+ + Put all your page content here in the

tag. diff --git a/content/i2p.md b/content/i2p.md new file mode 100644 index 0000000..fec9d8c --- /dev/null +++ b/content/i2p.md @@ -0,0 +1,101 @@ +--- +title: "i2p" +date: 2021-07-01 +img: 'i2p.svg' +icon: 'itoopie.svg' +tags: ['service'] +short_desc: "A private and uncensorable web-layer similar to Tor." +--- + +Now you have a website, why not offer it in a private alternative such +as the Invisible Internet? + +## Setting up I2P + +There are 2 main I2P implementations, I2P and i2pd, we are using i2pd in +this guide because it\'s easier to use in servers. + +### Installing I2P + +i2pd is in most repos, in debian/ubuntu you can install it simply with + +```sh +apt install i2pd +``` + +### Enabling I2P + +We are going to create a user for i2pd, because i2pd finds the +configuration files in its home directory. And it\'s easier (and more +tidy) to have it in a separate user: + +```sh +useradd -m i2p -s /bin/bash +su -l i2p +mkdir ~/.i2pd +cd ~/.i2pd +``` + +Now that you\'re in \~/.i2pd, you have to create a file named +\"tunnels.conf\". Which is the config file for every hidden service +you\'re offering over I2P, the content should be like this: + +```systemd +[example] +type = http +host = 127.0.0.1 +port = 8080 +keys = example.dat +``` + +### Getting your I2P Hostname + +Then, run `/usr/sbin/i2pd --daemon` to start i2pd and we can retreive +our I2P hostname. + +This can be done in lynx or a command-line browser by going to +`http://127.0.0.1:7070/?page=i2p_tunnels` to get your I2P hostname. + +You can also run these commands to find your hostname: + +```sh +printf "%s.b32.i2p +" $(head -c 391 /home/i2p/.i2pd/example.dat |sha256sum|xxd -r -p | base32 |sed s/=//g | tr A-Z a-z) +``` + +## Adding the Nginx Config + +From here, the steps are almost identical to setting up a normal website +configuration file. Follow the steps as if you were making a new website +on the webserver [tutorial](/basic/nginx) up until the server block of +code. Instead, paste this: + +```nginx +server { + listen 127.0.0.1:8080 ; + root /var/www/example ; + index index.html ; +} +``` + +#### Clarifications + +#### + +Nginx will listen in port 8080, but i2pd will forward your port 8080 to +the i2p site port 80. This way you don\'t have to deal with server names +or anything like that + +From here we are almost done, all we have to do is enable the site and +reload nginx which is also covered in [the webserver +tutorial](nginx.html#enable). + +### Update regularly! + +Make sure to update I2P on a regular basis by running: + +```sh +apt update && apt install i2pd +``` + +**Contributor** - [qorg11](https://qorg11.net) diff --git a/content/imgcompress.md b/content/imgcompress.md new file mode 100644 index 0000000..49dab19 --- /dev/null +++ b/content/imgcompress.md @@ -0,0 +1,51 @@ +--- +title: "Image compression" +date: 2021-07-17 +--- +Image files will usually have the most impact on the speed of your +websites (aside from Ad/tracker scripts). Learn to slim down your images +using the ubiquitous *ImageMagick* to make your websites faster on slow +internet connections. + +{{< img alt="Image network speed" src="/pix/imgcompress-network.png" link="/pix/imgcompress-network.png" >}} + +For the examples, I decided to use +[this](https://commons.wikimedia.org/wiki/File:Tabby_cat_with_blue_eyes-3336579.jpg) +public domain image. + +{{< img alt="Compressed image of a cat" src="/pix/imgcompress-cat.png" link="/pix/imgcompress-cat.png" >}} + +There are many ways to decrease image size using ImageMagick, the +simplest is to use the `-quality` option, which will compress the image +without changing the resolution. This option takes the value you want to +compress by (between 1 and 100, the lower the value, the lower the file +size). For example: + + convert in.jpg -quality 50 out.jpg + +Compressing the example image above results in the following file size +changes: + +``` + Quality Size + ---------- ------ + Original 2.1M + 90 1.7M + 80 844K + 70 588K + 60 448K + 50 368K + 40 308K + 30 248K + 20 184K + 10 116K +``` + +Due to the images high resolution, it is usable in this website even +when highly compressed (30% quality, still looks decent in my opinion). + +## Contribution + +- [Musse](https://na20a.neocities.org/) +- Monero: + `83is3y69Xv4fkFsTpZhw5c3bfxtimupfgTdpERHM1WtMNAwSqFjTCJm3VabyBKXKnL873dWPmqj4bRcgkm9oCktgQrzmhHd`{.crypto} diff --git a/content/irc.md b/content/irc.md new file mode 100644 index 0000000..f61abca --- /dev/null +++ b/content/irc.md @@ -0,0 +1,946 @@ +--- +title: "IRC" +date: 2020-07-03 +icon: 'irc.svg' +tags: ['service'] +short_desc: "Self-hosting the Internet's classic chat protocol." +--- + +Creating your own chat server for you and your friends is easy, and you +don\'t have to rely on a complicated system to get started. IRC is an +old but gold protocol, and has clients for basically every operating +system made since the 80s, with many powerful modern ones on Linux, Mac, +and Windows. + +Having a chat server for you and your friends makes it impossible for a +group of arbitrarily appointed moderators to deplatform you for +wrong-think, and gives you greater freedom of communication. + +## Installing an IRCd {#installing} + +An IRCd is short for \"IRC daemon\", which just means an IRC server. The +most easy IRCd to set up is [Ergo](https://ergo.chat/). + +The first thing you need to do is create a new user for the server to be +run by. This is good practice for installing software/servers manually, +as it give you more fine-grained control over which permissions the +application has. + +```sh +useradd -m ergo -s /bin/bash +``` + +Next, we want to switch to our newly created `ergo` user and create the +server directory. + +```sh +sudo -i -u ergo +mkdir server +``` + +You can find the latest release of Ergo on its GitHub [latest +release](https://github.com/ergochat/ergo/releases/latest) page.\ +There are several platforms available, but you want to choose Linux, +most likely `linux-x86_64`.\ +Once you have selected the correct package, copy its URL and replace the +release url with the package URL (still as the `ergo` user): + +```sh +wget "https://github.com/ergochat/ergo/releases/download/v2.7.0/ergo-2.7.0-linux-x86_64.tar.gz" +tar -xf ergo-2.7.0-linux-x86_64.tar.gz +mv ergo-2.7.0-linux-x86_64/* +rm -r ergo-2.7.0-linux-x86_64* +``` + +Executing `ls -l` should now yield something like this: + +```sh +-rw-r--r-- 1 ergo ergo 118825 Jun 8 00:51 CHANGELOG.md +-rw-r--r-- 1 ergo ergo 1983 May 31 01:48 README +-rw-r--r-- 1 ergo ergo 41440 Jun 8 00:42 default.yaml +drwxr-xr-x 2 ergo ergo 4096 Jul 1 09:01 docs +-rwxr-xr-x 1 ergo ergo 9654272 Jun 8 00:53 ergo +-rw-r--r-- 1 ergo ergo 1753 May 31 01:48 ergo.motd +drwxr-xr-x 2 ergo ergo 12288 Jul 1 09:01 languages +-rw-r--r-- 1 ergo ergo 39722 Jun 8 00:42 traditional.yaml +``` + +If you see something similar to the above, that means Ergo is installed, +although not quite ready to run yet. + +## Configuring Ergo {#configuring} + +Now that Ergo is installed, you want to configure it to fit the needs of +your group.\ +The configuration in this section is tailored towards a small group of +people, and less for a possibly large network, but it should work for +any size of group. + +First thing, make sure you\'re still using the `ergo` user, and are in +the `~/server` directory.\ +If you aren\'t, you can run the following to get back there: + +```sh +sudo -i -u ergo +cd ~/server +``` + +To start configuring, we need to copy some files: + +```sh +cp default.yaml ircd.yaml +cp ergo.motd ircd.motd +``` + +Next, generate certificate files for TLS: + +```sh +./ergo mkcerts +``` + +Ergo comes with a default configuration file with detailed documentation +that can be used to guide you through the configuration process. This +guide will help you setup the server for a typical use-case, but if you +see any settings that you would like to change along the way, go ahead +and change them, as long as you know what you\'re doing. + +The next steps involve editing the newly copied `ircd.yaml` file. If you +do not know how to edit text files from the command line, you can use +`nano`, which is very simple, using arrow keys to navigate, `CTRL+O` to +save, and `CTRL+X` to exit.\ +Another option is `vim`, which is a much more powerful text editor, but +has a learning curve. It is only recommended for this guide if you +already know how to use it.\ +Lastly, you can copy the `ircd.yaml` file to a text editor on your +computer and edit it with a GUI text editor of your choice. If that is +what you choose to do, you may want to just download the file from +[Ergo\'s +GitHub](https://raw.githubusercontent.com/ergochat/ergo/master/default.yaml), +edit it on your computer, clear the `ircd.yaml` file on the server, and +then paste the contents from your computer into the blank file.\ +No matter how you do it, the next steps assume you can edit the +configuration file. + +**Note**:\ +The options highlighted in this section are not a complete overview of +all options. Instead, the options shown are the ones which are most +relevant to a small network.\ +You should read over the configuration file yourself if you are curious +about everything you can change. + +### Network and server names {#configuring-names} + +One of the first properties in the config file is network name. You can +change this to whatever you like, as it will show up as the name when +you connect to the server. + +```yaml +# network configuration +network: + # name of the network + name: "Land-Chat" +``` + +Change the server name to your server\'s domain name. + +```yaml +# server configuration +server: + # server name + name: "example.org" +``` + +### Network password {#configuring-password} + +The next step is optional, depending on if you want your network +password protected or not. The benefit of password protection is fairly +obvious; nobody can connect to your network unless you gave them the +password. If you\'re wanting to run a public network which anyone can +join and create a channel, you want to skip this, but for personal +setups, it is highly recommended. + +Generate a password to use by executing the following: + +```sh +./ergo genpasswd +``` + +It will ask you to enter a password and confirm it, then you will be +given a hashed password.\ +Copy this password, and paste it into the following field (also removing +the `#` before the `password:` line): + +```yaml +# password to login to the server, generated using `ergo genpasswd`: +password: "" +``` + +### Message of the day (MotD) {#configuring-motd} + +Change the MotD (**M**essage **o**f **t**he **D**ay) file to the one you +copied earlier: + +```yaml +# motd filename +# if you change the motd, you should move it to ircd.motd +motd: ircd.motd +``` + +Feel free to edit `ircd.motd` to your heart\'s content. Its contents +will be sent to clients when they connect to the network. + +### IP limits {#configuring-ip-limits} + +For security purposes, you might want to limit the amount of client +connections per IP. For a private network, 4 is likely the maximum +amount of connections you will have per IP, so that is a safe value.\ +If your network is password protected, this is less of an issue, since +the only people connecting will be people who have the password. The +following is the default, but you can change it to be whichever value +you like: + +```yaml +# IP-based DoS protection +ip-limits: + # whether to limit the total number of concurrent connections per IP/CIDR + count: true + # maximum concurrent connections per IP/CIDR + max-concurrent-connections: 16 +``` + +### IP cloaking {#configuring-ip-cloaking} + +Traditionally, IRC networks expose users\' IP addresses to everyone. +This is not a good practice for privacy, however. With Ergo, IP cloaking +is enable by default. You can enable or disable it if you like, and +change how it looks to users.\ +In this case, `netname` was changed to `"chad"`. + +```yaml +# IP cloaking hides users' IP addresses from other users and from channel admins +# (but not from server admins), while still allowing channel admins to ban +# offending IP addresses or networks. In place of hostnames derived from reverse +# DNS, users see fake domain names like pwbs2ui4377257x8.irc. These names are +# generated deterministically from the underlying IP address, but if the underlying +# IP is not already known, it is infeasible to recover it from the cloaked name. +# If you disable this, you should probably enable lookup-hostnames in its place. +ip-cloaking: + # whether to enable IP cloaking + enabled: true + + # whether to use these cloak settings (specifically, `netname` and `num-bits`) + # to produce unique hostnames for always-on clients. you can enable this even if + # you disabled IP cloaking for normal clients above. if this is disabled, + # always-on clients will all have an identical hostname (the server name). + enabled-for-always-on: true + + # fake TLD at the end of the hostname, e.g., pwbs2ui4377257x8.irc + # you may want to use your network name here + netname: "chad" +``` + +### Password enforcement adjustments for HexChat (and possibly other clients) {#configuring-hexchat-password} + +Ergo offers account registration to allow users to do things like use +history and bouncer features, register channels, etc.\ +In clients such as HexChat, server passwords may conflict with account +passwords, so the following setting should be enabled if you wish to use +accounts with clients such as HexChat.\ +Note that this could under some circumstances be considered a security +hazard, as a user with an account does not need to know the server +password to connect, although that user would have needed to register an +account before the server had a password, and then a password would need +to have been set after the fact, so this can be considered a very small +concern if your setup has always had a password.\ +Also keep in mind that this setting has no effect if your network does +not even have a password at all. + +```yaml +# some clients (notably Pidgin and Hexchat) offer only a single password field, +# which makes it impossible to specify a separate server password (for the PASS +# command) and SASL password. if this option is set to true, a client that +# successfully authenticates with SASL will not be required to send +# PASS as well, so it can be configured to authenticate with SASL only. +skip-server-password: true +``` + +### Multiclient, always-on clients, history, etc {#configuring-multiclient} + +Traditionally, IRC servers have no message history, and once you close +your client, you cannot receive messages, and are not shown to be online +at all. Ergo includes functionality to allow users to both receive +history, and keep their clients \"online\" even after they have left. It +also allows multiple clients to connect to the same account.\ +If you are running a private network for friends, you should set +`always-on` and `auto-away` to `opt-out`, to have all users with +accounts to appear as if they are online at all times, and be able to +receive messages when they are offline.\ +For a public network, keep everything as their default values, since you +probably do not want randoms having this by default.\ +If for some reason you do not want any of these features at all, you can +set `enabled` to `false`, but this is not recommended. Below are the +recommended values for a private network (e.g. for friends) where users +with accounts will be able to receive messages and history while they +are offline. + +```yaml +# multiclient controls whether Ergo allows multiple connections to +# attach to the same client/nickname identity; this is part of the +# functionality traditionally provided by a bouncer like ZNC +multiclient: + # when disabled, each connection must use a separate nickname (as is the + # typical behavior of IRC servers). when enabled, a new connection that + # has authenticated with SASL can associate itself with an existing + # client + enabled: true + + # if this is disabled, clients have to opt in to bouncer functionality + # using nickserv or the cap system. if it's enabled, they can opt out + # via nickserv + allowed-by-default: true + + # whether to allow clients that remain on the server even + # when they have no active connections. The possible values are: + # "disabled", "opt-in", "opt-out", or "mandatory". + always-on: "opt-out" + + # whether to mark always-on clients away when they have no active connections: + auto-away: "opt-out" + + # QUIT always-on clients from the server if they go this long without connecting + # (use 0 or omit for no expiration): + #always-on-expiration: 90d +``` + +### VHosts {#configuring-vhosts} + +IP cloaking was mentioned previously, and somewhat related to that, Ergo +includes \"vhost\" functionality, which allows users to set a custom +IP/host string. This is mostly for cosmetic value, and does not +interfere with operators being able to see actual IP addresses for +banning, but if you do not want it enable for some reason, you can +disable it. + +```yaml +# vhosts controls the assignment of vhosts (strings displayed in place of the user's +# hostname/IP) by the HostServ service +vhosts: + # are vhosts enabled at all? + enabled: true +``` + +### Channels {#configuring-channels} + +Channels are where everyone on an IRC network talk. By default, anyone +can create a channel, and anyone with an account can register one. The +difference between a normal channel and a registered one is that the +registered one will preserve the operator status of the person who +created, whereas a normal channel\'s owner will lose operator status if +they leave the channel or disconnect from the network.\ +There are various settings for channels available, but the defaults are +suitable for a private network with trust among users, or where you just +want anyone to have the ability to create a channel. Below are the +default values: + +```yaml +# channel options +channels: + # modes that are set when new channels are created + # +n is no-external-messages and +t is op-only-topic + # see /QUOTE HELP cmodes for more channel modes + default-modes: +nt + + # how many channels can a client be in at once? + max-channels-per-client: 100 + + # if this is true, new channels can only be created by operators with the + # `chanreg` operator capability + operator-only-creation: false + + # channel registration - requires an account + registration: + # can users register new channels? + enabled: true + + # restrict new channel registrations to operators only? + # (operators can then transfer channels to regular users using /CS TRANSFER) + operator-only: false + + # how many channels can each account register? + max-channels-per-account: 15 +``` + +### Operators (administrators, etc) {#configuring-operators} + +The IRC term for an administrator or another privileged user is +\"operator\", or \"oper\" for short.\ +Ergo\'s opers have different permissions that can be granted to them, +and are defined in \"classes\", basically groups of permissions under a +name. For example, \"chat-moderator\" and \"server-admin\" are defined +in the default configuration: + +```yaml +# operator classes +oper-classes: + # chat moderator: can ban/unban users from the server, join channels, + # fix mode issues and sort out vhosts. + "chat-moderator": + # title shown in WHOIS + title: Chat Moderator + + # capability names + capabilities: + - "kill" + - "ban" + - "nofakelag" + - "roleplay" + - "relaymsg" + - "vhosts" + - "sajoin" + - "samode" + - "snomasks" + + # server admin: has full control of the ircd, including nickname and + # channel registrations + "server-admin": + # title shown in WHOIS + title: Server Admin + + # oper class this extends from + extends: "chat-moderator" + + # capability names + capabilities: + - "rehash" + - "accreg" + - "chanreg" + - "history" + - "defcon" + - "massmessage" +``` + +The above can be kept with their default values, but you are free to +modify them or create any new classes that are appropriate for your +setup.\ +Next, let\'s actually create an operator account: + +```yaml +# ircd operators +opers: + # default operator named 'gigachad'; log in with /OPER gigachad + "gigachad": + # which capabilities this oper has access to + class: "server-admin" + + # custom whois line + whois-line: is the server administrator + + # custom hostname + vhost: "gigachad" + + # normally, operator status is visible to unprivileged users in WHO and WHOIS + # responses. this can be disabled with 'hidden'. ('hidden' also causes the + # 'vhost' line above to be ignored.) + hidden: false + + # modes are modes to auto-set upon opering-up. uncomment this to automatically + # enable snomasks ("server notification masks" that alert you to server events; + # see `/quote help snomasks` while opered-up for more information): + #modes: +is acjknoqtuxv + + # operators can be authenticated either by password (with the /OPER command), + # or by certificate fingerprint, or both. if a password hash is set, then a + # password is required to oper up (e.g., /OPER dan mypassword). to generate + # the hash, use `ergo genpasswd`. + password: "" +``` + +This is a modified version of the default oper entry. The account name +is \"gigachad\", but you can change it to anything.\ +Replace `` with a password generated by +`./ergo genpasswd`, and you will have a new oper account to use.\ +Note that to log into an oper account, clients have to enter +`/OPER ` each time they log in. This can be +automated by most clients by setting the command to be executed when the +client logs in. In the case of HexChat, you can edit your network and +add the command to the `Connect commands` tab of the menu.\ +You can copy everything from `"gigachad"` to the end of the line, paste +it again, and change the name to create another oper account. Another, +less privileged example of an oper is shown as a comment below the above +configuration snippet. + +### Chat history {#configuring-history} + +Traditionally, IRC networks do not store, relay, or handle chat history +in any way.\ +On a privacy standpoint, this is a good thing, since chats are entirely +ephemeral and handled by clients.\ +On a practicality standpoint, this is a bad thing, since people have to +keep a client connected 24/7 to see message history.\ +For normalfriends, this can be a big problem, not only because having to +stay online 24/7 is just annoying or infeasible, but also because they +are likely used to chat platforms that handle history for them.\ +With this in mind, enabling history is a good idea if you want to move +friends over to IRC, and will make things a lot more pleasant for +private networks. + +Ergo\'s `history` configuration group is very long, so it is encouraged +to read over it yourself. This section will go over the most important +pieces of that configuration group. + +History is not endless (unless you want it to be), and the amount that +can be stored for channels is configurable: + +```yaml +# how many channel-specific events (messages, joins, parts) should be tracked per channel? +channel-length: 2048 +``` + +History is already enabled by default, but that just means it is being +collected, not relayed by default. To relay history to clients when they +connect, change the following to the amount of messages that you think +is appropriate: + +```yaml +# number of messages to automatically play back on channel join (0 to disable): +autoreplay-on-join: 250 +``` + +History older than a certain time can be configured to be deleted or be +inaccessible. The default cutoff time is 1 week, but this is +configurable as well. + +```yaml +# options to delete old messages, or prevent them from being retrieved +restrictions: + # if this is set, messages older than this cannot be retrieved by anyone + # (and will eventually be deleted from persistent storage, if that's enabled) + expire-time: 1w +``` + +By default, Ergo only stores chat history in memory, so when the server +restarts, all history is lost. If you wish to have chat history persist +beyond restarts, you must store it in a MySQL database: + +```yaml +# options to store history messages in a persistent database (currently only MySQL). +# in order to enable any of this functionality, you must configure a MySQL server +# in the `datastore.mysql` section. +persistent: + enabled: true + + # store unregistered channel messages in the persistent database? + unregistered-channels: true + +# connection information for MySQL (currently only used for persistent history): +mysql: + enabled: false + host: "localhost" + port: 3306 + # if socket-path is set, it will be used instead of host:port + #socket-path: "/var/run/mysqld/mysqld.sock" + user: "ergo" + password: "hunter2" + history-database: "ergo_history" + timeout: 3s + max-conns: 4 + # this may be necessary to prevent middleware from closing your connections: + #conn-max-lifetime: 180s +``` + +For privacy reasons, you may want to allow users to delete their own +messages in history, or export their messages to JSON: + +```yaml +# options to control how messages are stored and deleted: +retention: + # allow users to delete their own messages from history? + allow-individual-delete: true + + # if persistent history is enabled, create additional index tables, + # allowing deletion of JSON export of an account's messages. this + # may be needed for compliance with data privacy regulations. + enable-account-indexing: true +``` + +### Spam reduction {#configuring-spam} + +Most IRC networks have measures in place to reduce chat spam. By +default, \"fakelag\" is enabled in Ergo, and that can deal with most +aggregious chat spam.\ +If you are running a private network where user trust is high, you can +disable it so that there are no limits on the speed that messages can be +sent. + +```yaml +# fakelag: prevents clients from spamming commands too rapidly +fakelag: + # whether to enforce fakelag + enabled: true + + # time unit for counting command rates + window: 1s + + # clients can send this many commands without fakelag being imposed + burst-limit: 5 + + # once clients have exceeded their burst allowance, they can send only + # this many commands per `window`: + messages-per-window: 2 + + # client status resets to the default state if they go this long without + # sending any commands: + cooldown: 2s +``` + +## Starting and using your server + +Now that Ergo is both installed and configured, you can actually start +using it! + +### Starting the server {#using-starting} + +First thing, make sure you\'re still using the `ergo` user, and are in +the `~/server` directory.\ +If you aren\'t, you can run the following to get back there: + +```sh +sudo -i -u ergo +cd server +``` + +Starting the server is done in one command: + +```sh +./ergo run +``` + +It will stay online until you close the terminal, or press CTRL+C. +Don\'t worry, the next section goes over how to make it run like a +normal server with a SystemD service.\ +If you have not already, make sure the port `6697` is not blocked on +your server. If you are using UFW as your firewall, you need to run +`ufw enable 6697` (not as the `ergo` user, of course).\ +If you make and configuration changes while the server is running, you +can apply them without restarting by typing `/rehash` as an operator. + +### Connecting to the server {#using-connecting} + +To use IRC, you of course need an IRC client. There are many choices +available, but the most widely used for Windows and Linux is +[HexChat](https://hexchat.github.io/). On Mac, you have a slightly nicer +option with [Textual](https://www.codeux.com/textual/), although you +have to [compile it from +source](https://github.com/Codeux-Software/Textual/#building-textual) if +you want to use it for free.\ +A more user-friendly and modern client choice is TheLounge, which is +explained in the last section of this guide, if you want to look into +it. + +Connecting with HexChat is very easy. When you start it, you will see +something like this: + +{{< img alt="HexChat network select" src="/pix/irc/hexchat-network-select.png" link="/pix/irc/hexchat-network-select.png" >}} + +From there, you should click `+ Add` and name the server whatever you +like (so you can find it on the server list).\ +Once you have created a new server and named it, select it and click +`Edit...`. A menu will show up like the one below. Change the domain to +whatever domain your server is running on, and make sure to put in your +server password if you set one. + +{{< img alt="HexChat network edit menu" src="/pix/irc/hexchat-network-edit.png" link="/pix/irc/hexchat-network-edit.png" >}} + +Once you\'re done editing the network, click `(X) Close`, select your +network from the network list, and click `Connect`.\ +If all is well, you should be connected! + +{{< img alt="HexChat connection complete" src="/pix/irc/hexchat-connection-complete.png" link="/pix/irc/hexchat-connection-complete.png" >}} + +The process is very similar on Textual.\ +Create a new network and connect to it. Note that it will ask if you +want to connect even though the certificate is unsigned. This is due to +the self-signed certificates generated for the server, and is not a +problem or security vulnerability, it is just a little annoying. + +{{< img alt="Textual network edit menu" src="/pix/irc/textual-network-edit.png" link="/pix/irc/textual-network-edit.png" >}} + +Surviving restarts with a SystemD service + +In the beginning of the last section, Ergo was started by simply running +`./ergo run`, but this is only suitable for testing. To have a proper +server setup, you need to run it as a service. This can be achieved via +a SystemD service. + +Before creating your service file, make sure you are in `~/server` as +the `ergo` user.\ +Once you have done that, create a file called `start.sh` with the +following content: + +```sh +#!/bin/bash +./ergo run +``` + +Save the file, then mark it as executable: + +```sh +chmod +x start.sh +``` + +Now, create a file called `ergo.service` with the following content: + +```systemd +[Unit] +Description=Ergo IRC server +After=network.target +# If you are using MySQL for history storage, comment out the above line +# and uncomment these two instead (you must independently install and configure +# MySQL for your system): +# Wants=mysql.service +# After=network.target mysql.service + +[Service] +Type=simple +User=ergo +WorkingDirectory=/home/ergo/server +ExecStart=/home/ergo/server/start.sh +ExecReload=/bin/kill -HUP $MAINPID +Restart=on-failure +LimitNOFILE=1048576 +# Uncomment this for a hidden service: +# PrivateNetwork=true + +[Install] +WantedBy=multi-user.target +``` + +You now have your service file, but it is not installed yet. To install +it, switch to your normal user, and execute the following lines to +install, enable, and start the SystemD service: + +```sh +ln -s /home/ergo/server/ergo.service /etc/systemd/system/ergo.service +systemctl enable ergo +systemctl start ergo +``` + +Ergo is now installed and running as a service, and will automatically +start when the system boots. + +## Registering accounts and channels {#registering} + +Account and channel registration were mentioned multiple times in this +guide, and are indeed very important parts of the modern IRC ecosystem. +You can connect to most IRC networks and talk without creating an +account, but you will not be able to reserve your nickname or register +channels, so it is important to register an account. + +### Registering an account with NickServ {#registering-accounts} + +First, make sure you are connected to your IRC network. Once you are, +type `/nickserv help` to make sure NickServ (the registration system) is +working propertly.\ +If all is well, type the following, replacing `` with the +password you want to use: + +```txt +/nickserv register +``` + +At this point, you are now registered!\ +The final step is to configure authentication with your client. + +In HexChat, all that needs to be done is changing `Login method` to +`SASL (username + password)`, and entering your NickServ password that +you used earlier into the password field: + +{{< img alt="HexChat SASL in network edit menu" src="/pix/irc/hexchat-sasl.png" link="/pix/irc/hexchat-sasl.png" >}} + +In Textual, open up your network in the menu, and click `Identity` under +`Server Properties`. Enter your password in `Personal Password`, and +check `Wait for identification before joining channels`. + +{{< img alt="Textual identity menu" src="/pix/irc/textual-identity.png" link="/pix/irc/textual-identity.png" >}} + +You will now be logged into your account when you connect to your +network. + +### Registering channels with ChanServ {#registering-channels} + +Once you have an account registered, you can register channels with +ChanServ.\ +To do so, join the channel you want to register, then type the +following, replacing `` with the name of the channel you +want to register: + +```txt +/chanserv register # +``` + +You are now the channel owner, and are free to appoint operators, +administrators, etc for it. When you go offline, you won\'t lose +ownership, and you cannot be removed as the owner unless you unregister +the channel later. + +## Moderation + +Like any chat, there will come a point where you need to use moderation +tools to keep things under control. Many IRC setup guides do not go over +moderation, so it can be stressful when operators need to actually use +moderation tools.\ +The main difference between IRC and other chat systems in terms of +moderation is the difference between channel bans and network bans. +Channel ban keeps a person out of channel a channel, whereas a network +ban keeps a person out of the entire network. + +### Understanding masks {#moderation-masks} + +Bans are applied \"masks\", which are formatted pieces of text that +contain a user\'s nick (username), their realname value, and their IP +address or host.\ +This is what a mask looks like: `nick!~nick-dude@127.0.0.1`.\ +In bans, asterisks can be used as wildcards, which is useful for banning +IP address ranges, patterns of nicknames, or whatever else you can think +of.\ +A ban on the nick `person`, for example, would look like this: +`person!*@*`.\ +A ban on anyone with the IP address `127.0.0.1` would look like this: +`*!*@127.0.0.1` + +### Discovering real IPs {#moderation-real-ips} + +Even if IP cloaking is enabled on your network, you can still obtain +real IP addresses/hosts if you are an operator. See the **Operators** +part of the configuration section of this guide on how to become an +operator.\ +To find out a user\'s real IP, simply type `/whois` along with the +user\'s nick, and you will see information about the user, along with +their real IP address/host.\ +`/whois` is not a command that is exclusive to operators, but it does +not reveal as much information to non-operators. + +### Banning someone from the network {#moderation-network-ban} + +Any netword-wide moderation action requires being an operator. See the +**Operators** part of the configuration section of this guide on how to +become an operator.\ +Banning someone from the network is achieved with the `/kline` command. +To see more info on the command, type `/helpop kline`.\ + +To ban a nick from the network: + +```txt +/kline andkill !*@* +``` + +To ban an IP address or host from the network: + +```txt +/kline andkill *!*@ +``` + +To unban a mask, you can use the `/unkline` command with the mask you +want to unban. + +### Banning someone from a channel {#moderation-channel-ban} + +Channel owners, administrators, and operators can ban people from +channels. This is not the same as banning someone from the network, +since it only has an effect on one channel. Additionally, a channel +operator is not the same as a network operator. + +To ban someone in a channel, type the following in that channel, +replacing `` with the user\'s mask: + +```txt +/mode +b +``` + +Note that this will only ban the user, not kick them immediately. You +will want to run `/kick` along with the user\'s nick to also kick them.\ +To unban a user, run the command above, but replace the `+` with a `-`.\ +You can see who is banned in a channel by typing `/banlist`. + +### Muting people in a channel {#moderation-muting} + +By default, anyone can speak in an IRC channel. To change this, you must +be a channel owner, administrator, or operator.\ +Channels, along with users, have modes, which modify their behavior. +There is a special mode for channels called `m` (moderated) which +requires users to be privileged in some way to talk.\ +To set a channel as moderated, type the following in the channel: + +```txt +/mode +m +``` + +Now, users must be an owner, administrator, operator, or be voiced to +talk in the channel This be reversed by typing the command above, but +changing the `+` to a `-`.\ +To voice a user, run the following, replacing *\* with the +user\'s nick: + +```txt +/mode +v +``` + +Unvoice the user by typing the above command, but replacing the `+` with +a `-`. + +### Appointing channel administrators and operators {#moderation-appointing} + +Assuming you a channel owner, you can appoint both administrators and +operators. If you are only an operator, you may only appoint operators.\ +The difference between administrator and operator is mainly that +administrators cannot have their privileges taken away by operators, +only owners. To appoint an administrator, type the following, replacing +*\* with the user\'s nick: + +```txt +/mode +a +``` + +To appoint an operator, type the following, replacing *\* with +the user\'s nick: + +```txt +/mode +o +``` + +You can also use `/op` and `/deop` on most clients to appoint and remove +an operator.\ +To remove administrator or operator status, run either of the above +commands, but replace the `+` with a `-`. + +Bringing modern-day features to IRC with TheLounge + +A large downside to IRC as a protocol is just how old it is, and the +limitations that exist because of it. Other old protocols such as HTTP +were built to be content-agnostic and versitile, but IRC was built with +a very specific set of features, so it has not held up so well to +contemporary chat systems.\ +A notable thing that IRC as a protocol is missing is file uploads, and +other fancy features that many other chats have.\ +With that said, these problems can be fixed by clients, although many +clients are still very primitive. + +[TheLounge](https://thelounge.chat/) is a modern self-hosted IRC web +client that tries to make IRC as user-friendly as possible. It can be +the answer to many of the complaints that normalfriends may have about +IRC. It runs on anything with a web browser, can be \"installed\" since +it is a PWA (Progressive Web App), and is optimized for both desktops +and mobile devices. It keeps you logged in even when you are gone, and +even supports file uploads and embeds.\ +Effectively, it brings IRC up to the standard of most other chat +systems. + +If you would like to setup an instance of TheLounge for you and your +friends, you can take a look at their [installation +guide](https://thelounge.chat/docs/install-and-upgrade).\ +It is a self-hosted web app, so you can run it for multiple people, not +just yourself. + +------------------------------------------------------------------------ + +*Written by [Termer](https://termer.net/)* diff --git a/content/jitsi.md b/content/jitsi.md new file mode 100644 index 0000000..aa6bab4 --- /dev/null +++ b/content/jitsi.md @@ -0,0 +1,199 @@ +--- +title: "Jitsi" +date: 2021-07-31 +icon: "jitsi.svg" +tags: ['service'] +short_desc: "Video-chat software." +--- + +Jitsi is a set of open-source projects that allows you to easily +build and deploy secure video conferencing solutions. + +Is really easy to install, and also a really good private, federated and +libre alternative to Zoom or other video conferencing software. You can +create calls just by typing the URL, and loging-in is not necessary. + +## Dependencies and Installation + +First, install some dependencies: + +```sh +apt install gpg apt-transport-https nginx python3-certbot-nginx +``` + +Jitsi has its own package repository, so let\'s add it. + +```bash +curl https://download.jitsi.org/jitsi-key.gpg.key | gpg --dearmor > /usr/share/keyrings/jitsi-keyring.gpg +echo 'deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/' > /etc/apt/sources.list.d/jitsi-stable.list +apt update -y +``` + +Ok. So now we can install Jitsi, but before we do that, let\'s setup the +firewall `ufw`, in case you have it enabled, and the SSL certificate. + +## Enable Required Ports + +If you are using [ufw](/ufw) or another firewall, there are several +ports we need to ensure are open: + +```sh +ufw allow 80/tcp +ufw allow 443/tcp +ufw allow 10000/udp +ufw allow 3478/udp +ufw allow 5349/tcp +ufw enable +``` + +For your information, these allow the following: + +- 80 TCP -- Certbot. +- 443 TCP -- General access to Jitsi Meet. +- 10000 UDP -- General network video/audio communications. +- 3478 UDP -- Quering the stun server ([Coturn](/coturn), optional, needs config.js change to enable it). +- 5349 TCP -- Fallback network video/audio communications over TCP (when UDP is blocked for example), served by [Coturn](/coturn). + +## SSL certificate + +I\'ll be using [certbot](/basic/certbot) and +[Nginx](/basic/nginx) to generate a certificate for the +Jitsi subdomain to allow encrypted connections. + +```sh +certbot --nginx certonly -d meet.example.org +``` + +We will not create an Nginx config file for Jitsi because the Jitsi +package we will be installing will do that automatically. + +## Installation + +To begin the installation process, just run: + +```sh +apt install jitsi-meet +``` + +It will ask you for your `hostname`; there you\'ll need to input the +subdomain you have just added to Nginx, like `meet.example.org`. + +For the SSL certificate, choose `I want to use my own certificate`. + +When it ask you for the certification key and cert files, input +`/etc/letsencrypt/live/meet.example.org/privkey.pem` and +`/etc/letsencrypt/live/meet.example.org/fullchain.pem` respectively. + +## Using Jitsi + +{{< img alt="Jitsi once installed" src="/pix/jitsi-01.webp" >}} + +Jitsi can be used in a browser by then just going to `meet.example.org`. + +Note that there are also Jitsi clients for all major platforms: + +- [Desktop](https://desktop.jitsi.org/Main/Download.html) (Windows, + MacOS, GNU/Linux) +- Android ([F-Droid](https://f-droid.org/en/packages/org.jitsi.meet/) + and [Google + Play](https://play.google.com/store/apps/details?id=org.jitsi.meet)) +- [iPhone/iOS](https://apps.apple.com/us/app/jitsi-meet/id1165103905) + +**When using a Jitsi app for the first time, remember to go to the +\"Settings\" menu and change your server name to the Jitsi site you just +created.** + +When you create a video chatroom, its address will appear as +`meet.example.org/yourvideochatname` and can be shared as such. + +## Security + +By default, anyone who has access to **meet.example.org** will be able +to create a chatroom. You probably don\'t want that, so you\'ll need to +set up some authentication. The simplest option is to handle +authentication through the local [Prosody](/prosody) user +database. + +### Prosody configuration + +First, we need to enable password authentication in +[Prosody](/prosody). Edit +`/etc/prosody/conf.avail/meet.example.org.cfg.lua`, and locate this +block: + +```lua +VirtualHost "meet.example.org" + authentication = "anonymous" +``` + +And change the authentication mode from `"anonymous"` to +`"internal_hashed"`. + +Then, to enable guests to login and join your chatrooms, add the +following block **after** the one you just edited: + +```lua +VirtualHost "guest.meet.example.org" + authentication = "anonymous" + c2s_require_encryption = false +``` + +### Jitsi Meet configuration + +Next, in `/etc/jitsi/meet/meet.example.org-config.js`, uncomment the +following line: + +```js +var config = { + hosts: { + // anonymousdomain: 'guest.jitsi-meet.example.com', + }, +} +``` + +And change `'guest.jitsi-meet.example.com'` to +`'guest.meet.example.org'`. + +### Jicofo configuration + +Finally, we configure Jicofo to only allow the creation of conferences +when the request is coming from an authenticated user. To do so, add the +following `authentication` section to `/etc/jitsi/jicofo/jicofo.conf`: + +```yaml +jicofo { + authentication: { + enabled: true + type: XMPP + login-url: meet.example.org + } +``` + +### Create users in Prosody and restart the services + +You now need to register some users in [Prosody](/prosody), you +can do so manually using `prosodyctl`: + +```sh +prosodyctl register <username> meet.example.org <password> +``` + +Finally, restart `prosody`, `jicofo`, and `jitsi-videobridge2`: + +```sh +systemctl restart prosody +systemctl restart jicofo +systemctl restart jitsi-videobridge2 +``` + +## More info + +This article is based on [the original +documentation](https://jitsi.github.io/handbook/docs/devops-guide/devops-guide-quickstart). +There you can find more details and configurations. + +- Written by [Jose Fabio.](https://josefabio.com) + Donate Monero: + `484RLdsXQCDGSthNatGApRPTyqcCbM3PkM97axXezEuPZppimXmwWegiF3Et4BHBgjWR7sVXuEUoAeVNpBiVznhoDLqLV7j` + [\[QR\]](https://josefabio.com/figures/monero.jpg) +- Edited and revised by [Luke](https://lukesmith.xyz). diff --git a/content/mail/dovecot.md b/content/mail/dovecot.md new file mode 100644 index 0000000..df2b218 --- /dev/null +++ b/content/mail/dovecot.md @@ -0,0 +1,112 @@ +--- +title: "Dovecot Email Server" +draft: true +--- +In the article on [SMTP and Postfix](smtp.html), we set up a simple +Postfix server that we could use to programatically send mail with the +`mail` command. In order to have a true and fully-functional mail +server, we need Dovecot, which can store mails received by the server, +have and authenticate user accounts and interact with mail + +## Installation + + apt install dovecot-imapd dovecot-sieve + +## Certificate + +We will want a SSL certificate for the `mail.