` can be set to `https`. -- Get or create an email account to use as a mailer and add the - account/server information to the email settings. -- Add your public and secret Stripe keys to the information. -- Change the `connection-string` to - `postgresql://fosspay:fosspay@localhost/fosspay` as set up above. - -**An important note:** mail ports *must* be opened on the server you\'re -using, or else Fosspay will silently fail to send mails when someone -tries to donate or reset their password. You do not have to run a mail -server on the same server as Fosspay, but either way, mail submission -ports must be opened. This usually requires contacting your VPS provider -and requesting it from them. +- `domain` should be set to `donate.example.org`, with your domain. +- `protocol` can be set to `https`. +- Get or create an email account to use as a mailer and add the account/server + information to the email settings. +- Add your public and secret Stripe keys to the information. +- Change the `connection-string` to + `postgresql://fosspay:fosspay@localhost/fosspay` as set up above. + +**An important note:** mail ports *must* be opened on the server you\'re using, +or else Fosspay will silently fail to send mails when someone tries to donate +or reset their password. You do not have to run a mail server on the same +server as Fosspay, but either way, mail submission ports must be opened. This +usually requires contacting your VPS provider and requesting it from them. +Aside from this, any error in the email setup will cause Fosspay to crash +silently. ### Optional Integration with Patreon, Github, Liberapay diff --git a/content/gitea.md b/content/gitea.md index 685c8cb..e09b6c0 100644 --- a/content/gitea.md +++ b/content/gitea.md @@ -41,7 +41,7 @@ curl -sL -o /etc/apt/trusted.gpg.d/morph027-gitea.asc https://packaging.gitlab.i Then add the actual repository to apt: ```sh -echo "deb [arch=amd64] https://packaging.gitlab.io/gitea gitea main" > /etc/apt/sources.list.d/morph027-gitea.list +echo "deb [arch=$(dpkg --print-architecture)] https://packaging.gitlab.io/gitea gitea main" > /etc/apt/sources.list.d/morph027-gitea.list ``` Now we can install Gitea: diff --git a/content/networking.md b/content/networking.md new file mode 100644 index 0000000..5effd8a --- /dev/null +++ b/content/networking.md @@ -0,0 +1,340 @@ +--- +title: Networking Basics +date: 2022-07-01 +tags: ['concepts'] +--- + +## A quick detour to binary + +You probably know that everything computers do, they do in binary +(zeroes and ones) under the hood. But how does that actually work? + +Binary is just another numbering system like decimal (there are many +others!), so while with decimal each digit can have 10 different values +(0-9, hence **deci**mal), numbers represented in binary have 2 possible +values (0-1, hence **bi**nary). In binary a digit is called a bit. + +What is the highest number you can represent with one digit in decimal? +Easy: 9. So how many different values are there? 10 (0-9). + +What about 2 digits? 99 and 100, respectively. 3 digits? 999 and 1000. +I\'m sure I don\'t need to bore you by continueing. + +### The maths behind it + +Can we define a formula for the amount of possible values a decimal +number with `n` digits can have? + +It\'s pretty easy: `10n`. + +Now the 10 there in a numbering system where each digit can have 10 +different values can\'t be a coincidence! + +So we can generalize: In a numbering system where each digit can have +`x` different values, the amount of possible values for a number with +`n` digits is `xn`. + +So how many different values can we represent with 8 Bits (1 Byte)? +`28 = 256` (0-255). + +The IPv4 addresses you know are 32 bits long. So how many computers +could we theoretically assign unique IPs to on the internet? +`232 = 4,294,967,296`. That\'s 4 Billion! However there are far more +computers than that on the internet now, which is why people had to come +up with hacks (which we\'ll talk about later) so that we can today still +predominantly use pretty IPv4, as opposed to that ugly new IPv6 (eww). + +We\'ll say \"IP address\" instead of \"IPv4 