` subdomain. We can get +this with [Certbot](certbot.html). Assuming we are using Nginx for our +server otherwise, run: + + certbot --nginx certonly -d mail.example.org + +## DNS + +## Configuring Dovecot + +Dovecot\'s configuration file is in `/etc/dovecot/docevot.conf`. If you +open that file, you will this line: `!include conf.d/*.conf` which adds +all the `.conf` files in `/etc/dovecot/conf.d/` to the Dovecot +configuration. + +One can edit each of these files individually to get the needed +configuration, but to make things easy here, delete or backup the main +configuration file and we will replace it with one single config file +with all important settings in it. + +``` wide +ssl = required +ssl_cert = +``` + echo "auth required pam_unix.so nullok + account required pam_unix.so" >> /etc/pam.d/dovecot + +## Connecting Postfix and Dovecot + +[[Next:\<++\>](%3C++%3E)]{.next} diff --git a/content/mail/opendkim.md b/content/mail/opendkim.md new file mode 100644 index 0000000..bd8eb5d --- /dev/null +++ b/content/mail/opendkim.md @@ -0,0 +1,187 @@ +--- +title: "Validating your emails with OpenDKIM" +draft: true +tags: ['email'] +--- +Email is a lot like real-life mail. You can send email to anyone, but +you can also write whatever return address you\'d like. That is, it\'s +pretty easy to pretend to be someone else via mail, and that was +originally the case with email as well: email is just text, and you +could just change your `From:` address to any email address you wanted! + +DKIM (Domain Keys Identified Mail) helps solve this issue. + +OpenDKIM will generate a public/private cryptographic key pair for your +server. The public key will be made available publicly in your server\'s +DNS records and the private key will be used to sign every single email +that leaves the server. This means that people receiving mail from your +server can now be absolutely sure that it originated from your server +because their servers can check the cryptographic signature on the email +with the public key! + +OpenDKIM ensures that email originated from the server it claims it did, +but it does not ensure that it originated from the user account it +claims it did. This easier problem is solved by server-side +authorization settings. + +## Installation + +```sh +apt install opendkim opendkim-tools +``` + +## The Keys and Files + +We have to generate the DKIM keys and create some secondary files that +will be required for our configuration. + +### Generate the DKIM key + + + +Here we create directories for the OpenDKIM keys, generate them, and +ensure they have the right file permissions. + +```sh +mkdir -p /etc/postfix/dkim +opendkim-genkey -D /etc/postfix/dkim/ -d example.org -s mail +chgrp opendkim /etc/postfix/dkim/* +chmod g+r /etc/postfix/dkim/* +``` + +### Create the key table + +Now we\'ll tell OpenDKIM where the newly generated keys are on the file +system. + +```sh +echo "mail._domainkey.example.org example.org:mail:/etc/postfix/dkim/mail.private" > /etc/postfix/dkim/keytable +``` + +### Create the signing table + +```sh +echo "*@example.org mail._domainkey.example.org" > /etc/postfix/dkim/signingtable +``` + +### Adding trusted hosts + +```sh +echo "127.0.0.1 +10.1.0.0/16 +1.2.3.4/24" > /etc/postfix/dkim/trustedhosts +``` + +## Configuring opendkim.conf + +Now we have all the raw material, so open up `/etc/opendkim.conf` and we +can finalize our server settings. First, add these lines that will +source the files we just created. + +```yaml +KeyTable file:/etc/postfix/dkim/keytable +SigningTable refile:/etc/postfix/dkim/signingtable +InternalHosts refile:/etc/postfix/dkim/trustedhosts + +Canonicalization relaxed/simple +Socket inet:12301@localhost +``` + +There will already be an uncommented `Socket` directive, so delete, +comment out or replace it with the above. + +## Interfacing with Postfix + +There are a couple things we must add to the Postfix SMTP server +settings to interface it with OpenDKIM. Specifically, we have to set our +OpenDKIM server, which will be running on port `12301`, as a milter +(mail filter). This is easy to do with the four commands below: + +```sh +postconf -e "milter_default_action = accept" +postconf -e "milter_protocol = 6" +postconf -e "smtpd_milters = inet:localhost:12301" +postconf -e "non_smtpd_milters = inet:localhost:12301" +``` + +## Restart and reload Postfix and DKIM + +Now that we have all our settings in place: + +```sh +systemctl restart opendkim +systemctl enable opendkim +systemctl reload postfix +``` + +## Adding the DNS record! + +We are only one step away from having functioning OpenDKIM. We must add +the DKIM public key to our server\'s DNS settings, so go ahead and open +up [your registrar\'s site](https://www.epik.com/?affid=we2ro7sa6) or +wherever your site\'s DNS settings are. + +The public key is found in the file `/etc/postfix/dkim/mail.txt`, but it +will display as multiple lines and multiple quoted strings, which is +annoying and hard to copy-and-paste into your registrar. To make things +easier, run the following command to format the key in the way we need +it for the DNS TXT entry: + +```sh +echo -e " + +v=DKIM1; k=rsa; $(tr -d " +" }} + +On my registrar, Epik, this is how it is input, but on some registrars, +it may be required to include your domain name as well as +`mail._domainkey.example.org`. + +If you have your own DNS server, add a TXT entry as follows: + +```txt +mail._domainkey.example.org TXT v=DKIM1; k=rsa; p=ThatLongRandomSequenceOfLettersAndNumbersOfYours +``` + +## Testing it out! + +Now we want to send an email to make sure that your emails will now be +signed with OpenDKIM. + +### Hostname + +If you\'ve followed these instructions, all emails from the domain +**example.org** will now have a DKIM signature on them. If we send mail +via the `mail` command, however, their domain of origin will be whatever +your server\'s hostname is, which you may have set to something +different than your domain. + +You can permanently change your hostname by changing it in +`/etc/hostname` and rebooting, or you can just run +`hostname example.org` to change it temporarily for testing. Either way, +this will allow us to run the `mail` command as in [the SMTP +article](smtp.html). + +```sh +echo "Hi there. + +This is the text." | mail -s "Email from the server" your@emailaddress.com +``` + +### More helpful troubleshooting. + +You can also go to [this site](https://appmaildev.com/en/dkim), which +will help you troubleshoot any other DKIM problems if you mistyped +something. diff --git a/content/mail/rainloop.md b/content/mail/rainloop.md new file mode 100644 index 0000000..fcd1c06 --- /dev/null +++ b/content/mail/rainloop.md @@ -0,0 +1,19 @@ +--- +title: "Rainloop" +tags: ['service'] +icon: 'rainloop.png' +draft: true +short_desc: 'A graphical website for accessing a mail server.' +--- +## Dependencies + +First, we make sure we have all Rainloop\'s basic dependencies +installed. It requires PHP and some other modules. + + apt install -y nginx curl mariadb-server php php-cli php-fpm php-curl php-json php-mbstring php-mysql php-common php-xml unzip + +## Installation + + mkdir /var/www/rainloop + cd /var/www/rainloop + wget https://www.rainloop.net/repository/webmail/rainloop-community-latest.zip diff --git a/content/mail/rdns.md b/content/mail/rdns.md new file mode 100644 index 0000000..6571d8c --- /dev/null +++ b/content/mail/rdns.md @@ -0,0 +1,35 @@ +--- +title: "rDNS and PTR Records" +draft: true +tags: ['email'] +--- +While [DNS records](dns.html) refer a domain name to the IP address +where the the website is hosted, there is also rDNS (reverse DNS) and +specifically PTR (pointer) records which do the reverse: link a +server\'s IP to a domain name. + +This is important for many things, but especially email. Many email +servers require that other servers that send them mail have PTR records +to prevent spam. + +## Setting your PTR Record + +DNS settings are set with your registrar, while rDNS settings are set +with your server or VPS provider. **Remember to set records for both +IPv4 and IPv6!** + +In [Vultr](https://www.vultr.com/?ref=8384069-6G) we want to set the +IPv4 record, click on the server, then \"Settings,\" and make sure the +\"IPv4\" tab is selected. We can then edit the \"Reverse DNS\" blank +shown below. + +{{< img alt="IPv4 rDNS PTR record set in Vultr" src="/pix/rdns-01.png" >}} + +The setting for IPv6 is obviosuly under the IPv6 tab. Note here that we +copy the full IPv6 address from above and create a new rDNS entry by +pasting that and the domain name in the blanks below. Then just select +\"Add.\" + +{{< img alt="IPv6 rDNS PTR record set in Vultr" src="/pix/rdns-02.png" >}} + +That\'s it! diff --git a/content/mail/smtp.md b/content/mail/smtp.md new file mode 100644 index 0000000..6ce92f2 --- /dev/null +++ b/content/mail/smtp.md @@ -0,0 +1,70 @@ +--- +title: "Setting up a Postfix SMTP server" +draft: true +--- +The first step to setting up an email server is having an SMTP server. +SMTP sends and receives email. Whether we want a full email server or +just the ability to send automated email by script, we will need SMTP, +and Postfix is the standard SMTP server. + +Here let\'s set a server up. Note that our goal is to be able to send +emails from our server. If you want a full email server, this is the +first step, and we will address the rest later. + +## Before beginning! + +Whatever VPS ([Vultr](https://www.vultr.com/?ref=8384069-6G) or +[Frantech](https://my.frantech.ca/aff.php?aff=3886)) or IPS you are +using, it is a very common policy to **automatically block all email +ports by default**. VPS providers do this to prevent spammers from using +their services. + +If you want to start an email server, therefore, go to your VPS\'s site +and open a ticket or make a request to open up email ports. This is a +simple process that requires nothing too special. One of the wagies at +your VPS will kindly do the needful and open your ports for you. Note +that this is not the same as unblocking a port with [ufw](ufw.html). + +## Installation + +First, we install Postfix and also `mailutils`, which comes with some +mail programs we will use. + + apt install -y mailutils postfix + +Installing Postfix for the first time will give us some graphical +options. + +![SMTP Postfix internet site choice](pix/smtp-01.png) + +When asked for a \"mail name\", give your full domain name from which +you would like mail to come and go, e.g. [example.org]{.dfn} or +[landchad.net]{.dfn}. + +![SMTP Postfix fully qualified domain name](pix/smtp-02.png) + +## Test the email + +That is actually all you need to have set up to have a barebones, +send-only email server. We can test our server by running a `mail` +command like that below. + + echo "Hi there. + + This is the text." | mail -s "Email from the server" your@emailaddress.com + +And that is simply enough the command your server can run to send mail. +Note that we use the `-s` option to specify the email\'s subject while +we pipe the email content into the `mail` command via standard input. In +this example I use a quoted multiline email as an example. + +## Do you see your message? + +If you sent the above test message to an account on Gmail or another +major email provider, there is **very high** chance of the message you +sent above being marked as spam or not appearing at all! + +Don\'t worry, we\'ll take care of that in the next two articles where we +set up rDNS and OpenDKIM to validate the emails you send. + +[[Next: rDNS and PTR Records](rdns.html)]{.next} diff --git a/content/maintenance.md b/content/maintenance.md new file mode 100644 index 0000000..545da82 --- /dev/null +++ b/content/maintenance.md @@ -0,0 +1,124 @@ +--- +title: "Maintaining a Server" +date: 2021-06-29 +tags: ['server'] +--- +Here are some important topics you should be familiar with whenever you +are managing a server. + +## Keep packages up to date. {#update} + +All GNU/Linux distributions use package managers to easily be able to +install and update packages without manually downloading them. On +Debian, which we use here for these tutorial the package manager is +`apt-get` or `apt` for short. + +It\'s a good idea to use `apt` to keep your software reasonably up to +date. + +```sh +apt update +apt upgrade +``` + +Not only do up-to-date packages often come with more features, but they +can also fix any possible security bugs. + +## Troubleshooting general problems + +Often when you are installing something new, you might miss a step and +run into an error, so it\'s important to know how to check and see what +errors have happened on your computer. + +On Debian and other GNU/Linux distributions that use systemd (most of +them), you can use the command `journalctl` to look at the system\'s +general log. You will probably want to run `journalctl -xe` as the `-x` +and `-e` as that gives the most information and starts you at the bottom +of the log to see the most recent errors. + +Some programs do not use this system log, but have their own logs stored +in `/var/log/`, or sometimes it\'s more convenient to look at a specific +program\'s log to see only its issues. + +For example, we can see that in `/var/log/nginx/`, nginx produces both +`error` and `access` files. The `access` files show you all the times +people connect to files on your server and much more. We can look at the +most recent errors by running: + +```sh +tail -n 25 /var/log/nginx/error.log +``` + +The command `tail -n 25` means \"show me the last 25 lines of this +file.\" You can replace that with `less` to browse the whole file. In +`less`, navigate with arrows or vim-keys and exit with `q`. + +### systemctl + +Another tool on systemd distributions is `systemctl`. At a basic level, +use `systemctl status put-service-name-here` to see if a system service +is running and its most recent log. But there\'s much more to +`systemctl`. + +For example, you can run `systemctl stop nginx` to stop NginX and +`systemctl start nginx` to start it back up (or use `restart` for both). +When you make changes to a program\'s configuration files, `reload` well +make them reload them. If you no longer want a service to start when the +system is rebooted, use `disable`, or conversely, to make a service +start on reboot use `enable`. + +## Finding Files + +Especially if you\'re new to how a GNU/Linux system is arranged, you +might need help finding files. To find program-related files, you can +just use `whereis`: + +```sh +$ whereis nginx +nginx: /usr/sbin/nginx /usr/lib/nginx /etc/nginx /usr/share/nginx /usr/share/man/man8/nginx.8.gz +``` + +This command lists the directories related to that program. For example, +`/etc/nginx` is where the configuration files are and `/usr/share/nginx` +is where the library and module-like files are. + +But `whereis` can be used only with installed programs. A more general +tool is the pair of `updatedb` and `locate`. + +`updatedb` is a command that quickly indexes every file and directory on +your computer. Then you can run `locate` to find a file containing a +given name. After running `updatedb`, try running `locate nginx` to find +all files with \"nginx\" in their name. + +You can make your search more specific by chaining other Unix commands +through pipes. For example, `grep` takes input and returns only lines +that match an extra argument. In the example below, we `locate` all +files with \"nginx\" in the name, but we use `grep` to only show us +those with the word \"available\" in them. + +```sh +root@landchad:~# locate nginx | grep available +/etc/nginx/modules-available +/etc/nginx/sites-available +/etc/nginx/sites-available/default +/etc/nginx/sites-available/landchad +/usr/share/nginx/modules-available +/usr/share/nginx/modules-available/mod-http-auth-pam.conf +/usr/share/nginx/modules-available/mod-http-dav-ext.conf +/usr/share/nginx/modules-available/mod-http-echo.conf +/usr/share/nginx/modules-available/mod-http-geoip.conf +/usr/share/nginx/modules-available/mod-http-image-filter.conf +/usr/share/nginx/modules-available/mod-http-subs-filter.conf +/usr/share/nginx/modules-available/mod-http-upstream-fair.conf +/usr/share/nginx/modules-available/mod-http-xslt-filter.conf +/usr/share/nginx/modules-available/mod-mail.conf +/usr/share/nginx/modules-available/mod-stream.conf +``` + +`updatedb` is an ideal candidate for a [cronjob](/cron) so you +don\'t have to worry about running each time. For example, adding the +following to your crontab will run `updatedb` every 30 minutes: + +```sh +*/30 * * * * /usr/bin/updatedb +``` diff --git a/content/matrix.md b/content/matrix.md new file mode 100644 index 0000000..4442cc3 --- /dev/null +++ b/content/matrix.md @@ -0,0 +1,139 @@ +--- +title: "Matrix Synapse" +date: 2021-07-16 +icon: 'element.svg' +tags: ['service'] +short_desc: "An encrypted chat server sleek and accessible even to normies." +--- + +Matrix is easy-to-use, decentralized and encrypted private chat +software. Matrix is federated, meaning that with a Matrix account on any +server, including your own, you can talk to any other Matrix account on +the internet, similar to email. Matrix also allows fully end-to-end +encrypted group chats. + +**Synapse** is the name of the default Matrix server. It is written in +Python. While it is requires somewhat more system resources than [an +XMPP server](/prosody), it makes up for that in being very accessible +to non-technical users. + +## Installation + +Synapse is not in the Debian package repositories by default, but we can +easily add Matrix\'s repository including it: + +```sh +apt install -y lsb-release wget apt-transport-https +wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg +echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/matrix-org.list +``` + +After we update our packages lists, we will be able to install Synapse +with `apt`. + +```sh +apt update +apt install matrix-synapse-py3 +``` + +When prompted, give your main domain name (not a subdomain). This will +be the domain appended to your Matrix address, e.g. +`@chad:landchad.net`. + +## Nginx configuration + +Create an Nginx configuration file for Matrix, say +`/etc/nginx/sites-available/matrix` and add the content below: + +```nginx +server { + server_name matrix.example.org ; + listen 80; + listen [::]:80; + location / { + proxy_pass http://localhost:8008; + } + location ~* ^(\/_matrix|\/_synapse\/client) { + proxy_pass http://localhost:8008; + proxy_set_header X-Forwarded-For $remote_addr; + client_max_body_size 50M ; + } + location /.well-known/matrix/server { + return 200 '{"m.homeserver": {"base_url": "https://matrix.example.org"}}'; + default_type application/json; + add_header Access-Control-Allow-Origin *; + } +} +``` + +Note the `client_max_body_size` variable. By default, Nginx caps the +size of files it can transfer. We increase that to 50M if needed by +Matrix. (Note however that both Matrix and Nginx have seperate settings +for this and to raise it to something much larger, you will have to +increase the value in both configuration files.) + +Now let\'s enable the Nginx Matrix site and reload Nginx to make it +active. + +```sh +ln -s /etc/nginx/sites-available/matrix /etc/nginx/sites-enabled +systemctl reload nginx +``` + +### Encryption + +Obviously, we need to encrypt our `matrix` subdomain as well. Let\'s do +that with certbot: + +```sh +certbot --nginx -d matrix.example.org +``` + +## Configuration + +### Read the config file + +The configuration file for Matrix is in +`/etc/matrix-synapse/homeserver.yaml`. It is well documented and +commented, so you can read about the settings, but let\'s change the +essential ones here. + +Make what changes you want and run `systemctl reload matrix-synapse` to +make the system configuration active. + +### Create an administrator account + +If you allow open registration on your server in the configuration file, +you can create an account through Element or another Matrix client, but +you are probably going to want an official admin account to use. To make +one, simply run the following command, which will then give you several +choices for creating a user, among which will be the ability to make it +an admin. + +```sh +register_new_matrix_user -c homeserver.yaml http://localhost:8008 +``` + +## Using Matrix with ![Element Matrix logo](pix/element.svg)Element + +There are many different [clients](https://matrix.org/clients/) that can +be used on desktops or phones to chat on your Matrix server, but the +most popular and most widely vetted is ![Element +logo](pix/element.svg)Element. + +Get Element to access your Matrix server: + +- Mobile: + - [F-droid](https://f-droid.org/packages/im.vector.app/) + - [Google + Play](https://play.google.com/store/apps/details?id=im.vector.app) + - [Apple App + Store](https://apps.apple.com/app/vector/id1083446067) +- Real computer: + - GNU/Linux: You know how to install it. + - [Windows](https://packages.riot.im/desktop/install/win32/x64/Element%20Setup.exe) + - [Mac](https://packages.riot.im/desktop/install/macos/Element.dmg) + +Note also that Element has a web client (i.e. a version that can be +accessed on your own website) that is also easy to install on an Nginx +server, although that will be covered in another article. diff --git a/content/monero.md b/content/monero.md new file mode 100644 index 0000000..87f1d78 --- /dev/null +++ b/content/monero.md @@ -0,0 +1,89 @@ +--- +title: "Monero" +icon: 'xmr.svg' +date: '2021-06-29' +tags: ['service'] +short_desc: "The ideal private cryptocurrency for the Internet." +--- +Monero (abbreviated XMR) is easily the cryptocurrency most actually used +as such. Unlike Bitcoin, Monero is actually private and has very low +transaction fees. That makes it a good idea to get a Monero wallet and +add an address on your website where you can receive donations. + +## Generate a Monero wallet + +Go to [Monero\'s official site](https://www.getmonero.org/downloads/) and you can download either the GUI (graphical) or CLI (command-line +wallet). Some Linux distributions will have these packages in their +repositories (`monero` and `monero-gui` on Arch-based distributions). + + + +Once you install and run the wallet program, you will get a menu like +this: + +{{< img src="/pix/monero-01.png" alt="simple mode" >}} + +Now if you want to start using Monero and using it as a pro, you can +choose to download the whole blockchain which will maximize your +transactional privacy, however for this tutorial or setting up a wallet, +we can just do the Simple Mode and save our bandwidth. **In fact, if you +are paranoid, you can disconnect your computer from the internet while +generating a wallet.** + +Now we choose to create a wallet. + +{{< img src="/pix/monero-02.png" alt="create wallet" >}} + +Now we get the most important and sensitive part, you private mneumonic +seed. **These words are sacred! They are your money!** To be clear, they +are randomly generated words that seed the randomness required to unlock +whatever money you receive or hold. Never show these words to anyone, +don\'t even keep them on your computer, but write them down and store +them securely in real life in a safe or somewhere where only you have +access. + +{{< img src="/pix/monero-03.png" alt="seed" >}} + +It goes without saying that the seed above that we generated for this +tutorial should never be used by anyone since it is public on the +internet and anyone could easily take the funds from the wallet. + +Finally, we get to the main wallet screen. Now we see your public +sharable wallet receiving address. It is the thing that starts with `4` +and is too long to be included in the image below labeled \"Primary +address.\" + +{{< img src="/pix/monero-04.png" alt="address" >}} + +Click the clipboard next to it to copy the whole sequence (which will be +more than 90 letters and numbers) to your clipboard. This is your +address. Put it on your website and you can receive donations! + +You can also click to save that QR code image and you can put it up on +your website and people will be able to scan it and send you Monero. +When scanned, that QR code will read as the public donation address. + +## What do I do now? + +You can now receive Monero/XMR donations! All you need to do is put +either your full address or your QR code on your site and people can +send you tips in Monero. + +Here is the address we use for this site (i.e. not the compromised +wallet generated above): + +84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh + +{{< img src="/pix/xmr.png" class=qr alt="monero donation qr" >}} + +It\'s now up to you how and where to display these on your site. diff --git a/content/movim.md b/content/movim.md new file mode 100644 index 0000000..8743b81 --- /dev/null +++ b/content/movim.md @@ -0,0 +1,116 @@ +--- +title: "Movim" +draft: true +icon: 'movim.svg' +tags: ['service'] +short_desc: 'An XMPP-based social media site, blog and chat site.' +--- +## Installing the Packages and Database + +### Dependencies + + apt install -y nginx python3-certbot-nginx postgresql composer php-fpm php-curl php-mbstring php-imagick php-gd php-pgsql php-xml git + +### Installing Movim Itself + + cd /var/www + git clone https://github.com/movim/movim.git + cd movim + composer install + +### Preparing Permissions + + cd /var/www + chown www-data movim && chown www-data movim/public && chmod u+rwx movim + +### Database setup + + su - postgres # Become the postgres user + psql # Open a postgresql prompt + CREATE USER movim WITH PASSWORD 'yourpassword' ; + CREATE DATABASE movim WITH OWNER movim ; + \q + +leave postgres user + +We now have to tell movim to use this newly created postgresql username +and database that we\'ve created. Create a new file in +`/var/www/movim/config/db.inc.php` and add the following content: + + 'pgsql', + 'username' => 'movim', + 'password' => 'yourpassword', + 'host' => 'localhost', + 'port' => 5432, + 'database' => 'movim' + ]; + +ask for pass https://movim.yourdomain.com Choose postgresq localhost +pass + +## Configuration with nginx + +Let\'s create an nginx configuration file for this movim site. I will +create a file `movimsite.conf` in `/etc/nginx/sites-available/` and add +the following content: + + server { + listen 80 ; + listen [::]:80 ; + server_name movim.lukesmith.xyz ; + include /etc/nginx/snippets/movim.conf ; + location / { + try_files $uri $uri/ =404; + } + } + +Note above that this is calling the file +`/etc/nginx/snippets/movim.conf` which contains the content needed for +Movim and should be autocreated when installing the Debian package. + +To enable the site, let\'s link the file to the `sites-enabled` +directory and then reload nginx to update it. + + ln -s /etc/nginx/sites-available/movimsite.conf /etc/nginx/sites-enabled/ + systemctl reload nginx + +Now, run [certbot](/basic/certbot) which we installed above to get secured +connections on your site. Choose to \"Redirect\" unencrypted connections +when prompted. + + certbot --nginx + +## Systemd service + +Let\'s create a systemd service for Movim. Create the file +`/etc/systemd/system/movim.service` and add the content below: + + [Unit] + Description=Movim daemon + After=nginx.service network.target local-fs.target + + [Service] + User=www-data + Type=simple + Environment=PUBLIC_URL=https://localhost/movim/ + Environment=WS_PORT=8080 + EnvironmentFile=-/etc/default/movim + ExecStart=/usr/bin/php daemon.php start --url=${PUBLIC_URL} --port=${WS_PORT} + WorkingDirectory=/var/www/movim/ + StandardOutput=syslog + SyslogIdentifier=movim + PIDFile=/run/movim.pid + Restart=on-failure + RestartSec=10 + + [Install] + WantedBy=multi-user.target + + systemctl daemon-reload + systemctl restart movim + +Install prosody modules apt install mercurial mkdir -p +/usr/share/prosody hg clone https://hg.prosody.im/prosody-modules/ +/usr/share/prosody/modules diff --git a/content/nextcloud.md b/content/nextcloud.md new file mode 100644 index 0000000..4d571cc --- /dev/null +++ b/content/nextcloud.md @@ -0,0 +1,292 @@ +--- +title: "Nextcloud" +date: 2021-06-30 +icon: 'nextcloud.svg' +tags: ['service'] +short_desc: 'A free and private Google Drive-like cloud storage system.' +--- + +## What is Nextcloud? {#whatis} + +[![](/pix/nextcloud.svg)Nextcloud](https://nextcloud.com) +is a free and open source solution for cloud storage. However it can +also do other things, such as manage your email, notes, calender, tasks, +and can even connect to the Fediverse (think Mastodon and Pleroma). +Pretty much every service that Google has to offer has a much better +alternative as a Nextcloud app and this is a must-have for anyone +wanting to get away from Google services but still wants a traditional +cloud experience (in the likes of Google Services, anyways). + +## Instructions + +We should upgrade the system and then install packages that we might +need. Run the following command: + +```sh +apt full-upgrade -y && apt install mariadb-server php-mysql php php-gd php-mbstring php-dom php-curl php-zip php-simplexml php-xml php-fpm -y +``` + +Next, we need to set up our SQL database by running a Secure +Installation and creating the tables that will store data that Nextcloud +will need. Run the following command: + +```sh +mysql_secure_installation +``` + +When it asks for root a password, say yes and input a new and secure +password. The root password here is just for the SQL database, not for +the GNU/Linux system. + +Answer the rest of the questions as follows: + +```sh +Remove anonymous users? [Y/n]: Y +Disallow root login remotely? [Y/n]: Y +Remove test database and access to it? [Y/n]: Y +Reload privilege tables now? [Y/n]: Y +``` + + +Next, sign into the SQL database with the new and secure password you +chose before. Run the following command: + +```sh +mysql -u root -p +``` + +We need to create a database for Nextcloud. Follow the instructions +below and change some of the placeholders as you wish: + +```mysql +CREATE DATABASE nextcloud; +GRANT ALL ON nextcloud.* TO 'username'@'localhost' IDENTIFIED BY 'password'; +FLUSH PRIVILEGES; +EXIT; +``` + +Now we need to configure PHP. Let\'s start my making sure that the PHP +user is set to `www-data` and if that is not the case, add the +`www-data` user if needed and set the correct variable in `nginx.conf`. +Make sure this line is at the beginning of `/etc/nginx/nginx.conf`. + +```nginx +user www-data; +``` + +Check for the `www-data` user by running `id -u www-data`. If a number +is output from that command, then the www-data user exists. If not. add +the user simply by running `useradd www-data` + +Next, we need to ensure that we have SSL certificates generated for your +website. If you have not already done this, refer to [this +guide](/basic/certbot). + +In `/etc/nginx/sites-available/` we need to make a new configuration for +Nextcloud (example: `/etc/nginx/sites-available/nextcloud`). Create it +and open it, modify, and add the following lines: + +```nginx +upstream php-handler { + server unix:/var/run/php/php7.4-fpm.sock; + server 127.0.0.1:9000; +} + +server { + listen 80; + listen [::]:80; + server_name example.org; + + return 301 https://$server_name$request_uri; +} + +server { + listen 443 ssl http2; + listen [::]:443 ssl http2; + server_name example.org; + ssl_certificate /etc/letsencrypt/live/example.org/fullchain.pem ; + ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem ; + + root /var/www; + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + location ^~ /.well-known { + location = /.well-known/carddav { return 301 /nextcloud/remote.php/dav/; } + location = /.well-known/caldav { return 301 /nextcloud/remote.php/dav/; } + + location /.well-known/acme-challenge { try_files $uri $uri/ =404; } + location /.well-known/pki-validation { try_files $uri $uri/ =404; } + + return 301 /nextcloud/index.php$request_uri; + } + + location ^~ /nextcloud { + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + fastcgi_hide_header X-Powered-By; + + index index.php index.html /nextcloud/index.php$request_uri; + + location = /nextcloud { + if ( $http_user_agent ~ ^DavClnt ) { + return 302 /nextcloud/remote.php/webdav/$is_args$args; + } + } + + location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } + location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + + location ~ \.php(?:$|/) { + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + set $path_info $fastcgi_path_info; + + try_files $fastcgi_script_name =404; + + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + fastcgi_param HTTPS on; + + fastcgi_param modHeadersAvailable true; + fastcgi_param front_controller_active true; + fastcgi_pass php-handler; + + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + location ~ \.(?:css|js|svg|gif)$ { + try_files $uri /nextcloud/index.php$request_uri; + expires 6M; + access_log off; + } + + location ~ \.woff2?$ { + try_files $uri /nextcloud/index.php$request_uri; + expires 7d; + access_log off; + } + + location /nextcloud/remote { + return 301 /nextcloud/remote.php$request_uri; + } + + location /nextcloud { + try_files $uri $uri/ /nextcloud/index.php$request_uri; + } + } +} +``` + +Enable the site by running this command: + +```sh +ln -s /etc/nginx/sites-available/nextcloud /etc/nginx/sites-enabled/ +``` + +Next, we need to download the latest release tarball of Nextcloud. Go to +https://nextcloud.com/install/#instructions-server and copy the URL of +the .tar.bz2 tarball from the More Downloads dropdown menu then go to +your server\'s shell prompt and download the tarball with wget. Here is +an example: + +```sh +wget https://download.nextcloud.com/server/releases/nextcloud-21.0.2.tar.bz2 +``` + +Now we need to extract the Nextcloud tarball. Run the following command: + +```sh +tar -xjf nextcloud*.tar.bz2 -C /var/www +``` + +If you have multiple Nextcloud tarballs in the current working directory +you might want to manually specify which one you wish to extract. + +Let\'s correct the ownership and permissions of those files. Run the +following commands: + +```sh +chown -R www-data:www-data /var/www/nextcloud +chmod -R 755 /var/www/nextcloud +``` + + +Start and enable the php-fpm and the mariadb services (the name of the +php-fpm service may have a version number ahead of it, use bash\'s tab +autocomplete to help you out with that): + +```sh +systemctl enable php7.4-fpm +systemctl start php7.4-fpm +systemctl enable mariadb +systemctl start mariadb +``` + +Reload the nginx service: + +```sh +systemctl reload nginx +``` + +Now we need to head to Nextcloud\'s web interface. Go to your web +browser and go to your website, but go to the subdirectory \"nextcloud\" +instead. Go to `https://example.org/nextcloud`. This will launch the +configuration wizard. + +- Choose an admin username and secure password. +- Leave Data folder at the default value unless it is incorrect. +- For Database user, enter the user you set for the SQL database. +- For Database password, enter the password you chose for the new user + in MariaDB. +- For Database name, enter: `nextcloud` +- Leave \"localhost\" as \"localhost\". +- Click Finish. + +Congratulations, you have set up your own Nextcloud instance. + +## What\'s Next? {#whatsnext} + +Now you may be wondering: What do I do now? Here are some suggestions: + +- Rice your Nextcloud instance by changing your themeing and + installing new themes and plugins in Settings in the Nextcloud Web + Interface. +- Install the Nextcloud Client on your personal computer and sync your + files to your instance. +- Install the Nextcloud App on your mobile device and sync your files + to your instance. +- Set up your email account on the Nextcloud Mail app on the web + interface to view and sync your email there (just like Gmail). +- Schedule events with Nextcloud Calender. +- Write notes in Markdown inside the Nextcloud Notes web and mobile + app. +- Set the Nextcloud Dashboard as your web browser\'s homepage (it is + pretty nice). + +Enjoy your cloud services in freedom. + +------------------------------------------------------------------------ + +*Written by [Matthew \"Madness\" Evan](https://github.com/MattMadness)* diff --git a/content/nginx-tweaks.md b/content/nginx-tweaks.md new file mode 100644 index 0000000..8d4dcb8 --- /dev/null +++ b/content/nginx-tweaks.md @@ -0,0 +1,46 @@ +--- +title: "Nginx Tweaks" +date: 2022-06-16 +--- +The point of this article is to show you how to do some commonly-desired +tweaks in Nginx while in the meantime helping you understand how it +works. + +## Do not require `.html` in URLs + +If your website is using lots of `.html` files for pages, it\'s sort of +overkill to make people type that in for every page they are looking +for. We can remove that requirement with Nginx. + +Open your site\'s configuration file in `/etc/nginx/sites-enabled/` and +within the `server` block, there should be a `location` block that looks +something like this if you have followed [the guide here](/basic/nginx). + +```nginx +location / { + try_files $uri $uri/ =404 ; +} +``` + +What this means is that in the file location of `/`, i.e. anywhere and +everywhere in the root file system, We will look for the three things +listed in `try_files` in that order: + +1. `$uri`: a file that directly matches the content added after the + domain. +2. `$uri/`: a *directory* that directly matches the content added after + the domain. +3. `=404`: if neither of those is found, we give a 404 error, which as + you probably know, signified \"Page not found.\" + +We will now change the content inside the `location` block to the below: + +```nginx +location / { + if ($request_uri ~ ^/(.*)\.html$) { return 302 /$1; } + try_files $uri $uri.html $uri/ =404 ; +} +``` + +`$1` here refers to the first content in the parentheses `()` in the +preceeding regular expression. diff --git a/content/openalias.md b/content/openalias.md new file mode 100644 index 0000000..2760c0c --- /dev/null +++ b/content/openalias.md @@ -0,0 +1,102 @@ +--- +title: "OpenAlias" +date: 2021-07-01 +tags: ['server'] +--- +## The Problem + +Cryptocurrency can be unintuitive. After all, look at this annoying +Monero address of ours: + +- `84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh` + +It breaks up pages and looks ugly. When you copy and paste it to send +money, you might be paranoid that you somehow added an extra character +in there. That\'s all around a bad user experience. + +### It would be nice\... + +It would be nice if we could just input someone\'s email address or +maybe a website and send Bitcoin or Monero to that instead. So instead +of that long jumble, it would be easier to just type in someone\'s +website or email and sending them money that way. + +## The Solution + +The [OpenAlias](https://openalias.org/) standards are just that. It uses +[DNS](/basic/dns) settings, which you know something about, to link a +website or an email address with a cryptocurrency address. It allows +someone to simply put `landchad.net` or `chad@landchad.net` as a payment +recipient and that will direct to that long address above. + +The default Monero wallet and Bitcoin\'s Electrum are already compatible +with OpenAlias, as are a growing group of wallet software. + +## Let\'s do it. + +Open up your domain registar and open up your DNS settings for the +website you would like to add. + +Open the **TXT record** section. Now, create an entry with text like +that below: + +```txt +oa1:xmr recipient_address=84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh; recipient_name=LandChad.net; +``` + +Obviously change the address to your desired address and you may also +give a proper name for yourself (this may be multiple words). Note that +the entry above is **all one line**. + +Now create a new TXT entry and input this text into the **TXT Value** +input box. Note here that I have create two entries: + +{{< img alt="openalias" src="/pix/openalias-01.png" link="/pix/openalias-01.png" >}} + +One entry\'s \"Host\" is left empty, this will allow people to send +Monero by merely typing `landchad.net`. + +The second entry has \"chad\" as the \"Host\"; this will allow people to +send money to `chad@landchad.net`, i.e. this is how you allow people to +connect a Monero address with an email address. + +### Checking to see if it works\... + +Let\'s check to see if it works. In the Monero wallet, we can now type +in `landchad.net` as a recipient: + +{{< img alt="checking" src="/pix/openalias-02.png" link="/pix/openalias-02.png" >}} + +And once we press the \"Resolve\" button, it automatically turns into +that address we gave to the DNS! + +{{< img alt="It works!" src="/pix/openalias-03.png" link="/pix/openalias-03.png" >}} + +Now people can donate Monero to you without having to worry about QR +codes or copying-and-pasting super-long public addresses! + +### Now with Bitcoin! + +OpenAlias was originally developed for Monero, but since it\'s such a +good idea, Bitcoin wallets have implemented it as well, so let\'s add +some TXT entries for Bitcoin. The OpenAlias TXT records have the same +format, except for the **xmr** at the beginning is replaced with **btc** +and obviously we use a Bitcoin address instead of Monero. + +```txt +oa1:btc recipient_address=bc1q9f3tmkhnxj8gduytdktlcw8yrnx3g028nzzsc5; recipient_name=LandChad.net; +``` + +Add the TXT entries in and save: + +{{< img alt="bitcoin openalias entries" src="/pix/openalias-04.png" link="/pix/openalias-04.png" >}} + +And we can then check that it\'s working by trying to send money to +`landchad.net` in Electrum. See that it automatically appends the +address! + +{{< img alt="electrum resolves an openalias" src="/pix/openalias-05.png" link="/pix/openalias-05.png" >}} + +And that\'s it. Now users can easily send your website or email address +Bitcoin or Monero without having to worry about hard to read addresses +and QR codes. diff --git a/content/page-quality.md b/content/page-quality.md new file mode 100644 index 0000000..ba45488 --- /dev/null +++ b/content/page-quality.md @@ -0,0 +1,180 @@ +--- +title: "Page Quality" +date: 2022-03-21 +tags: ['server'] +--- +After you\'ve deployed your website, you may want to consider improving +its performance, accessibility, and search-engine optimization (SEO). +Doing so can help make your website more user-friendly and increase its +page rank in search results. Luckily, Google provides a [measurement +tool](https://web.dev/measure) to help you improve these aspects. Start by +entering your website\'s URL and click the *Run Audit* button (it will +take 5-10 seconds to generate the report). + +Once the report has finished, you\'ll be greeted by a score for four +different categories: *Performance*, *Accessibility*, *Best Practices*, +and *SEO*. A lot of the tests listed are self-explanatory, and Google +provides you with articles to help you pass them. Below are some easy +ways to improve your scores, some specific to the nginx configuration +used in the [landchad website tutorial.](/basic/nginx) + +## Performance + +### Serving static assets with an efficient cache policy + +Serving your files with an efficient cache policy will allow the user\'s +browser to cache files such as pictures and CSS so that the browser doesn\'t +need to fetch these files each time the page is visited. + +It\'s very easy to set this up in nginx. Just paste the following within the +server block of your website\'s configuration file: + +```nginx +# Media: images, icons, video, audio, HTC +location ~* \.(?:jpg|jpeg|gif|png|ico|svg|webp)$ { + expires 1M; + access_log off; + # max-age must be in seconds + add_header Cache-Control "max-age=2629746, public"; +} + +# CSS and Javascript +location ~* \.(?:css|js)$ { + expires 1y; + access_log off; + add_header Cache-Control "max-age=31556952, public"; +} +``` + +You can add more types of file extensions (mp3, mp4, ogg) as you see +fit. + +If you\'re changing your CSS files a lot, caching could keep repeat +users from getting the most up-to-date stylesheet. To combat this, you +can version your stylesheets like so: + +```html + +``` + +Just increase the version number whenever you update your stylesheet, +and the browser will re-update its cache. + +### Enable text compression + +Another easy addition to your websites configuration file. Enabling text +compression is easy and will save bandwidth for users. Simply paste the +following within the server block of your website\'s configuration file: + +```nginx +gzip on; +gzip_min_length 1100; +gzip_buffers 4 32k; +gzip_types text/plain application/x-javascript text/xml text/css; +gzip_vary on; +``` + +After reloading nginx, you can test if compression is working by opening +your browsers developer tools and going to the network tab. Refresh your +website with the network tab, click on the item with your URL and look +at the response headers. You should see `Content-Encoding: gzip` as one +of the headers displayed. + +### Properly sizing images + +If you\'ve put images on your webpage, you\'ve most definitely gotten +this warning. To pass this audit, you\'ll need to scale your images down +using a tool like gimp or imagemagick to a size appropriate for your +website. It doesn\'t make much sense to serve a high-res image for +images that are rendered much smaller on a webpage. + +Once you\'ve scaled your image down, you can use a tool like `cwebp` to +convert your images into the .webp format, a format specifically created +for serving bandwidth concious images. + +First, you\'ll have to install the webp package: + +```sh +apt install webp +``` + +Now you can easily convert your images to webp (keep in mind that it\'s +much more effective to first size your images appropriately before +this). Using the below command, you can specify the quality of the photo +with the `q` option. I typically shoot for a quality in the range of +60-80, depending on the image and how large it will be displayed on the +webpage. + +```sh +cwebp -q 80 your-photo.png -o your-photo.webp +``` + +You can now check the difference in size of the images using `ls`. + +```sh +ls -lh your-photo* +``` + +After utilizing webp images, the audit typically goes away, but if you +didn\'t scale your image properly before hand, it may still linger. + +## Accessibility + +### Image elements do not have \[alt\] attributes + +It may seem silly to add `alt` attributes to images, but it helps screen +readers convey images to users and can help page rank as a result. The +`alt` attribute should simply describe the image being displayed. + +```html + A cabin nestled between pine trees

+``` + +## SEO + +### Document does not have a meta description + +Adding meta descriptions to your webpage allow for web-crawlers and bots +to easily determine what content your website contains. Just like on +other online platforms, you can give your webpage a long list of +keywords to help increase the chance someone stumbles upon your site +from a search engine. You don\'t need to add all of the below meta tags +to pass the audit, only add what\'s necessary. + +```html +// Instructions for web scrapers + + + + + + +// Facebook specific standard, but many websites use this so it has become almost standard to include + + + + + + + +// below is for twitter sharing previews, you can test this at: +// cards-dev.twitter.com + + + + + + + + +// If you have accounts on twitter or facebook that are relevant to your site + + + +``` + + +------------------------------------------------------------------------ + +*Written by [Jacob.](https://mccor.xyz) Donate Monero +[here.](https://mccor.xyz)* diff --git a/content/peertube.md b/content/peertube.md new file mode 100644 index 0000000..b0ec47e --- /dev/null +++ b/content/peertube.md @@ -0,0 +1,284 @@ +--- +title: "PeerTube" +date: 2021-07-31 +icon: 'peertube.svg' +tags: ['service','activity-pub'] +short_desc: 'Your own self-hosted video-site also compatible with Activity Pub.' +--- + +PeerTube is a self-hosted and (optionally) federated video sharing +platform that saves bandwith on videos the more people watch. PeerTube +instances can follow each other to share videos and grow the federated +network, but you can always keep your instance to yourself if you choose +to. + +## Note on Bandwidth + +Video sharing is the most bandwidth intensive thing on the internet! If +you plan on just having a small personal site with a few viewers and +friends, that won\'t be a big concern, but most VPS providers like Vultr +have caps on how much bandwidth can be used within a month without being +throttled. This level is far beyond what most sites need, but it might +be an issue with a video site! + +So if you plan on having a big video-sharing PeerTube site, it\'s a good +idea to host it with a provider that offers infinite bandwidth. I +strongly recommend getting a separate VPS with +[Frantech/BuyVM](https://my.frantech.ca/aff.php?aff=3886). They have +unmetered bandwidth, extremely cheap block storage for hosting many, +many videos and they even have a good record of being censorship +resistant. + +## Prerequisites + +**Most** of PeerTube\'s dependencies can be installed with this command: + +```sh +apt install -y curl sudo unzip vim ffmpeg postgresql postgresql-contrib g++ make redis-server git python-dev cron wget +``` + +It\'s also important to start all associated daemons: + +```sh +systemctl start postgresql redis +``` + +PeerTube also requires **NodeJS 14** and **yarn** which cannot be +installed from the Debian repositories. This means they have to be +installed from separate, external repos: + +```sh +curl -fsSL https://deb.nodesource.com/setup_14.x | bash - +apt install -y nodejs +npm install --global yarn +``` + +Now we create a PeerTube user to run and handle PeerTube with the proper +permissions: + +```sh +useradd -m -d /var/www/peertube -s /bin/bash -p peertube peertube +``` + +## Database + +PeerTube requires a PostgreSQL database to function. To create it, first +make a new Postgres user named PeerTube: + +```bash +su -l postgres +createuser -P peertube +createdb -O peertube -E UTF8 -T template0 peertube_prod +psql -c "CREATE EXTENSION pg_trgm;" peertube_prod +psql -c "CREATE EXTENSION unaccent;" peertube_prod +exit +``` + +Be sure to **make note of your Postgres user password,** as it will be +needed later when setting up PeerTube. + +## Installation + +Using `su -l`, we will become the PeerTube user to create the required +directories and download and install PeerTube itself with the proper +permissions. First, we create the required directories. + +```sh +su -l peertube +mkdir config storage versions +chmod 750 config +``` + +### Downloading PeerTube + +Still as the PeerTube user, we can now check for the most recent +PeerTube versions number, download and install it in the newly created +`versiond` directory. + +```bash +VERSION=$(curl -s https://api.github.com/repos/chocobozzz/peertube/releases/latest | grep tag_name | cut -d '"' -f 4) +cd /var/www/peertube/versions +wget "https://github.com/Chocobozzz/PeerTube/releases/download/${VERSION}/peertube-${VERSION}.zip" +unzip peertube-${VERSION}.zip +rm peertube-${VERSION}.zip +``` + +### Installation via Yarn + +The downloaded release can then be symbolically linked to +`/var/www/peertube/peertube-latest` and **yarn** is used to install +PeerTube: + +```sh +cd /var/www/peertube +ln -s versions/peertube-${VERSION} ./peertube-latest +cd ./peertube-latest +yarn install --production --pure-lockfile +``` + +## Configuration + +PeerTube\'s default config file can be copied over to +`/var/www/peertube/config/production.yaml` so it can actually be used: + +Note that we are still running these as the PeerTube user (having run +`su -l peertube`). + +```sh +cd /var/www/peertube +cp peertube-latest/config/production.yaml.example config/production.yaml +``` + +Now the `production.yaml` file must be edited in the following ways: + +First, add the hostname: + +```yaml +webserver: + https: true + hostname: 'example.org' + port: 443 +``` + +Then, the database: + +```yaml +database: + hostname: 'localhost' + port: 5432 + ssl: false + suffix: '_prod' + username: 'peertube' + password: 'your_password' + pool: + max: 5 +``` + +An email to generate the admin user: + +```yaml +admin: + # Used to generate the root user at first startup + # And to receive emails from the contact form + email: 'chad@example.org' +``` + +And **optionally,** email server information: + +```yaml +smtp: + # smtp or sendmail + transport: smtp + # Path to sendmail command. Required if you use sendmail transport + sendmail: null + hostname: mail.example.org + port: 465 # If you use StartTLS: 587 + username: your_email_username + password: your_email_password + tls: true # If you use StartTLS: false + disable_starttls: false + ca_file: null # Used for self signed certificates + from_address: 'admin@example.org' +``` + +At this point, we have done all we need to do as the PeerTube user. Run +`exit` or press `Ctrl-d` to log out and return to the root prompt where +we will configure Nginx and other system settings. + +## Certbot + +First, we will want a Certbot SSL certificate to encrypt connections to +our PeerTube instance. Just run the following: + +```sh +certbot --nginx -d peertube.example.org certonly +``` + +## Nginx + +PeerTube includes an Nginx configuration that can be copied over to +`/etc/nginx/sites-available:` + +```sh +cp /var/www/peertube/peertube-latest/support/nginx/peertube /etc/nginx/sites-available/peertube +``` + +Because the PeerTube config is so long, it\'s recommended to use `sed` +to modify the contents of the file, replacing `${WEBSERVER_HOST}` with +your hostname, and `$(PEERTUBE_HOST)` with your localhost and port, +which by default should be `127.0.0.1:9000`: + +```sh +sed -i 's/${WEBSERVER_HOST}/example.org/g' /etc/nginx/sites-available/peertube +sed -i 's/${PEERTUBE_HOST}/127.0.0.1:9000/g' /etc/nginx/sites-available/peertube +``` + +Once you\'re happy with the Nginx config file, link it to +`sites-enabled` to activate it: + +```sh +ln -s /etc/nginx/sites-available/peertube /etc/nginx/sites-enabled/peertube +``` + +## Running PeerTube + +A config file for a systemd daemon is included in PeerTube and can be +setup and started like so: + +```sh +cp /var/www/peertube/peertube-latest/support/systemd/peertube.service /etc/systemd/system/ +systemctl daemon-reload +systemctl start peertube +``` + +PeerTube will take a minute or so to start, but after it does, you can check +its status with `systemctl status peertube` and at this point, your +PeerTube site should be live! + +## Using PeerTube + +To set a password for your admin user, run: + +```sh +cd /var/www/peertube/peertube-latest +NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production npm run reset-password -- -u root +``` + +Login to your PeerTube instance using the admin email specified in your +`production.yaml` file and the admin password you just set. + +{{< img alt="PeerTube login" src="/pix/peertube-login.jpg" >}} + +Once logged in, it\'s recommended to create a separate user without +admin privileges for uploading videos to PeerTube. This can be done +easily from the users tab in the administration section. + +Enjoy your PeerTube instance! + +------------------------------------------------------------------------ + +## Updating PeerTube + +PeerTube is constantly adding new features, so it\'s a good idea to +[check for new +updates](https://github.com/Chocobozzz/PeerTube/blob/develop/CHANGELOG.md) +and add them if you wish. Just in the past year, they have added +livestreaming and more. + +Updating is fairly easy now since an `upgrade.sh` script has been added. +Just run: + +```sh +cd /var/www/peertube/peertube-latest/scripts && sudo -H -u peertube ./upgrade.sh +``` + +Although check the +[changelog](https://github.com/Chocobozzz/PeerTube/blob/develop/CHANGELOG.md) +to see if there are additional manual requirements for particular +updates. + +------------------------------------------------------------------------ + +*Written by [Denshi.](https://denshi.org) Donate Monero +[here](https://denshi.org/donate.html) +[\[QR\]](https://denshi.org/images/monero.jpg)* diff --git a/content/pleroma.md b/content/pleroma.md new file mode 100644 index 0000000..78aab03 --- /dev/null +++ b/content/pleroma.md @@ -0,0 +1,186 @@ +--- +title: "Pleroma" +date: 2021-07-01 +icon: 'pleroma.svg' +tags: ['service','activity-pub'] +short_desc: 'A federated Twitter-like microblogging system.' +--- +Hopefully by now you won\'t have to be sold on the invasive practices +that social media companies conduct. Websites such as Facebook and +Twitter aquire so much data on users that they often know more about you +than you know about yourself. The simple solution to this is to not use +social media. However, that just isn\'t an option for most people. So +the next best thing is to setup a self-hosted and federalised social +media site so that you have full control over your data. I\'ve +previously made [a video showing all the steps in depth if you want to +check it out.](https://www.youtube.com/watch?v=l7mVsLSsotU) If you run +into any issues I suggest you look at the video. + +You\'ll need a server or VPS. Nearly any Operating system is supported +but for this tutorial I\'m gonna presume you\'re using a Debian-based +OS. You\'ll also need a domain name pointing to your server\'s IP +address [which is explained in this tutorial.](/basic/dns) + +## Installation + +### Setting Up and Configuring + +First things first you\'ll need to make sure that you\'ve hardened you +SSH so that password authentication is disabled and you\'ll also want to +setup Fail2Ban. There\'s a great tutorial on how to do this [which can +be read here.](/sshkeys) + +Next we\'ll install the required packages: + +```sh +apt install -y curl unzip libncurses5 postgresql postgresql-contrib nginx certbot libmagic-dev +``` + +You can manually configure postgreSQL to suit your system better. [Check +out the documentation +here](https://docs-develop.pleroma.social/backend/configuration/postgresql/) +and then run the below command: + +```sh +systemctl restart postgresql +``` + +### Installing the Pleroma App + +#### First as the root user + +Pleroma is not in the Debian app repositories, so we will install it +manually. First create the Pleroma user by running the below command: + +```sh +useradd -m -s /bin/bash -d /opt/pleroma pleroma +``` + +Then, still as root, we will create the required directories and give +the Pleroma user ownership of them. + +```sh +mkdir -p /var/lib/pleroma/uploads +chown -R pleroma /var/lib/pleroma +mkdir -p /var/lib/pleroma/static +chown -R pleroma /var/lib/pleroma +mkdir -p /etc/pleroma +chown -R pleroma /etc/pleroma +``` + +#### Now, as the new Pleroma user + +Now run `su -l pleroma` to login as the Pleroma user. Now use the `curl` +command below to download the Pleroma software and unzip it. + +```sh +curl 'https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=amd64' -o /tmp/pleroma.zip +unzip /tmp/pleroma.zip -d /tmp/ +``` + +Note that we are downloading the **amd64** version here. If you know you +have a different CPU architecture, replace that with whatever your +architecture is. + +```sh +mv /tmp/release/* /opt/pleroma +rmdir /tmp/release +rm /tmp/pleroma.zip +./bin/pleroma_ctl instance gen --output /etc/pleroma/config.exs --output-psql /tmp/setup_db.psql +``` + +We need to briefly return to the root user so we can run the following +command (via the postgres user) to set up the database. Type `ctrl-d` or +run `exit` to return to the root user, then run: + +```sh +su postgres -s $SHELL -lc "psql -f /tmp/setup_db.psql" +``` + +Then return to the pleroma user with `su -l pleroma` and we will test to +see that Pleroma can run: + +```sh +./bin/pleroma_ctl migrate +./bin/pleroma daemon +``` + +That will initialize Pleroma. It might take as long as a minute to get +started, so wait a bit, then run the following: + +```sh +curl http://localhost:4000/api/v1/instance +``` + +If everything is working, this command will give you a long line of +messy output. If it is not, you will get a connection error message. +Once it is working successfully, stop the Pleroma daemon and we will +interface Pleroma with the web server. + +```sh +./bin/pleroma stop +``` + +### Setup and Configure Nginx + +Return again to the root user. Let\'s copy Pleroma\'s Nginx +configuration file from the template given in the installation and +enable it: + +```sh +cp /opt/pleroma/installation/pleroma.nginx /etc/nginx/sites-available/pleroma.conf +ln -s /etc/nginx/sites-available/pleroma.conf /etc/nginx/sites-enabled/pleroma.conf +``` + +Edit the `etc/nginx/sites-available/pleroma.conf` file and replace +**example.tld** with your domain name. + +We now have to get a SSL certificate to enable encryption, since we have +a model configuration that already includes SSL information, just check +the brief [the standalone certificate page](/standalone) to get the +needed certificate. Once you\'ve got your cert setup, copy over the +Nginx configuration with the below command: + +Once everything, including your Cerbot certificate is ready, simply +reload Nginx with this command: + +```sh +systemctl reload nginx +``` + +### Setting up the service + +Pleroma itself runs on a SystemD service similar to other things running +on your server like Nginx. To start the service up run the below +commands: + +```sh +cp /opt/pleroma/installation/pleroma.service /etc/systemd/system/pleroma.service +systemctl start pleroma +systemctl enable pleroma +``` + +If everything worked then when you go to your domain in the web browser +you should see a bare-bones Pleroma instance. + +### Creating an Admin User + +You\'ll be able to create new accounts on the Pleroma instance in the +login section on the website but the easiest way to setup an admin +account is with the CLI. Simply run the below command replaced with your +username: + +```sh +su -l pleroma +./bin/pleroma_ctl user new username username@example.org --admin +``` + +If you run into any issues then [feel free to checkout the +documentation](https://docs-develop.pleroma.social/backend/installation/otp_en/) +or send me an email or message. My details are below. + +- [biasedriot.co](https://biasedriot.co) +- [youtube](https://www.youtube.com/channel/UCehh50T6qtDpt_kEUF33GJw) +- Bitcoin: `1Dmn9jEtWAhdLk1HHWkUVNeDdAaBCwNajm`{.crypto} +- Monero: + `84Y4FZiTbLeR5qc1fBrBhB1yq5agKtEdoixq2w1ysXJv486MiBCz3czGT15bqeXDPpdLoNyF93inxY3BCk6g8mrDMNKoArS` diff --git a/content/prosody.md b/content/prosody.md new file mode 100644 index 0000000..1b02b0c --- /dev/null +++ b/content/prosody.md @@ -0,0 +1,273 @@ +--- +title: "Prosody" +date: 2022-04-03 +icon: 'prosody.svg' +tags: ['service'] +short_desc: 'A minimalist XMPP chat server.' +--- + +XMPP is a fantastically simple protocol that\'s usually used as a +messenger. It\'s highly extensible, better than IRC, lighter and more +decentralized than Matrix and Telegram and normie social media can\'t +hold a candle to it. + +XMPP is so decentralized and extensible that there are many *different* +XMPP servers. Here, let\'s set up an [Prosody](https://prosody.im/) XMPP +server. + +## Installation + +Prosody is in the Debian repositories, so we can easily install it on +our server with the following command: + +```sh +apt install prosody +``` + +## Configuration + +The Prosody configuration file is in `/etc/prosody/prosody.cfg.lua`. To +set it all up, we will be changing several things. + +### Setting Admins + +Let\'s go ahead and set who our admin(s) will be. Find the line that +says `admins = { }` and to this we can specify one or more server +admins. + +```cfg +# To add one admin: +admins = { "chad@example.org" } + +# We can add more than one by separating them by commas. (This file is written in Lua.) +admins = { "chad@example.org", "chadmin@example.org" } +``` + +Note that we have not created these accounts yet, we will do this +[below](#user). + +### Set the Server URL + +Find the line `VirtualHost "localhost"` and replace `localhost` with +your domain. In our case, we will have `VirtualHost "example.org"` + +### Multi-User Chats + +Most people will probably want the ability to have chats with more than +two users. This is easily enough to enable. In the config file, add the +following: + +```cfg +Component "chat.example.org" "muc" + modules_enabled = { "muc_mam" } + restrict_room_creation = "admin" +``` + +On the first line, you must have a separate subdomain for your +multi-user chats. I use the `chat.` subdomain, but some use `muc.`. +Anything if possible. + +The second line is important because it prevents non-admins from +creating and squatting rooms on your server. The only situation where +you might not want that is if you indend to open a general public chat +system for people you don\'t know. + +Read more about the `muc` plugin on the Prosody documentation page +[here](https://prosody.im/doc/modules/mod_muc). + +### Enabling chat histories + +By default, Prosody will send out messages received only to the first +available clients. That means that if you have your desktop client +turned off and your cell phone receives a message, it will *not* be +available to the desktop client when you start it. + +While this may be preferred in some cases, enable the MAM module +(Message Archive Management) to have the server hold on messages and +sync them to all clients. + +Within the `modules_enabled` block, you can uncomment the `mam` line to +enable it. You can see other settings for this module +[here](https://prosody.im/doc/modules/mod_mam) like, for example, how +long a server should hold on to message histories for synching. + +Note also that Prosody comes with the `carbons` activated module by +default, which is related. This will send received messages to *all* +active clients (your phone and desktop), although it will not save +messages like MAM for clients not online or to be added later. + +### File sharing + +With this we can bring XMPP to the level of other popular instant +messaging applications like Matrix and whatsapp. It is extremely easy to +setup. This part is optional, but it can make XMPP more normie-friendly +if you plan on moving family members and friends over to XMPP. + +First we need to install extra prosody modules. Run the following +command: + +```sh +apt install prosody-modules +``` + +Then we can add the following line to you prosody config file to enable +file uploads: + +```cfg +Component "uploads.example.org" "http_upload" +``` + +As you will notice, you need another subdomain for this. We will add an +ssl certficate for this later. + +You will also need to go back to `modules_enabled` and uncomment the +`http_files` module. This is used to actually serve the files to users. + +And the last part of the setup is to enable the built in proxy server. +This helps with file transfers for devices behind a NAT, and unless you +are using XMPP in a LAN, you probably need this. Enable the proxy by +adding the following line to the config: + +```cfg +Component "proxy.example.org" "proxy65" +``` + +As you can see, another subdomain is needed. We will add ssl +certificates for this later. + +At this point, file sharing is now setup and ready to be used. Although +there are some concerns that should be addressed. + +A big concern with file sharing is large files, seeing as all files +shared over XMPP will be stored on your server. This can become a +problem when many (and large) files are being shared. We can put a cap +on large files by adding the following line to our config: + +```cfg +http_upload_file_size_limit = 20971520 +``` + +This puts a 20MB cap on all files being shared. The value is specified +in bytes. You can also specify after how long files should be deleted by +adding the following line: + +```cfg +http_upload_expire_after = 60 * 60 * 24 * 7 +``` + +The value is specified in seconds. The above line will make prosody +delete files after a week. + +If it is for some reason neccessary, you can also manually invoke expiry +with the following command: + +```cfg +prosodyctl mod_http_upload expire +``` + +### Other things to check + +Check the config file for other settings you might want to change. For +example, if you want to run a general public XMPP server, you can allow +anyone to create an account by changing `allow_registration` to `true`. + +Another thing you can do is enable the `csi_simple` module, which will +add some optimizations for mobile devices. + +Another thing worth noting is the `archive_expires_after = "1w"` line. +This specifies after how long message archives will be deleted. + +Also the `smacks` module helps a lot with slow internet connections. + +## Certificates + +Obviously, we want to have client-to-server and server-to-server +encryption. Nowadays, use can use Certbot to generate certificates and +use a convenient command below `prosodyctl` to import them. + +**If you have multi-user chat enabled, be sure to get a certificate for +that subdomain as well.** Include the `--nginx` option assuming you have +an Nginx server running. + +```sh +certbot -d chat.example.org --nginx +``` + +**If you have file sharing enabled, be sure to get a certificate for +those subdomains as well.** + +```sh +certbot -d uploads.example.org --nginx +certbot -d proxy.example.org --nginx +``` + +Once you have the certificates for encryption, run the following to +import them into Prosody. + +```sh +prosodyctl --root cert import /etc/letsencrypt/live/ +``` + +Note that you might get an error that a certificate has not been found +if your `muc` subdomain and your main domain share a certificate. It +should still work, this is just notifying you that no specific +certificate for the subdomain. + +**Note:** The above command will need to be rerun when certificates are +renewed. You may want to create a [cronjob](/cron) to have this done +automatically. + +## Creating users/admins manually {#user} + +Let\'s manually create the admin user we prepared for above. Note that +you can indeed do this in your XMPP client if you have not disabled +registration, but this is how it is done on the command line: + +```sh +prosodyctl adduser chad@example.org +``` + +This will prompt you to create a password as well. + +## Make changes active + +With any system service, use `systemctl reload` or `systemctl restart` +to make the new settings active: + +```sh +systemctl restart prosody +``` + +## Using your Server! + +Once your server is set up, you just need an XMPP client to use your new +and secure chat system. + +- GNU/Linux: [Dino](https://dino.im/) or [Gajim](https://gajim.org/) +- Windows: [Gajim](https://gajim.org/) also runs on Windows. +- Android: [Conversations.im](https://conversations.im/) or + [snikket](https://snikket.org/) +- Mac/iOS: [Monal IM](https://monal.im/) or + [Siskin](https://siskin.im/) for iOS alone +- command-line (GNU/Linux, MacOS, Windows): + [Profanity](https://profanity-im.github.io/) +- [See a more complete list kept by + XMPP](https://xmpp.org/software/clients.html) + +Install whichever of these clients you want on your computer or phone +and you can log into your new XMPP server with the account you made. +Note that if you enabled public registration, anyone can create an +account on your server through one of these clients. + +### Account addresses + +XMPP account addressed look just like email addresses: +`username@example.org`. You can message any account on any XMPP server +on the internet with that format. + +### Note on MUCs (multi-user chats) + +Remember that MUCs are kept on a separate subdomain that we created and +should\'ve gotten a certificate for above, for example, +`chat.example.org`. Chatrooms are created and referred to in the +following format: `#chatroomname@chat.example.org`. diff --git a/content/radicale.md b/content/radicale.md new file mode 100644 index 0000000..56d3b0f --- /dev/null +++ b/content/radicale.md @@ -0,0 +1,105 @@ +--- +title: "Radicale" +date: 2021-10-07 +pix: 'radicale.svg' +icon: 'radicale.svg' +tags: ['service'] +short_desc: 'A private calendar, contact and to-do list system.' +--- + +Radicale is an open source calDAV server. CalDAV is a widely supported +internet standard for calendars, todo-lists and contacts. Hosting your +own calDAV server allows sharing calendars between mutliple devices. + +More information can be found on the projects offical website: +[radicale.org](https://radicale.org/3.0.html). + +## Installing Radicale + +Firstly, we have to install radicale on our system, luckily for us +radicale is packaged for the most used distros. + +```sh +apt install radicale apache2-utils +``` + +Next we need to configure Radicale. We configure radicale to be +accessible from other machines, how Radicale handles users and where the +files should be stored. Open /etc/radicale/config with your favourite +editor and add this configuration. + +```systemd +[server] +# Bind all addresses +hosts = 0.0.0.0:5232, [::]:5232 + +[auth] +type = htpasswd +htpasswd_filename = /etc/radicale/users +htpasswd_encryption = bcrypt + +[storage] +filesystem_folder = /var/lib/radicale/collections +``` + +As you can see under \[auth\] we use htpasswd to manage the users. +Execute the following command to add a new user to Radicale. + +```sh +htpasswd -c /etc/radicale/users username +``` + +As Radicale stands now it is fully functional and after starting it by +executing its binary, can be accessed under example.org:5232. But there +are two additional things we can do to make using and managing Radicale +way easier. + +### Setting up a Nginx reverse proxy + +Because the URL of your Radicale server is an URL you will have to +remember and enter it on any device you want to use your calendar on it +is advised to set up a reverse proxy. + +```nginx +server { + listen 443 ssl; + listen [::]:443 ssl; + server_name cal.example.org; + location / { + proxy_pass http://localhost:5232/; # The / is important! + } + # You can also leave these two lines out and use certbot + ssl_certificate /etc/ssl/nginx/cal.example.com/fullchain.pem; + ssl_certificate_key /etc/ssl/nginx/cal.example.com/privkey.pem; +} +``` + +### Run as a service + +Running Radicale as a service makes managing it much easier. Add this +config to /etc/systemd/system/radicale.service. + +```systemd +[Unit] +Description=A simple CalDAV (calendar) and CardDAV (contact) server + +[Service] +ExecStart=/usr/bin/env python3 -m radicale +Restart=on-failure + +[Install] +WantedBy=default.target +``` + +After creating the config load, start and enable the service with the +following commands. + +```sh +systemctl daemon-reload +systemctl enable --now radicale +``` + +## Contribution + +Author: Jocomol -- [jocomol.ch](https://jocomol.ch) \-- XMR: +`41kLv68Nk4N3zvTRFYtHZfRRFMgXkxK2FcXDeCSa4yNwBGTBa1WQ8HtXL8cCAcoZ2iSLBCS6HQqdpRSf56ecMBgWTkn2ARt`{.crypto} diff --git a/content/rss-bridge.md b/content/rss-bridge.md new file mode 100644 index 0000000..5969152 --- /dev/null +++ b/content/rss-bridge.md @@ -0,0 +1,114 @@ +--- +title: "RSS Bridge" +date: 2021-07-05 +tags: ['service'] +icon: 'rss.svg' +short_desc: 'Creates RSS feeds for normie sites like Facebook.' +--- +RSS Bridge is a useful utility you can use to help you avoid the big +tech sites, like Facebook and Twitter, which instead of the feed you +usually would see, will be a based and minimalist RSS feed. + +You\'ll need a server or VPS. Nearly any Operating system is supported +but for this tutorial I\'m gonna presume you\'re using a Debian-based +OS. You\'ll also need a domain name pointing to your server\'s IP +address [which is explained in this tutorial.](/basic/dns) + +## Installation + +### Setting Up and Configuring + +First things first you\'ll need to make sure that you\'ve hardened you +SSH so that password authentication is disabled and you\'ll also want to +setup Fail2Ban. There\'s a great tutorial on how to do this [which can be read here.](/sshkeys) + +Next we\'ll install the required packages: + +```sh +apt install -y curl unzip nginx certbot php-fpm php-mysql php-cli php7.3-mbstring php7.3-curl php7.3-xml php7.3-sqlite3 php7.3-json +``` + +We now have to create the website configuration file. Create/open the a +file below: + +```sh +nano /etc/nginx/sites-available/rss-bridge +``` + +And add the following content: + +```nginx +server { + root /var/www/rss-bridge; + index index.php index.html index.htm index.nginx-debian.html; + server_name rss-bridge.example.org; + + location / { + try_files $uri $uri/ =404; + } + + location ~ \.php$ { + include snippets/fastcgi-php.conf; + fastcgi_pass unix:/var/run/php/php7.3-fpm.sock; + } + + location ~ /\.ht { + deny all; + } +} +``` + +After you have saved the file, you need to create a symlink so the +server actually will read the file. + +```sh +ln -s /etc/nginx/sites-available/rss-bridge /etc/nginx/sites-enabled/rss-bridge +``` + +Then we have to create the folder where the service will reside in. + +```sh +mkdir -p /var/www/rss-bridge +cd /var/www/rss-bridge +``` + +Lets download the latest version of RSS-Bridge in the directory. + +The newest version can be found +[here](https://github.com/RSS-Bridge/rss-bridge/releases), at the time of +writing that is \"RSS-Bridge 2021-04-25.\" + +```sh +wget https://github.com/RSS-Bridge/rss-bridge/archive/refs/tags/2021-04-25.zip +``` + +Unzip the file: + +```sh +unzip 2021-04-25.zip +``` + +This will create a directory called rss-bridge-version-number, we now +want to move all the file contents of the newly created directory to the +one we are in + +```sh +mv rss-bridge-2021-04-25/* . +rm -rf rss-bridge-2021-04-25 2021-04-25.zip +``` + +Now all we need to do is grant read/write permissions and reload the web +server. + +```sh +chown -R www-data:www-data /var/www/rss-bridge +systemctl reload nginx +``` + +That\'s it, you should now have a working rss-bridge installed. But you +should definately get an SSL certifcate installed [which is done briefly here](/basic/certbot). + +- [handskemager.xyz](https://handskemager.xyz) +- Bitcoin: `bc1qhfjgwjzksf2auqjefwpvq20wvyugq3lhqgkxvu`{.crypto} +- Monero: + `88cPx6Gzv5RWRRJLstUt6hACF1BRKPp1RMka1ukyu2iuHT7iqzkNfMogYq3YdDAC8AAYRqmqQMkCgBXiwdD5Dvqw3LsPGLU`{.crypto} diff --git a/content/rsync.md b/content/rsync.md new file mode 100644 index 0000000..b2ccc07 --- /dev/null +++ b/content/rsync.md @@ -0,0 +1,104 @@ +--- +title: "Rsync: Upload and Sync Files and Websites" +date: 2021-07-01 +img: 'rsync.png' +tags: ['server'] +--- + +rsync is a simple way to copy files and folders between your local computer and +server. While you can install [Nextcloud](/nextcloud) is a more normie-friendly +Dropbox/Google Drive-like way to share files, people familiar with the +command-line will find all they need in the simple `rsync` command. + +It not only makes file-transfer easy, but it allows you to build and +maintain your website offline, then easily upload it to the proper +directory on your server so you don\'t need to constantly be logged into +your server to modify your site. + +## Installing rsync + +Run the following on your server *and* on your local machine. + +```sh +apt install rsync +``` + +## Uploading files with rsync + +From your local machine you can upload files to your server like this: + +```sh +rsync -rtvzP /path/to/file root@example.org:/path/on/the/server +``` + +You will be prompted for the root password and then uploading will +commence. + +If you omit **root@**, rsync will not attempt to log in as root, but +whatever your local username is. + +### Options to rsync + +In this command, we give several options to rsync. You can remove some of these +or add to them based on your needs: + +- `-r` -- run recurssively (include directories) +- `-t` -- transfer modification times, which allows skipping files + that have not been modified on future uploads +- `-v` -- visual, show files uploaded +- `-z` -- compress files for upload +- `-P` -- if uploading a large file and upload breaks, pick up where + we left off rather than reuploading the entire file + +Avoid using the commonly used `-a` option when uploading to a server. It can +transfer your local machine\'s user and group permissions to your +server, which might cause breakage. + +But `-a` is useful for making back-ups of important directories. It's an alias for many options at once (`-rlptgoD`)---read `man rsync` for the details. + +### Scriptability + +It\'s a good idea to build your website offline, then make an rsync +script or bash alias like the one above to upload the edited files when +you have made updates. + +### Password-less authentication + +To avoid having to manually input your password each upload, you can set +up [SSH keys](/sshkeys) to securely idenitify yourself and computer +as a trusted. + +### Picky trailing slashes + +rsync is very particular about trailing slashes. This is useful, but can +be confusing to some new users. Suppose we run the following wanting to +mirror our offline copy of our website in the directory we use on our +server (`/var/www/websitefiles/`): + +```sh +❌ rsync -rtvzP ~/websitefiles/ root@example.org:/var/www/websitefiles/ +``` + +This will *not actually do quite what we want*. It will take our local +`websitefiles` directory and put it *inside* `websitefiles` on the +remote machine, ending up with `/var/www/websitefiles/websitefiles`. + +Instead, remove the trailing slash from the remote server location: + +```sh +✅ rsync -rtvzP ~/websitefiles/ root@example.org:/var/www/websitefiles +``` + +`websitefiles/` has been replaced with `websitefiles`, and this will do +what we want. + +## Downloading files with rsync {#downloading-file-with-rsync} + +You may just as easily download files and directories from your server +with rsync: + +```sh +rsync -rtvzP root@example.org:/path/to/file /path/to/file +``` + +If you don't keep a local copy of your website or other things saved on a server🔒, it might be a good idea to set up a [cronjob](/cron) or just a normal script on your local computer that takes back-ups of your website in case of server failure! diff --git a/content/searxng.md b/content/searxng.md new file mode 100644 index 0000000..4797b69 --- /dev/null +++ b/content/searxng.md @@ -0,0 +1,146 @@ +--- +title: "SearXNG" +date: 2022-05-16 +icon: 'searxng.svg' +tags: ['service'] +short_desc: 'Polls dozens of search engines to give you private and complete search results.' +--- + +SearXNG is a free internet metasearch engine which aggregates results +from more than 70 search services. This guide sets up a working instance +that can be accessed using a domain over HTTPS. Features include: + +- Self-hosted +- No user tracking +- No user profiling +- About 70 supported search engines +- Easy integration with any search engine +- Cookies are not used by default +- Secure, encrypted connections (HTTPS/SSL) + +## Installation + +Install the required packages. + +```sh +apt install git nginx -y +``` + +Open http and https ports. + +```sh +iptables -I INPUT 6 -m state --state NEW -p tcp --dport 80 -j ACCEPT +iptables -I INPUT 6 -m state --state NEW -p tcp --dport 443 -j ACCEPT +netfilter-persistent save +ufw allow 80 +ufw allow 443 +``` + +Clone the SearXNG Repository. + +```sh +git clone https://github.com/searxng/searxng searxng +cd searxng +``` + +Installing SearXNG, Filtron and Morty. + +```sh +./utils/searx.sh install all +./utils/filtron.sh install all +./utils/morty.sh install all +``` + +Check that both filtron and morty are running. + +```sh +systemctl status filtron +systemctl status morty +``` + +## Configure Nginx + +Create a new file `/etc/nginx/sites-available/searxng.conf` and add the +following: + +```nginx +server { + + # Listens on http + listen 80; + listen [::]:80; + + # Your server name + server_name searx.example.org; + + # If you want to log user activity, comment these + access_log /dev/null; + error_log /dev/null; + + # Searx reverse proxy + location / { + proxy_pass http://127.0.0.1:4004/; + + proxy_set_header Host $host; + proxy_set_header Connection $http_connection; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Scheme $scheme; + proxy_set_header X-Script-Name /searx; + } + + location /searx/static { + alias /usr/local/searx/searx-src/searx/static; + } + + # Morty reverse proxy + location /morty { + proxy_pass http://127.0.0.1:3000/; + + proxy_set_header Host $host; + proxy_set_header Connection $http_connection; + proxy_set_header X-Real-IP $remote_addr; + proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; + proxy_set_header X-Scheme $scheme; + } +} +``` + + +Now create a symbolic link to enable this site. + +```sh +ln -s /etc/nginx/sites-available/searxng.conf /etc/nginx/sites-enabled/searxng.conf +``` + +Restart Nginx and SearXNG. + +```sh +systemctl restart nginx +service uwsgi restart searx +``` + +## Configure HTTPS with Certbot + +Install certbot. + +```sh +apt install python3-certbot-nginx +``` + +Install a Let\'s Encrypt SSL certificate to Nginx and optionally let it +configure HTTPS for you. [Detailed instructions and additional information](/basic/certbot). + +```sh +certbot --nginx +``` + +SearXNG should now be available from your domain. + +## Configuration + +You can change settings by editing `/etc/searxng/settings.yml`. + +## Contribution + +Author: goshawk22 -- [website](https://goshawk22.uk) diff --git a/content/selfhosting.md b/content/selfhosting.md new file mode 100644 index 0000000..0aa00b2 --- /dev/null +++ b/content/selfhosting.md @@ -0,0 +1,202 @@ +--- +title: "Self hosting" +date: 2020-08-19 +tags: ['server'] +--- +## Introduction + +When you have a(n old) computer lying around, and you have cheap +electricity and a good internet connection, self hosting might be a good +option for you. + +### Why would you choose selfhosting? + +- You have control over the hardware, and you can upgrade your server + in the future. For example: if you host a file server and your hard + drive goes full, you can simply add another hard drive or upgrade + it. +- No bandwith limits, storage limits, etc. (some VPSes have this) +- It **can** be cheaper than using a VPS. This only is the case if you + got the server for really cheap and your electricity is cheap. +- You can have a media server to consoom your content (for example + with `Jellyfin`). You can technically do this on a VPS, but that + will be more expensive than self hosting. If you have a media + server, you can stream media from your server to more devices. (I + recommend just downloading it on your device, but if you have + multiple devices, this could be a good solution) + +### Downsides + +Some possible downsides of choosing to host at home could be: + +- Your ISP not approving of what you\'re doing. Some ISP\'s do not + condone you hosting at home. Usually when this is the case, it could + be harder if you want to forward ports, or it could be impossible to + get a static IP address. Check your ISP\'s terms of service. + Sometimes, it will say that hosting a webserver, email server, and + more, is not allowed. +- This can also include blocked ports. ISPs can block certain ports to + the world. Sometimes ISPs only block 445/139 (which is for the + better as Samba, using these ports isn\'t really secure and it\'s + outdated). But some ISPs (sadly) block crucial ports like 80 + and/or 443. You need to check this before trying anything. If this + is the case, a way to get around it is to get another ISP or use an + alternative port. A great website to check this is: + [canyouseeme.org](https://canyouseeme.org/). You can also check if + you did the port forwaring correctly here. +- Security. Opening your network to the public could bring security + risks. For example, never open a Samba server to the public, because + it\'s a pretty old protocol, and it has some security + vulnerabilities. Be sure you are forwarding the right port, and + don\'t just forward random ports to the internet. Also, if you are + getting DDoSed, your ISP will temporarily shut down your whole + internet connection. +- When setting up an email server, it can be way harder to not have + your email show up as spam in other\'s people email. If you use a + VPS, this is way easier. +- Space, power consumption and noise. Of course, this differs per + server. + +Your mileage may vary, go and check each of these points, and see if +selfhosting is the right choice for you. Try and calculate your power +consumption and see if your electricity cost is not too expensive. + +For me, the upsides outweighed the downsides, which is why I chose to +host at home. But, this differs with each person and scenario. Go and +research what your exact situation is, before trying anything. Otherwise +you\'ll have to face some bad surprises. + +## Hardware + +### What kind of hardware should you choose? + +If you pay your own electricity bill, power consumption is a big factor. +Most old laptop computers are ideal in the sense that they don\'t use a +lot of power, and if the battery still works, you have a built-in UPS! +The bad thing is, most old laptop computers aren\'t that powerful, and +they lack in upgradability. (you shouldn\'t really be using anything +older than 2006, and I recommend at least a performance equivalant of a +Core 2 CPU) + +If you can find an energy efficient desktop (under 100W), that is a +great option. They are pretty upgradable and they don\'t use a lot of +power. They can also be pretty cheap, but old laptops are usually +cheaper. If you can afford new hardware, and are willing to build a PC, +you can find really power effecient CPU/motherboard combos, and they can +be cheap, for example the Celeron J3060. I recommend a low wattage power +supply or an effecient one for these kinds of builds. Pico PSUs are +pretty tiny and efficient solutions in these builds. + +Of course, if you don\'t pay your electricity bill or cost is not a +problem for you, you can use just about any old desktop (as long as +it\'s not from the 90\'s, I recommend at least a Core 2 chip again, or +an Athlon 64 X2). + +### Usecases + +Of course, hardware choices depend on the usecase. The above +recommendations I gave you work fine for e-mail server, webserver and +fileserver types of applications, but they will struggle to transcode +video if you are going to host a media server. You\'ll need a faster +CPU, but also a faster GPU. As an example, the Athlon 200GE or 3000G are +good and efficient choices for these builds. They are decent CPUs, but +also have a built in GPU that will transcode video just fine. + +If you need a lot of storage, go for a case with a lot of mounts for +hard drives, this way you can easily mount multiple hard drives. Pros of +multiple hard drives are redundancy and speed. Cons could be that they +create more heat and noise. You can\'t use a laptop if you want multiple +drives, except if you use a hard drive caddy for the CD/DVD drive bay. +Some business laptops even support RAID 1 (redundancy) and RAID 0 (speed +and more storage, but you lose your files if one hard drive breaks) this +way. + +## Getting started + +### Installing Debian + +Once you have the machine, you can install the OS. I recommend Debian, +as all of the guides on this website are Debian specific. Debian just +werks as a server OS. + +You\'ll need to burn a Debian install image onto a USB flash drive or a +CD. You can download the image +[here](https://www.debian.org/CD/netinst/), and you can also find +information on how to burn the image onto a USB flash drive or CD there. + +While installing Debian, do not install any desktop environment. But +install an SSH server when you get the chance. Also leave webserver +unchecked, even if you want to use it as a webserver. You\'ll have a +chance to install this later. + +### Port forwaring + +Every time you are going to set up a new server program, you need to +forward a port corresponding to that program. For example, HTTP is port +80, HTTPS is 443, etc. You need to set this up on your router\'s NAT +settings (sometimes just called port forwarding, this differs per +router). These steps differ for each router. Refer to your routers +manual. A simple command to see what your servers IP address is, is to +run `ifconfig` on your server. This shows a lot of network info, but it +will also show your local IP address needed for port forwarding. + +Basic ports: + +- SSH: port 22 (open this port if you want to admin your server + outside your network) +- HTTP: port 80 (open this port if you want basic webserver + functionality) +- HTTPS: port 443 (you should open this port if you are setting up a + webserver because encryption) + +### Static or dynamic IP address + +If you want to host your server at home, make sure you have a static IP +address, or you can change your dynamic IP address to a static one. +Refer to your router settings, some ISPs will have options on this here. +If you can\'t find anything on this, get in touch with your ISP. + +Once you\'ve made sure you have a static IP address, you can find out +what the IP address is with various websites. You can use a search +engine to easily find this out. Write this down as you\'ll need it +later. + +Once you\'re done, you can pretty much follow every guide on this +website, the only difference is that you\'ll need to forward the ports +you\'ll be using for the server. + +### Finding the ports you\'ll need to forward + +If you need to know what port you\'ll need to forward, there\'s a +command for that. Just type `netstat -tulpn` in your servers command +line. If you want to see the name of the programs, you need to run it as +a root user. You can do this by putting `sudo` before the command. + +```txt +Local Address State PID/Program name +0.0.0.0:25 LISTEN 887/master +0.0.0.0:1883 LISTEN 22452/mosquitto +0.0.0.0:445 LISTEN 798/smbd +0.0.0.0:993 LISTEN 381/dovecot +127.0.0.1:3306 LISTEN 560/mysqld +0.0.0.0:587 LISTEN 887/master +0.0.0.0:139 LISTEN 798/smbd +127.0.1.1:12301 LISTEN 412/opendkim +0.0.0.0:143 LISTEN 381/dovecot +0.0.0.0:465 LISTEN 887/master +0.0.0.0:22 LISTEN 472/sshd +:::25 LISTEN 887/master +:::443 LISTEN 1769/apache2 +:::1883 LISTEN 22452/mosquitto +:::445 LISTEN 798/smbd +``` + +*Example output* + +In this example, if you need to find the port number from `dovecot`, you +can look for it in the `Program name` column. Then you can see in the +local address column that the reported local address is `0.0.0.0:993`. +You need to look for the part after the semicolon. In this case it\'s +993. So you\'ll need to forward port 993. + +*Written by [hiddej](https://github.com/hidde-j)* diff --git a/content/sshkeys.md b/content/sshkeys.md new file mode 100644 index 0000000..f1c8c0d --- /dev/null +++ b/content/sshkeys.md @@ -0,0 +1,153 @@ +--- +title: "Log on with SSH Keys" +date: 2021-06-29 +tags: ['server'] +--- +Let\'s generate and use SSH keys on our computer. This allows us to +ensure our identity better than a password ever could. This allows us to +do two main things: + +1. **Password-less login**: With SSH keys, we can permanently designate + our profile on our local computer as safe for our server, allowing + us to bypass password verification when logging into our server. +2. **Prevent hacking**: Since we no longer need a password to log in, + we can simply deactivate password logins on our server altogether, + which prevents hacking from people who may be so lucky as to guess + our password! + +In other words, using an SSH key to login is **both safer, faster and +easier**. + +This is especially useful once you start making scripts on your computer +that interact with your server. You can upload files in the background, +edit your spam filters or anything else from your local computer without +having to input your password each time you touch the server. + +## Generate an SSH key pair + +Generating an SSH key is simple. Just run: + +```sh +ssh-keygen +``` + +It will prompt you for several options and you can generally chose the +default options in each case. It will ask you to optionally include a +password on your SSH key. I generally recommend against this unless you +happen to be using a computer where you don\'t have root access but +someone else does (it does minimize the ease of using an SSH key in our +case). + +### What does this SSH key do? + +Now whenever you use `ssh` to log into a server, you have the public key +of this SSH key pair as your identifier. You can tell your server to +trust this key and it will automatically allow password-less logins from +this computer. + +### Backing up your key + +We will do that momentarily, but first, I recommend you backup your +newly generated key if you plan to use it. If we disable logins to this +one key and then lose the key, we might be locked out of our server. + +I suggest copying your entire `~/.ssh/` directory (user-specific) to a +USB drive and storing it securely. You may also copy it to the same +place on another computer to use the key there. + +## Making your server trust your key. + +Now that you have generated an SSH key, just run the following: + +```sh +ssh-copy-id root@yourdomain.com +``` + +The command will ask for your server\'s root password and log you in +briefly. What this does is that it puts your public SSH key fingerprint +on your server in a file `/root/.ssh/authorized_keys`. This file in turn +allows approved SSH keys to log in without passwords. + +Note that you can also replace **root** with a username of an account on +the server if you had made a non-root user that you\'d like to easily +log into as well. For the username **user**, it will also store the key +in `/home/user/.ssh/authorized_keys`. + +To test if this has worked, now try logging in normally to your server +with ssh: + +```sh +ssh root@yourdomain.com +``` + +It should now let you log in without a password prompt! + +If you find that this does not work try running the following, make sure +you are in the directory where the keys where created. + +```sh +chmod 700 ~/.ssh/ +chmod 644 ~/.ssh/id_rsa.pub +chmod 600 ~/.ssh/id_rsa +chmod 644 ~/.ssh/authorized_keys +``` + +For whatever reason these files due not have the correct permissions +set, as ssh is very picky about correct file permissions this can cause +errors. The above will fix these. + +## Disabling Password Logins for Security + +Once we have authorized ssh keys for all the devices we need, we can +actually just disable password logins. If you\'ve ever looked at your +system logs (`journalctl -xe`) you will find that there are always +hundreds of random Chinese computers trying to brute force every server +connected to the internet with random passwords. They are usually +unsuccessful, but let\'s make it **impossible** for them. + +Log into your server and open the `/etc/ssh/sshd_config` file. Here we +can set settings for our SSH daemon that receives SSH requests. + +Now find, uncomment or create the following three lines and set them all +to **no**: + +```sh +PasswordAuthentication no +ChallengeResponseAuthentication no +UsePAM no +``` + +Once we\'ve done that, we will reload our SSH daemon: + +```sh +systemctl reload sshd +``` + +### We\'re done! + +Now you can log in quickly and password-less-ly to your server, despite +the fact that it is now more secure than ever! + +With these settings, even if a hacker steals or perfectly guesses an +account password, they still cannot log in without an approved SSH key! + +## What if I lose my SSH key?! + +Firstly, don\'t do this. Take every precaution that you have a backup. + +If this does happen, Vultr and most other VPS providers will have a way +out. Log onto their website and select the server you want to log into. + +{{< img src="/pix/ssh-01.png" alt="vultr login" >}} + +In the image above, to the right of your VPS name are a series of icons. +Click on the computer screen-like icon which is the leftmost one. + +This will open up a browser window emulating a terminal and you can +always login with your password here, since logins here count as being +local---they do not use SSH and therefore can indeed validate with +your password even if you have disabled it over SSH. + +From here, simply reverse the settings we set above and you can log in +via SSH with a password and reapprove a newly created SSH key or +whatever you want to do. diff --git a/content/standalone.md b/content/standalone.md new file mode 100644 index 0000000..c466465 --- /dev/null +++ b/content/standalone.md @@ -0,0 +1,40 @@ +--- +title: "Certbot on Standalone Domains and Subdomains" +date: 2021-07-02 +tags: ['server'] +--- + +The command `certbot --nginx` will take an unencrypted website on an +Nginx configuration file, get a certificate for it and change the +configuration to use that certificate and thus HTTPS. + +Sometimes, however, you are given an Nginx configuration template that +already has encryption/HTTPS, so running the automated `certbot --nginx` +is not possible, as it will simply give an error saying that the +certicate that Nginx is looking for doesn\'t already exist and thus the +Nginx config is broken. + +So suppose you want to get a certificate for **pleroma.example.org** +because you are installing Pleroma and the configuration file +presupposes a certificate. In this case you would want to run this: + +```sh +systemctl stop nginx +certbot certonly --standalone -d pleroma.example.org +systemctl start nginx +``` + +What we do here is temporarily turn of Nginx, then run a `certonly` +subcommand that generates a certificate for the domain without changing +or caring about the Nginx configuration. Then we reactivate Nginx, thus +turning back on our webserver. + +The reason we deactivate Nginx is that it uses the ports that Certbot +will want to bind to, and thus we must temporarily turn Nginx off to let +Certbot use those ports. (What it actually does is spin up a dummy +webserver that doesn\'t need to think about the Nginx configuration.) + +This is just a little note of something that might confuse people, but +the three commands above should suffice. If your site is still managed +by Nginx, it should still be able to renew with simple +`certbot renew --nginx` without a problem. diff --git a/content/tor.md b/content/tor.md new file mode 100644 index 0000000..d4fa9fb --- /dev/null +++ b/content/tor.md @@ -0,0 +1,119 @@ +--- +title: "Tor" +date: 2021-06-30 +icon: 'tor.svg' +tags: ['service'] +short_desc: "Set your site up privately on the 'dark web.'" +--- + +Now that you have a website, why not offer it on a private alternative +such as the onion network? + +## Setting up Tor + +### Installing Tor + +First, we need to ensure that our CPU architecture is supported. Ensure +that it is either amd64, arm64, or i386: + + dpkg --print-architecture + +We need to [add the Tor repos to our +system](https://support.torproject.org/apt/tor-deb-repo/) to get the +latest version of Tor: + + apt install -y apt-transport-https gpg + echo "deb [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $(lsb_release -cs) main + deb-src [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $(lsb_release -cs) main" > /etc/apt/sources.list.d/tor.list + +Then we need to add the GPG keys to our keyring: + + curl -s https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor > /usr/share/keyrings/tor-archive-keyring.gpg + +Now install Tor: + + apt update + apt install tor deb.torproject.org-keyring + +### Enabling Tor + +Next edit the file `/etc/tor/torrc`, uncommenting the following lines: + + HiddenServiceDir /var/lib/tor/hidden_service/ + HiddenServicePort 80 127.0.0.1:80 + +#### Optional: Running multiple onion services + +If you want to forward multiple virtual ports for a single onion +service, just add more HiddenServicePort lines (replace the 80 with any +unoccupied port). + +If you want to run multiple onion services from the same Tor client, +just add another HiddenServiceDir line. + +Now start and enable Tor at boot: + + systemctl enable --now tor + +If the next command outputs "active" in green you\'re golden! + + systemctl status tor + +Now your server is on the dark web. The following command will give you +your onion address: + + cat /var/lib/tor/hidden_service/hostname + +## Adding the Nginx Config + +From here, the steps are almost identical to setting up a normal website +configuration file. Follow the steps as if you were making a new website +in the webserver [tutorial](/basic/nginx) up until the server block of +code. Instead, paste this: + + server { + listen 127.0.0.1:80 ; + root /var/www/landchad ; + index index.html ; + server_name your-onion-address.onion ; + } + +#### Clarification + +Nginx will listen on port 80 for your *server\'s* localhost. + +The `root` line is the path to whichever website of yours you\'d like to +mirror. + +Now we are almost done, all we have to do is enable the site and reload +nginx which, is also covered in [the webserver +tutorial](nginx.html#enable). + +### Advertise your onion service + +You can add the Onion-Location header to your normal website to +advertise your onion service to Tor users. On your regular site\'s nginx +config, add the following line: + + server { + ... + add_header Onion-Location http://your-onion-address.onion$request_uri; + } + +After doing this and reloading nginx, when visiting your regular site +via Tor, you should see a \".onion available\" button on the address +bar, which should take you to the onion service. + +### Update regularly! + +Make sure to update Tor on a regular basis by running: + + apt update + apt install tor + +#### Note: + +You do [not]{.underline} need to run certbot for an ssl certificate. +HTTP over tor is plenty secure! + +**Contributor** - [tomfasano.co](https://tomfasano.co){target="_blank"} diff --git a/content/ufw.md b/content/ufw.md new file mode 100644 index 0000000..52cd294 --- /dev/null +++ b/content/ufw.md @@ -0,0 +1,223 @@ +--- +title: "Using UFW as a Firewall" +date: 2021-06-30 +tags: ['server'] +--- +**Uncomplicated Firewall** (UFW) is a front-facing program for the more +involved `iptables` firewall program installed in most GNU/Linux +distributions. We can use `ufw` to restrict machines on the internet to +only access the services (SSH, websites etc) you want them to, but it +can also be used to prevent programs on the computer itself from +accesing parts of the internet it shouldn\'t. + +## How to Get It + +Log into your server by pulling up a terminal and typing: + +```sh +ssh root@example.org +``` + +This command will attempt to log into your server and run a remote +shell. If you leave the settings default, it should prompt you for your +password, and you can just copy or type in the password from Vultr\'s +site. + +Some VPS providers automatically install `ufw`, but if you do not have +it installed already, install it in the typical way: + +```sh +apt install ufw +``` + +## First-Time Setup + +You can check the status of `ufw` right now by running: + +```sh +ufw status +``` + +Without any changes, it should report back `Status: inactive`. Let\'s +set it up so that only connections to SSH (standardized at port 22) are +allowed in, and then enable the firewall: + +**Careful!** Enabling `ufw` without allowing SSH will block you from +remoting to your server. Double-check that you have allowed SSH, and if +you have changed the default SSH port, put in *that* number instead. + +```sh +ufw default deny incoming # block all incoming connections by default +ufw allow in ssh # or: ufw allow in 22 +ufw enable +``` + +`ufw` has an internal list of protocols applications, and the ports used +by them. In this case, it knows SSH is on port 22. We\'ll go more in +detail how to view all protocols `ufw` knows about. By default, when you +allow an incoming port, it allows that port both on IPv4 and IPv6. + +With the firewall enabled and allowing only SSH in, all other ports are +protected from incoming requests. To view all your rules, run: + +```sh +ufw status verbose +``` + +A firewall that allows to connect to SSH and their website may look +like: + +```txt +Status: active +Logging: on (low) +Default: deny (incoming), allow (outgoing), deny (routed) +New profiles: skip + +To Action From +-- ------ ---- +22 (SSH) ALLOW IN Anywhere +80,443/tcp (WWW Full) ALLOW IN Anywhere +22 (SSH (v6)) ALLOW IN Anywhere (v6) +80,443/tcp (WWW Full (v6)) ALLOW IN Anywhere (v6) +``` + +If you want to delete e.g. the \'WWW Full\' rule, run: + +```sh +ufw delete allow in 'WWW Full' +ufw reload +``` + +## Enabling Common Services + +You have blocked all incoming ports but SSH, which means no outsiders +would be able to access other services, like an email server or your +website. You should look at the ports your services are open on and +enable them individually. Here is a list of a few common services: + +### Opening Port Numbers + +Suppose you install [a Gemini server](/gemini), which must broadcast +on port 1965. By default `ufw` blocks all incoming connections on all +ports, so whenever you install a new service like this you will have to +tell `ufw` to enable the desired port: + +```sh +ufw allow 1985 +``` + +### Websites: HTTP and HTTPS + +HTTP uses port 80 and HTTPS uses port 443. We can enable them like this: + +```sh +ufw allow 80 +ufw allow 443 +``` + +But `ufw` additionally knows the typical ports of common serives, so you +can also run this: + +```sh +ufw allow http +ufw allow https +``` + +And that will do the same thing. There are also other abbreviations for +common port lists: + +```sh +ufw allow in 'WWW Full' +``` + +To see these other \"apps\" that `ufw` knows by default, run +`ufw app list` + +### Email: IMAP, POP3, and SMTP + +```sh +ufw allow in IMAPS +ufw allow in POP3 +ufw allow in SMTP +ufw allow in 'Postfix SMTPS' +ufw allow in 'Mail Submission' +``` + +## Fine-Tuning Rules + +Instead of denying all ports by default, you may want to deny (ignores +incoming requests) or reject (explicitly tells requests they\'re not +allowed): + +```sh +ufw default allow in +ufw deny in PORT +ufw reject in PORT +ufw reload +``` + +You can add rules to comments to remember what they are there for: + +```sh +ufw allow in PORT comment 'Secret SSH' +ufw reload +ufw status verbose +``` + +Output: + +```txt +To Action From +-- ------ ---- +PORT ALLOW IN Anywhere # Secret SSH +PORT (v6) ALLOW IN Anywhere (v6) # Secret SSH +``` + +To deny outgoing ports: + +```sh +ufw deny out PORT +``` + +Ratelimiting is useful to protect against brute-force login attacks, +like in SSH. Only IPv4 is supported for now. Enable it by running: + +```sh +ufw limit PORT/tcp +``` + +To blocklist IP addresses: + +```sh +ufw deny from IP_ADDRESS +``` + +To read more what you can do with `ufw`, run: + +```sh +man ufw +``` + +## Recovering SSH {#recovering-from-losing-ssh} + +If you have accidentally firewalled yourself from logging on your +computer, you can recover access by using your VPS\'s virtual console. +On Vultr, this is on your VPS\'s menu. To the right of the server name, +It is the leftmost icon that looks like a monitor. + +{{< img src="/pix/ssh-01.png" link="/pix/ssh-01.png" alt="View Console" >}} + +Log in through there, and disable ufw by typing: + +```sh +ufw disable +``` + +## Further Reading + +- `man ufw` 👈 +- [Ubuntu Wiki: + UncomplicatedFirewall](https://wiki.ubuntu.com/UncomplicatedFirewall) +- [Gufw (Graphical UFW)](https://help.ubuntu.com/community/Gufw) + +**Contributor** - [shunter.xyz](https://shunter.xyz) diff --git a/coturn.html b/coturn.html deleted file mode 100644 index 6bbd89e..0000000 --- a/coturn.html +++ /dev/null @@ -1,93 +0,0 @@ - - - - Coturn – LandChad.net - - - - - - - -