address\" from here on. + +By the way, this principle goes a long way in computing! Say, for +example, I know your password is 7 letters long and contains only +lowercase english letters (a-z). How many times would I have to guess at +maximum to crack your password? `257 = 6,103,515,625` times. + +### Converting from binary to decimal + +You can use the same principle to convert from one numbering system to +another. Each digit gains \"significance\", starting at zero going from +right to left. This is easiest understood through an example from +decimal: + +``` +943 = 9*102 + 4*101 + 3*100 = 900 + 40 + 3 = 943 +``` + +The same holds true for binary: + +``` +11001101 = 27 + 26 + 23 + 22 + 20 = 128 + 64 + 8 + 4 + 1 = 205 +``` + +### The binary behind IP addresses + +As mentioned, IP addresses are made up of 32 bit, or 4 byte. IP +addresses are usually represented in \"dotted-decimal\" notation, where +we write the decimal value of the first byte (left-to-right), a dot, +then the decimal value of the second byte, etc. + +So, in theory, the lowest possible IP address is `0.0.0.0` (all bits are +0) and the highest possible IP address is `255.255.255.255` (all bits +are 1). + +## Subnetting + +Open up a terminal and run + +```sh +ip a +``` + +You should see many names, such as `wlan*` or `wlp*` for wireless +interfaces or something like `eth*` or `enp*` for ethernet interfaces. +I\'ve used a new word here: \"interfaces\", we\'ll talk more about what +those are later. + +Here\'s my WiFi interface: + +{{< img alt="wifi interface" src="/pix/networking-wlan0.png" link="/pix/networking-wlan0.png" >}} + +We can see an IP address, `192.168.1.221`, and another one which we\'ll +ignore for now. Did I just leak my IP address? No, it is only my local +IP, it could even be that yours is the same as mine! + +There are two reasons for this: + +1. There is a [list of IP address + ranges](https://en.wikipedia.org/wiki/Reserved_IP_addresses#IPv4) + reserved for you to use however you want, here in local networking. + You will not find a server on the internet that has an IP in one of + those ranges. +2. The hack to get around the limitations of IPv4 I mentioned earlier + is [NAT (Network Address + Translation)](https://en.wikipedia.org/wiki/Network_address_translation). + Your router gives every device in your local network one of those + reserved IPs and manages one public IP towards the internet for all + of them. So instead of every device needing one of those 4 Billions + IPs, only every house needs one. And some ISPs take this a level + further and again put multiple houses under one NAT, so multiple + houses can share one IP towards the internet (Carrier-Grade NAT). + +If you followed the link for reserved IP address ranges or looked closer +at my screenshot, you will see IP addresses followed by a slash and then +some number, here `/24`. This is how we denote IP ranges in networking, +the so-called CIDR-Notation. The first ip address in the range is the +**Network ID** and the number after the slash is the **subnet mask**. It +might look strange at first, but makes a lot of sense: The subnet mask +is the amount of bits **fixed**. So here in my case the first 24 bits (3 +bytes) are fixed and my local network\'s IP range, also called +**subnet**, goes from `192.168.1.0` to `192.168.1.255`. + +Here are two popular reserved subnets and their IP ranges: + +``` +192.168.0.0/16: 192.168.0.0 – 192.168.255.255 +10.0.0.0/8: 10.0.0.0 – 10.255.255.255 +``` + +Here\'s another popular one, but note that the subnet mask isn\'t +divisible by 8, so it is a bit less easy to deal with: + +``` +172.16.0.0/12: 172.16.0.0 – 172.31.255.255 +``` + +The way this works is the first byte is fully fixed, and then the first +4 bits of the second byte are fixed too, the rest is usable by us. So in +the second byte the last `8-4 = 4` bits are free. `24 = 16`, giving us +the actual highest number 15. We add this to the \"starting point\", the +current value of the second byte, and arrive at `16+15 = 31`! + +Don\'t worry if that last part about uneven subnet-masks was confusing +to you, you won\'t have to deal with