Coturn

- -

Coturn is a libre STUN and TURN server software that allows users of chat protcols (Such as XMPP and Matrix) to perform WebRTC voice and video calls despite them being behind NATs.

- -

Almost every self-hosted voice and video conferencing program (such as Jitsi and Nextcloud's Talk app) will require Coturn or some other equivalent turnserver to function properly.

- -

Installation

- -

Coturn is available in the Debian repositories:

- -

apt install coturn

- -

Configuration

- -

Base configuration

- -

Coturn's configuration file is /etc/turnserver.conf. There are a few aspects that need to be changed in order to get a fully-functioning turnserver.

- -

Here is an example of some sane defaults:

- -

server-name=turn.example.org
-realm=turn.example.org
-listening-ip=your_public_ip
-
-listening-port=3478
-min-port=10000
-max-port=20000
-
-## The "verbose" option is useful for debugging issues
-verbose

- -

Authentication

- -

There are two options for authentication on a turnserver:

Usernames and passwords,
or authentication secrets.

- -

Depending on what self-hosted service is being used in conjunction with Coturn, you may need one or the other of these two options.

- -

Usernames and Passwords

- -

To utilize username and password authentication with Coturn, add the following configuration in turnserver.conf:

- -

lt-cred-mech
-user=username:password

- -

Authentication Secrets

- -

To utilize authentication secrets with Coturn, add the following configuration in turnserver.conf:

- -

use-auth-secret
-static-auth-secret=your_auth_secret

- -

TURNS (TLS Encryption)

- -

Some self-hosted services (such as Matrix and XMPP) may support the use of TURNS: An encrypted version of TURN, which allows for WebRTC connections to be established with the use of an encrypted TLS tunnel, just like HTTPS allows for encrypted viewing of websites.

- -

To utilize TURNS, certificates need to be declared for turn.example.org in turnserver.conf: -

cert=/etc/letsencrypt/live/turn.example.org/fullchain.pem
-pkey=/etc/letsencrypt/live/turn.example.org/privkey.pem

- -

Starting Coturn

- -

After all configuration changes are complete, Coturn can be started with its systemd daemon:

- -

systemctl restart coturn

- -

Congratulations! You've successfully setup a Coturn server!

- -

Written by Denshi. Donate Monero here [QR]

- -

- - - diff --git a/cron.html b/cron.html deleted file mode 100644 index d3c2c1d..0000000 --- a/cron.html +++ /dev/null @@ -1,174 +0,0 @@ - - - - Cronjobs – LandChad.net - - - - - - - -

Using Cronjobs to run scheduled tasks

- -

- Cron is a service that lets you run scheduled tasks. These tasks are called cronjobs. If you have already followed the initial course you will have already used cron when you set up certbot. -

What tasks would I want to schedule?

- You can schedule anything! Some examples of what you might have done already include: -

updatedb to update your locate database
certbot to update renewing of your https certs

- Some tasks that you might want to schedule may include: -

Package updates - if you really just want to leave your server alone you can automated updating packages on your server
Backups - you may want to backup certain files every day and some every week, this is possible with cron

- And many more, anything you can do can be turned into a cronjob. -

- -

Basic Cronjobs

- -

- This the preferred method for personal tasks and scripts; it's also the easiest to get started with. Run the command crontab -e to access your user's crontab -

- -

- Once you have figured out the command you want to run you need to figure out how often you want to run it and when. I am going to schedule my system updates once a week on at 3:30 AM on Mondays. -

- We now have to convert this time (Every Monday at 3:30 AM) into a cron time. Cron uses a simple but effective way of scheduling when to run things. -

- Crontab expressions look like this * * * * * command-to-run - The five elements before the command tell when the command is supposed to be run automatically. -

- So for our Monday at 3:30 AM job we would do the following: -

 .---------------- minute (0 - 59)
- | .------------- hour (0 - 23)
- | | .---------- day of month (1 - 31)
- | | | .------- month (1 - 12)
- | | | | .---- day of week (0 - 6)
- | | | | |
- * * * * *
-30 3 * * 1 apt -y update && apt -y upgrade

- -

Some notes

On the day of the week option, Sunday is 0 and counting up from there, Saturday will be 6.
* designates "everything". Our command above has a * in the day of month and month columns. This means it will run regardless of the day of the month or month.
The hour option uses 24 hour time. 3 = 3AM, while use 15 for 3PM.

- -

More examples

- Let's add another job, our backup job (for the purposes of this our backup command is just called backup). - We want to run backup every evening at 11PM. - Once we work out the timings for this we can add the to the same file as the above by running crontab -e This would mean our full crontab would look like this: -

0 23 * * * backup

- -

Consecutive times

- -

- Suppose we want a command to run every weekday. - We know we can put 1 (Monday), but we can also use 1-5 - to signify from day 1 (Monday) to day 5 (Friday). -

- -

0 6 * * 1-5 echo "Wakey, wakey, wagie!" >> /home/wagie/alarm

- -

The above echo command runs every Monday through Friday at 6:00AM.

- -

Non-consecutive times

- -

- We can also randomly specify non-consecutive arguments with a comma. - Suppose you have a script you want to run at the midday of the 1st, 15th, and 20th day of every month. - You can specify that by putting 1,15,20 for the day of the month argument: -

- -

0 12 1,15,20 * * /usr/bin/pay_bills_script

- -

"Every X minutes/days/months"

- -

We can also easily run a command every several minutes or months, without specifying the specific times:

- -

*/15 * * * * updatedb

- -

This cronjob will run the updatedb command every 15 minutes.

- -

Beware of this Rookie Mistake Though...

- -

- Suppose you want to run a script once every other month. - You might be tempted write this: -

- -

* * * */2 *

- -

- That might feel right, but this script will be running once every minute during that every other month. - You should specify the first two arguments, because with * it will be running every minute and hour! -

- -

0 0 1 */2 *

- -

This makes the command run only at 0:00 (12:00AM) on the first day of every two months, which is what we really want.

- -

- Consult the website crontab.guru for an intuitive and interactive tester of cronjobs. -

- -

User vs. Root Cronjobs

- -

- It is important to note that user accounts all have different cronjobs. - If you have a user account chad and edit his crontab with crontab -e, - the commands you add will be run as the chad user, not root or anyone else. -

- -

- Bear in mind that if you need root access to run a particular command, - you will usually want to add it as root. -

- -

System-wide cron directories

- -

- crontab -e is the typical interface for adding cronjobs, but it's important to at least know that system-wide jobs are often stored in the file directory. - Some programs which need cronjobs will automatically install them in the following way. -

- -

- Run the command ls /etc/cron* you should see a list of directories and there contents. The directories should be something like the below: -

/etc/cron.d This is a crontab like the ones that you create with crontab -e
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly

- -

- The directories cron.{hourly,daily,weekly,monthly} are where you can put scripts to run at those times. You don't put normal cron entries here. I prefer to use these directories for system wide jobs that don't relate to an individual user. -

- -

Contribution

- -

Mark McNally -- website, Youtube
Edits and examples by Luke

- - - -

- - - diff --git a/crypto.html b/crypto.html deleted file mode 100644 index 9302e56..0000000 --- a/crypto.html +++ /dev/null @@ -1,86 +0,0 @@ - - - - The Case for Crypto for Normal People – LandChad.net - - - - - - - -

The Case for Crypto for Normal People

- -

- A lot of people get nervous about cryptocurrency because it seems like a confusing world that requires risks. - I however, recommend that if you have your own website, you should absolutely allow people to send you tips/donations in the most important two currencies: - Bitcoin (the classic digital gold) - and Monero (the private and cheaper to use version of Bitcoin). -

- -

- To accept donations costs you absolutely nothing. - It costs you nothing to hold these donations for years before you bother to figure out how it works. - You don't have to do anything now but create a wallet and put a public address up. -

- -

Cryptocurrency is the only open source and peer-to-peer currency

- -

- The whole point of being an Internet Landchad is that you do not have to rely on centralized platforms running privacy-violating proprietary software which can be used to censor you and others. -

- -

- Cryptocurrency is the first ever technology that secures digital scarcity and allows people to transact with one another digitally without any intermediary. -

- -

- Cryptocurrency might be a wild west, but it is the monetary equivalent of free and open source software. -

- -

- I will not give investment advice about it, but I will say this, independent of the possibility of a bitcoin being worth more than $1 million later this decade, it is a generally good idea for you to have a way to exchange value without some proprietary intermediary system. -

- -

- It's a good idea for any person to put some spare money in Bitcoin and Monero and encourage their friends to do so for the mere fact that it can be used to exchange and store value you might owe someone. - It's easier than cash and Monero at least is cheap and easy to transact with. -

- -

Why Bitcoin and Monero?

- -

- Bitcoin obviously is the original cryptocurrency. - It is clunky, old, sometimes expensive to transact with for small amounts, but it is consistent and is coming to function as "digital gold": - a way of storing value over years. - As the Bitcoin network comes to be used by more and more people, companies, countries and others to store value, it also increases the price, which obviously has made many people very rich. - Bitcoin will surge and crash in cycles, but the long-term trend is unambiguously up as more people store value on the network. -

- -

- Monero is a more recent cryptocurrency that better preserves privacy and fixes nearly all of Bitcoin's other flaws. - All Bitcoin transactions (and those of nearly all cryptocurrencies) are publicly visible on the blockchain. - That means that people can watch where wallets get and spend money, which can be a massive problem. - Monero, however, uses clever cryptography to avoid this. - This makes it the choice "dark web" currency, but because it has many other benefits (low transaction fees (unlike Bitcoin), ASIC resistance) it is now a staple of the internet. -

- -

- There are many other coins and tokens used for technology projects, but Bitcoin and Monero are by far the most important. -

- -

- Due to the difference in transaction fees (it is expensive to transact with Bitcoin), you are probably more likely to get more little tips via Monero. - Big donations might come in Bitcoin though. -

- -

- - diff --git a/dns.html b/dns.html deleted file mode 100644 index 9dc09c4..0000000 --- a/dns.html +++ /dev/null @@ -1,129 +0,0 @@ - - - - Connect Your Domain and Server with DNS Records – LandChad.net - - - - - - - -

Connect Your Domain and Server with DNS Records

- -

The Gist

Now that we have a domain and a server, we can connect the two using DNS records. - DNS (domain name system) records are usually put into your registrar and direct people looking up your website to the server where your website and other things will be. -

- -

- Get your IPv4/IPv6 addresses from Vultr and put them into A/AAAA records on Epik. - Simple process, takes a minute, but here's a guide with a million images just so you know. -

- -

Open up your Registrar

- -

- As before, we will be using Epik as a registrar and Vultr as a server host. - Go ahead and log into your accounts on both. - Open up Epik, or your registrar, and click on your domain and then a choice for "DNS records." - This is the screen you'll want to see on Epik. -

- -

- -

- Note that we are on the "External Hosts (A, AAAA)" tab by default. - Epik sometimes adds records to this page once you buy a domain. - If they did, you can go ahead and delete them so they look clean like the picture above. -

- -

- All we have to do now is get our IP addresses from Vultr and add new DNS records that will send connections to our server. -

- -

- Keep the Epik tab open and open Vultr and we will copy-and-paste our IP addresses in. -

- -

Find your server's IP addresses

- -

- Looking at your server in the Vultr menu, you should see a number next to it. - Mine here is 104.238.126.105 as you can see below the server name (which I have named landchad.net after the domain I will soon attach to it). - That is my IPv4 address. -

- - -

- Copy your IPv4 address and - on Epik, click the "Add Record" record button and add two A entries pasting in your IPv4 address like I've done for mine here. -

- -

- -

- I add two entries. - One has nothing written in the "Host" section. This will direct connections to landchad.net over IPv4 to our IP address. - The second has a * in the "Host" section. - This will direct connections to all possible subdomains to the right place too, - I mean mail.landchad.net or blog.landchad.net and any other subdomain we might want to add later. -

- - -

- Now let's get our IPv6 address, which is a little more hidden for some reason. - IPv6 is important because we are running out of IPv4 addresses, so it is highly important to allow connections via IPv6 as it will be standard in the future. - Anyway, now back on Vultr, click on the server name. -

- -

On the server settings, click on settings - and we will see we are on a submenu labeled "IPv4" where we see our IPv4 address again. -

- -

- -

- Now just click on the IPv6 submenu to reveal your IPv6 address. -

- -

- -

- That ugly looking sequence of numbers and letters with colons in between (2001:19f0:5:ccc:5400:03ff:fe58:324a) is my IPv6 address. - Yours will look something like it. - Now let's put it into Epik. - This time, be sure to select to put in AAAA records as below: -

- -

- -

- Now just click "Save Changes." - It might take a minute for the DNS settings to propagate across the internet. -

- -

Test it out!

- -

- Now we should have our domain name directing to our new server. - We can check by pinging our domain name, check this out: -

- -

- -

- As you can see, our ping to landchad.net is now being directed to 104.238.128.105. - That means we have successfully set up our DNS records! - You can also run the command host if you have it, which will list both IPv4 and IPv6 addresses for a domain name. -

- - Previous: Get a server. - Next: Setting up the Webserver -

- - - diff --git a/domain.html b/domain.html deleted file mode 100644 index a246c2e..0000000 --- a/domain.html +++ /dev/null @@ -1,146 +0,0 @@ - - - - Get a Domain Name – LandChad.net - - - - - - - -

Get a Domain Name

- -

Terms

- -

Domain name: The name of a website that you type in an address bar. This site's domain name is LandChad.net.
Top-level domain (TLD): The extension of a domain name, like .com, .net, .xyz, etc.
Registrar: A service authorized to reserve a domain name for you.

- -

- When domain names first sell, they usually sell for very cheap, but once someone buys one, they have the rights to it until they decide to sell it, often for much, much more money. - Therefore, it's a good idea to reserve a domain name ASAP, even if you didn't intend on doing anything big with it. -

- -

- So let's register your domain name! -

- -

How

- -

Domains can be registered at any accredited registrar. - In this guide, I will use the registrar Epik because it is one of the more high quality and easy to use. - The guides on this site will use Epik, but if you choose to register your domain with one of the many, many other registrars, - you can still do most of what Epik does, albeit options and settings might appear in different menus. -

- -

Basic info about domain names

- -

Domain names usually require a very small year fee to keep registered, usually around $12 for most generic TLDs. - There are some "specialty" TLDs that are more expensive, but .com, .xyz and other basic TLDs are that cheap.
Once you own a domain, it is yours as long as you pay the yearly fee, but you can also sell it to someone for however much you want.
Domain names do not hold your data or your website, instead, you add "DNS settings" that direct people connecting to your domain to your IP address. - The purpose of a domain name is so that people don't have to remember your IP address to find your website!

- -

Looking for domain names

- -

- Let's go to Epik's site and you can search for domain names. -

- -

- You can look for whatever domain name you want. - Domains that are already bought and owned by someone else might have the option to "Backorder," but it's always best to get one that is unowned, like these: -

- -

- -

- Note the differences in prices. - Some "specialty" TLDs like .game and .io charge a much larger fee, although you might want one. - Some domains above, like .xyz and .org have reduced prices for the first year. -

- -

- Choose the domain you want and buy it. - These .xyz domains are a steal now on sale. -

- -

- -

- That's all you have to do to own a domain name! - As you register a domain, you can also setup an automatic payment to pay your fee yearly to keep your domain. - Easy as pie. -

- -

Now we will get a server to host your website on.

- - Next: Get a Server. - -

- -

More info on domains

- -

Privacy

- -

- One worry people have when reserving a domain is that a domain registrar requires that you submit a home address! - In fact, it used to be even worse: You could easily look up the information of the owner of a website by looking them up in the public WHOIS database! -

- -

- Firstly, you can easily register a domain under some other address you don't actually have access to. - The internet police does not go looking to see who lives where. -

- -

- But more importantly, every good registrar like Epik now includes some kind of WHOIS guard, which is a service that logs a dummy address including a dummy email in the WHOIS database instead of your proper information. - By the way, if the registrar you're looking at requires an extra fee for this service, switch to another. All good registrars should do this for free nowadays. -

- -

Registrars to avoid

- -

- If you are picking a random registrar to use, it's best to avoid any registrar based in America or Europe. - They are more likely to (1) be under the tacit control or cooperation with the "Five Eyes" and other Western privacy-violating regimes - or (2) be staffed by political partisans who have now made a habit out of seizing domains they want to shut up. -

- (2) is a new, but much bigger problem, and even if you don't plan on posting any political content, there is really no predicting what their standards are going to be in the future. - I recommend Epik because it is one of the only English-speaking registrars that does what registrars used to do: register domains without political curation, which is unfortunately now becoming more uncommon. - If you don't want to use Epik, use a registrar based in Russia or China or a country more sympathetic to political criticism. -

- -

Here are some registrars to explicitly avoid:

- - -

GoDaddy – People always want to go here because it's so well advertized. - They have a long record of censorship and nickeling-and-diming accounts. Just avoid them. - They can be lazy because a lot of people use them because they are often the "default" registrar. -
NearlyFreeSpeech – People have signed up for this minor registrar because of its name that's actually tongue-and-cheek. I will let this post of theirs speak for itself. - Register a domain here only if you want to have it seized.
Google, Amazon – Maybe this is obvious, but if you are trying to escape the control of Google or Amazon, it is a very self-defeating thing to register your domain with them. Sites like Parler figured this out the hard way.

- -

- If you use one of these registrars, be sure to remove your domains from it ASAP. - That is usually a very easy thing to do, although you can only move a domain to a new registrar once every several months. - Pick a good one and stay put. - Registrars without principled policies maintain the right to seize your domain name on their whim. - Don't think for a minute that this doesn't apply to you. -

- Next: Get a Server. - -

- - - diff --git a/donate-bitcoin.html b/donate-bitcoin.html deleted file mode 100644 index a5bc901..0000000 --- a/donate-bitcoin.html +++ /dev/null @@ -1,23 +0,0 @@ - - - - Donate Bitcoin – LandChad.net - - - - - - - -

Donate Bitcoin

- -

Donate Bitcoin to LandChad.net at the address below:

bc1q78m8m73pxdxl6fsup3ywexhjuq3rtclhmxdr5h

You may also simply type in landchad.net in most wallets and it will resolve to this address as well.

Here is a QR code for the address:

- - - diff --git a/donate-monero.html b/donate-monero.html deleted file mode 100644 index 6e0ae35..0000000 --- a/donate-monero.html +++ /dev/null @@ -1,23 +0,0 @@ - - - - Donate Monero – LandChad.net - - - - - - - -

Donate Monero

- -

Donate Monero to LandChad.net at the address below:

84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh

You may also simply type in landchad.net in most wallets and it will resolve to this address as well.

Here is a QR code for the address:

- - - diff --git a/ejabberd.html b/ejabberd.html deleted file mode 100644 index 910db7b..0000000 --- a/ejabberd.html +++ /dev/null @@ -1,188 +0,0 @@ - - - - ejabberd (an XMPP Server) – LandChad.net - - - - - - - -

ejabberd (an XMPP Server)

- -

- Ejabberd is a server for the XMPP protocol written in Erlang. - It's easier to configure and setup than Prosody due to having most of its modules built-in and pre-configured by default. -

- -

Prerequisites

Subdomains

- Ejabberd presumes that you have already created all the required and optional subdomains for its operation prior to running it. -

- -

Depending on the usecase, you may need any or all of the following domains for XMPP functionality:

example.org - Your XMPP hostname
conference.example.org - For Multi User Chats (MUCs)
upload.example.org - For file upload support
proxy.example.org - For SOCKS5 proxy support
pubsub.example.org - For publish-subscribe support

- -

This guide will assume all these subdomains have been created.

- -

Installation

Ejabberd is available in the Debian repositories:

apt install ejabberd

- -

Configuration

The ejabberd server is configured in /etc/ejabberd/ejabberd.yml. Changes are only applied by restarting the ejabberd daemon in systemd:

systemctl restart ejabberd

- -

Hostnames

The XMPP hostname is specified in the hosts section of ejabberd.yml:

- -

hosts:
-  - example.org

- -

Certificates

Unlike Prosody, ejabberd doesn't come equipped with a script that can automatically copy over the relevant certificates to a directory where the ejabberd user can read them.

- -

One way of organizing certificates for ejabberd is to have them stored in /etc/ejabberd/certs, with each domain having a separate directory for both the fullchain cert and private key.

- -

Using certbot, this process can be easily automated with this one-liner:

$DOMAIN=subdomain.example.org
-certbot --nginx -d $DOMAIN certonly; mkdir /etc/ejabberd/certs/$DOMAIN; cp /etc/letsencrypt/live/$DOMAIN/fullchain.pem /etc/ejabberd/certs/$DOMAIN; cp /etc/letsencrypt/live/$DOMAIN/privkey.pem /etc/ejabberd/certs/$DOMAIN

- -

This should be ran with your XMPP hostname (example.org) and repeated for all your desired subdomains.

- -

To enable the use of all these certificates in ejabberd, the following configuration is necessary:

- -

certfiles:
-  - "/etc/ejabberd/certs/*/*.pem"

- -

Admin User

- -

The admin user can be specified in ejabberd.yml under the acl section:

- -

acl:
-  admin:
-    user: admin

- -

This would make admin@example.org the user with administrator privileges.

- -

Message Archives

- -

The ejabberd server supports keeping archives of messages through its mod_mam module. This can be enabled by uncommenting the following lines:

- -

mod_mam:
-  assume_mam_usage: true
-  default: always

- -

Database

Why use a database?

In the mod_mam section of the ejabberd config file, the following message is in comments:

- -

mod_mam:
-  ## Mnesia is limited to 2GB, better to use an SQL backend
-  ## For small servers SQLite is a good fit and is very easy
-  ## to configure. Uncomment this when you have SQL configured:
-  ## db_type: sql

- -

As these comments imply, an SQL backend is strongly recommended if you wish to use your ejabberd server for anything more than just testing. Ejabberd supports MySQL, SQLite and PostgreSQL.

- -

While all of those are suitable choices, the best database system to use is PostgreSQL. It's the same database backend used by PeerTube and Matrix, making it the most convenient option if you're already running those too.

- -

Installing PostgreSQL

- -

PostgreSQL is available in the Debian repositories:

apt install postgresql

- -

Start the PostgreSQL daemon to begin using it:

systemctl start postgresql

- -

Creating the Database

To create the database, first create a PostgreSQL user for ejabberd:

- -

su -c "createuser --pwprompt ejabberd" postgres

- -

Then, create the database and make ejabberd its owner:

- -

su -c "psql -c 'CREATE DATABASE ejabberd OWNER ejabberd;'" postgres

- -

Importing Database Scheme

- -

Ejabberd doesn't create the database scheme by default; It has to be imported into the database before use.

- -

su -c "curl -s https://raw.githubusercontent.com/processone/ejabberd/master/sql/pg.sql | psql ejabberd" postgres

- -

Configuring ejabberd to use PostgreSQL

Finally, add the following configuration to ejabberd.yml:

- -

sql_type: pgsql
-sql_server: "localhost"
-sql_database: "ejabberd"
-sql_username: "ejabberd"
-sql_password: "psql_password"

- -

Once you've ensured your database name, username and password are all correct, enable SQL storage for mod_mam:

- -

mod_mam:
-  ## (Other parameters)
-  db_type: sql

- -

Using ejabberd

Registering the Admin User

To begin using ejabberd, firstly start the ejabberd daemon:

- -

systemctl restart ejabberd

- -

Then, using ejabberdctl as the ejabberd user, register the admin user which is set in ejabberd.yml:

- -

su -c "ejabberdctl register admin example.org password" ejabberd

- -

This will create the user admin@example.org.

- -

Using the Web Interface

- -

By default, ejabberd has a web interface accessible from http://example.org:5280/admin. When accessing this interface, you will be prompted for the admin credentials:

- -

After signing in with the admin credentials, you will be able to manage your ejabberd server from this web interface:

- -

TURN & STUN for Calls

- -

Ejabberd supports the TURN and STUN protocols to allow internet users behind NATs to perform voice and video calls with other XMPP users.

- -

Firstly, setup a TURN and STUN server with Coturn, using an authentication secret.

- -

Then, edit mod_stun_disco to contain the appropriate information for your turnserver:

- -

  mod_stun_disco:
-    secret: "your_auth_secret"
-    services:
-      -
-	host: turn.example.org
-        type: stun
-      -
-	host: turn.example.org
-	type: turn

- -

And with that, you've successfully setup your ejabberd XMPP server!

- -

Written by Denshi. Donate Monero here [QR]

- -

- - - diff --git a/favicon.ico b/favicon.ico deleted file mode 100644 index d8f549d..0000000 Binary files a/favicon.ico and /dev/null differ diff --git a/federation.html b/federation.html deleted file mode 100644 index 0d4ec94..0000000 --- a/federation.html +++ /dev/null @@ -1,71 +0,0 @@ - - - - Federation – LandChad.net - - - - - - - -

Federation

- -

- The internet was supposed to be a place where everyone was an internet LandChad. - Everyone had their own website and email and own services. - Obviously, this site is all about getting back to that ideal. -

- -

- That's why it's important to understand the concept of Federation in technology. - It's the idea that instead of one central "node" or site that everyone uses, like Facebook, Twitter, Insta, R*ddit, - people can run their own sites that can nonetheless interact with othersites as easily as if they were the same. -

- -

- You already know one federated technology: email. - There is no one site for email, but many sites, and all people on all those sites can use email to talk to one another. - You can get censored on Facebook. - You can't get censored on "email." - You could have a Gmail account deleted, but you are not blocked out of the system, as you can go to any number of sites and get a new account or make your own server and you can still talk to all your friends via email. -

- -

"Federated" Social Media

- -

- The idea of Federated Social Media is using that principle used in email, but for other things, like chatting or social media. -

- -

- Here's an example. - There is some software you can install on your server called Pleroma. - It can be installed on your site just like a web or email server, but what it does is creates a Twitter-like microblogging site. - You can then have your friends join and use it just like you use Twitter, with you as the admin and deciding policy and you can even format and decorate the site how you want. -

- -

It gets even better...

- -

- But here is the clincher. - Federated social media like Pleroma can interact with other Pleroma servers on the internet in the same way that Gmail's servers can send messages to any other email server. - So you might have 2 people on your Pleroma site, but you can interact with the many thousands of other Pleroma sites. -

- -

- There is seamless interaction. - You can view, like, share and respond to their posts as if they were part of your own site. -

- - -

And it gets even betterer...

- -

- Pleroma is based on a protocol called Activity Pub. - This is also used by other software like PeerTube (which is a self-hosted YouTube-equivalent), Friendica (Facebook equivalent) -

- - - diff --git a/gemini.html b/gemini.html deleted file mode 100644 index 923a454..0000000 --- a/gemini.html +++ /dev/null @@ -1,103 +0,0 @@ - - - - How to set up your own gemini server - - - - - - - -

Creating and serving gemini capsules

- -

What is Gemini?

Gemini is a new internet protocol which is different from the HTTP and Gopher. It's much cleaner and has a growing community and audience of hackers.

Why use gemini protocol?

Gemini capsules (webpages of gemini) are lightweight, minimal, and don't use many resources to operate.
It can run along with your websites. Gemini capsules use port 1965 by default. Your webserver can run at port 80 or 443 along with gemini server at port 1965.
By exploring an alternative protocol, you can check different ways to serve data and blogs.

To access any gemini urls i.e. gemini://example.org, you can use any gemini client such as amfora, lagrange, elpher, etc. -

Instructions

Create a gemini user

- It is most secure and clean to have a separate gemini user, so let's create one: -

useradd -m -s /bin/bash gemini

Now log in as gemini with the following command:

su -l gemini

To create and serve a gemini capsule, we need three basic steps:

Content – the webpages in our capsule
TLS certificate – Gemini requires encrypted connection.
Gemini server – the program that makes our capsule available (similar to Nginx for HTTP)

As the gemini user, we can create three different directories to simplify the process:

mkdir -p ~/gemini/{content,certificate,server}

Content

This will be the directory where your capsule files will be contained. Gemini uses text/gemini markup (in place of HTTP's equivalent HTML). It heavily borrows from Markdown. Similar to .html or .md, gemini uses .gmi as its extension.

To create one gemini file, go inside the content directory and create one index.gmi file.

nano gemini/content/index.gmi

We can add the content we want in our Gemini capsule here:

# This is Sample Gemini page
-## With header 1 and header 2
-And a short paragraph like this.
-=> /index.gmi Link to the same page

TLS certificate

Go to the certificate directory which we created earlier and generate a TLS certificate using OpenSSL.

cd ~/gemini/certificate/
-openssl req -new -subj "/CN=example.org" -x509 -newkey ec -pkeyopt ec_paramgen_curve:prime256v1 -days 3650 -nodes -out cert.pem -keyout key.pem

Gemini server

Download and prepare the server

There are many gemini server software choices available. - We will use agate server for now. This is a simple gemini server written in Rust.

It's a good idea to always get the most recent version, which you can see on the agate releases page. At the time of this writing, that is agate v3.1.0 which we will now download. We will download it to the server directory we made.

cd ~/gemini/server
-wget https://github.com/mbrubeck/agate/releases/download/v3.1.0/agate.x86_64-unknown-linux-gnu.gz

Unzip the gz, then rename and make it executable:

gunzip agate.x86_64-unknown-linux-gnu.gz
-mv agate.x86_64-unknown-linux-gnu agate-server
-chmod +x agate-server

Create a system service

Now we need to create a systemd service to autostart and manage agate. - The gemini user does not have permission to do this, so press ctrl-d to log out of the gemini user and return to root. - As root, create the file below by opening it in your text editor (nano, vim, etc.):

nano /etc/systemd/system/agate.service

Add the following content to the file customizing highlighted text to your use.

[Unit]
-Description=agate
-After=network.target
-
-[Service]
-User=gemini
-Type=simple
-ExecStart=/home/gemini/gemini/server/agate-server --content /home/gemini/gemini/content --certs /home/gemini/gemini/certificate/ --hostname example.org --lang en-US
-
-[Install]
-WantedBy=default.target

Now we are ready to run server. Enable and run agate server.

systemctl enable agate
-systemctl start agate

Firewall

Lastly, if you have a firewall running, remember to open port 1965, which is the port number used by gemini:

ufw allow 1965

Finalization

Now your server should be running. If everything went okay, you can access your gemini capsule via any gemini client with a url like this:

gemini://example.org

Sample gemini site for reference:

gemini://gemini.circumlunar.space

Enjoy your first gemini capsule.

- For information about how to write in "gemtext" the markup language in Gemini, see this site: https://gemini.circumlunar.space/docs/gemtext.gmi. - As you might guess, it also has an analogous gemini capsule here: gemini://gemini.circumlunar.space/docs/gemtext.gmi -

Written by nihar.page

- -

- - - diff --git a/git.html b/git.html deleted file mode 100644 index c304eb9..0000000 --- a/git.html +++ /dev/null @@ -1,190 +0,0 @@ - - - - Hosting Your Own Git Repositories – LandChad.net - - - - - - - -

Hosting Your Own Git Repositories

- -

- Once you have your own VPS or other Internet-available server, you can - start hosting your own git repositories. The goal of this tutorial is - for you to go from

- -

git clone github.com/...

- -

git clone YourLandChadDomainName.xyz/...

- -

- so you can cultivate your own homegrown, grass-fed code, rather than - relying on a centralized proprietary service like GitHub. -

- -

Installing git

- -

- You most likely already have it installed on your server, but if not, - run:

- -

apt install git

- -

- We don't need any additional software, git itself ships - with everything needed to host a remote repository! -

- -

Creating bare repositories

- -

- For each repository you want to host, you will need to manually create - what's called a "bare" repository on your server. These hold all the - commits and any other git data needed for your repository, but without - an expanded "index" in which you can just browse all the files of a - certain commit in the file system. -

- -

- These repositories need to be owned by the git user, and - you should probably pick a directory where you will store them all. One - sane choice is under /srv/git/, and we will use this as the - example directory for the rest of the tutorial, but any other path will - do as well. -

- -

Become the git user and create the directory

- -

- If you're logged in to your server as root and have git - installed, you can become the git user by executing -

- -

su git

- -

- Now navigate to/create your desired directory, for example -

- -

cd /srv
-mkdir git

- -

Create the repo

- -

- Now you can create the bare repository with -

- - -

git init --bare my-repo.git

- -

- By convention, bare repository names end with ".git". -

- -

- Repeat the above command for any other repositories you want to host. -

- -

Syncing local repositories with your server

- -

Set up SSH login for the git user

- -

- You will need to be able to login remotely via ssh as the - git user we've used before. To do this, you will either - need to set up a password for the git user by running - passwd git, - or copy your public SSH key from your local machine to - /home/git/.ssh/authorized_keys. - See the SSH keys instructional for details - (just log in as git instead of root). -

- -

Syncing a new repository with your server

- If you've just created a new repository on your local machine, you will - need to tell git where the remote repository is to be able - to sync with it (using commands like git push or - git pull). We do this by defining a "remote" for your - repository. -

- -

- A remote is just a named URL remembered in your repo's configuration. So - we need a name and a URL. By convention, the "main" remote is called - "origin". The URL has the format user@host:path, where: -

- -

- user is git, the git user - we've already worked with before. -
- host is your domain name. - Alternatively you could even use your server's raw IP address. -
- path is the absolute path to the repository on the - server, in our example /srv/git/my-repo.git -

- -

- So, to create a new remote, run: -

- -

git remote add origin git@yourdomain.xyz:/srv/git/my-repo.git

- -

- Now you'll be able to run git push origin master to push - your commits or git pull origin to pull from the remote. -

- -

Syncing an existing repository

- -

- If you've already set up your local repository to sync with a service - like GitHub it probably already has a remote called "origin". You can - see your repo's remotes with: -

- -

git remote -v

- -

- You can follow the above instructions, substituting an arbitrary other - name other than "origin" to create a differently named remote, e.g. -

- -

git remote add vps git@...

- -

- Now you'll be able to push/pull with git push vps master - and git pull vps, respectively. -

- -

- Or, to completely sever ties with your centralized git provider, first - remove the original origin with: - git remote remove origin - and then follow the instructions as above. -

- -

Contribution

Martin Chrzanowski -- website, donate

- - - diff --git a/gitea.html b/gitea.html deleted file mode 100644 index 647d603..0000000 --- a/gitea.html +++ /dev/null @@ -1,109 +0,0 @@ - - - - Setting up Gitea – LandChad.net - - - - - - - -

Setting up Gitea

- -

Gitea allows you to self-host your git repositories similar to bare repositories, but comes with additional features that you might know from GitHub, such as issues, pull requests or multiple users. Its advantage over GitLab—another Free Software GitHub clone—is that it is much more lightweight and easier to setup.

Head over to gitea.com to see what it looks like in practice.

Although Gitea is lighter than Gitlab, if you have a VPS with only 512MB of RAM, you will probably have to upgrade. Gitea is more memory-intensive than having just a bare git repository.

- -

Installing Gitea

First install a few dependencies:

apt install curl sqlite3

Unfortunately, Gitea itself is not in the official Debian repos, so we will add a third-party repository for it.

Add the repo's gpg key to apt's trusted keys:

- -

curl -sL -o /etc/apt/trusted.gpg.d/morph027-gitea.asc https://packaging.gitlab.io/gitea/gpg.key

- -

Then add the actual repository to apt:

- -

echo "deb [arch=amd64] https://packaging.gitlab.io/gitea gitea main" > /etc/apt/sources.list.d/morph027-gitea.list

- -

Now we can install Gitea:

- -

apt update
-apt install gitea

- -

Since apt automatically enables and starts the Gitea service, it should already be running on port 3000 on your server!

- -

Setting up a Nginx reverse proxy

You should know how to generate SSL certificates and use Nginx by now. Add this to your Nginx config to proxy requests made to your git subdomain to Gitea running on port 3000:

- -


-server {
-	listen 443 ssl;
-	listen [::]:443 ssl;
-        ssl_certificate /etc/ssl/nginx/git.example.org.crt;
-        ssl_certificate_key /etc/ssl/nginx/git.example.org.key;
-        server_name git.example.org;
-	location / {
-		proxy_pass http://localhost:3000/; # The / is important!
-		proxy_redirect off;
-		proxy_set_header Host $host;
-		proxy_set_header X-Real-IP $remote_addr;
-		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-		proxy_set_header X-Forwarded-Proto $scheme;
-	}
-}
-

And reload Nginx:

systemctl reload nginx

- -

Setting up Gitea

- -

If everything worked fine you should now see a setup screen when you go to your configured domain in the browser. The options should be pretty self-explanatory, it is only important to select SQLite3 and to replace the base url and SSH server domain with your own.

- -

Database Type:: SQLite3
SSH Server Domain:: git.example.org
Gitea Base URL:: git.example.org

- -

These and other settings can be changed in a configuration file later so don't worry about making wrong decisions right now.

- -

After clicking the install button you should now be able to log into your Gitea instance with the account you just created! Explore the settings for more things to do, such as setting up your SSH keys.

- -

If Gitea does not load fully and has random errors, it is possible that you need to increase your available memory on your VPS. This can usually be done on your VPS-provider's website without too much trouble.

- -

A few extras

Automatically create a new repo on push

This is an incredibly useful feature for me. Open up /etc/gitea/app.ini and add DEFAULT_PUSH_CREATE_PRIVATE = true to the repository section like so:

-
-

If you now add a remote to a repository like this

git remote add origin 'ssh://gitea@git.example.org/username/coolproject.git'

and push, Gitea will automatically create a private coolproject repository in your account!

- -

Change tab-width

By default Gitea displays tabs 8 spaces wide, however I prefer 4 spaces. We can change this!

mkdir -p /var/lib/gitea/custom/templates/custom/

And write this into /var/lib/gitea/custom/templates/custom/header.tmpl:

<style>
-.tab-size-8 {
-	tab-size: 4 !important;
-	-moz-tab-size: 4 !important;
-}
-</style>

- - -

Contribution

phire

- - - diff --git a/html.html b/html.html deleted file mode 100644 index 2b5beee..0000000 --- a/html.html +++ /dev/null @@ -1,200 +0,0 @@ - - - - Make a Simple Webpage – LandChad.net - - - - - - - -

Make a Simple Webpage

- -

- We now have a webpage that's actually on the real-live internet! - You've already made it! - Now the only issue is putting what you want on your website. -

- -

- In this little series, we'll overview the basics of HTML and CSS, - the two important languages that will allow you to make a stylish multi-page website. - We will start with HTML. -

- -

HTML

- -

- HTML is the hypertext markup language. - It is the "language" that all webpages are written in so that all browsers can read and display them properly. -

- A markup language is not the same as a programming language: - Programming languages specify orders for a computer, while markup languages are ways of specifying the styling of text. - Markup languages are necessary because computers run on mere text, not colors, sizes, headers and other styling things. -

- -

- Let's understand what HTML is. - In a previous article, we put this text in your website's index.html. -

- -

Paragraphs

- -

-Note how this HTML file appears as a webpage: -

- - - - - - - - -

<!DOCTYPE html>
-<h1>My website!</h1>
-<p>This is my website. Thanks for stopping by!</p>
-<p>Now my website is live!</p>

- -

-The content between the <p> and </p> tag(s) is formatted as different paragraphs. -If you don't use these <p> tags, the text will not be formatted as separate paragraphs even if you write it as -multiple lines. -Observe if we add lines to the end of this file: -

- - - - - - -

<!DOCTYPE html>
-<h1>My website!</h1>
-<p>This is my website. Thanks for stopping by!</p>
-<p>Now my website is live!</p>
-Here is some more text.
-There are no paragraph tags on this stuff.
-So it will all appear as one paragraph.
-Despite being on multiple lines.
-
-
-Even this!

- -

-This will seem strange at first, but this is the use of HTML as a markup -language: it allows you to style your document with tags and write it in whatever way is convenient. -

- -

-Let's learn more about what HTML can do. -

- - -

Headings

- -

-In addition to paragraphs (<p>), we can specify headings with inside <h1></h1> tags. -Heading tags are for your page's title and section headings in the document: -

- -

<h1></h1> – Main and largest headings
<h2></h2> – Subheadings (smaller)
<h3></h3> – Sub-subheadings (yet smaller)
<h4></h4> – Etc., etc.

- - - - - - - -

<h1>This is a top-level heading.</h1>
-
-<p>Here is some paragraph text.</p>
-
-<p>And here is some more...</p>
-
-<h2>This is a subheading (h2)</h2>
-
-<p>And another paragraph.</p>
-
-<h2>And here is another subheading (Also an h2)</h2>
-
-<p>Etc. etc...</p>

- -

A preview to CSS

- -

-It is very important to use headings like this for your pages. - -Notice that on this website, headings come in different colors, text-alignment and sizes for emphasis. -If we use these heading tags, when we clear CSS, we can easily style all <h2>, for example, -to be the size and color and alignment we want. -

- -

Text formatting

- -

-HTML can also be used to do text formatting. -We can make bold, italic, underlined or struck through text with more HTML tags: -

- - - - - - -

<p>This is <b>bold text</b>.</p>
-
-<p>This is <i>italic text</i>.</p>
-
-<p>This is <u>underlined</u>.</p>
-
-<p>This is <s>struck through</s>.</p>

- -

Semantic Tags

- -

- While <b></b> and <i></i> - do exist, it's actually better not to use them directly in text. -

- -

- Try using <strong></strong> instead of <b></b> and <em></em> instead of <i></i>. - By default, they will look exactly the same. - You complain that they require more key presses, but it's thought to be a very bad idea to modify lower-level tags with CSS directly. -

- -

- Note that some bold words on this site have different color for emphasis. - This is a setting set via CSS for all <strong> tags. - It would not be a good idea for us to use this for <b>, since there might be a non-colored situation we want to occasionally use it in. -

- - Next: Images and Links in HTML - -

- - - diff --git a/html2.html b/html2.html deleted file mode 100644 index e263676..0000000 --- a/html2.html +++ /dev/null @@ -1,27 +0,0 @@ - - - - Images and Links in HTML – LandChad.net - - - - - - - -

Images and Links in HTML

- -

Links

- We need to create links -

-<<++>> -<<++>> -<<++>> -<<++>> - Next:<++> -

- - - diff --git a/html4.html b/html4.html deleted file mode 100644 index 5653ddc..0000000 --- a/html4.html +++ /dev/null @@ -1,99 +0,0 @@ - - - - Doing HTML Right – LandChad.net - - - - - - - -

Doing HTML Right

- -

- We've noted that HTML is very forgiving -

- -

A look at a decent template

- -

- I have a template file that I use for this website that includes all the basics. - When I make a new page, I just copy the template and add the content. - Here is what the template looks like: -

<!DOCTYPE html>
-<html lang=en>
-    <head>
-        <title>Your page title</title>
-        <meta charset="utf-8"/>
-        <link rel="shortcut icon" href="favicon.ico" type="image/x-icon" />
-        <link rel='stylesheet' type='text/css' href='style.css'>
-        <meta name="viewport" content="width=device-width, initial-scale=1">
-        <link rel='alternate' type='application/rss+xml' title='Site Title RSS' href='/rss.xml'>
-    </head>
-<body>
-    <header><h1>Your page title</h1></header>
-
-    <nav></nav>
-
-    <main>
-
-    Put all your page content here in the <main> tag.
-
-    </main>
-
-    <footer></footer>
-</body>
-</html>

- -

Explanation of All These Important Things

- -

<head> contains page metadata, including: -
- <title>, the page title that appears in a browser tab.
- The charset, which tells the browser what encoding to use (this ensures unicode characters will display)
- The favicon is the little site icon that open appears in the browser tab. Just create an .ico file and put it in favicon.ico and each page will read it.
- The stylesheet is the CSS stylesheet, which is extremely important for making your site look good and we will get to in the CSS lessons.
- The RSS feed which is a file you can create to give users updates about your site. We'll talk about making an RSS later too.
-
<body>, which usually designates what content will visibly display.
<header>, which is a semantic tag that where we use to put the main page title in.
<nav>, a place to store a navigation bar later. I use a script to automatically update the bar on all pages and it looks for this tag.
<main>, designates where the main text of the document is.
<footer>, the content appearing at the bottom of the document, I also manage this like nav, with a script.
<<++>>, <++>
<<++>>, <++>

- -

The Importance

- -

- If you're new to this world, you might be wondering why you should use body and main and nav and header and all this seemingly confusing stuff! - (Especially when even bad HTML displays!) -

- -

- Not only do many devices, especially mobile ones, specifically use these tags for their features, but - when using CSS, we can also style each of these elements the way you want them to appear without changing the HTML on all your pages. -

- -

- With CSS, we can say that we might want the whole body to have a image background, but main should be floating over it semi-transparent. - We can tell nav to float off on the left or right and we can change footer and nav settings just by tweaking the CSS. -

- -

- Speaking of which, we've been talking up CSS for a while, so now it's time to learn it! -

- - Next: Styling with CSS - -

- - - diff --git a/i2p.html b/i2p.html deleted file mode 100644 index 775bea1..0000000 --- a/i2p.html +++ /dev/null @@ -1,101 +0,0 @@ - - - - Mirror your site over I2P - - - - - - - -

Mirror Your Site Over I2P

- -

- Now you have a website, why not offer it in a private alternative such as the Invisible Internet? -

- -

Setting up I2P

- There are 2 main I2P implementations, I2P and i2pd, we are using i2pd in this - guide because it's easier to use in servers. -

Installing I2P

- -

- i2pd is in most repos, in debian/ubuntu you can install it simply - with

apt install i2pd

- -

Enabling I2P

- We are going to create a user for i2pd, because i2pd finds the configuration - files in its home directory. And it's easier (and more tidy) to have it in a separate user: -

useradd -m i2p -s /bin/bash
-su -l i2p
-mkdir ~/.i2pd
-cd ~/.i2pd

- -

- Now that you're in ~/.i2pd, you have to create a file named - "tunnels.conf". Which is the config file for every hidden service you're - offering over I2P, the content should be like this: -

[example]
-type = http
-host = 127.0.0.1
-port = 8080
-keys = example.dat

- -

Getting your I2P Hostname

- -

- Then, run /usr/sbin/i2pd --daemon to start i2pd and we can retreive our I2P hostname. -

- -

- This can be done in lynx or a command-line browser by going to http://127.0.0.1:7070/?page=i2p_tunnels to get your I2P hostname. -

- You - can also run these commands to find your hostname: -

printf "%s.b32.i2p\n" $(head -c 391 /home/i2p/.i2pd/example.dat |sha256sum|xxd -r -p | base32 |sed s/=//g | tr A-Z a-z)

- -

Adding the Nginx Config

- From here, the steps are almost identical to setting up a normal website configuration file. - Follow the steps as if you were making a new website on the webserver - tutorial up until the server block of code. Instead, paste this: -

- -

server {
-listen 127.0.0.1:8080 ;
-root /var/www/example ;
-index index.html ;
-}

- - -

- From here we are almost done, all we have to do is enable the site and reload nginx which is also covered in the webserver tutorial. -

- -

Update regularly!

- -

Make sure to update I2P on a regular basis by running:

apt update && apt install i2pd

Contributor - qorg11

- -

- - - diff --git a/imgcompress.html b/imgcompress.html deleted file mode 100644 index 320392d..0000000 --- a/imgcompress.html +++ /dev/null @@ -1,74 +0,0 @@ - - - - Image compression – LandChad.net - - - - - - - - -

Image compression

- -

- Image files will usually have the most impact on the - speed of your websites (aside from Ad/tracker scripts). - Learn to slim down your images using the ubiquitous - ImageMagick to make your websites faster on - slow internet connections. -

- For the examples, I decided to use - this - public domain image. -

There are many ways to decrease image size using - ImageMagick, the simplest is to use the - -quality option, which will compress the - image without changing the resolution. This option - takes the value you want to compress by (between 1 and - 100, the lower the value, the lower the file size). For - example:

convert in.jpg -quality 50 out.jpg

- Compressing the example image above results in the - following file size changes: -

- - - - - - - - - - - - - -

Quality	Size
Original	2.1M
90	1.7M
80	844K
70	588K
60	448K
50	368K
40	308K
30	248K
20	184K
10	116K

- -

- Due to the images high resolution, it is usable in this - website even when highly compressed (30% quality, still - looks decent in my opinion). -

Contribution

Musse
Monero: 83is3y69Xv4fkFsTpZhw5c3bfxtimupfgTdpERHM1WtMNAwSqFjTCJm3VabyBKXKnL873dWPmqj4bRcgkm9oCktgQrzmhHd

- - - diff --git a/index.html b/index.html deleted file mode 100644 index abddd3a..0000000 --- a/index.html +++ /dev/null @@ -1,163 +0,0 @@ - - - - Chad's Guide to Starting Your Own Website – LandChad.net - - - - - - - - - - -

Chad's Guide to Starting Your Own Website

- -

- This is LandChad.net, a site dedicated to turning internet peasants into Internet Landlords - by showing them how to setup websites, email servers, chat servers and everything in between. -

- -

Starting a website is something that can be done in a lazy afternoon and costs pocket change.

Most of the internet's problems could be solved if more people had their own personal platforms, - so the objective of this site is to guide any normal person through the process of installing a website.

- - -

All courses

- -

Basic Personal Website Setup

- -

- This is the basic "course." Follow these quick tutorials and you'll - have a fully functioning basic web page on the domain name of your - choice. -

- -

- ⏳ This "basic course" can take as little as an hour or even less. -

- -

Excellent Extras

- -

"Build your own platform!"

- -

Host your own services, social media and more.

- -

Prosody: Minimalist and federated chat server
ejabberd: Another option for an XMPP server
Pleroma: A federated Twitter-like microblogging site
PeerTube: A federated YouTube-like video site
Nextcloud: Setting up a Nextcloud Instance (file hosting and more)
Jitsi: Free and easy video conferencing
git: Version control software on your own server
Cgit: A hyperfast web frontend for git repositories
Gitea: A fully-featured git and issue tracking site
Radicale: A small but powerful calDav and cardDav server
IRC: Installing and managing a classic internet relay chat server
RSS Bridge: Creating RSS feeds for social media sites
Matrix: An easy-to-use, free and federated chat and channel server.
Calibre: A library server
I2P: Host your site on a private and peer-to-peer internet layer.
Tor: Host your site on private onion-routing.
SearXNG: Setting up a SearXNG metasearch engine.

- -

Accepting Cryptocurrency Tips

Why crypto?: The case for crypto for normal people
Bitcoin: Accept Bitcoin (BTC) donations
Monero: Accept Monero (XMR) donations for superior privacy
OpenAlias: OpenAlias to make crypto easy

- -

In the Works...

- -

- These articles are still under construction. - Subscribe to our RSS feed for updates. -

- -

On the look out for...

- -

- There are other articles not currently under construction which we would like to add the LandChad.net. - If you have experience with any of these, you may submit an article for review on the Github. - Please include directions for Debian 11 as default. - Abstain from using containerization (Docker, etc.). - Attempt to follow the same settings as other articles here. -

- -

BTCPay (Docker install permitted only in this case.)
Email webclients
Simple static site generators
Movim for XMPP
Nitter

- - -

Support LandChad.net

- -

Help advertize this site by adding this banner with a link on your website:

- -

- -

- No ads, trackers or trash on this site. - We are funded by doing good and earning gratitude. - Express your gratitude in the following ways: -

- -

When setting up a website, use our linked affiliate links, like to Vultr or Frantech/BuyVM for a VPS.
If you enjoy a guest article, the author's donation links may be included at the bottom of the page.
Donate crypto to the long-term LandChad maintenance and expansion fund:

- -

Monero
-84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh
-

Bitcoin
-bc1q9f3tmkhnxj8gduytdktlcw8yrnx3g028nzzsc5
-

- - - - -

- - - diff --git a/irc.html b/irc.html deleted file mode 100644 index 2d156f8..0000000 --- a/irc.html +++ /dev/null @@ -1,801 +0,0 @@ - - - - Creating Your Own Chat Server With IRC – LandChad.net - - - - - - - -

Creating Your Own Chat Server With IRC

- -

- Creating your own chat server for you and your friends is easy, and you don't have to rely on a complicated system to get started. - IRC is an old but gold protocol, and has clients for basically every operating system made since the 80s, with many powerful modern ones on Linux, Mac, and Windows. -

- -

- Having a chat server for you and your friends makes it impossible for a group of arbitrarily appointed moderators to deplatform you for wrong-think, and gives you greater freedom of communication. -

- -

Installing an IRCd

- -

- An IRCd is short for "IRC daemon", which just means an IRC server. - The most easy IRCd to set up is Ergo. -

- -

- The first thing you need to do is create a new user for the server to be run by. - This is good practice for installing software/servers manually, as it give you more fine-grained control over which permissions the application has. -

- -

useradd -m ergo -s /bin/bash

- -

- Next, we want to switch to our newly created ergo user and create the server directory. -

- -

sudo -i -u ergo
-mkdir server

- -

- You can find the latest release of Ergo on its GitHub latest release page.
- There are several platforms available, but you want to choose Linux, most likely linux-x86_64.
- Once you have selected the correct package, copy its URL and replace the release url with the package URL (still as the ergo user): -

- -

wget https://github.com/ergochat/ergo/releases/download/v2.7.0/ergo-2.7.0-linux-x86_64.tar.gz
-tar -xf ergo-2.7.0-linux-x86_64.tar.gz
-mv ergo-2.7.0-linux-x86_64/*
-rm -r ergo-2.7.0-linux-x86_64*

- -

Executing ls -l should now yield something like this:

- -

-rw-r--r-- 1 ergo ergo  118825 Jun  8 00:51 CHANGELOG.md
--rw-r--r-- 1 ergo ergo    1983 May 31 01:48 README
--rw-r--r-- 1 ergo ergo   41440 Jun  8 00:42 default.yaml
-drwxr-xr-x 2 ergo ergo    4096 Jul  1 09:01 docs
--rwxr-xr-x 1 ergo ergo 9654272 Jun  8 00:53 ergo
--rw-r--r-- 1 ergo ergo    1753 May 31 01:48 ergo.motd
-drwxr-xr-x 2 ergo ergo   12288 Jul  1 09:01 languages
--rw-r--r-- 1 ergo ergo   39722 Jun  8 00:42 traditional.yaml

- -

If you see something similar to the above, that means Ergo is installed, although not quite ready to run yet.

- -

Configuring Ergo

- -

- Now that Ergo is installed, you want to configure it to fit the needs of your group.
- The configuration in this section is tailored towards a small group of people, and less for a possibly large network, - but it should work for any size of group. -

- -

- First thing, make sure you're still using the ergo user, and are in the ~/server directory.
- If you aren't, you can run the following to get back there: -

- -

sudo -i -u ergo
-cd ~/server

- -

To start configuring, we need to copy some files:

- -

cp default.yaml ircd.yaml
-cp ergo.motd ircd.motd

- -

- Next, generate certificate files for TLS: -

- -

./ergo mkcerts

- -

- Ergo comes with a default configuration file with detailed documentation that can be used to guide you through the configuration process. - This guide will help you setup the server for a typical use-case, but if you see any settings that you would like to change along the way, - go ahead and change them, as long as you know what you're doing. -

- -

- The next steps involve editing the newly copied ircd.yaml file. If you do not know how to edit text files from the command line, - you can use nano, which is very simple, using arrow keys to navigate, CTRL+O to save, and CTRL+X to exit.
- Another option is vim, which is a much more powerful text editor, but has a learning curve. It is only recommended for this guide if you already know how to use it.
- Lastly, you can copy the ircd.yaml file to a text editor on your computer and edit it with a GUI text editor of your choice. - If that is what you choose to do, you may want to just download the file from Ergo's GitHub, - edit it on your computer, clear the ircd.yaml file on the server, and then paste the contents from your computer into the blank file.
- No matter how you do it, the next steps assume you can edit the configuration file. -

- -

- Note:
- The options highlighted in this section are not a complete overview of all options. - Instead, the options shown are the ones which are most relevant to a small network.
- You should read over the configuration file yourself if you are curious about everything you can change. -

- -

Network and server names

- One of the first properties in the config file is network name. - You can change this to whatever you like, as it will show up as the name when you connect to the server. -

- -

# network configuration
-network:
-    # name of the network
-    name: "Land-Chat"

- -

Change the server name to your server's domain name.

- -

# server configuration
-server:
-    # server name
-    name: "example.org"

- -

Network password

- The next step is optional, depending on if you want your network password protected or not. - The benefit of password protection is fairly obvious; nobody can connect to your network unless you gave them the password. - If you're wanting to run a public network which anyone can join and create a channel, you want to skip this, but for personal setups, - it is highly recommended. -

- -

Generate a password to use by executing the following:

- -

./ergo genpasswd

- -

- It will ask you to enter a password and confirm it, then you will be given a hashed password.
- Copy this password, and paste it into the following field (also removing the # before the password: line): -

- -

# password to login to the server, generated using `ergo genpasswd`:
-password: "<your hashed password>"

- -

Message of the day (MotD)

Change the MotD (Message of the Day) file to the one you copied earlier:

- -

# motd filename
-# if you change the motd, you should move it to ircd.motd
-motd: ircd.motd

- -

Feel free to edit ircd.motd to your heart's content. Its contents will be sent to clients when they connect to the network.