them as a regular user. +Additionally there are websites where you can enter subnets and they do +the maths for you. + +## Interfaces + +I\'ve mentioned interfaces a few times now without really explaining +what they are. Generally you can think of interfaces as physical +networking devices. If you have a WiFi-Card in your computer, it will +get an interface. If you have an ethernet card, it will get another one. +If you now plug in something like a USB WiFi dongle, it will get another +interface. + +There are also virtual interfaces. For example if you run a virtual +machine with something like virt-manager, use containers with docker or +connect to a VPN through OpenVPN or WireGuard, all those get virtual +interfaces. + +We can assign IP addresses to interfaces and Linux then knows that when +it receives a packet who\'s recipient is that IP, it is meant for us. +Then later with routing we can tell Linux to send packets destined to, +say, `192.168.3.0/24`, to our ethernet interface, which will make Linux +send that data to the ethernet card, which will in turn send it through +the actual physical cable! + +Here\'s a bigger picture of the full output of `ip a` on my machine: + +{{< img alt="output of ip a" src="/pix/networking-interfaces.png" link="/pix/networking-interfaces.png" >}} + +We can see a few interfaces here: + +- `lo`: The loopback interface. A virtual interface that makes packets + to `127.0.0.1` go straight back to your own machine. +- `wlan0`: My WiFi interface. We can see its state is `UP`, I have the + IP `192.168.1.221` on the network and the subnet mask is `/24`. +- `virbr0`: My KVM interface. We can see its state is `DOWN`, I have + the IP `192.168.122.1` on the network and the subnet mask is `/24`. +- `wgpi`: An interface for the WireGuard connection I have to my + Raspberry Pi. I have the IP `10.91.0.2` on the network and the + subnet mask is `/24`. +- `wgnord`: An interface for the WireGuard connection I have to a + remote VPN server. I have the IP `10.5.0.2` on the network and the + subnet mask is `/32`. + +## Routing + +Okay, so we\'ve learned about interfaces now. Those don\'t do much by +themselves though, since right now Linux will never really use them. To +make use of them we need to use routing to tell Linux which packets it +should put into those interfaces. These definitions of what outgoing +traffic to put into which interfaces are called routes! + +To view the routes set up on your machine, run this command: + +```sh +ip r +``` + +Here\'s the command\'s output on my server: + +{{< img alt="output of ip r" src="/pix/networking-server-routes.png" link="/pix/networking-server-routes.png" >}} + +And here\'s an excerpt of the interfaces on my server: + +{{< img alt="network interface" src="/pix/networking-server-interfaces.png" link="/pix/networking-server-interfaces.png" >}} + +The first route containing `default via` is special: All packets that +don\'t match other routes are automatically sent to this interface +(`ens3`). Now you might remember `172.31.1.1` is in one of those +reserved subnets, so this isn\'t another machine on the internet! This +is my server\'s \"gateway\". At home your gateway probably is your +router: You send everything to it and it then forwards those packets to +the internet (or another device on your local network, if you\'re +speaking to another IP within your subnet). + +Note also that my server\'s `ens3` interface has an IP address assigned +which is not one of the reserved ones. Therefore my server isn\'t behind +NAT and this is the actual IP my server can be reached at on the +internet! Also note that the subnet mask is `/32`, or \"all bits in this +IP are fixed\". + +The second line is for the virtual interface created by docker. All +containers get assigned an IP within the subnet `172.17.0.0/16`, and +this route tells Linux to put packets destined for said subnet into the +`docker0` virtual interface, which then ends up at the container having +that IP. We can see some additional info too: The IP packet\'s source +will be set to `172.17.0.1` and the `linkdown` state signifies that we +have a route set up, but the interface for that route is in `DOWN` +state. + +## Putting it all into practice + +Now it might be interesting and all to know how Linux does networking, +but as a regular user you\'ve probably never had to touch the `ip` +command in the past: Your server comes set up out of the box and if you +connect to a WiFi, the interface and routes are configured automatically +for you. This is done by your network manager through +[DHCP](https://en.wikipedia.org/wiki/Dynamic_Host_Configuration_Protocol). + +Recently I\'ve had a use case where I had to configure networking +manually: I wanted to move around 200GB of data from one laptop to +another. Now there are a few ways I could go about this: I could look +for a big enough USB-Drive and move the data that way. Or I could +connect both devices to the same WiFi (they already were) and move the +data over the network using rsync, or sshfs, or scp, or nfs, \... But +the problem here is that my local WiFi is only about 100Mbit/s fast, +moving 200GB at that speed would take over 4 hours, if my math is +correct, and would congest the WiFi for all that time. But your standard +ethernet can do a stable 1Gbit/s, which would drop the time down to 26 +minutes! + +So I take an ethernet cable and directly connect both laptops with that. +On both machines `ip a` now shows something like this: + +{{< img alt="new output of ip a" src="/pix/networking-ethernet-unconfigured.png" link="/pix/networking-ethernet-unconfigured.png" >}} + +There is no DHCP-Server running on either machine, so we\'ll have to do +the configuring ourselves! From here on we\'ll have Computer A with +interface `eth0` and Computer B with interface `eth1`, for clarity. + +First we must choose what subnet our ethernet interface should use. We +can freely choose from the list of reserved subnets here, as long as the +subnet isn\'t occupied by another interface on either machine. We\'ll +say `192.168.50.0/24`. + +Note also that the first and last address on each subnet, here +`192.168.50.0` and `192.168.50.255`, respectively, can\'t actually be +assigned to any device. The first is called \"Network ID\", as mentioned +previously, and the last is called \"broadcast IP\". + +So we\'ll give Computer A the IP `192.168.50.1` and Computer B the IP +`192.168.50.2`. To do that we use the `ip` command aswell. + +Computer A: + +```sh +ip addr add 192.168.50.1/24 dev eth0 +``` + +Computer B: + +```sh +ip addr add 192.168.50.2/24 dev eth1 +``` + +It should look something like this now: + +{{< img alt="new ip addresses" src="/pix/networking-ethernet-ip.png" link="/pix/networking-ethernet-ip.png" >}} + +Now we change the interface\'s state to `UP`: + +Computer A: + +```sh +ip link set eth0 up +``` + +Computer B: + +```sh +ip link set eth1 up +``` + +It should look something like this now: + +{{< img alt="ethernet output" src="/pix/networking-ethernet-ip-up.png" link="/pix/networking-ethernet-ip-up.png" >}} + +Are we done? You can try pinging one IP from another. It won\'t work, +because we don\'t have routes set up yet. So lets\'s do that: + +Computer A: + +```sh +ip route add 192.168.50.0/24 dev eth0 +``` + +Computer B: + +```sh +ip route add 192.168.50.0/24 dev eth1 +``` + +You should see something like this in `ip r`: + +{{< img alt="ip routes final" src="/pix/networking-ethernet-route.png" link="/pix/networking-ethernet-route.png" >}} + +They are now able to talk to each other! + +## Contribution +- [phire](https://phire.cc) diff --git a/content/nginx-tweaks.md b/content/nginx-tweaks.md index 8d4dcb8..8e85af5 100644 --- a/content/nginx-tweaks.md +++ b/content/nginx-tweaks.md @@ -2,19 +2,19 @@ title: "Nginx Tweaks" date: 2022-06-16 --- -The point of this article is to show you how to do some commonly-desired -tweaks in Nginx while in the meantime helping you understand how it -works. + +The point of this article is to show you how to do some commonly-desired tweaks +in Nginx while in the meantime helping you understand how it works. ## Do not require `.html` in URLs If your website is using lots of `.html` files for pages, it\'s sort of -overkill to make people type