- -

IP limits

- For security purposes, you might want to limit the amount of client connections per IP. - For a private network, 4 is likely the maximum amount of connections you will have per IP, so that is a safe value.
- If your network is password protected, this is less of an issue, since the only people connecting will be people who have the password. - The following is the default, but you can change it to be whichever value you like: -

- -

# IP-based DoS protection
-ip-limits:
-    # whether to limit the total number of concurrent connections per IP/CIDR
-    count: true
-    # maximum concurrent connections per IP/CIDR
-    max-concurrent-connections: 16

- -

IP cloaking

- Traditionally, IRC networks expose users' IP addresses to everyone. This is not a good practice for privacy, however. - With Ergo, IP cloaking is enable by default. You can enable or disable it if you like, and change how it looks to users.
- In this case, netname was changed to "chad". -

- -

# IP cloaking hides users' IP addresses from other users and from channel admins
-# (but not from server admins), while still allowing channel admins to ban
-# offending IP addresses or networks. In place of hostnames derived from reverse
-# DNS, users see fake domain names like pwbs2ui4377257x8.irc. These names are
-# generated deterministically from the underlying IP address, but if the underlying
-# IP is not already known, it is infeasible to recover it from the cloaked name.
-# If you disable this, you should probably enable lookup-hostnames in its place.
-ip-cloaking:
-    # whether to enable IP cloaking
-    enabled: true
-
-    # whether to use these cloak settings (specifically, `netname` and `num-bits`)
-    # to produce unique hostnames for always-on clients. you can enable this even if
-    # you disabled IP cloaking for normal clients above. if this is disabled,
-    # always-on clients will all have an identical hostname (the server name).
-    enabled-for-always-on: true
-
-    # fake TLD at the end of the hostname, e.g., pwbs2ui4377257x8.irc
-    # you may want to use your network name here
-    netname: "chad"

- -

Password enforcement adjustments for HexChat (and possibly other clients)

- Ergo offers account registration to allow users to do things like use history and bouncer features, register channels, etc.
- In clients such as HexChat, server passwords may conflict with account passwords, so the following setting should be enabled if you wish to use accounts with clients such as HexChat.
- Note that this could under some circumstances be considered a security hazard, as a user with an account does not need to know the server password to connect, - although that user would have needed to register an account before the server had a password, and then a password would need to have been set after the fact, so this can be considered a very small concern if your setup has always had a password.
- Also keep in mind that this setting has no effect if your network does not even have a password at all. -

- -

# some clients (notably Pidgin and Hexchat) offer only a single password field,
-# which makes it impossible to specify a separate server password (for the PASS
-# command) and SASL password. if this option is set to true, a client that
-# successfully authenticates with SASL will not be required to send
-# PASS as well, so it can be configured to authenticate with SASL only.
-skip-server-password: true

- -

Multiclient, always-on clients, history, etc

- Traditionally, IRC servers have no message history, and once you close your client, you cannot receive messages, and are not shown to be online at all. - Ergo includes functionality to allow users to both receive history, and keep their clients "online" even after they have left. - It also allows multiple clients to connect to the same account.
- If you are running a private network for friends, you should set always-on and auto-away to opt-out, - to have all users with accounts to appear as if they are online at all times, and be able to receive messages when they are offline.
- For a public network, keep everything as their default values, since you probably do not want randoms having this by default.
- If for some reason you do not want any of these features at all, you can set enabled to false, but this is not recommended. - Below are the recommended values for a private network (e.g. for friends) where users with accounts will be able to receive messages and history while they are offline. -

- -

# multiclient controls whether Ergo allows multiple connections to
-# attach to the same client/nickname identity; this is part of the
-# functionality traditionally provided by a bouncer like ZNC
-multiclient:
-    # when disabled, each connection must use a separate nickname (as is the
-    # typical behavior of IRC servers). when enabled, a new connection that
-    # has authenticated with SASL can associate itself with an existing
-    # client
-    enabled: true
-
-    # if this is disabled, clients have to opt in to bouncer functionality
-    # using nickserv or the cap system. if it's enabled, they can opt out
-    # via nickserv
-    allowed-by-default: true
-
-    # whether to allow clients that remain on the server even
-    # when they have no active connections. The possible values are:
-    # "disabled", "opt-in", "opt-out", or "mandatory".
-    always-on: "opt-out"
-
-    # whether to mark always-on clients away when they have no active connections:
-    auto-away: "opt-out"
-
-    # QUIT always-on clients from the server if they go this long without connecting
-    # (use 0 or omit for no expiration):
-    #always-on-expiration: 90d

- -

VHosts

- IP cloaking was mentioned previously, and somewhat related to that, Ergo includes "vhost" functionality, which allows users to set a custom IP/host string. - This is mostly for cosmetic value, and does not interfere with operators being able to see actual IP addresses for banning, but if you do not want it enable for some reason, you can disable it. -

- -

# vhosts controls the assignment of vhosts (strings displayed in place of the user's
-# hostname/IP) by the HostServ service
-vhosts:
-    # are vhosts enabled at all?
-    enabled: true

- -

Channels

- Channels are where everyone on an IRC network talk. By default, anyone can create a channel, and anyone with an account can register one. - The difference between a normal channel and a registered one is that the registered one will preserve the operator status of the person who created, - whereas a normal channel's owner will lose operator status if they leave the channel or disconnect from the network.
- There are various settings for channels available, but the defaults are suitable for a private network with trust among users, or where you just want anyone to have the ability to create a channel. - Below are the default values: -

- -

# channel options
-channels:
-    # modes that are set when new channels are created
-    # +n is no-external-messages and +t is op-only-topic
-    # see  /QUOTE HELP cmodes  for more channel modes
-    default-modes: +nt
-
-    # how many channels can a client be in at once?
-    max-channels-per-client: 100
-
-    # if this is true, new channels can only be created by operators with the
-    # `chanreg` operator capability
-    operator-only-creation: false
-
-    # channel registration - requires an account
-    registration:
-        # can users register new channels?
-        enabled: true
-
-        # restrict new channel registrations to operators only?
-        # (operators can then transfer channels to regular users using /CS TRANSFER)
-        operator-only: false
-
-        # how many channels can each account register?
-        max-channels-per-account: 15

- -

Operators (administrators, etc)

- The IRC term for an administrator or another privileged user is "operator", or "oper" for short.
- Ergo's opers have different permissions that can be granted to them, and are defined in "classes", basically groups of permissions under a name. - For example, "chat-moderator" and "server-admin" are defined in the default configuration: -

- -

# operator classes
-oper-classes:
-    # chat moderator: can ban/unban users from the server, join channels,
-    # fix mode issues and sort out vhosts.
-    "chat-moderator":
-        # title shown in WHOIS
-        title: Chat Moderator
-
-        # capability names
-        capabilities:
-            - "kill"
-            - "ban"
-            - "nofakelag"
-            - "roleplay"
-            - "relaymsg"
-            - "vhosts"
-            - "sajoin"
-            - "samode"
-            - "snomasks"
-
-    # server admin: has full control of the ircd, including nickname and
-    # channel registrations
-    "server-admin":
-        # title shown in WHOIS
-        title: Server Admin
-
-        # oper class this extends from
-        extends: "chat-moderator"
-
-        # capability names
-        capabilities:
-            - "rehash"
-            - "accreg"
-            - "chanreg"
-            - "history"
-            - "defcon"
-            - "massmessage"

- -

- The above can be kept with their default values, but you are free to modify them or create any new classes that are appropriate for your setup.
- Next, let's actually create an operator account: -

- -

# ircd operators
-opers:
-    # default operator named 'gigachad'; log in with /OPER gigachad <password>
-    "gigachad":
-        # which capabilities this oper has access to
-        class: "server-admin"
-
-        # custom whois line
-        whois-line: is the server administrator
-
-        # custom hostname
-        vhost: "gigachad"
-
-        # normally, operator status is visible to unprivileged users in WHO and WHOIS
-        # responses. this can be disabled with 'hidden'. ('hidden' also causes the
-        # 'vhost' line above to be ignored.)
-        hidden: false
-
-        # modes are modes to auto-set upon opering-up. uncomment this to automatically
-        # enable snomasks ("server notification masks" that alert you to server events;
-        # see `/quote help snomasks` while opered-up for more information):
-        #modes: +is acjknoqtuxv
-
-        # operators can be authenticated either by password (with the /OPER command),
-        # or by certificate fingerprint, or both. if a password hash is set, then a
-        # password is required to oper up (e.g., /OPER dan mypassword). to generate
-        # the hash, use `ergo genpasswd`.
-        password: "<your oper password>"

- -

- This is a modified version of the default oper entry. The account name is "gigachad", but you can change it to anything.
- Replace <your oper password> with a password generated by ./ergo genpasswd, and you will have a new oper account to use.
- Note that to log into an oper account, clients have to enter /OPER <oper name> <oper password> each time they log in. - This can be automated by most clients by setting the command to be executed when the client logs in. - In the case of HexChat, you can edit your network and add the command to the Connect commands tab of the menu.
- You can copy everything from "gigachad" to the end of the line, paste it again, and change the name to create another oper account. - Another, less privileged example of an oper is shown as a comment below the above configuration snippet. -

- -

Chat history

- Traditionally, IRC networks do not store, relay, or handle chat history in any way.
- On a privacy standpoint, this is a good thing, since chats are entirely ephemeral and handled by clients.
- On a practicality standpoint, this is a bad thing, since people have to keep a client connected 24/7 to see message history.
- For normalfriends, this can be a big problem, not only because having to stay online 24/7 is just annoying or infeasible, - but also because they are likely used to chat platforms that handle history for them.
- With this in mind, enabling history is a good idea if you want to move friends over to IRC, and will make things a lot more pleasant for private networks. -

- -

- Ergo's history configuration group is very long, so it is encouraged to read over it yourself. - This section will go over the most important pieces of that configuration group. -

- -

- History is not endless (unless you want it to be), and the amount that can be stored for channels is configurable: -

- -

# how many channel-specific events (messages, joins, parts) should be tracked per channel?
-channel-length: 2048

- -

- History is already enabled by default, but that just means it is being collected, not relayed by default. - To relay history to clients when they connect, change the following to the amount of messages that you think is appropriate: -

- -

# number of messages to automatically play back on channel join (0 to disable):
-autoreplay-on-join: 250

- -

- History older than a certain time can be configured to be deleted or be inaccessible. - The default cutoff time is 1 week, but this is configurable as well. -

- -


-# options to delete old messages, or prevent them from being retrieved
-restrictions:
-    # if this is set, messages older than this cannot be retrieved by anyone
-    # (and will eventually be deleted from persistent storage, if that's enabled)
-    expire-time: 1w
-

- -

- By default, Ergo only stores chat history in memory, so when the server restarts, all history is lost. - If you wish to have chat history persist beyond restarts, you must store it in a MySQL database: -

- -

# options to store history messages in a persistent database (currently only MySQL).
-# in order to enable any of this functionality, you must configure a MySQL server
-# in the `datastore.mysql` section.
-persistent:
-    enabled: true
-
-    # store unregistered channel messages in the persistent database?
-    unregistered-channels: true

- -
- -

# connection information for MySQL (currently only used for persistent history):
-mysql:
-    enabled: false
-    host: "localhost"
-    port: 3306
-    # if socket-path is set, it will be used instead of host:port
-    #socket-path: "/var/run/mysqld/mysqld.sock"
-    user: "ergo"
-    password: "hunter2"
-    history-database: "ergo_history"
-    timeout: 3s
-    max-conns: 4
-    # this may be necessary to prevent middleware from closing your connections:
-    #conn-max-lifetime: 180s

- -

- For privacy reasons, you may want to allow users to delete their own messages in history, or export their messages to JSON: -

- -

# options to control how messages are stored and deleted:
-retention:
-    # allow users to delete their own messages from history?
-    allow-individual-delete: true
-
-    # if persistent history is enabled, create additional index tables,
-    # allowing deletion of JSON export of an account's messages. this
-    # may be needed for compliance with data privacy regulations.
-    enable-account-indexing: true

- -

Spam reduction

- Most IRC networks have measures in place to reduce chat spam. By default, "fakelag" is enabled in Ergo, and that can deal with most aggregious chat spam.
- If you are running a private network where user trust is high, you can disable it so that there are no limits on the speed that messages can be sent. -

- -

# fakelag: prevents clients from spamming commands too rapidly
-fakelag:
-    # whether to enforce fakelag
-    enabled: true
-
-    # time unit for counting command rates
-    window: 1s
-
-    # clients can send this many commands without fakelag being imposed
-    burst-limit: 5
-
-    # once clients have exceeded their burst allowance, they can send only
-    # this many commands per `window`:
-    messages-per-window: 2
-
-    # client status resets to the default state if they go this long without
-      # sending any commands:
-    cooldown: 2s

- -

Starting and using your server

- Now that Ergo is both installed and configured, you can actually start using it! -

- -

Starting the server

- First thing, make sure you're still using the ergo user, and are in the ~/server directory.
- If you aren't, you can run the following to get back there: -

- -

sudo -i -u ergo
-cd server

- -

- Starting the server is done in one command: -

- -

./ergo run

- -

- It will stay online until you close the terminal, or press CTRL+C. Don't worry, the next section goes over how to make it run like a normal server with a SystemD service.
- If you have not already, make sure the port 6697 is not blocked on your server. If you are using UFW as your firewall, - you need to run ufw enable 6697 (not as the ergo user, of course).
- If you make and configuration changes while the server is running, you can apply them without restarting by typing /rehash as an operator. -

- -

Connecting to the server

- To use IRC, you of course need an IRC client. There are many choices available, but the most widely used for Windows and Linux is HexChat. - On Mac, you have a slightly nicer option with Textual, although you have to compile it from source if you want to use it for free.
- A more user-friendly and modern client choice is TheLounge, which is explained in the last section of this guide, if you want to look into it. -

- -

- Connecting with HexChat is very easy. When you start it, you will see something like this: -

- -

- -

- From there, you should click + Add and name the server whatever you like (so you can find it on the server list).
- Once you have created a new server and named it, select it and click Edit.... - A menu will show up like the one below. Change the domain to whatever domain your server is running on, - and make sure to put in your server password if you set one. -

- -

- -

- Once you're done editing the network, click (X) Close, select your network from the network list, and click Connect.
- If all is well, you should be connected! -

- -

- -

- The process is very similar on Textual.
- Create a new network and connect to it. Note that it will ask if you want to connect even though the certificate is unsigned. - This is due to the self-signed certificates generated for the server, and is not a problem or security vulnerability, it is just a little annoying. -

- -

- -

Surviving restarts with a SystemD service

- In the beginning of the last section, Ergo was started by simply running ./ergo run, but this is only suitable for testing. - To have a proper server setup, you need to run it as a service. This can be achieved via a SystemD service. -

- -

- Before creating your service file, make sure you are in ~/server as the ergo user.
- Once you have done that, create a file called start.sh with the following content: -

- -

#!/bin/bash
-./ergo run

- -

Save the file, then mark it as executable:

- -

chmod +x start.sh

- -

Now, create a file called ergo.service with the following content:

- -

[Unit]
-Description=Ergo IRC server
-After=network.target
-# If you are using MySQL for history storage, comment out the above line
-# and uncomment these two instead (you must independently install and configure
-# MySQL for your system):
-# Wants=mysql.service
-# After=network.target mysql.service
-
-[Service]
-Type=simple
-User=ergo
-WorkingDirectory=/home/ergo/server
-ExecStart=/home/ergo/server/start.sh
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=on-failure
-LimitNOFILE=1048576
-# Uncomment this for a hidden service:
-# PrivateNetwork=true
-
-[Install]
-WantedBy=multi-user.target

- -

- You now have your service file, but it is not installed yet. - To install it, switch to your normal user, and execute the following lines to install, enable, and start the SystemD service: -

- -

ln -s /home/ergo/server/ergo.service /etc/systemd/system/ergo.service
-systemctl enable ergo
-systemctl start ergo

- -

Ergo is now installed and running as a service, and will automatically start when the system boots.

- -

Registering accounts and channels

- Account and channel registration were mentioned multiple times in this guide, and are indeed very important parts of the modern IRC ecosystem. - You can connect to most IRC networks and talk without creating an account, but you will not be able to reserve your nickname or register channels, so it is important to register an account. -

- -

Registering an account with NickServ

- First, make sure you are connected to your IRC network. - Once you are, type /nickserv help to make sure NickServ (the registration system) is working propertly.
- If all is well, type the following, replacing <your password> with the password you want to use: -

- -

/nickserv register <your password>

- -

- At this point, you are now registered!
- The final step is to configure authentication with your client. -

- -

In HexChat, all that needs to be done is changing Login method to SASL (username + password), and entering your NickServ password that you used earlier into the password field:

- -

- -

- In Textual, open up your network in the menu, and click Identity under Server Properties. - Enter your password in Personal Password, and check Wait for identification before joining channels. -

- -

- -

You will now be logged into your account when you connect to your network.

- -

Registering channels with ChanServ

- Once you have an account registered, you can register channels with ChanServ.
- To do so, join the channel you want to register, then type the following, replacing <your channel> with the name of the channel you want to register: -

- -

/chanserv register #<your channel>

- -

- You are now the channel owner, and are free to appoint operators, administrators, etc for it. - When you go offline, you won't lose ownership, and you cannot be removed as the owner unless you unregister the channel later. -

- -

Moderation

- Like any chat, there will come a point where you need to use moderation tools to keep things under control. - Many IRC setup guides do not go over moderation, so it can be stressful when operators need to actually use moderation tools.
- The main difference between IRC and other chat systems in terms of moderation is the difference between channel bans and network bans. - Channel ban keeps a person out of channel a channel, whereas a network ban keeps a person out of the entire network. -

- -

Understanding masks

- Bans are applied "masks", which are formatted pieces of text that contain a user's nick (username), their realname value, and their IP address or host.
- This is what a mask looks like: nick!~nick-dude@127.0.0.1.
- In bans, asterisks can be used as wildcards, which is useful for banning IP address ranges, patterns of nicknames, or whatever else you can think of.
- A ban on the nick person, for example, would look like this: person!*@*.
- A ban on anyone with the IP address 127.0.0.1 would look like this: *!*@127.0.0.1 -

- -

Discovering real IPs

- Even if IP cloaking is enabled on your network, you can still obtain real IP addresses/hosts if you are an operator. - See the Operators part of the configuration section of this guide on how to become an operator.
- To find out a user's real IP, simply type /whois along with the user's nick, and you will see information about the user, along with their real IP address/host.
- /whois is not a command that is exclusive to operators, but it does not reveal as much information to non-operators. -

- -

Banning someone from the network

- Any netword-wide moderation action requires being an operator. See the Operators part of the configuration section of this guide on how to become an operator.
- Banning someone from the network is achieved with the /kline command. To see more info on the command, type /helpop kline.
-

- -

To ban a nick from the network:

- -

/kline andkill <nick>!*@*

- -

To ban an IP address or host from the network:

- -

/kline andkill *!*@<IP or mask>

- -

To unban a mask, you can use the /unkline command with the mask you want to unban.

- -

Banning someone from a channel

- Channel owners, administrators, and operators can ban people from channels. - This is not the same as banning someone from the network, since it only has an effect on one channel. - Additionally, a channel operator is not the same as a network operator. -

- -

To ban someone in a channel, type the following in that channel, replacing <mask> with the user's mask:

- -

/mode +b <mask>

- -

- Note that this will only ban the user, not kick them immediately. - You will want to run /kick along with the user's nick to also kick them.
- To unban a user, run the command above, but replace the + with a -.
- You can see who is banned in a channel by typing /banlist. -

- -

Muting people in a channel

- By default, anyone can speak in an IRC channel. To change this, you must be a channel owner, administrator, or operator.
- Channels, along with users, have modes, which modify their behavior. There is a special mode for channels called m (moderated) which requires users to be privileged in some way to talk.
- To set a channel as moderated, type the following in the channel: -

- -

/mode +m

- -

- Now, users must be an owner, administrator, operator, or be voiced to talk in the channel - This be reversed by typing the command above, but changing the + to a -.
- To voice a user, run the following, replacing <nick> with the user's nick: -

- -

/mode +v <nick>

- -

Unvoice the user by typing the above command, but replacing the + with a -.

- -

Appointing channel administrators and operators

- Assuming you a channel owner, you can appoint both administrators and operators. - If you are only an operator, you may only appoint operators.
- The difference between administrator and operator is mainly that administrators cannot have their privileges taken away by operators, only owners. - To appoint an administrator, type the following, replacing <nick> with the user's nick: -

- -

/mode +a <nick>

- -

To appoint an operator, type the following, replacing <nick> with the user's nick:

- -

/mode +o <nick>

- -

- You can also use /op and /deop on most clients to appoint and remove an operator.
- To remove administrator or operator status, run either of the above commands, but replace the + with a -. -

- -

Bringing modern-day features to IRC with TheLounge

- A large downside to IRC as a protocol is just how old it is, and the limitations that exist because of it. - Other old protocols such as HTTP were built to be content-agnostic and versitile, but IRC was built with a very specific set of features, so it has not held up so well to contemporary chat systems.
- A notable thing that IRC as a protocol is missing is file uploads, and other fancy features that many other chats have.
- With that said, these problems can be fixed by clients, although many clients are still very primitive. -

- -

- TheLounge is a modern self-hosted IRC web client that tries to make IRC as user-friendly as possible. - It can be the answer to many of the complaints that normalfriends may have about IRC. It runs on anything with a web browser, can be "installed" since it is a PWA (Progressive Web App), - and is optimized for both desktops and mobile devices. It keeps you logged in even when you are gone, and even supports file uploads and embeds.
- Effectively, it brings IRC up to the standard of most other chat systems. -

- -

- If you would like to setup an instance of TheLounge for you and your friends, you can take a look at their installation guide.
- It is a self-hosted web app, so you can run it for multiple people, not just yourself. -

- -

Written by Termer

- - - diff --git a/jitsi.html b/jitsi.html deleted file mode 100644 index ad15404..0000000 --- a/jitsi.html +++ /dev/null @@ -1,185 +0,0 @@ - - - - Jitsi Video Chat – LandChad.net - - - - - - - -

Jitsi Video Chat

- -

- Jitsi is a set of open-source projects that allows you to easily build and deploy secure video conferencing solutions. -

- Is really easy to install, and also a really good private, federated and libre alternative to Zoom or other video conferencing software. - You can create calls just by typing the URL, and loging-in is not necessary. -

- -

Dependencies and Installation

- -

First, install some dependencies:

- -

apt install gpg apt-transport-https nginx python3-certbot-nginx

- -

Jitsi has its own package repository, so let's add it.

- -

curl https://download.jitsi.org/jitsi-key.gpg.key | gpg --dearmor > /usr/share/keyrings/jitsi-keyring.gpg
-echo 'deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/' > /etc/apt/sources.list.d/jitsi-stable.list
-apt update -y

- -

- Ok. So now we can install Jitsi, but before we do that, let's setup the firewall ufw, in case you - have it enabled, and the SSL certificate. -

- -

Enable Required Ports

- -

If you are using ufw or another firewall, there are several ports we need to ensure are open:

ufw allow 80/tcp
-ufw allow 443/tcp
-ufw allow 10000/udp
-ufw allow 3478/udp
-ufw allow 5349/tcp
-ufw enable

- -

For your information, these allow the following:

- -

80 TCP – Certbot.
443 TCP – General access to Jitsi Meet.
10000 UDP – General network video/audio communications.
3478 UDP – Quering the stun server (coturn, optional, needs config.js change to enable it).
- 5349 TCP – Fallback network video/audio communications over TCP (when UDP is blocked for example), served by coturn. -

- -

SSL certificate

- -

- I'll be using certbot and - Nginx to generate a certificate - for the Jitsi subdomain to allow encrypted connections. -

- -

certbot --nginx certonly -d meet.example.org

- -

- We will not create an Nginx config file for Jitsi because the Jitsi package we will be installing will do that automatically. -

- -

Installation

- -

To begin the installation process, just run:

apt install jitsi-meet

- -

- It will ask you for your hostname; there you'll need to input the subdomain you have just added to Nginx, like - meet.example.org. -

- -

For the SSL certificate, choose I want to use my own certificate.

- -

- When it ask you for the certification key and cert files, input - /etc/letsencrypt/live/meet.example.org/privkey.pem and - /etc/letsencrypt/live/meet.example.org/fullchain.pem respectively. -

- -

Using Jitsi

- -

- -

Jitsi can be used in a browser by then just going to meet.example.org.

- -

Note that there are also Jitsi clients for all major platforms:

- -

Desktop (Windows, MacOS, GNU/Linux)
Android (F-Droid and Google Play)
iPhone/iOS

- -

- When using a Jitsi app for the first time, remember to go to the "Settings" menu and change your server name to the Jitsi site you just created. -

- -

When you create a video chatroom, its address will appear as meet.example.org/yourvideochatname and can be shared as such.

- -

Security

- -

- By default, anyone who has access to meet.example.org will be able to create a chatroom. You probably don't want that, so you'll need to set up some authentication. The simplest option is to handle authentication through the local Prosody user database. -

- -

Prosody configuration

- First, we need to enable password authentication in Prosody. Edit /etc/prosody/conf.avail/meet.example.org.cfg.lua, and locate this block: -

VirtualHost "meet.example.org"
-    authentication = "anonymous"

- And change the authentication mode from "anonymous" to "internal_hashed". -

- Then, to enable guests to login and join your chatrooms, add the following block after the one you just edited: -

VirtualHost "guest.meet.example.org"
-    authentication = "anonymous"
-    c2s_require_encryption = false

- -

Jitsi Meet configuration

- Next, in /etc/jitsi/meet/meet.example.org-config.js, uncomment the following line: -

var config = {
-    hosts: {
-        // anonymousdomain: 'guest.jitsi-meet.example.com',
-    },
-}
-

- And change 'guest.jitsi-meet.example.com' to 'guest.meet.example.org'. -

- -

Jicofo configuration

- Finally, we configure Jicofo to only allow the creation of conferences when the request is coming from an authenticated user. To do so, add the following authentication section to /etc/jitsi/jicofo/jicofo.conf: -

jicofo {
-  authentication: {
-    enabled: true
-    type: XMPP
-    login-url: meet.example.org
- }

- -

Create users in Prosody and restart the services

- You now need to register some users in Prosody, you can do so manually using prosodyctl: -

prosodyctl register <username> meet.example.org <password>

- Finally, restart prosody, jicofo, and jitsi-videobridge2: -

systemctl restart prosody
-systemctl restart jicofo
-systemctl restart jitsi-videobridge2

- -

More info

- -

- This article is based on the original documentation. There you can find more details and configurations. -

- -

Written by Jose Fabio. Donate Monero: 484RLdsXQCDGSthNatGApRPTyqcCbM3PkM97axXezEuPZppimXmwWegiF3Et4BHBgjWR7sVXuEUoAeVNpBiVznhoDLqLV7j [QR]
Edited and revised by Luke.

- - - - diff --git a/layouts/partials/footer.html b/layouts/partials/footer.html new file mode 100644 index 0000000..7742c7e --- /dev/null +++ b/layouts/partials/footer.html @@ -0,0 +1,13 @@ + {{ if in .Params.tags "basic" }} + {{ with .NextInSection }} + Next: {{ .Title }} + {{ end }} + {{ with .PrevInSection }} + Or Previous: {{ .Title }} + {{ end }} + + {{ end }} +

+ + + diff --git a/layouts/shortcodes/basic.html b/layouts/shortcodes/basic.html new file mode 100644 index 0000000..b2df0d9 --- /dev/null +++ b/layouts/shortcodes/basic.html @@ -0,0 +1,8 @@ +

+ +{{ with .Params.icon }}{{ end }} +{{.Title}} +{{ with .Params.short_desc }}{{ . }}{{ end }}{{.Params.Tags}} +

diff --git a/layouts/shortcodes/maintain.html b/layouts/shortcodes/maintain.html new file mode 100644 index 0000000..a864eab --- /dev/null +++ b/layouts/shortcodes/maintain.html @@ -0,0 +1,4 @@ +

{{ with .Params.icon }}{{ end }}{{.Title}}{{ with .Params.short_desc }}{{ . }}{{ end }}{{.Params.Tags}}

diff --git a/layouts/shortcodes/services.html b/layouts/shortcodes/services.html new file mode 100644 index 0000000..877140d --- /dev/null +++ b/layouts/shortcodes/services.html @@ -0,0 +1,4 @@ +

{{ with .Params.icon }}{{ end }}{{.Title}}{{ with .Params.short_desc }}{{ . }}{{ end }}{{.Params.Tags}}

diff --git a/maintenance.html b/maintenance.html deleted file mode 100644 index 328f0a8..0000000 --- a/maintenance.html +++ /dev/null @@ -1,125 +0,0 @@ - - - - Maintaining a Server – LandChad.net - - - - - - - -

Maintaining a Server

- -

Here are some important topics you should be familiar with whenever you are managing a server.

Keep packages up to date.

All GNU/Linux distributions use package managers to easily be able to install and update packages without manually downloading them. - On Debian, which we use here for these tutorial the package manager is apt-get or apt for short. -

- -

- It's a good idea to use apt to keep your software reasonably up to date. -

- -

apt update
-apt upgrade

- -

- Not only do up-to-date packages often come with more features, but they can also fix any possible security bugs. -

- -

Troubleshooting general problems

- Often when you are installing something new, you might miss a step and run into an error, so it's important to know how to check and see what errors have happened on your computer. -

On Debian and other GNU/Linux distributions that use systemd (most of them), you can use the command journalctl to look at the system's general log. - You will probably want to run journalctl -xe as the -x and -e as that gives the most information and starts you at the bottom of the log to see the most recent errors. -

- Some programs do not use this system log, but have their own logs stored in /var/log/, or sometimes it's more convenient to look at a specific program's log to see only its issues. -

- -

For example, we can see that in /var/log/nginx/, nginx produces both error and access files. - The access files show you all the times people connect to files on your server and much more. - We can look at the most recent errors by running: -

- -

tail -n 25 /var/log/nginx/error.log

- -

- The command tail -n 25 means "show me the last 25 lines of this file." - You can replace that with less to browse the whole file. - In less, navigate with arrows or vim-keys and exit with q. -

- -

systemctl

- -

- Another tool on systemd distributions is systemctl. - At a basic level, use systemctl status put-service-name-here - to see if a system service is running and its most recent log. - But there's much more to systemctl. -

- -

- For example, you can run systemctl stop nginx to stop NginX and systemctl start nginx to start it back up (or use restart for both). - When you make changes to a program's configuration files, reload well make them reload them. - If you no longer want a service to start when the system is rebooted, use disable, or conversely, to make a service start on reboot use enable. -

- -

Finding Files

- -

- Especially if you're new to how a GNU/Linux system is arranged, you might need help finding files. - To find program-related files, you can just use whereis: -

$ whereis nginx
-nginx: /usr/sbin/nginx /usr/lib/nginx /etc/nginx /usr/share/nginx /usr/share/man/man8/nginx.8.gz

- -

This command lists the directories related to that program. For example, /etc/nginx is where the configuration files are and /usr/share/nginx is where the library and module-like files are.

But whereis can be used only with installed programs. - A more general tool is the pair of updatedb and locate. -

- -

- updatedb is a command that quickly indexes every file and directory on your computer. - Then you can run locate to find a file containing a given name. - After running updatedb, try running locate nginx to find all files with "nginx" in their name. -

- -

- You can make your search more specific by chaining other Unix commands through pipes. - For example, grep takes input and returns only lines that match an extra argument. - In the example below, we locate all files with "nginx" in the name, but we use grep to only show us those with the word "available" in them. -

- -

root@landchad:~# locate nginx | grep available
-/etc/nginx/modules-available
-/etc/nginx/sites-available
-/etc/nginx/sites-available/default
-/etc/nginx/sites-available/landchad
-/usr/share/nginx/modules-available
-/usr/share/nginx/modules-available/mod-http-auth-pam.conf
-/usr/share/nginx/modules-available/mod-http-dav-ext.conf
-/usr/share/nginx/modules-available/mod-http-echo.conf
-/usr/share/nginx/modules-available/mod-http-geoip.conf
-/usr/share/nginx/modules-available/mod-http-image-filter.conf
-/usr/share/nginx/modules-available/mod-http-subs-filter.conf
-/usr/share/nginx/modules-available/mod-http-upstream-fair.conf
-/usr/share/nginx/modules-available/mod-http-xslt-filter.conf
-/usr/share/nginx/modules-available/mod-mail.conf
-/usr/share/nginx/modules-available/mod-stream.conf

- -

- updatedb is an ideal candidate for a cronjob so you don't have to worry about running each time. - For example, adding the following to your crontab will run updatedb every 30 minutes: -

*/30 * * * * /usr/bin/updatedb

- - - diff --git a/matrix.html b/matrix.html deleted file mode 100644 index ed0126d..0000000 --- a/matrix.html +++ /dev/null @@ -1,131 +0,0 @@ - - - - Matrix Synapse Server – LandChad.net - - - - - - - -

Matrix Synapse Server

- -

Matrix is easy-to-use, decentralized and encrypted private chat software. - Matrix is federated, meaning that with a Matrix account on any server, including your own, you can talk to any other Matrix account on the internet, similar to email. - Matrix also allows fully end-to-end encrypted group chats. -

- -

Synapse is the name of the default Matrix server. It is written in Python. While it is requires somewhat more system resources than an XMPP server, it makes up for that in being very accessible to non-technical users.

- -

Installation

- -

Synapse is not in the Debian package repositories by default, but we can easily add Matrix's repository including it:

- -

apt install -y lsb-release wget apt-transport-https
-wget -O /usr/share/keyrings/matrix-org-archive-keyring.gpg https://packages.matrix.org/debian/matrix-org-archive-keyring.gpg
-echo "deb [signed-by=/usr/share/keyrings/matrix-org-archive-keyring.gpg] https://packages.matrix.org/debian/ $(lsb_release -cs) main" > /etc/apt/sources.list.d/matrix-org.list

After we update our packages lists, we will be able to install Synapse with apt.

- -

apt update
-apt install matrix-synapse-py3

- -

When prompted, give your main domain name (not a subdomain). This will be the domain appended to your Matrix address, e.g. @chad:landchad.net.

- -

Nginx configuration

- -

Create an Nginx configuration file for Matrix, say /etc/nginx/sites-available/matrix and add the content below: -

- -

server {
-        server_name matrix.example.org ;
-        listen 80;
-        listen [::]:80;
-        location / {
-                proxy_pass http://localhost:8008;
-        }
-        location ~* ^(\/_matrix|\/_synapse\/client) {
-                proxy_pass http://localhost:8008;
-                proxy_set_header X-Forwarded-For $remote_addr;
-                client_max_body_size 50M ;
-        }
-        location /.well-known/matrix/server {
-                return 200 '{"m.homeserver": {"base_url": "https://matrix.example.org"}}';
-                default_type application/json;
-                add_header Access-Control-Allow-Origin *;
-        }
-}

- - - -

Now let's enable the Nginx Matrix site and reload Nginx to make it active.

- -

ln -s /etc/nginx/sites-available/matrix /etc/nginx/sites-enabled
-systemctl reload nginx

- -

Encryption

- -

Obviously, we need to encrypt our matrix subdomain as well. Let's do that with certbot:

- -

certbot --nginx -d matrix.example.org

- -

Configuration

- -

Read the config file

- -

- The configuration file for Matrix is in /etc/matrix-synapse/homeserver.yaml. - It is well documented and commented, so you can read about the settings, but let's change the essential ones here. -

- -

- Make what changes you want and run systemctl reload matrix-synapse to make the system configuration active. -

- -

Create an administrator account

- -

If you allow open registration on your server in the configuration file, you can create an account through Element or another Matrix client, but you are probably going to want an official admin account to use. - To make one, simply run the following command, which will then give you several choices for creating a user, among which will be the ability to make it an admin. -

- -

register_new_matrix_user -c homeserver.yaml http://localhost:8008

- -

Using Matrix with Element

- -

- There are many different clients that can be used on desktops or phones to chat on your Matrix server, but the most popular and most widely vetted is Element logo Element. -

- -

Get Element to access your Matrix server:

- -

Mobile: -
- F-droid
- Google Play
- Apple App Store
-
Real computer: -
- GNU/Linux: You know how to install it.
- Windows
- Mac
-

- -

- Note also that Element has a web client (i.e. a version that can be accessed on your own website) that is also easy to install on an Nginx server, - although that will be covered in another article. -

- -

- - - diff --git a/monero.html b/monero.html deleted file mode 100644 index 1cc086f..0000000 --- a/monero.html +++ /dev/null @@ -1,111 +0,0 @@ - - - - Setting up a Monero wallet – LandChad.net - - - - - - - -

Setting up a Monero wallet

- -

- Monero (abbreviated XMR) is easily the cryptocurrency most actually used as such. - Unlike Bitcoin, Monero is actually private and has very low transaction fees. - That makes it a good idea to get a Monero wallet and add an address on your website where you can receive donations. -

- -

Generate a Monero wallet

- -

- Got to https://www.getmonero.org/downloads/ to Monero's official site and you can download either the GUI (graphical) or CLI (command-line wallet). - Some Linux distributions will have these packages in their repositories (monero and monero-gui on Arch-based distributions). -

- - - -

- Once you install and run the wallet program, you will get a menu like this: -

- -

- -

- Now if you want to start using Monero and using it as a pro, you can choose to download the whole blockchain which will maximize your transactional privacy, - however for this tutorial or setting up a wallet, we can just do the Simple Mode and save our bandwidth. - In fact, if you are paranoid, you can disconnect your computer from the internet while generating a wallet. -

- -

Now we choose to create a wallet.

- -

- -

- Now we get the most important and sensitive part, you private mneumonic seed. - These words are sacred! They are your money! - To be clear, they are randomly generated words that seed the randomness required to unlock whatever money you receive or hold. - Never show these words to anyone, don't even keep them on your computer, but write them down and store them securely in real life in a safe or somewhere where only you have access. -

- -

- - - -

- Finally, we get to the main wallet screen. - Now we see your public sharable wallet receiving address. - It is the thing that starts with 4 and is too long to be included in the image below labeled "Primary address." -

- -

- Click the clipboard next to it to copy the whole sequence (which will be more than 90 letters and numbers) to your clipboard. - This is your address. - Put it on your website and you can receive donations! -

- -

- You can also click to save that QR code image and you can put it up on your website and people will be able to scan it and send you Monero. - When scanned, that QR code will read as the public donation address. -

- - -

What do I do now?

- -

- You can now receive Monero/XMR donations! - All you need to do is put either your full address or your QR code on your site and people can send you tips in Monero. -

- -

- Here is the address we use for this site (i.e. not the compromised wallet generated above): -

- -

84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh

- -

- -

- It's now up to you how and where to display these on your site. -

- - -

- - - diff --git a/nextcloud.html b/nextcloud.html deleted file mode 100644 index 274d854..0000000 --- a/nextcloud.html +++ /dev/null @@ -1,207 +0,0 @@ - - - - Setting up a Nextcloud Instance – LandChad.net - - - - - - - -

Setting up a Nextcloud Instance

- -

What is Nextcloud?

logo Nextcloud is a free and open source solution for cloud storage. However it can also do other things, such as manage your email, notes, calender, tasks, and can even connect to the Fediverse (think Mastodon and Pleroma). Pretty much every service that Google has to offer has a much better alternative as a Nextcloud app and this is a must-have for anyone wanting to get away from Google services but still wants a traditional cloud experience (in the likes of Google Services, anyways).

- -

Instructions

We should upgrade the system and then install packages that we might need. Run the following command:

apt-get full-upgrade -y && sudo apt-get install mariadb-server php-mysql php php-gd php-mbstring php-dom php-curl php-zip php-simplexml php-xml php-fpm -y

Next, we need to set up our SQL database by running a Secure Installation and creating the tables that will store data that Nextcloud will need. Run the following command:

mysql_secure_installation

When it asks for root a password, say yes and input a new and secure password. The root password here is just for the SQL database, not for the GNU/Linux system.

Answer the rest of the questions as follows:

Remove anonymous users? [Y/n]: Y
-Disallow root login remotely? [Y/n]: Y
-Remove test database and access to it? [Y/n]: Y
-Reload privilege tables now? [Y/n]: Y
-

Next, sign into the SQL database with the new and secure password you chose before. Run the following command:

mysql -u root -p

We need to create a database for Nextcloud. Follow the instructions below and change some of the placeholders as you wish:

CREATE DATABASE nextcloud;
-GRANT ALL ON nextcloud.* TO 'username'@'localhost' IDENTIFIED BY 'password';
-FLUSH PRIVILEGES;
-EXIT;

Now we need to configure PHP. Let's start my making sure that the PHP user is set to www-data and if that is not the case, add the www-data user if needed and set the correct variable in nginx.conf. Make sure this line is at the beginning of /etc/nginx/nginx.conf.

user www-data;

Check for the www-data user by running id -u www-data. If a number is output from that command, then the www-data user exists. If not. add the user simply by running useradd www-data

Next, we need to ensure that we have SSL certificates generated for your website. If you have not already done this, refer to this guide.