that in for every page they are looking -for. We can remove that requirement with Nginx. +overkill to make people type that in for every page they are looking for. We +can remove that requirement with Nginx. -Open your site\'s configuration file in `/etc/nginx/sites-enabled/` and -within the `server` block, there should be a `location` block that looks -something like this if you have followed [the guide here](/basic/nginx). +Open your site\'s configuration file in `/etc/nginx/sites-enabled/` and within +the `server` block, there should be a `location` block that looks something +like this if you have followed [the guide here](/basic/nginx). ```nginx location / { @@ -23,15 +23,14 @@ location / { ``` What this means is that in the file location of `/`, i.e. anywhere and -everywhere in the root file system, We will look for the three things -listed in `try_files` in that order: +everywhere in the root file system, We will look for the three things listed in +`try_files` in that order: -1. `$uri`: a file that directly matches the content added after the +1. `$uri`: a file that directly matches the content added after the domain. +2. `$uri/`: a *directory* that directly matches the content added after the domain. -2. `$uri/`: a *directory* that directly matches the content added after - the domain. -3. `=404`: if neither of those is found, we give a 404 error, which as - you probably know, signified \"Page not found.\" +3. `=404`: if neither of those is found, we give a 404 error, which as you + probably know, signified \"Page not found.\" We will now change the content inside the `location` block to the below: @@ -42,5 +41,5 @@ location / { } ``` -`$1` here refers to the first content in the parentheses `()` in the -preceeding regular expression. +`$1` here refers to the first content in the parentheses `()` in the preceeding +regular expression. diff --git a/content/radicale.md b/content/radicale.md index 56d3b0f..b24f8ef 100644 --- a/content/radicale.md +++ b/content/radicale.md @@ -46,7 +46,7 @@ As you can see under \[auth\] we use htpasswd to manage the users. Execute the following command to add a new user to Radicale. ```sh -htpasswd -c /etc/radicale/users username +htpasswd -B -c /etc/radicale/users username ``` As Radicale stands now it is fully functional and after starting it by diff --git a/content/rss-feed.md b/content/rss-feed.md new file mode 100644 index 0000000..ec91488 --- /dev/null +++ b/content/rss-feed.md @@ -0,0 +1,95 @@ +--- +title: "Creating an RSS Feed" +tags: ['concepts'] +date: 2022-07-02 +draft: true +--- + +RSS feeds are an easy way to be notified about new content from various +websites, and they are easy to implement in your website. + +## How an RSS Feed Works + +Some websites with frequently changing content like blogs, podcasts, or +video sharing sites, will have a link to a file containing the RSS feed +and its items. + +When there is new content, a new item can be added to the RSS feed, and +old items can optionally be removed from the RSS feed. A user\'s feed +reader can check an RSS feed for new items and notify the user about +them or organize them. + +## Writing an RSS Feed + +RSS feeds are written as XML (e**x**tensible **m**arkup **l**anguage) +files, so they can be written and served similar to HTML webpages. + +We will start by creating a file for our RSS feed. Make sure the file +name ends with `.rss` or `.xml`. Then, write the following code in the +file: + +```xml +<?xml version="1.0" encoding="UTF-8" ?> +<rss version="2.0"> + <channel> + </channel> +</rss> +``` + +The `<rss>` tag specifies that there is an RSS feed in between the +`<rss>` and `</rss>` tags. `version="2.0"` specifies that version 2.0 of +RSS is used. The items in an RSS feed go in between the `<channel>` and +`</channel>` tags. + +### Title, Description, and Link + +Now we will write a title and description for our RSS feed, as well as a +link to the webpage that the RSS feed goes with. In this example, we +will be writing an RSS feed for a blog called **LandChad\'s Blog**. + +In between the `<channel>` and `</channel>` tags, the `<title>` tag will +be used to label the feed as **LandChad\'s Blog**. The `<description>` +and `<link>` tags are used for the description of the feed and a link to +the corresponding webpage. + + ```xml + <channel> + <title>LandChad's Blog</title> + <description>LandChad's writings and ideas</description> + <link>https://example.org/blog</link> + </channel> + ``` + +{{< img src="/pix/rss-01.png" alt="LandChad's blog feed" link="/pix/rss-01.png" >}} + +### Feed Items + +Now we will add items to the RSS feed. These items are listed in the +user\'s feed reader and can represent different content on a page such +as blog posts or videos. In this example, there is a blog post called +**RSS is Amazing!**. + +The `<item>` tag is used to add items to the RSS feed. An item is given +a title using the `<title>` tag to label the item. The item will have a +link to its webpage using the `<link>` tag and an item description using +the `<description>` tag. + +The date and time of an item can be specified using the `<pubDate>` tag. +The date and time **must follow a specific format**. In the example +below, the item was posted on **Friday, October 1, 2021 at 2:27 PM in +the -0400 time zone**. + +```xml +<item> + <title>RSS is Amazing!</title> + <link>https://example.org/blog/2021-10-1-rss</link> + <description>RSS is a good notification system.</description> + <pubDate>Fri, 1 Oct 2021 14:27:00 -0400</pubDate> + </item> + ``` + +{{< img src="/pix/rss-02.png" alt="LandChad's Blog feed with an item" link="/pix/rss-02.png" >}} + +## Contributor + +[ClosedGL](https://closedgl.xyz) diff --git a/content/searxng.md b/content/searxng.md index 4797b69..7e0c570 100644 --- a/content/searxng.md +++ b/content/searxng.md @@ -20,6 +20,8 @@ that can be accessed using a domain over HTTPS. Features include: ## Installation +"For the installation procedure, use a sudoer login to run the scripts. If you install from root, take into account that the scripts are creating a searx, a filtron and a morty user. In the installation procedure these new created users do need read access to the clone of searx, which is not the case if you clone into a folder below /root." - SearXNG Docs + Install the required packages. ```sh @@ -29,8 +31,8 @@ apt install git nginx -y Open http and https ports. ```sh -iptables -I INPUT 6 -m state --state NEW -p tcp --dport 80 -j ACCEPT -iptables -I INPUT 6 -m state --state NEW -p tcp --dport 443 -j ACCEPT +iptables -I INPUT -m state --state NEW -p tcp --dport 80 -j ACCEPT +iptables -I INPUT -m state --state NEW -p tcp --dport 443 -j ACCEPT netfilter-persistent save ufw allow 80 ufw allow 443 diff --git a/content/tor.md b/content/tor.md index d4fa9fb..c12fa92 100644 --- a/content/tor.md +++ b/content/tor.md @@ -116,4 +116,4 @@ Make sure to update Tor on a regular basis by running: You do [not]{.underline} need to run certbot for an ssl certificate. HTTP over tor is plenty secure! -**Contributor** - [tomfasano.co](https://tomfasano.co){target="_blank"} +**Contributor** - [tomfasano.net](https://tomfasano.net) diff --git a/content/yarr.md b/content/yarr.md new file mode 100644 index 0000000..6882fa1 --- /dev/null +++ b/content/yarr.md @@ -0,0 +1,101 @@ +--- +title: "Yarr" +date: 2022-07-01 +icon: 'yarr.svg' +tags: ['service'] +short_desc: 'A self-hosted, web-based feed aggregator' +--- + +[Yarr](https://github.com/nkanaev/yarr) (yet another rss reader) is a web-based feed aggregator which can be used both as a desktop application and a personal self-hosted server. + +It is written in Go with the frontend in Vue.js. The storage is backed by SQLite. + +## Installing Yarr + +Firstly, we have to download yarr binary from github on our system + +```sh +wget https://github.com/nkanaev/yarr/releases/download/v2.3/yarr-v2.3-linux64.zip +``` + +Unzip the archive + +```sh +unzip -x yarr-v2.3-linux64.zip +``` + +Move the binary to your bin folder + +```sh +mv yarr /usr/local/bin/yarr +``` + +## Configuration + +Now we need to create a `auth.conf` file that include user and password to create a local yarr account. +I personnaly store this file in a directory called yarr in `~/.config` folder, but you can place the