In /etc/nginx/sites-available/ we need to make a new configuration for Nextcloud (example: /etc/nginx/sites-available/nextcloud). Create it and open it, modify, and add the following lines:

upstream php-handler {
-    server unix:/var/run/php/php7.4-fpm.sock;
-    server 127.0.0.1:9000;
-}
-
-server {
-    listen 80;
-    listen [::]:80;
-    server_name example.org;
-
-    return 301 https://$server_name$request_uri;
-}
-
-server {
-    listen 443      ssl http2;
-    listen [::]:443 ssl http2;
-    server_name example.org;
-    ssl_certificate     /etc/letsencrypt/live/example.org/fullchain.pem ;
-    ssl_certificate_key /etc/letsencrypt/live/example.org/privkey.pem ;
-
-    root /var/www;
-
-    location = /robots.txt {
-        allow all;
-        log_not_found off;
-        access_log off;
-    }
-
-    location ^~ /.well-known {
-        location = /.well-known/carddav { return 301 /nextcloud/remote.php/dav/; }
-        location = /.well-known/caldav  { return 301 /nextcloud/remote.php/dav/; }
-
-        location /.well-known/acme-challenge    { try_files $uri $uri/ =404; }
-        location /.well-known/pki-validation    { try_files $uri $uri/ =404; }
-
-        return 301 /nextcloud/index.php$request_uri;
-    }
-
-    location ^~ /nextcloud {
-        client_max_body_size 512M;
-        fastcgi_buffers 64 4K;
-
-        gzip on;
-        gzip_vary on;
-        gzip_comp_level 4;
-        gzip_min_length 256;
-        gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
-        gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
-
-        add_header Referrer-Policy                      "no-referrer"   always;
-        add_header X-Content-Type-Options               "nosniff"       always;
-        add_header X-Download-Options                   "noopen"        always;
-        add_header X-Frame-Options                      "SAMEORIGIN"    always;
-        add_header X-Permitted-Cross-Domain-Policies    "none"          always;
-        add_header X-Robots-Tag                         "none"          always;
-        add_header X-XSS-Protection                     "1; mode=block" always;
-
-        fastcgi_hide_header X-Powered-By;
-
-        index index.php index.html /nextcloud/index.php$request_uri;
-
-        location = /nextcloud {
-            if ( $http_user_agent ~ ^DavClnt ) {
-                return 302 /nextcloud/remote.php/webdav/$is_args$args;
-            }
-        }
-
-        location ~ ^/nextcloud/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/)    { return 404; }
-        location ~ ^/nextcloud/(?:\.|autotest|occ|issue|indie|db_|console)                  { return 404; }
-
-        location ~ \.php(?:$|/) {
-            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
-            set $path_info $fastcgi_path_info;
-
-            try_files $fastcgi_script_name =404;
-
-            include fastcgi_params;
-            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
-            fastcgi_param PATH_INFO $path_info;
-            fastcgi_param HTTPS on;
-
-            fastcgi_param modHeadersAvailable true;
-            fastcgi_param front_controller_active true;
-            fastcgi_pass php-handler;
-
-            fastcgi_intercept_errors on;
-            fastcgi_request_buffering off;
-        }
-
-        location ~ \.(?:css|js|svg|gif)$ {
-            try_files $uri /nextcloud/index.php$request_uri;
-            expires 6M;
-            access_log off;
-        }
-
-        location ~ \.woff2?$ {
-            try_files $uri /nextcloud/index.php$request_uri;
-            expires 7d;
-            access_log off;
-        }
-
-        location /nextcloud/remote {
-            return 301 /nextcloud/remote.php$request_uri;
-        }
-
-        location /nextcloud {
-            try_files $uri $uri/ /nextcloud/index.php$request_uri;
-        }
-    }
-}

Enable the site by running this command:

ln -s /etc/nginx/sites-available/nextcloud /etc/nginx/sites-enabled/

Next, we need to download the latest release tarball of Nextcloud. Go to https://nextcloud.com/install/#instructions-server and copy the URL of the .tar.bz2 tarball from the More Downloads dropdown menu then go to your server's shell prompt and download the tarball with wget. Here is an example:

wget https://download.nextcloud.com/server/releases/nextcloud-21.0.2.tar.bz2

Now we need to extract the Nextcloud tarball. Run the following command:

tar -xjf nextcloud*.tar.bz2 -C /var/www

If you have multiple Nextcloud tarballs in the current working directory you might want to manually specify which one you wish to extract.

Let's correct the ownership and permissions of those files. Run the following commands:

chown -R www-data:www-data /var/www/nextcloud
-chmod -R 755 /var/www/nextcloud
-

Start and enable the php-fpm and the mariadb services (the name of the php-fpm service may have a version number ahead of it, use bash's tab autocomplete to help you out with that):

systemctl enable php7.4-fpm
-systemctl start php7.4-fpm
-systemctl enable mariadb
-systemctl start mariadb

Reload the nginx service:

systemctl reload nginx

Now we need to head to Nextcloud's web interface. Go to your web browser and go to your website, but go to the subdirectory "nextcloud" instead. Go to https://example.org/nextcloud. This will launch the configuration wizard.

- -

Choose an admin username and secure password.
Leave Data folder at the default value unless it is incorrect.
For Database user, enter the user you set for the SQL database.
For Database password, enter the password you chose for the new user in MariaDB.
For Database name, enter: nextcloud
Leave "localhost" as "localhost".
Click Finish.

- -

Congratulations, you have set up your own Nextcloud instance.

- -

What's Next?

Now you may be wondering: What do I do now? Here are some suggestions:

- -

Rice your Nextcloud instance by changing your themeing and installing new themes and plugins in Settings in the Nextcloud Web Interface.
Install the Nextcloud Client on your personal computer and sync your files to your instance.
Install the Nextcloud App on your mobile device and sync your files to your instance.
Set up your email account on the Nextcloud Mail app on the web interface to view and sync your email there (just like Gmail).
Schedule events with Nextcloud Calender.
Write notes in Markdown inside the Nextcloud Notes web and mobile app.
Set the Nextcloud Dashboard as your web browser's homepage (it is pretty nice).

- -

Enjoy your cloud services in freedom.

- -

Written by Matthew "Madness" Evan

- -

- - - diff --git a/nginx.html b/nginx.html deleted file mode 100644 index d0a4cfc..0000000 --- a/nginx.html +++ /dev/null @@ -1,249 +0,0 @@ - - - - Setting Up a Webserver – LandChad.net - - - - - - - -

Setting Up a Webserver

- -

At this point, we should have a domain name and a server and the domain name should direct to the IP address of the server with DNS records. - As I said in previous articles, the instructions I will give will be for Debian. - In this article, other distributions might work a little differently.

- -

Logging in to the server

- -

- We first want to log into our VPS to get a command prompt where we can set up the web server. - I am assuming you are using either MacOS or GNU/Linux and you know how to open a terminal. - On Windows, you can also use either PuTTY or the Windows Subsystem for Linux. -

- Now on Vultr's site, you can click on your VPS and you will see that there is an area that shows you the password for your server at the bottom here. -

- -

- -

- Now pull up a terminal and type: -

- -

ssh root@example.org

- -

- This command will attempt to log into your server. - It should prompt you for your password, and you can just copy or type in the password from Vultr's site. -

- - - -

Installing the Webserver: Nginx

- -

- If the program runs without an error, ssh has now logged you into your server. - Let's start by running the following commands. -

- -

apt update
-apt upgrade
-apt install nginx

- -

- The first command checks for packages that can be updated and the second command installs any updates. -

- -

- The third command installs nginx (pronounced Engine-X) which is the web server we'll be using, - along with some other programs. -

- -

Our nginx configuration file

- -

- nginx is your webserver. - You can make a little website or page, put it on your VPS and then tell nginx where it is and how to host it on the internet. - It's simple. Let's do it. -

- - - -

First, let's create the settings for our website. You can copy and paste (with required changes) - but I will also explain what the lines do. -

- -

- Create a file in /etc/nginx/sites-available by doing this: -

- -

nano /etc/nginx/sites-available/mywebsite

- -

- Note that "nano" is a command line text editor. - You will now be able to create and edit this file. - By saving, this file will now appear. - Note also I name the file mywebsite, but you can name it whatever you'd like. -

- -

- I'm going to add the following content to the file. - The content like this will be different depending on what you want to call your site. -

- -

server {
-        listen 80 ;
-        listen [::]:80 ;
-        server_name landchad.net ;
-        root /var/www/landchad ;
-        index index.html index.htm index.nginx-debian.html ;
-        location / {
-                try_files $uri $uri/ =404 ;
-        }
-}

- - -

Explanation of those settings

-The listen lines tell nginx to listen for connections on both IPv4 and IPv6. -

-The server_name is the website that we are looking for. -By putting landchad.net here, that means whenever someone connects to this server and is looking for that address, -they will be directed to the content in this block. -

-root specifies the directory we're going to put our website files in. -This can theoretically be wherever, but it is conventional to have them in /var/www/. -Name the directory in that whatever you want. -

-index determine what the "default" file is; -normally when you go to a website, say landchad.net, you are actually going to a file at landchad.net/index.html. -That's all that is. -Note that that this in concert with the line above mean that /var/www/landchad/index.html, a file on our computer that we'll create -will be the main page of our website. -

-Lastly, the location block is really just telling the server how to look up files, otherwise throw a 404 error. -Location settings are very powerful, but this is all we need them for now. -

- -

Create the directory and index for the site

- -

-We'll actually start making a "real" website later, but let's go ahead and create a little page that will appear on when someone looks up the domain. -

- -

mkdir /var/www/landchad

- -

-Now let's create and index file inside of that directory which will appear when the website is accessed: -

- -

nano /var/www/landchad/index.html

- -

-I'll add the following basic content, but you can add whatever you want. -This will appear on your website. -

- -

<!DOCTYPE html>
-<h1>My website!</h1>
-<p>This is my website. Thanks for stopping by!</p>
-<p>Now my website is live!</p>

- -

Enable the site

- -

-Once you save that file, we can enable it making a link to it in the sites-enabled directory: -

- -

ln -s /etc/nginx/sites-available/mywebsite /etc/nginx/sites-enabled

- -

-Now we can just reload or restart to make nginx service the new configuration: -

- -

systemctl reload nginx

- -

The Firewall

- -

-Vultr and some other VPS automatically install and enable ufw, a firewall program. -This will block basically everything by default, so we have to change that. -If you don't have ufw installed, you can skip this section. -

- -

Option 1: Disable the firewall entirely...

- -

It's usually easier to just entirely disable the firewall as we set up different services. -But be sure to see the article on how to fully configure the firewall later. -

- -

systemctl stop ufw
-systemctl disable ufw

- -

Option 2: Or enable the proper ports.

- -

We can also simply manually disable the blocking of connections over HTTP and HTTPS. -This keeps the firewall otherwise active. -

- -

ufw allow 80
-ufw allow 443

- -

-Port 80 is the canonical webserver port, while 443 is the port used for encrypted connections. -We will certainly need that for the next page. -

- -

Nginx security hint

- -

By default, Nginx and most other webservers automatically show their version number on error pages. -It's a good idea to disable this from happening because if an exploit comes out for your server software, someone could exploit it. Open the main Nginx config file /etc/nginx/nginx.conf and find the line # server_tokens off;. Uncomment it, and reload Nginx. -

- -

-Remember to keep your server software up to date to get the latest security fixes! -

- -

We now have running website!

- -

-At this point you can now type in your website in your browser and this webpage will appear! -

- -

-Note the "Not secure" notification. -The next brief step is securing encrypted connections to your website. -

- - Previous: Set up DNS. - Next: Enabling Encrypted Connections. - -

- - - diff --git a/openalias.html b/openalias.html deleted file mode 100644 index b78bdfd..0000000 --- a/openalias.html +++ /dev/null @@ -1,121 +0,0 @@ - - - - OpenAlias – LandChad.net - - - - - - - -

OpenAlias

- -

The Problem

- Cryptocurrency can be unintuitive. - After all, look at this annoying Monero address of ours: -

- -

84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh
-

- -

- It breaks up pages and looks ugly. When you copy and paste it to send money, you might be paranoid that you somehow added an extra character in there. - That's all around a bad user experience. -

- -

It would be nice...

- -

- It would be nice if we could just input someone's email address or maybe a website and send Bitcoin or Monero to that instead. - So instead of that long jumble, it would be easier to just type in someone's website or email and sending them money that way. -

- -

The Solution

The OpenAlias standards are just that. - It uses DNS settings, which you know something about, to link a website or an email address with a cryptocurrency address. - It allows someone to simply put landchad.net or chad@landchad.net as a payment recipient and that will direct to that long address above. -

- -

- The default Monero wallet and Bitcoin's Electrum are already compatible with OpenAlias, as are a growing group of wallet software. -

- -

Let's do it.

- -

Open up your domain registar and open up your DNS settings for the website you would like to add.

- -

- Open the TXT record section. - Now, create an entry with text like that below: -

- -

oa1:xmr recipient_address=84RXmrsE7ffCe1ADprxLMHRpmyhZuWYScDR4YghE8pFRFSyLtiZFYwD6EPijVzD3aZiEpg57MfHEr1pGJNPXyJgENMnWrSh; recipient_name=LandChad.net;

- -

Obviously change the address to your desired address and you may also give a proper name for yourself (this may be multiple words). - Note that the entry above is all one line. -

- -

- Now create a new TXT entry and input this text into the TXT Value input box. - Note here that I have create two entries: -

- -

- -

- One entry's "Host" is left empty, this will allow people to send Monero by merely typing landchad.net. -

- -

- The second entry has "chad" as the "Host"; this will allow people to send money to chad@landchad.net, i.e. - this is how you allow people to connect a Monero address with an email address. -

- -

Checking to see if it works...

- Let's check to see if it works. - In the Monero wallet, we can now type in landchad.net as a recipient: -

- -

- And once we press the "Resolve" button, it automatically turns into that address we gave to the DNS! -

- -

- -

- Now people can donate Monero to you without having to worry about QR codes or copying-and-pasting super-long public addresses! -

- -

Now with Bitcoin!

- -

- OpenAlias was originally developed for Monero, but since it's such a good idea, Bitcoin wallets have implemented it as well, so let's add some TXT entries for Bitcoin. - The OpenAlias TXT records have the same format, except for the xmr at the beginning is replaced with btc and obviously we use a Bitcoin address instead of Monero. -

- -

oa1:btc recipient_address=bc1q9f3tmkhnxj8gduytdktlcw8yrnx3g028nzzsc5; recipient_name=LandChad.net;

- -

Add the TXT entries in and save:

- -

- -

And we can then check that it's working by trying to send money to landchad.net in Electrum. - See that it automatically appends the address! -

- -

- And that's it. Now users can easily send your website or email address Bitcoin or Monero without having to worry about hard to read addresses and QR codes. -

- -

- - - diff --git a/page-quality.html b/page-quality.html deleted file mode 100644 index c3f26d1..0000000 --- a/page-quality.html +++ /dev/null @@ -1,185 +0,0 @@ - - - - Page Quality – example.org - - - - - - - -

Page Quality

- -

- After you've deployed your website, you may want to consider improving its performance, accessibility, and search-engine optimization (SEO). - Doing so can help make your website more user-friendly and increase its page rank in search results. - Luckily, Google provides a measurement tool to help you improve these aspects. - Start by entering your website's URL and click the Run Audit button (it will take 5-10 seconds to generate the report). -

- -

- Once the report has finished, you'll be greeted by a score for four different categories: Performance, Accessibility, Best Practices, and SEO. - A lot of the tests listed are self-explanatory, and Google provides you with articles to help you pass them. - Below are some easy ways to improve your scores, some specific to the nginx configuration used in the landchad website tutorial. -

- -

Performance

- -

Serving static assets with an efficient cache policy

- -

- Serving your files with an efficient cache policy will allow the user's browser to cache files such as pictures and CSS so that the browser doesn't need to fetch these files each time the page is visited. - It's very easy to set this up in nginx. - Just paste the following within the server block of your website's configuration file: -

- -

# Media: images, icons, video, audio, HTC
-location ~* \.(?:jpg|jpeg|gif|png|ico|svg|webp)$ {
-    expires 1M;
-    access_log off;
-    # max-age must be in seconds
-    add_header Cache-Control "max-age=2629746, public";
-}
-    
-# CSS and Javascript
-location ~* \.(?:css|js)$ {
-    expires 1y;
-    access_log off;
-    add_header Cache-Control "max-age=31556952, public";
-}

- -

- You can add more types of file extensions (mp3, mp4, ogg) as you see fit. -

- -

- If you're changing your CSS files a lot, caching could keep repeat users from getting the most up-to-date stylesheet. - To combat this, you can version your stylesheets like so: -

- -

<link rel="stylesheet" type="text/css" href="style.css?v=1.0.0">

- -

- Just increase the version number whenever you update your stylesheet, and the browser will re-update its cache. -

- -

Enable text compression

- -

- Another easy addition to your websites configuration file. - Enabling text compression is easy and will save bandwidth for users. - Simply paste the following within the server block of your website's configuration file: -

- -

gzip on;
-gzip_min_length 1100;
-gzip_buffers 4 32k;
-gzip_types text/plain application/x-javascript text/xml text/css;
-gzip_vary on;
-

- -

- After reloading nginx, you can test if compression is working by opening your browsers developer tools and going to the network tab. - Refresh your website with the network tab, click on the item with your URL and look at the response headers. - You should see Content-Encoding: gzip as one of the headers displayed. -

- -

Properly sizing images

- -

- If you've put images on your webpage, you've most definitely gotten this warning. - To pass this audit, you'll need to scale your images down using a tool like gimp or imagemagick to a size appropriate for your website. - It doesn't make much sense to serve a high-res image for images that are rendered much smaller on a webpage. -

- -

- Once you've scaled your image down, you can use a tool like cwebp to convert your images into the .webp format, a format specifically created for serving bandwidth concious images. -

- -

- First, you'll have to install the webp package: -

- -

apt install webp

- -

- Now you can easily convert your images to webp (keep in mind that it's much more effective to first size your images appropriately before this). - Using the below command, you can specify the quality of the photo with the q option. - I typically shoot for a quality in the range of 60-80, depending on the image and how large it will be displayed on the webpage. -

- -

cwebp -q 80 your-photo.png -o your-photo.webp

- -

- You can now check the difference in size of the images using ls. -

- -

ls -lh your-photo*

- -

- After utilizing webp images, the audit typically goes away, but if you didn't scale your image properly before hand, it may still linger. -

- -

Accessibility

- -

Image elements do not have [alt] attributes

- -

- It may seem silly to add alt attributes to images, but it helps screen readers convey images to users and can help page rank as a result. - The alt attribute should simply describe the image being displayed. -

- -

<img src="img/cabin.webp" alt="A cabin nestled between pine trees">

- -

SEO

- -

Document does not have a meta description

- -

- Adding meta descriptions to your webpage allow for web-crawlers and bots to easily determine what content your website contains. - Just like on other online platforms, you can give your webpage a long list of keywords to help increase the chance someone stumbles upon your site from a search engine. - You don't need to add all of the below meta tags to pass the audit, only add what's necessary. -

- -


-// Instructions for web scrapers
-<meta name="robots" content="index, follow">
-
-<meta name="description" content="your website description>">
-<meta name="keywords" content="your, keywords, here">
-<meta name="author" content="your name>">
-
-// Facebook specific standard, but many websites use this so it has become almost standard to include
-<meta property="og:site_name" content="Site Name">
-<meta name="twitter:domain" property="twitter:domain" content="example.org">
-<meta name="og:title" property="og:title" content="Site Name">
-<meta property="og:description" content="your website description">
-<meta name="twitter:description" property="twitter:description" content="your website description">
-<meta name="og:image" content="https://link-to-an-image-that-represents-your-site">
-
-// below is for twitter sharing previews, you can test this at:
-// cards-dev.twitter.com
-<meta property="twitter:card" content="https://link-to-an-image-that-represents-your-site">
-<meta name="twitter:image:src" property="twitter:image:src" content="https://link-to-an-image-that-represents-your-site">
-<meta name="twitter:image" property="twitter:image" content="https://link-to-an-image-that-represents-your-site">
-<meta name="og:image:alt" property="og:image:alt" content="alt text for your image>">
-
-<meta property="og:url" content="example.org">
-<meta property="og:type" content="website">
-
-// If you have accounts on twitter or facebook that are relevant to your site
-<meta property="fb:admins" content="facebook group" >
-<meta name="twitter:site" property="twitter:site" content="@yourTwitterHandle">
-<meta name="twitter:creator" property="twitter:creator" content="@yourTwitterHandle>">
-

- -

- Written by Jacob. Donate Monero here. -

- - - diff --git a/peertube.html b/peertube.html deleted file mode 100644 index 1921821..0000000 --- a/peertube.html +++ /dev/null @@ -1,222 +0,0 @@ - - - - PeerTube Instance – LandChad.net - - - - - - - -

PeerTube Instance

- -

PeerTube is a self-hosted and (optionally) federated video sharing platform that saves bandwith on videos the more people watch. - PeerTube instances can follow each other to share videos and grow the federated network, - but you can always keep your instance to yourself if you choose to.

- -

Note on Bandwidth

- -

- Video sharing is the most bandwidth intensive thing on the internet! - If you plan on just having a small personal site with a few viewers and friends, that won't be a big concern, - but most VPS providers like Vultr have caps on how much bandwidth can be used within a month without being throttled. - This level is far beyond what most sites need, but it might be an issue with a video site! -

- -

- So if you plan on having a big video-sharing PeerTube site, it's a good idea to host it with a provider that offers infinite bandwidth. - I strongly recommend getting a separate VPS with Frantech/BuyVM. - They have unmetered bandwidth, extremely cheap block storage for hosting many, many videos and they even have a good record of being censorship resistant. -

- -

Prerequisites

- -

Most of PeerTube's dependencies can be installed with this command:

- -

apt install -y curl sudo unzip vim ffmpeg postgresql postgresql-contrib g++ make redis-server git python-dev cron wget

- -

It's also important to start all associated daemons:

- -

systemctl start postgresql redis

- -

PeerTube also requires NodeJS 14 and yarn which cannot be installed from the Debian repositories. This means they have to be installed from separate, external repos:

- -

curl -fsSL https://deb.nodesource.com/setup_14.x | bash -
-apt install -y nodejs
-npm install --global yarn

- -

Now we create a PeerTube user to run and handle PeerTube with the proper permissions:

- -

useradd -m -d /var/www/peertube -s /bin/bash -p peertube peertube

- -

Database

- -

PeerTube requires a PostgreSQL database to function. To create it, first make a new Postgres user named PeerTube:

- -

su -l postgres
-createuser -P peertube
-createdb -O peertube -E UTF8 -T template0 peertube_prod
-psql -c "CREATE EXTENSION pg_trgm;" peertube_prod
-psql -c "CREATE EXTENSION unaccent;" peertube_prod
-exit

- -

Be sure to make note of your Postgres user password, as it will be needed later when setting up PeerTube.

- -

Installation

- -

Using su -l, we will become the PeerTube user to create the required directories and download and install PeerTube itself with the proper permissions. - First, we create the required directories.

- -

su -l peertube
-mkdir config storage versions
-chmod 750 config

- -

Downloading PeerTube

Still as the PeerTube user, we can now check for the most recent PeerTube versions number, download and install it in the newly created versiond directory.

VERSION=$(curl -s https://api.github.com/repos/chocobozzz/peertube/releases/latest | grep tag_name | cut -d '"' -f 4)
-cd /var/www/peertube/versions
-wget "https://github.com/Chocobozzz/PeerTube/releases/download/${VERSION}/peertube-${VERSION}.zip"
-unzip peertube-${VERSION}.zip
-rm peertube-${VERSION}.zip

- -

Installation via Yarn

- -

The downloaded release can then be symbolically linked to /var/www/peertube/peertube-latest and yarn is used to install PeerTube:

- -

cd /var/www/peertube
-ln -s versions/peertube-${VERSION} ./peertube-latest
-cd ./peertube-latest
-yarn install --production --pure-lockfile

- -

Configuration

- -

PeerTube's default config file can be copied over to /var/www/peertube/config/production.yaml so it can actually be used:

- -

Note that we are still running these as the PeerTube user (having run su -l peertube).

- -

cd /var/www/peertube
-cp peertube-latest/config/production.yaml.example config/production.yaml

- -

Now the production.yaml file must be edited in the following ways:

- -

First, add the hostname:

- -

webserver:
-  https: true
-  hostname: 'example.org'
-  port: 443

- -

Then, the database:

- -

database:
-  hostname: 'localhost'
-  port: 5432
-  ssl: false
-  suffix: '_prod'
-  username: 'peertube'
-  password: 'your_password'
-  pool:
-     max: 5

- -

An email to generate the admin user:

- -

admin:
-  # Used to generate the root user at first startup
-  # And to receive emails from the contact form
-  email: 'chad@example.org'

- -

And optionally, email server information:

- -

smtp:
-  # smtp or sendmail
-  transport: smtp
-  # Path to sendmail command. Required if you use sendmail transport
-  sendmail: null
-  hostname: mail.example.org
-  port: 465 # If you use StartTLS: 587
-  username: your_email_username
-  password: your_email_password
-  tls: true # If you use StartTLS: false
-  disable_starttls: false
-  ca_file: null # Used for self signed certificates
-  from_address: 'admin@example.org'

- -

At this point, we have done all we need to do as the PeerTube user. Run exit or press Ctrl-d to log out and return to the root prompt where we will configure Nginx and other system settings.

- -

Certbot

- -

First, we will want a Certbot SSL certificate to encrypt connections to our PeerTube instance. - Just run the following:

- -

certbot --nginx -d peertube.example.org certonly

- -

Nginx

- -

PeerTube includes an Nginx configuration that can be copied over to /etc/nginx/sites-available: - -

cp /var/www/peertube/peertube-latest/support/nginx/peertube /etc/nginx/sites-available/peertube

- -

Because the PeerTube config is so long, it's recommended to use sed to modify the contents of the file, - replacing ${WEBSERVER_HOST} with your hostname, - and $(PEERTUBE_HOST) with your localhost and port, which by default should be 127.0.0.1:9000: - -

sed -i 's/${WEBSERVER_HOST}/example.org/g' /etc/nginx/sites-available/peertube
-sed -i 's/${PEERTUBE_HOST}/127.0.0.1:9000/g' /etc/nginx/sites-available/peertube

- -

Once you're happy with the Nginx config file, link it to sites-enabled to activate it:

- -

ln -s /etc/nginx/sites-available/peertube /etc/nginx/sites-enabled/peertube

- -

Running PeerTube

- -

A config file for a systemd daemon is included in PeerTube and can be setup and started like so:

- -

cp /var/www/peertube/peertube-latest/support/systemd/peertube.service /etc/systemd/system/
-systemctl daemon-reload
-systemctl start peertube

- -

- PeerTube will take a momemnt to start, but after it does, you can check its status with systemctl status peertube and at this point, your PeerTube site should be live! -

- -

Using PeerTube

- -

To set a password for your admin user, run:

- -

cd /var/www/peertube/peertube-latest
-NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production npm run reset-password -- -u root

- -

Login to your PeerTube instance using the admin email specified in your production.yaml file and the admin password you just set.

- -

Once logged in, it's recommended to create a separate user without admin privileges for uploading videos to PeerTube. - This can be done easily from the users tab in the administration section.

- -

Enjoy your PeerTube instance!

- -

Updating PeerTube

- -

PeerTube is constantly adding new features, so it's a good idea to check for new updates and add them if you wish. Just in the past year, they have added livestreaming and more.

- -

Updating is fairly easy now since an upgrade.sh script has been added. Just run:

- -

cd /var/www/peertube/peertube-latest/scripts && sudo -H -u peertube ./upgrade.sh

- -

- Although check the changelog to see if there are additional manual requirements for particular updates. -

- -

Written by Denshi. Donate Monero here [QR]

- - - diff --git a/pix/auth.svg b/pix/auth.svg deleted file mode 100644 index 5b17192..0000000 --- a/pix/auth.svg +++ /dev/null @@ -1,1461 +0,0 @@ - - - - diff --git a/pix/bat.svg b/pix/bat.svg deleted file mode 100644 index 2154658..0000000 --- a/pix/bat.svg +++ /dev/null @@ -1,22 +0,0 @@ - - - diff --git a/pix/bitcoin-01.png b/pix/bitcoin-01.png deleted file mode 100644 index 8f38d0e..0000000 Binary files a/pix/bitcoin-01.png and /dev/null differ diff --git a/pix/bitcoin-02.png b/pix/bitcoin-02.png deleted file mode 100644 index a566a18..0000000 Binary files a/pix/bitcoin-02.png and /dev/null differ diff --git a/pix/bitcoin-03.png b/pix/bitcoin-03.png deleted file mode 100644 index dd02d8d..0000000 Binary files a/pix/bitcoin-03.png and /dev/null differ diff --git a/pix/bitcoin-04.png b/pix/bitcoin-04.png deleted file mode 100644 index 104f179..0000000 Binary files a/pix/bitcoin-04.png and /dev/null differ diff --git a/pix/brave-01.png b/pix/brave-01.png deleted file mode 100644 index 7b5b0dd..0000000 Binary files a/pix/brave-01.png and /dev/null differ diff --git a/pix/brave-02.png b/pix/brave-02.png deleted file mode 100644 index 555eca8..0000000 Binary files a/pix/brave-02.png and /dev/null differ diff --git a/pix/brave-03.png b/pix/brave-03.png deleted file mode 100644 index 7074971..0000000 Binary files a/pix/brave-03.png and /dev/null differ diff --git a/pix/brave-04.gif b/pix/brave-04.gif deleted file mode 100644 index 54cfd7a..0000000 Binary files a/pix/brave-04.gif and /dev/null differ diff --git a/pix/btc.png b/pix/btc.png deleted file mode 100644 index bbe842c..0000000 Binary files a/pix/btc.png and /dev/null differ diff --git a/pix/btc.svg b/pix/btc.svg deleted file mode 100644 index b3fd9e3..0000000 --- a/pix/btc.svg +++ /dev/null @@ -1,7 +0,0 @@ - - \ No newline at end of file diff --git a/pix/calibre.png b/pix/calibre.png deleted file mode 100644 index 81adc85..0000000 Binary files a/pix/calibre.png and /dev/null differ diff --git a/pix/calibre/calibre-1.png b/pix/calibre/calibre-1.png deleted file mode 100644 index cf767e0..0000000 Binary files a/pix/calibre/calibre-1.png and /dev/null differ diff --git a/pix/calibre/calibre-2.png b/pix/calibre/calibre-2.png deleted file mode 100644 index e0c76ba..0000000 Binary files a/pix/calibre/calibre-2.png and /dev/null differ diff --git a/pix/certbot-01.png b/pix/certbot-01.png deleted file mode 100644 index 37d81f8..0000000 Binary files a/pix/certbot-01.png and /dev/null differ diff --git a/pix/certbot-02.png b/pix/certbot-02.png deleted file mode 100644 index 24905f8..0000000 Binary files a/pix/certbot-02.png and /dev/null differ diff --git a/pix/certbot-03.png b/pix/certbot-03.png deleted file mode 100644 index 1a60fe9..0000000 Binary files a/pix/certbot-03.png and /dev/null differ diff --git a/pix/cgit.svg b/pix/cgit.svg deleted file mode 100644 index 72eafa6..0000000 --- a/pix/cgit.svg +++ /dev/null @@ -1,58 +0,0 @@ - - - - diff --git a/pix/chad.gif b/pix/chad.gif deleted file mode 100644 index 98b8904..0000000 Binary files a/pix/chad.gif and /dev/null differ diff --git a/pix/dns-epik.png b/pix/dns-epik.png deleted file mode 100644 index 33d2c40..0000000 Binary files a/pix/dns-epik.png and /dev/null differ diff --git a/pix/dns-ipv4-done.png b/pix/dns-ipv4-done.png deleted file mode 100644 index 1195f06..0000000 Binary files a/pix/dns-ipv4-done.png and /dev/null differ diff --git a/pix/dns-ipv4.png b/pix/dns-ipv4.png deleted file mode 100644 index d9c14cd..0000000 Binary files a/pix/dns-ipv4.png and /dev/null differ diff --git a/pix/dns-ipv6-done.png b/pix/dns-ipv6-done.png deleted file mode 100644 index 0559575..0000000 Binary files a/pix/dns-ipv6-done.png and /dev/null differ diff --git a/pix/dns-ipv6.png b/pix/dns-ipv6.png deleted file mode 100644 index 8fffd6a..0000000 Binary files a/pix/dns-ipv6.png and /dev/null differ diff --git a/pix/dns-ping.png b/pix/dns-ping.png deleted file mode 100644 index f900774..0000000 Binary files a/pix/dns-ping.png and /dev/null differ diff --git a/pix/dns-vultr.png b/pix/dns-vultr.png deleted file mode 100644 index 9db0be7..0000000 Binary files a/pix/dns-vultr.png and /dev/null differ diff --git a/pix/domain-cart.png b/pix/domain-cart.png deleted file mode 100644 index 7f55880..0000000 Binary files a/pix/domain-cart.png and /dev/null differ diff --git a/pix/domain-search.png b/pix/domain-search.png deleted file mode 100644 index e99ca2a..0000000 Binary files a/pix/domain-search.png and /dev/null differ diff --git a/pix/ejabberd-admin.jpg b/pix/ejabberd-admin.jpg deleted file mode 100644 index 9bbd4ed..0000000 Binary files a/pix/ejabberd-admin.jpg and /dev/null differ diff --git a/pix/ejabberd-login.jpg b/pix/ejabberd-login.jpg deleted file mode 100644 index 8904aaf..0000000 Binary files a/pix/ejabberd-login.jpg and /dev/null differ diff --git a/pix/element.svg b/pix/element.svg deleted file mode 100644 index d29423e..0000000 --- a/pix/element.svg +++ /dev/null @@ -1,6 +0,0 @@ - \ No newline at end of file diff --git a/pix/git.svg b/pix/git.svg deleted file mode 100644 index 2e42bc7..0000000 --- a/pix/git.svg +++ /dev/null @@ -1,15 +0,0 @@ - - - - diff --git a/pix/gitea-push-create.png b/pix/gitea-push-create.png deleted file mode 100644 index ca79c71..0000000 Binary files a/pix/gitea-push-create.png and /dev/null differ diff --git a/pix/gitea.svg b/pix/gitea.svg deleted file mode 100644 index 9df6b83..0000000 --- a/pix/gitea.svg +++ /dev/null @@ -1,31 +0,0 @@ - - diff --git a/pix/github.svg b/pix/github.svg deleted file mode 100644 index 93af7db..0000000 --- a/pix/github.svg +++ /dev/null @@ -1,3 +0,0 @@ - \ No newline at end of file diff --git a/pix/html-01.png b/pix/html-01.png deleted file mode 100644 index c984971..0000000 Binary files a/pix/html-01.png and /dev/null differ diff --git a/pix/html-02.png b/pix/html-02.png deleted file mode 100644 index d2f70d0..0000000 Binary files a/pix/html-02.png and /dev/null differ diff --git a/pix/html2-01.png b/pix/html2-01.png deleted file mode 100644 index b808c0e..0000000 Binary files a/pix/html2-01.png and /dev/null differ diff --git a/pix/i2p.svg b/pix/i2p.svg deleted file mode 100644 index 5dc629b..0000000 --- a/pix/i2p.svg +++ /dev/null @@ -1,98 +0,0 @@ - - - \ No newline at end of file diff --git a/pix/imgcompress-cat.png b/pix/imgcompress-cat.png deleted file mode 100644 index 7243ae8..0000000 Binary files a/pix/imgcompress-cat.png and /dev/null differ diff --git a/pix/imgcompress-network.png b/pix/imgcompress-network.png deleted file mode 100644 index 09bc401..0000000 Binary files a/pix/imgcompress-network.png and /dev/null differ diff --git a/pix/irc.svg b/pix/irc.svg deleted file mode 100644 index 0f48379..0000000 --- a/pix/irc.svg +++ /dev/null @@ -1,57 +0,0 @@ - - - diff --git a/pix/irc/hexchat-connection-complete.png b/pix/irc/hexchat-connection-complete.png deleted file mode 100644 index 096ae01..0000000 Binary files a/pix/irc/hexchat-connection-complete.png and /dev/null differ diff --git a/pix/irc/hexchat-network-edit.png b/pix/irc/hexchat-network-edit.png deleted file mode 100644 index 4a0fb6f..0000000 Binary files a/pix/irc/hexchat-network-edit.png and /dev/null differ diff --git a/pix/irc/hexchat-network-select.png b/pix/irc/hexchat-network-select.png deleted file mode 100644 index 9f4ffe3..0000000 Binary files a/pix/irc/hexchat-network-select.png and /dev/null differ diff --git a/pix/irc/hexchat-sasl.png b/pix/irc/hexchat-sasl.png deleted file mode 100644 index ce77149..0000000 Binary files a/pix/irc/hexchat-sasl.png and /dev/null differ diff --git a/pix/irc/textual-identity.png b/pix/irc/textual-identity.png deleted file mode 100644 index a2fce22..0000000 Binary files a/pix/irc/textual-identity.png and /dev/null differ diff --git a/pix/irc/textual-network-edit.png b/pix/irc/textual-network-edit.png deleted file mode 100644 index 1eb4dc7..0000000 Binary files a/pix/irc/textual-network-edit.png and /dev/null differ diff --git a/pix/itoopie.svg b/pix/itoopie.svg deleted file mode 100644 index 39e430d..0000000 --- a/pix/itoopie.svg +++ /dev/null @@ -1 +0,0 @@ - diff --git a/pix/jitsi-01.webp b/pix/jitsi-01.webp deleted file mode 100644 index a71f1ae..0000000 Binary files a/pix/jitsi-01.webp and /dev/null differ diff --git a/pix/jitsi.svg b/pix/jitsi.svg deleted file mode 100644 index 5a3526a..0000000 --- a/pix/jitsi.svg +++ /dev/null @@ -1,650 +0,0 @@ - - - - diff --git a/pix/landchad.gif b/pix/landchad.gif deleted file mode 100644 index 302cd26..0000000 Binary files a/pix/landchad.gif and /dev/null differ diff --git a/pix/matrix.svg b/pix/matrix.svg deleted file mode 100644 index 9a8b8dd..0000000 --- a/pix/matrix.svg +++ /dev/null @@ -1,48 +0,0 @@ - - - diff --git a/pix/monero-01.png b/pix/monero-01.png deleted file mode 100644 index 44f7a62..0000000 Binary files a/pix/monero-01.png and /dev/null differ diff --git a/pix/monero-02.png b/pix/monero-02.png deleted file mode 100644 index 1ef8bbc..0000000 Binary files a/pix/monero-02.png and /dev/null differ diff --git a/pix/monero-03.png b/pix/monero-03.png deleted file mode 100644 index 52bebbe..0000000 Binary files a/pix/monero-03.png and /dev/null differ diff --git a/pix/monero-04.png b/pix/monero-04.png deleted file mode 100644 index 228734c..0000000 Binary files a/pix/monero-04.png and /dev/null differ diff --git a/pix/nextcloud.svg b/pix/nextcloud.svg deleted file mode 100644 index 6f2e1a3..0000000 --- a/pix/nextcloud.svg +++ /dev/null @@ -1 +0,0 @@ - \ No newline at end of file diff --git a/pix/nginx-password.png b/pix/nginx-password.png deleted file mode 100644 index a1ae5e5..0000000 Binary files a/pix/nginx-password.png and /dev/null differ diff --git a/pix/nginx-website.png b/pix/nginx-website.png deleted file mode 100644 index 40d5236..0000000 Binary files a/pix/nginx-website.png and /dev/null differ diff --git a/pix/openalias-01.png b/pix/openalias-01.png deleted file mode 100644 index b239634..0000000 Binary files a/pix/openalias-01.png and /dev/null differ diff --git a/pix/openalias-02.png b/pix/openalias-02.png deleted file mode 100644 index 03a45b0..0000000 Binary files a/pix/openalias-02.png and /dev/null differ diff --git a/pix/openalias-03.png b/pix/openalias-03.png deleted file mode 100644 index 9e2ba0b..0000000 Binary files a/pix/openalias-03.png and /dev/null differ diff --git a/pix/openalias-04.png b/pix/openalias-04.png deleted file mode 100644 index 35caf10..0000000 Binary files a/pix/openalias-04.png and /dev/null differ diff --git a/pix/openalias-05.png b/pix/openalias-05.png deleted file mode 100644 index a435462..0000000 Binary files a/pix/openalias-05.png and /dev/null differ diff --git a/pix/peertube-login.jpg b/pix/peertube-login.jpg deleted file mode 100644 index d191cc4..0000000 Binary files a/pix/peertube-login.jpg and /dev/null differ diff --git a/pix/peertube.svg b/pix/peertube.svg deleted file mode 100644 index 38992a5..0000000 --- a/pix/peertube.svg +++ /dev/null @@ -1,118 +0,0 @@ - - diff --git a/pix/pleroma.svg b/pix/pleroma.svg deleted file mode 100644 index c92da7c..0000000 --- a/pix/pleroma.svg +++ /dev/null @@ -1,2 +0,0 @@ - - diff --git a/pix/prosody.svg b/pix/prosody.svg deleted file mode 100644 index 9edae9b..0000000 --- a/pix/prosody.svg +++ /dev/null @@ -1,9 +0,0 @@ - \ No newline at end of file diff --git a/pix/radicale.svg b/pix/radicale.svg deleted file mode 100644 index 546d3d1..0000000 --- a/pix/radicale.svg +++ /dev/null @@ -1,10 +0,0 @@ - - diff --git a/pix/rss.svg b/pix/rss.svg deleted file mode 100644 index 35afbe2..0000000 --- a/pix/rss.svg +++ /dev/null @@ -1,33 +0,0 @@ - - - - \ No newline at end of file diff --git a/pix/searxng.svg b/pix/searxng.svg deleted file mode 100644 index 417e7ed..0000000 --- a/pix/searxng.svg +++ /dev/null @@ -1,19 +0,0 @@ - - \ No newline at end of file diff --git a/pix/server-features.png b/pix/server-features.png deleted file mode 100644 index 6891b46..0000000 Binary files a/pix/server-features.png and /dev/null differ diff --git a/pix/server-location.png b/pix/server-location.png deleted file mode 100644 index b97e8d2..0000000 Binary files a/pix/server-location.png and /dev/null differ diff --git a/pix/server-size.png b/pix/server-size.png deleted file mode 100644 index 39ddc33..0000000 Binary files a/pix/server-size.png and /dev/null differ diff --git a/pix/server-type.png b/pix/server-type.png deleted file mode 100644 index 188b101..0000000 Binary files a/pix/server-type.png and /dev/null differ diff --git a/pix/ssh-01.png b/pix/ssh-01.png deleted file mode 100644 index 855f313..0000000 Binary files a/pix/ssh-01.png and /dev/null differ diff --git a/pix/tor.svg b/pix/tor.svg deleted file mode 100644 index 4d7eefd..0000000 --- a/pix/tor.svg +++ /dev/null @@ -1,41 +0,0 @@ - - \ No newline at end of file diff --git a/pix/webrtc.svg b/pix/webrtc.svg deleted file mode 100644 index 582a506..0000000 --- a/pix/webrtc.svg +++ /dev/null @@ -1,16 +0,0 @@ - - \ No newline at end of file diff --git a/pix/xmpp.svg b/pix/xmpp.svg deleted file mode 100644 index c9d7536..0000000 --- a/pix/xmpp.svg +++ /dev/null @@ -1,26 +0,0 @@ - - - - diff --git a/pix/xmr.png b/pix/xmr.png deleted file mode 100644 index 00cfa96..0000000 Binary files a/pix/xmr.png and /dev/null differ diff --git a/pix/xmr.svg b/pix/xmr.svg deleted file mode 100644 index 002ad9b..0000000 --- a/pix/xmr.svg +++ /dev/null @@ -1,7 +0,0 @@ - - diff --git a/pleroma.html b/pleroma.html deleted file mode 100644 index 755692a..0000000 --- a/pleroma.html +++ /dev/null @@ -1,169 +0,0 @@ - - - - Setup a Pleroma Server – LandChad.net - - - - - - - -