file wherever you want. + +```sh +mkdir ~/.config/yarr +echo 'landchad:password' > ~/.config/yarr/auth.conf +``` + +## Creating a service + +Create a new file /etc/systemd/system/yarr.service and add the following: + +```systemd +[Unit] +Description=Yarr + +[Service] +Environment=HOME=/home/landchad +ExecStart=/usr/bin/env yarr -addr 0.0.0.0:7070 -auth-file=/home/landchad/.config/yarr/auth.conf -db=/home/landchad/.config/yarr/feed.sql -log-file=/home/landchad>/.config/yarr/access.log +Restart=on-failure + +[Install] +WantedBy=multi-user.target +``` + +After creating the config, load, start and enable the service with the following commands. + +```sh +systemctl daemon-reload +systemctl enable --now yarr +``` + +## Nginx configuration +Create an Nginx configuration file for Yarr, say /etc/nginx/sites-available/yarr and add the content below: + +```nginx +server { + listen 80 ; + listen [::]:80 ; + + server_name rss.example.org ; + + location / { + proxy_pass http://localhost:7070/; + } +} +``` + +Now let's enable the Nginx Yarr site and reload Nginx to make it active. + +```sh +ln -s /etc/nginx/sites-available/yarr /etc/nginx/sites-enabled +systemctl reload nginx +``` + +### Encryption + +You can encrypt your yarr subdomain as well. Let's do that with certbot: + +```sh +certbot --nginx -d rss.example.org +``` + +Now you can go to rss.example.org, login and start to add your feeds! + +## Contribution +Author: Jppaled -- [jppaled.xyz](https://jppaled.xyz) \-- XMR: `86bVp8bcx1F3y3NsfuTRs6D7FfnDyLomV7dLJmus2YMiY9Aat6W5m8JGwuvH39HKrq3immS7noKq8HeW4gb4BFbyLoz5WSZ`{.crypto} diff --git a/static/pix/networking-ethernet-ip-up.png b/static/pix/networking-ethernet-ip-up.png Binary files differnew file mode 100644 index 0000000..e6e2224 --- /dev/null +++ b/static/pix/networking-ethernet-ip-up.png diff --git a/static/pix/networking-ethernet-ip.png b/static/pix/networking-ethernet-ip.png Binary files differnew file mode 100644 index 0000000..ec1024c --- /dev/null +++ b/static/pix/networking-ethernet-ip.png diff --git a/static/pix/networking-ethernet-route.png b/static/pix/networking-ethernet-route.png Binary files differnew file mode 100644 index 0000000..61befb9 --- /dev/null +++ b/static/pix/networking-ethernet-route.png diff --git a/static/pix/networking-ethernet-unconfigured.png b/static/pix/networking-ethernet-unconfigured.png Binary files differnew file mode 100644 index 0000000..96f1dbd --- /dev/null +++ b/static/pix/networking-ethernet-unconfigured.png diff --git a/static/pix/networking-interfaces.png b/static/pix/networking-interfaces.png Binary files differnew file mode 100644 index 0000000..bbf0ee3 --- /dev/null +++ b/static/pix/networking-interfaces.png diff --git a/static/pix/networking-server-interfaces.png b/static/pix/networking-server-interfaces.png Binary files differnew file mode 100644 index 0000000..ddae269 --- /dev/null +++ b/static/pix/networking-server-interfaces.png diff --git a/static/pix/networking-server-routes.png b/static/pix/networking-server-routes.png Binary files differnew file mode 100644 index 0000000..f756a07 --- /dev/null +++ b/static/pix/networking-server-routes.png diff --git a/static/pix/networking-wlan0.png b/static/pix/networking-wlan0.png Binary files differnew file mode 100644 index 0000000..44f10a5 --- /dev/null +++ b/static/pix/networking-wlan0.png diff --git a/static/pix/rss-01.png b/static/pix/rss-01.png Binary files differnew file mode 100644 index 0000000..aa3c965 --- /dev/null +++ b/static/pix/rss-01.png diff --git a/static/pix/rss-02.png b/static/pix/rss-02.png Binary files differnew file mode 100644 index 0000000..e296352 --- /dev/null +++ b/static/pix/rss-02.png diff --git a/static/pix/yarr.svg b/static/pix/yarr.svg new file mode 100644 index 0000000..bedae7c --- /dev/null +++ b/static/pix/yarr.svg @@ -0,0 +1 @@ +<svg xmlns="http://www.w3.org/2000/svg" width="24" height="24" viewBox="0 0 24 24" fill="none" stroke="white" stroke-width="2" stroke-linecap="round" stroke-linejoin="round" class="feather feather-anchor"><circle cx="12" cy="5" r="3"/><line x1="12" y1="22" x2="12" y2="8"/><path d="M5 12H2a10 10 0 0 0 20 0h-3"/></svg> |