Setup a Pleroma Server

- -

Hopefully by now you won't have to be sold on the invasive practices that social media companies conduct. Websites such as Facebook and Twitter aquire so much data on users that they often know more about you than you know about yourself. - -The simple solution to this is to not use social media. However, that just isn't an option for most people. So the next best thing is to setup a self-hosted and federalised social media site so that you have full control over your data. - -I've previously made a video showing all the steps in depth if you want to check it out. If you run into any issues I suggest you look at the video. -

- -

You'll need a server or VPS. Nearly any Operating system is supported but for this tutorial I'm gonna presume you're using a Debian-based OS. You'll also need a domain name pointing to your server's IP address which is explained in this tutorial. -

- - - -

Installation

- -

Setting Up and Configuring

- -

First things first you'll need to make sure that you've hardened you SSH so that password authentication is disabled and you'll also want to setup Fail2Ban. -There's a great tutorial on how to do this which can be read here. -

- -

-Next we'll install the required packages: -

- -

apt install -y curl unzip libncurses5 postgresql postgresql-contrib nginx certbot libmagic-dev

- -

-You can manually configure postgreSQL to suit your system better. Check out the documentation here and then run the below command: -

- -

systemctl restart postgresql

- - -

Installing the Pleroma App

- -

First as the root user

-Pleroma is not in the Debian app repositories, so we will install it manually. -First create the Pleroma user by running the below command: -

- -

useradd -m -s /bin/bash -d /opt/pleroma pleroma

- -

-Then, still as root, we will create the required directories and give the Pleroma user ownership of them. -

- -

mkdir -p /var/lib/pleroma/uploads
-chown -R pleroma /var/lib/pleroma
-mkdir -p /var/lib/pleroma/static
-chown -R pleroma /var/lib/pleroma
-mkdir -p /etc/pleroma
-chown -R pleroma /etc/pleroma

- -

Now, as the new Pleroma user

- -

-Now run su -l pleroma to login as the Pleroma user. -Now use the curl command below to download the Pleroma software and unzip it. -

- -

curl 'https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=amd64' -o /tmp/pleroma.zip
-unzip /tmp/pleroma.zip -d /tmp/

- - - -

mv /tmp/release/* /opt/pleroma
-rmdir /tmp/release
-rm /tmp/pleroma.zip
-./bin/pleroma_ctl instance gen --output /etc/pleroma/config.exs --output-psql /tmp/setup_db.psql

- -

We need to briefly return to the root user so we can run the following command (via the postgres user) to set up the database. -Type ctrl-d or run exit to return to the root user, then run: -

- -

su postgres -s $SHELL -lc "psql -f /tmp/setup_db.psql"

- -

Then return to the pleroma user with su -l pleroma and we will test to see that Pleroma can run:

- -

./bin/pleroma_ctl migrate
-./bin/pleroma daemon

- -

-That will initialize Pleroma. It might take as long as a minute to get started, so wait a bit, then run the following: -

curl http://localhost:4000/api/v1/instance

- -

If everything is working, this command will give you a long line of messy output. If it is not, you will get a connection error message. -Once it is working successfully, stop the Pleroma daemon and we will interface Pleroma with the web server.

- -

./bin/pleroma stop

- -

Setup and Configure Nginx

- -

-Return again to the root user. Let's copy Pleroma's Nginx configuration file from the template given in the installation and enable it: -

- -

cp /opt/pleroma/installation/pleroma.nginx /etc/nginx/sites-available/pleroma.conf
-ln -s /etc/nginx/sites-available/pleroma.conf /etc/nginx/sites-enabled/pleroma.conf

- -

Edit the etc/nginx/sites-available/pleroma.conf file and replace example.tld with your domain name.

- -

-We now have to get a SSL certificate to enable encryption, since we have a model configuration that already includes SSL information, -just check the brief the standalone certificate page to get the needed certificate. -Once you've got your cert setup, copy over the Nginx configuration with the below command: -

- -

-Once everything, including your Cerbot certificate is ready, simply reload Nginx with this command: -

- -

systemctl reload nginx

- - -

Setting up the service

- -

-Pleroma itself runs on a SystemD service similar to other things running on your server like Nginx. To start the service up run the below commands: -

- -

cp /opt/pleroma/installation/pleroma.service /etc/systemd/system/pleroma.service
-systemctl start pleroma
-systemctl enable pleroma

- -

-If everything worked then when you go to your domain in the web browser you should see a bare-bones Pleroma instance. -

- - -

Creating an Admin User

- -

You'll be able to create new accounts on the Pleroma instance in the login section on the website but the easiest way to setup an admin account is with the CLI. Simply run the below command replaced with your username: -

- -

su -l pleroma
-./bin/pleroma_ctl user new username username@example.org --admin

- -

-If you run into any issues then feel free to checkout the documentation or send me an email or message. My details are below. -

- -

biasedriot.co
youtube
Bitcoin: 1Dmn9jEtWAhdLk1HHWkUVNeDdAaBCwNajm
Monero: 84Y4FZiTbLeR5qc1fBrBhB1yq5agKtEdoixq2w1ysXJv486MiBCz3czGT15bqeXDPpdLoNyF93inxY3BCk6g8mrDMNKoArS

- -

- - - diff --git a/prosody.html b/prosody.html deleted file mode 100644 index 07f42b9..0000000 --- a/prosody.html +++ /dev/null @@ -1,257 +0,0 @@ - - - - Prosody (an XMPP Server) – LandChad.net - - - - - - - -

Prosody (an XMPP Server)

- -

XMPP is a fantastically simple protocol that's usually used as a messenger. - It's highly extensible, - better than IRC, - lighter and more decentralized than Matrix - and Telegram and normie social media can't hold a candle to it. -

- -

- XMPP is so decentralized and extensible that there are many different XMPP servers. - Here, let's set up an Prosody XMPP server. -

- -

Installation

- -

- Prosody is in the Debian repositories, so we can easily install it on our server with the following command: -

- -

apt install prosody

- - -

Configuration

- -

-The Prosody configuration file is in /etc/prosody/prosody.cfg.lua. -To set it all up, we will be changing several things. -

- -

Setting Admins

- -

-Let's go ahead and set who our admin(s) will be. -Find the line that says admins = { } and to this we can specify one or more server admins. -

- -

# To add one admin:
-admins = { "chad@example.org" }
-
-# We can add more than one by separating them by commas. (This file is written in Lua.)
-admins = { "chad@example.org", "chadmin@example.org" }

- -

-Note that we have not created these accounts yet, we will do this below. -

- -

Set the Server URL

- -

-Find the line VirtualHost "localhost" and replace localhost with your domain. -In our case, we will have VirtualHost "example.org" -

- -

Multi-User Chats

- -

-Most people will probably want the ability to have chats with more than two users. -This is easily enough to enable. -In the config file, add the following: -

- -

Component "chat.example.org" "muc"
-    modules_enabled = { "muc_mam" }
-    restrict_room_creation = "admin"

- -

-On the first line, you must have a separate subdomain for your multi-user chats. -I use the chat. subdomain, but some use muc.. -Anything if possible. -

- -

-The second line is important because it prevents non-admins from creating and squatting rooms on your server. -The only situation where you might not want that is if you indend to open a general public chat system for people you don't know. -

- - - -

Enabling chat histories

- -

-By default, Prosody will send out messages received only to the first available clients. -That means that if you have your desktop client turned off and your cell phone receives a message, it will not be available to the desktop client when you start it. -

- -

While this may be preferred in some cases, enable the MAM module (Message Archive Management) to have the server hold on messages and sync them to all clients.

- -

-Within the modules_enabled block, you can uncomment the mam line to enable it. -You can see other settings for this module here like, for example, how long a server should hold on to message histories for synching. -

- -

-Note also that Prosody comes with the carbons activated module by default, which is related. This will send received messages to all active clients (your phone and desktop), although it will not save messages like MAM for clients not online or to be added later. -

- -

File sharing

- -

With this we can bring XMPP to the level of other popular instant messaging applications like Matrix and whatsapp. It is extremely easy to setup. This part is optional, but it can make XMPP more normie-friendly if you plan on moving family members and friends over to XMPP.

- -

First we need to install extra prosody modules. Run the following command:

apt install prosody-modules

- -

Then we can add the following line to you prosody config file to enable file uploads:

Component "uploads.example.org" "http_upload"

- -

As you will notice, you need another subdomain for this. We will add an ssl certficate for this later.

- -

You will also need to go back to modules_enabled and uncomment the http_files module. This is used to actually serve the files to users.

- -

And the last part of the setup is to enable the built in proxy server. This helps with file transfers for devices behind a NAT, and unless you are using XMPP in a LAN, you probably need this. Enable the proxy by adding the following line to the config:

- -

Component "proxy.example.org" "proxy65"

- -

As you can see, another subdomain is needed. We will add ssl certificates for this later.

- -

At this point, file sharing is now setup and ready to be used. Although there are some concerns that should be addressed.

- -

A big concern with file sharing is large files, seeing as all files shared over XMPP will be stored on your server. This can become a problem when many (and large) files are being shared. We can put a cap on large files by adding the following line to our config:

http_upload_file_size_limit = 20971520

- -

This puts a 20MB cap on all files being shared. The value is specified in bytes. You can also specify after how long files should be deleted by adding the following line:

http_upload_expire_after = 60 * 60 * 24 * 7

- -

The value is specified in seconds. The above line will make prosody delete files after a week.

- -

If it is for some reason neccessary, you can also manually invoke expiry with the following command:

- -

prosodyctl mod_http_upload expire

- -

Other things to check

- -

Check the config file for other settings you might want to change. -For example, if you want to run a general public XMPP server, you can allow anyone to create an account by changing allow_registration to true. -

- -

Another thing you can do is enable the csi_simple module, which will add some optimizations for mobile devices.

- -

Another thing worth noting is the archive_expires_after = "1w" line. This specifies after how long message archives will be deleted.

- -

Also the smacks module helps a lot with slow internet connections.

- -

Certificates

- -

-Obviously, we want to have client-to-server and server-to-server encryption. -Nowadays, use can use Certbot to generate certificates and use a convenient command below prosodyctl to import them. -

- -

-If you have multi-user chat enabled, be sure to get a certificate for that subdomain as well. -Include the --nginx option assuming you have an Nginx server running. -

- -

certbot -d chat.example.org --nginx

- -

-If you have file sharing enabled, be sure to get a certificate for those subdomains as well. -

certbot -d uploads.example.org --nginx
-certbot -d proxy.example.org --nginx
-

- -

-Once you have the certificates for encryption, run the following to import them into Prosody. -

- -

prosodyctl --root cert import /etc/letsencrypt/live/

- -

-Note that you might get an error that a certificate has not been found if your muc subdomain and your main domain share a certificate. -It should still work, this is just notifying you that no specific certificate for the subdomain. -

- -

Note: The above command will need to be rerun when certificates are renewed. -You may want to create a cronjob to have this done automatically.

- - - -

Creating users/admins manually

- -

-Let's manually create the admin user we prepared for above. -Note that you can indeed do this in your XMPP client if you have not disabled registration, but this is how it is done on the command line: -

- -

prosodyctl adduser chad@example.org

- -

This will prompt you to create a password as well.

- - -

Make changes active

- -

-With any system service, use systemctl reload or systemctl restart to make the new settings active: -

- -

systemctl restart prosody

- -

Using your Server!

- -

-Once your server is set up, you just need an XMPP client to use your new and secure chat system. -

- -

GNU/Linux: Dino or Gajim
Windows: Gajim also runs on Windows.
Android: Conversations.im or snikket
Mac/iOS: Monal IM or Siskin for iOS alone
command-line (GNU/Linux, MacOS, Windows): Profanity
See a more complete list kept by XMPP

- -

-Install whichever of these clients you want on your computer or phone and you can log into your new XMPP server with the account you made. -Note that if you enabled public registration, anyone can create an account on your server through one of these clients. -

- -

Account addresses

- -

-XMPP account addressed look just like email addresses: username@example.org. -You can message any account on any XMPP server on the internet with that format. -

- -

Note on MUCs (multi-user chats)

- -

-Remember that MUCs are kept on a separate subdomain that we created and should've gotten a certificate for above, for example, chat.example.org. -Chatrooms are created and referred to in the following format: #chatroomname@chat.example.org. -

- -

- - - diff --git a/radicale.html b/radicale.html deleted file mode 100644 index 85bbf14..0000000 --- a/radicale.html +++ /dev/null @@ -1,70 +0,0 @@ - - - - Setting up Radicale – LandChad.net - - - - - - - -

Setting up a calDAV server - Radicale

- -

Radicale is an open source calDAV server. CalDAV is a widely supported internet standard for calendars, todo-lists and contacts. Hosting your own calDAV server allows sharing calendars between mutliple devices.

More information can be found on the projects offical website: radicale.org.

Installing Radicale

Firstly, we have to install radicale on our system, luckily for us radicale is packaged for the most used distros.

apt install radicale apache2-utils

Next we need to configure Radicale. We configure radicale to be accessible from other machines, how Radicale handles users and where the files should be stored. Open /etc/radicale/config with your favourite editor and add this configuration.

[server]
-# Bind all addresses
-hosts = 0.0.0.0:5232, [::]:5232
-
-[auth]
-type = htpasswd
-htpasswd_filename = /etc/radicale/users
-htpasswd_encryption = bcrypt
-
-[storage]
-filesystem_folder = /var/lib/radicale/collections

- -

As you can see under [auth] we use htpasswd to manage the users. Execute the following command to add a new user to Radicale.

htpasswd -c /etc/radicale/users username

As Radicale stands now it is fully functional and after starting it by executing its binary, can be accessed under example.org:5232. But there are two additional things we can do to make using and managing Radicale way easier.

Setting up a Nginx reverse proxy

Because the URL of your Radicale server is an URL you will have to remember and enter it on any device you want to use your calendar on it is advised to set up a reverse proxy.

server {
-	listen 443 ssl;
-	listen [::]:443 ssl;
-	server_name cal.example.org;
-	location / {
-		proxy_pass http://localhost:5232/; # The / is important!
-	}
-	# You can also leave these two lines out and use certbot
-	ssl_certificate /etc/ssl/nginx/cal.example.com/fullchain.pem;
-	ssl_certificate_key /etc/ssl/nginx/cal.example.com/privkey.pem;
-}

Run as a service

Running Radicale as a service makes managing it much easier. Add this config to /etc/systemd/system/radicale.service.

[Unit]
-Description=A simple CalDAV (calendar) and CardDAV (contact) server
-
-[Service]
-ExecStart=/usr/bin/env python3 -m radicale
-Restart=on-failure
-
-[Install]
-WantedBy=default.target

After creating the config load, start and enable the service with the following commands.

systemctl daemon-reload
-systemctl enable --now radicale

Contribution

Author: Jocomol – jocomol.ch -- XMR: 41kLv68Nk4N3zvTRFYtHZfRRFMgXkxK2FcXDeCSa4yNwBGTBa1WQ8HtXL8cCAcoZ2iSLBCS6HQqdpRSf56ecMBgWTkn2ARt -

- - - diff --git a/rss-bridge.html b/rss-bridge.html deleted file mode 100644 index 3fea0ff..0000000 --- a/rss-bridge.html +++ /dev/null @@ -1,98 +0,0 @@ - - - - Setting up RSS Bridge – LandChad.net - - - - - - - -

Setting up RSS Bridge

- -

RSS Bridge is a useful utility you can use to help you avoid the big tech sites, like Facebook and Twitter, which instead of the feed you usually would see, will be a based and minimalist RSS feed.

- - -

- - - -

Installation

- -

Setting Up and Configuring

- -

-Next we'll install the required packages: -

- -

apt install -y curl unzip nginx certbot php-fpm php-mysql php-cli php7.3-mbstring php7.3-curl php7.3-xml php7.3-sqlite3 php7.3-json

- -

We now have to create the website configuration file. Create/open the a file below:

nano /etc/nginx/sites-available/rss-bridge

And add the following content:

- -

server {
-    root /var/www/rss-bridge;
-    index index.php index.html index.htm index.nginx-debian.html;
-    server_name rss-bridge.example.org;
-
-    location / {
-            try_files $uri $uri/ =404;
-    }
-
-    location ~ \.php$ {
-            include snippets/fastcgi-php.conf;
-            fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
-    }
-
-    location ~ /\.ht {
-            deny all;
-    }
-}
-

- -

After you have saved the file, you need to create a symlink so the server actually will read the file.

ln -s /etc/nginx/sites-available/rss-bridge /etc/nginx/sites-enabled/rss-bridge

- -

Then we have to create the folder where the service will reside in.

mkdir -p /var/www/rss-bridge
-cd /var/www/rss-bridge
-

- -

Lets download the latest version of RSS-Bridge in the directory.

The newest version can be found here, at the time of writing that is "RSS-Bridge 2021-04-25."

wget https://github.com/RSS-Bridge/rss-bridge/archive/refs/tags/2021-04-25.zip

Unzip the file:

unzip 2021-04-25.zip

This will create a directory called rss-bridge-version-number, we now want to move all the file contents of the newly created directory to the one we are in

mv rss-bridge-2021-04-25/* .
-rm -rf rss-bridge-2021-04-25 2021-04-25.zip
-

- -

Now all we need to do is grant read/write permissions and reload the web server.

- -

chown -R www-data:www-data /var/www/rss-bridge
-systemctl reload nginx
-

- -

That's it, you should now have a working rss-bridge installed. But you should definately get an SSL certifcate installed which is done briefly here.

- - -

handskemager.xyz
Bitcoin: bc1qhfjgwjzksf2auqjefwpvq20wvyugq3lhqgkxvu
Monero: 88cPx6Gzv5RWRRJLstUt6hACF1BRKPp1RMka1ukyu2iuHT7iqzkNfMogYq3YdDAC8AAYRqmqQMkCgBXiwdD5Dvqw3LsPGLU

- -

- - - diff --git a/rss.xml b/rss.xml deleted file mode 100644 index 393aeb2..0000000 --- a/rss.xml +++ /dev/null @@ -1,2641 +0,0 @@ - - - - -LandChad.net: Web Guides for Internet Landchads! -Tutorials on minimalist webpage creation and server maintenance. -en-us -https://landchad.net/rss.xml - - -LandChad.net Web Guides for Internet LandChads -https://landchad.net/pix/chad.gif -https://landchad.net/rss.xml - - - - - -Setting up Cgit -https://landchad.net/cgit.html -https://landchad.net/cgit.html -Tue, 14 Sep 2021 14:06:48 -0400 - -

Setting up Cgit

- -

- Once you have your server hosting your git repositories, you might want to allow others to browse - your repositories on the web. Cgit is a Free Software that allows browsing git repositories through - the web.

- Note that Cgit is a read-only frontend for Git repositories and doesn't have issues, pull requests - or user management. If that's what you want, consider installing Gitea instead.

Installing cgit and fcgiwrap

Install fcgiwrap

- NGINX doesn't have the capability to run CGI scripts by itself, it depends on an intermediate layer - like fcgiwrap to run CGI scripts like cgit:

apt install fcgiwrap

And now we can install cgit itself with:

apt install cgit

Setting up NGINX

- You should have an NGINX server running with a TLS certificate by now. Add the following configuration - to your server to pass the requests to Cgit, while serving static files directly:


-server {
-	listen 443 ssl;
-	listen [::]:443 ssl;
-    ssl_certificate /etc/ssl/nginx/git.example.org.crt;
-    ssl_certificate_key /etc/ssl/nginx/git.example.org.key;
-    server_name git.example.org;
-	root /usr/share/cgit ;
-	try_files $uri @cgit ;
-	location @cgit {
-		include fastcgi_params;
-		fastcgi_param SCRIPT_FILENAME /usr/lib/cgit/cgit.cgi;
-		fastcgi_param PATH_INFO $request_uri;
-		fastcgi_param QUERY_STRING $query_string;
-		fastcgi_pass unix:/run/fcgiwrap.socket;
-	}
-}
-

Then get NGINX to reload your configuration.

Configuring cgit

You've got cgit up and running now, but you'll probably see it without any style and without any repository. - To change this, we need to configure Cgit to our liking, by editing /etc/cgitrc. -


-css=/cgit.css
-logo=/cgit.svg
-virtual-root=/
-# Title and description shown on top of each page
-root-title=Chad's git server
-root-desc=A web interface to LandChad's git repositories, powered by Cgit
-# The location where git repos are stored on the server
-scan-path=/srv/git/
-

This configuration assumes you followed the git hosting guide and store your repositories - on the /srv/git/ directory.

Cgit's configuration allows changing many settings, as documented on the cgitrc(5) manpage installed with - Cgit.

Changing the displayed repository owner

Cgit's main page shows each repo's owner, which is "git" in case you followed the git hosting guide, but you - might want to change the name to yours. Cgit shows the owner's system name, so you need to modify the git - user - to give it your name:


-usermod -c "Your Name" git
-

Changing the repository description

Navigate to your bare repository on the server and edit the description file inside it

Displaying the repository idle time

To do this, we need to create a post-receive hook for each repository that updates the file cgit uses - to determine the idle time. Inside your repository, create a file hooks/post-receive and add - the following contents:


-#!/bin/sh
-agefile="$(git rev-parse --git-dir)"/info/web/last-modified
-mkdir -p "$(dirname "$agefile")" &&
-git for-each-ref \
-	--sort=-authordate --count=1 \
-	--format='%(authordate:iso8601)' \
-	>"$agefile"
-

And give it execution permissions with:

chmod +x hooks/post-receive

Next time you push to that repository, the idle time should reset and show the correct value.

Contribution

Ariel Costas – website, donations

- -]]> - - - - -Self hosting -https://landchad.net/selfhosting.html -https://landchad.net/selfhosting.html -Sun, 29 Aug 2021 15:35:48 -0400 -

Self hosting

- -

Introduction

When you have a(n old) computer lying around, and you have cheap electricity and a good internet connection, self hosting might be a good option for you.

Why would you choose selfhosting?

- You have control over the hardware, and you can upgrade your server in the future. For example: if you host a file server and your hard drive goes full, you can simply add another hard drive or upgrade it. -
- No bandwith limits, storage limits, etc. (some VPSes have this) -
- It can be cheaper than using a VPS. This only is the case if you got the server for really cheap and your electricity is cheap. -
- You can have a media server to consoom your content (for example with Jellyfin). You can technically do this on a VPS, but that will be more expensive than self hosting. If you have a media server, you can stream media from your server to more devices. (I recommend just downloading it on your device, but if you have multiple devices, this could be a good solution) -

- -

Downsides

Some possible downsides of choosing to host at home could be:

- Your ISP not approving of what you're doing. Some ISP's do not condone you hosting at home. Usually when this is the case, it could be harder if you want to forward ports, or it could be impossible to get a static IP address. Check your ISP's terms of service. Sometimes, it will say that hosting a webserver, email server, and more, is not allowed. -
- This can also include blocked ports. ISPs can block certain ports to the world. Sometimes ISPs only block 445/139 (which is for the better as Samba, using these ports isn't really secure and it's outdated). But some ISPs (sadly) block crucial ports like 80 and/or 443. You need to check this before trying anything. If this is the case, a way to get around it is to get another ISP or use an alternative port. A great website to check this is: canyouseeme.org. You can also check if you did the port forwaring correctly here.
- Security. Opening your network to the public could bring security risks. For example, never open a Samba server to the public, because it's a pretty old protocol, and it has some security vulnerabilities. Be sure you are forwarding the right port, and don't just forward random ports to the internet. Also, if you are getting DDoSed, your ISP will temporarily shut down your whole internet connection. -
- When setting up an email server, it can be way harder to not have your email show up as spam in other's people email. If you use a VPS, this is way easier. -
- Space, power consumption and noise. Of course, this differs per server. -

Your mileage may vary, go and check each of these points, and see if selfhosting is the right choice for you. Try and calculate your power consumption and see if your electricity cost is not too expensive.

For me, the upsides outweighed the downsides, which is why I chose to host at home. But, this differs with each person and scenario. Go and research what your exact situation is, before trying anything. Otherwise you'll have to face some bad surprises.

Hardware

- -

What kind of hardware should you choose?

If you pay your own electricity bill, power consumption is a big factor. Most old laptop computers are ideal in the sense that they don't use a lot of power, and if the battery still works, you have a built-in UPS! The bad thing is, most old laptop computers aren't that powerful, and they lack in upgradability. (you shouldn't really be using anything older than 2006, and I recommend at least a performance equivalant of a Core 2 CPU) -

If you can find an energy efficient desktop (under 100W), that is a great option. They are pretty upgradable and they don't use a lot of power. They can also be pretty cheap, but old laptops are usually cheaper. If you can afford new hardware, and are willing to build a PC, you can find really power effecient CPU/motherboard combos, and they can be cheap, for example the Celeron J3060. I recommend a low wattage power supply or an effecient one for these kinds of builds. Pico PSUs are pretty tiny and efficient solutions in these builds.

Of course, if you don't pay your electricity bill or cost is not a problem for you, you can use just about any old desktop (as long as it's not from the 90's, I recommend at least a Core 2 chip again, or an Athlon 64 X2).

Usecases

Of course, hardware choices depend on the usecase. The above recommendations I gave you work fine for e-mail server, webserver and fileserver types of applications, but they will struggle to transcode video if you are going to host a media server. You'll need a faster CPU, but also a faster GPU. As an example, the Athlon 200GE or 3000G are good and efficient choices for these builds. They are decent CPUs, but also have a built in GPU that will transcode video just fine.

- If you need a lot of storage, go for a case with a lot of mounts for hard drives, this way you can easily mount multiple hard drives. Pros of multiple hard drives are redundancy and speed. Cons could be that they create more heat and noise. You can't use a laptop if you want multiple drives, except if you use a hard drive caddy for the CD/DVD drive bay. Some business laptops even support RAID 1 (redundancy) and RAID 0 (speed and more storage, but you lose your files if one hard drive breaks) this way.

Getting started

Installing Debian

Once you have the machine, you can install the OS. I recommend Debian, as all of the guides on this website are Debian specific. Debian just werks as a server OS.

You'll need to burn a Debian install image onto a USB flash drive or a CD. You can download the image here, and you can also find information on how to burn the image onto a USB flash drive or CD there. -

While installing Debian, do not install any desktop environment. But install an SSH server when you get the chance. Also leave webserver unchecked, even if you want to use it as a webserver. You'll have a chance to install this later.

Port forwaring

Every time you are going to set up a new server program, you need to forward a port corresponding to that program. For example, HTTP is port 80, HTTPS is 443, etc. You need to set this up on your router's NAT settings (sometimes just called port forwarding, this differs per router). These steps differ for each router. Refer to your routers manual. A simple command to see what your servers IP address is, is to run ifconfig on your server. This shows a lot of network info, but it will also show your local IP address needed for port forwarding. -

Basic ports:

- SSH: port 22 (open this port if you want to admin your server outside your network) -
- HTTP: port 80 (open this port if you want basic webserver functionality) -
- HTTPS: port 443 (you should open this port if you are setting up a webserver because encryption) -

- -

Static or dynamic IP address

If you want to host your server at home, make sure you have a static IP address, or you can change your dynamic IP address to a static one. Refer to your router settings, some ISPs will have options on this here. If you can't find anything on this, get in touch with your ISP.

Once you've made sure you have a static IP address, you can find out what the IP address is with various websites. You can use a search engine to easily find this out. Write this down as you'll need it later.

Once you're done, you can pretty much follow every guide on this website, the only difference is that you'll need to forward the ports you'll be using for the server.

Finding the ports you'll need to forward

If you need to know what port you'll need to forward, there's a command for that. Just type netstat -tulpn in your servers command line. If you want to see the name of the programs, you need to run it as a root user. You can do this by putting sudo before the command.

Local Address                    State       PID/Program name
-0.0.0.0:25                       LISTEN      887/master
-0.0.0.0:1883                     LISTEN      22452/mosquitto
-0.0.0.0:445                      LISTEN      798/smbd
-0.0.0.0:993                      LISTEN      381/dovecot
-127.0.0.1:3306                   LISTEN      560/mysqld
-0.0.0.0:587                      LISTEN      887/master
-0.0.0.0:139                      LISTEN      798/smbd
-127.0.1.1:12301                  LISTEN      412/opendkim
-0.0.0.0:143                      LISTEN      381/dovecot
-0.0.0.0:465                      LISTEN      887/master
-0.0.0.0:22                       LISTEN      472/sshd
-:::25                            LISTEN      887/master
-:::443                           LISTEN      1769/apache2
-:::1883                          LISTEN      22452/mosquitto
-:::445                           LISTEN      798/smbd

Example output

- -

In this example, if you need to find the port number from dovecot, you can look for it in the Program name column. Then you can see in the local address column that the reported local address is 0.0.0.0:993. You need to look for the part after the semicolon. In this case it's 993. So you'll need to forward port 993.

- -Next: Connect Your Domain and Server - -

Written by hiddej -

-]]> - - - - -Mirror your site over I2P -https://landchad.net/i2p.html -https://landchad.net/i2p.html -Sun, 29 Aug 2021 15:32:44 -0400 -

Mirror Your Site Over I2P

- -

- Now you have a website, why not offer it in a private alternative such as the Invisible Internet? -

Setting up I2P

- There are 2 main I2P implementations, I2P and i2pd, we are using i2pd in this - guide because it's easier to use in servers. -

Installing I2P

- i2pd is in most repos, in debian/ubuntu you can install it simply - with

apt install i2pd

Enabling I2P

- We are going to create a user for i2pd, because i2pd finds the configuration - files in its home directory. And it's easier (and more tidy) to have it in a separate user: -

useradd -m i2p -s /bin/bash
-su -l i2p
-mkdir ~/.i2pd
-cd ~/.i2pd

- Now that you're in ~/.i2pd, you have to create a file named - "tunnels.conf". Which is the config file for every hidden service you're - offering over I2P, the content should be like this: -

[example]
-type = http
-host = 127.0.0.1
-port = 8080
-keys = example.dat

Getting your I2P Hostname

- Then, run /usr/sbin/i2pd --daemon to start i2pd and we can retreive our I2P hostname. -

- This can be done in lynx or a command-line browser by going to http://127.0.0.1:7070/?page=i2p_tunnels to get your I2P hostname. -

- You - can also run these commands to find your hostname: -

printf "%s.b32.i2p
-" $(head -c 391 /home/i2p/.i2pd/example.dat |sha256sum|xxd -r -p | base32 |sed s/=//g | tr A-Z a-z)

Adding the Nginx Config

server {
-listen 127.0.0.1:8080 ;
-root /var/www/example ;
-index index.html ;
-}

- -

- From here we are almost done, all we have to do is enable the site and reload nginx which is also covered in the webserver tutorial. -

Update regularly!

Make sure to update I2P on a regular basis by running:

apt update && apt install i2pd

Contributor - qorg11

- - -]]> - - - - -Setting up a Calibre library server -https://landchad.net/calibre.html -https://landchad.net/calibre.html -Tue, 03 Aug 2021 13:49:21 -0400 -

Setting up a Calibre library server

- -

- The Calibre library server is a great way to store your eBooks. - It allows you to: -

Share your books with others.
Easily transfer your books between devices and access them from anywhere.

Installation

Install the Calibre package. - You might also want rsync to upload books.

apt install -y calibre rsync
-mkdir /opt/calibre

- Either upload your existing library using rsync. For example to /opt/calibre/. -

- On client: -

cd ~/Documents
-rsync -avuP your-library-dir root@example.org:/opt/calibre/

- Or create a library and add a book to it: -

cd /opt/calibre
-calibredb add book.epub --with-library your-library

- -

- Add a new user to protect your server: -

calibre-server --manage-users

Creating a service

- Create a new file /etc/systemd/system/calibre-server.service and add the following: -

[Unit]
-Description=Calibre library server
-After=network.target
-[Service]
-Type=simple
-User=root
-Group=root
-ExecStart=/usr/bin/calibre-server --enable-auth --enable-local-write /opt/calibre/your_library --listen-on 127.0.0.1
-[Install]
-WantedBy=multi-user.target
-

- -

- Issue systemctl daemon-reload to apply the changes. -

- Enable and start the service. -

systemctl enable calibre-server
-systemctl start calibre-server

A reverse proxy with Nginx

- Create a new file /etc/nginx/sites-available/calibre and enter the following: -

server {
-    listen 80;
-    client_max_body_size 64M; # to upload large books
-    server_name calibre.example.org ;
-    location / {
-        proxy_pass http://127.0.0.1:8080;
-    }
-}

Issue a Let's Encrypt certificate. Detailed instructions and additional information.

certbot --nginx

Now just go to calibre.example.org. The server will request an username and a password.

- -

After login you will see something like this.

- -

Contribution

Author: rflx – website -- XMR: 48T5XpHTXAZ5Nn8YCypA4aWn1ffQLHJkFGDArXQB6cmrP6cqLY72cu7CR2iq2MmL5Ndu3d47e5MKjGpL4prYgdrTCFAHD9c -

-]]> - - - - -Jitsi Video Chat -https://landchad.net/jitsi.html -https://landchad.net/jitsi.html -Tue, 03 Aug 2021 13:00:23 -0400 -

Jitsi Video Chat

- -

- Jitsi is a set of open-source projects that allows you to easily build and deploy secure video conferencing solutions. -

Dependencies and Installation

First, install some dependencies:

apt install gpg apt-transport-https nginx python3-certbot-nginx

Jitsi has its own package repository, so let's add it.

curl https://download.jitsi.org/jitsi-key.gpg.key | gpg --dearmor > /usr/share/keyrings/jitsi-keyring.gpg
-echo 'deb [signed-by=/usr/share/keyrings/jitsi-keyring.gpg] https://download.jitsi.org stable/' > /etc/apt/sources.list.d/jitsi-stable.list
-apt update -y

- Ok. So now we can install Jitsi, but before we do that, let's the firewall ufw, in case you - have it enabled, and the SSL certificate. -

Enable Required Ports

If you are using ufw or another firewall, there are several ports we need to ensure are open:

ufw allow 80/tcp
-ufw allow 443/tcp
-ufw allow 10000/udp
-ufw allow 3478/udp
-ufw allow 5349/tcp
-ufw enable

For your information, these allow the following:

80 TCP – Certbot.
443 TCP – General access to Jitsi Meet.
10000 UDP – General network video/audio communications.
3478 UDP – Quering the stun server (coturn, optional, needs config.js change to enable it).
- 5349 TCP – Fallback network video/audio communications over TCP (when UDP is blocked for example), served by coturn. -

SSL certificate

- I'll be using certbot and - Nginx to generate a certificate - for the Jitsi subdomain to allow encrypted connections. -

certbot --nginx certonly -d meet.example.org

- We will not create an Nginx config file for Jitsi because the Jitsi package we will be installing will do that automatically. -

Installation

To begin the installation process, just run:

apt install jitsi-meet

- It will ask you for your hostname; there you'll need to input the subdomain you have just added to Nginx, like - meet.example.org. -

For the SSL certificate, choose I want to use my own certificate.

- When it ask you for the certification key and cert files, input - /etc/letsencrypt/live/meet.example.org/privkey.pem and - /etc/letsencrypt/live/meet.example.org/cert.pem respectively. -

Using Jitsi

Jitsi can be used in a browser by then just going to meet.example.org.

Note that there are also Jitsi clients for all major platforms:

Desktop (Windows, MacOS, GNU/Linux)
Android (F-Droid and Google Play)
iPhone/iOS

- When using a Jitsti app for the first time, remember to go to the "Settings" menu and change your server name to the Jitsi site you just created. -

When you create a video chatroom, its address will appear as meet.example.org/yourvideochatname and can be shared as such.

More info

- This article is based on the original documentation. There you can find more details and configurations. -

Written by Jose Fabio. Donate Monero: 484RLdsXQCDGSthNatGApRPTyqcCbM3PkM97axXezEuPZppimXmwWegiF3Et4BHBgjWR7sVXuEUoAeVNpBiVznhoDLqLV7j [QR]
Edited and revised by Luke.

- - -]]> - - - - -PeerTube Instance -https://landchad.net/peertube.html -https://landchad.net/peertube.html -Thu, 29 Jul 2021 10:44:56 -0400 -

PeerTube Instance

- -

Prerequisites

Most of PeerTube's dependencies can be installed with this command:

apt install -y curl sudo unzip vim ffmpeg postgresql postgresql-contrib g++ make redis-server git python-dev cron wget

It's also important to start all associated daemons:

systemctl start postgresql redis

PeerTube also requires NodeJS 14 and yarn which cannot be installed from the Debian repositories. This means they have to be installed from separate, external repos:

curl -fsSL https://deb.nodesource.com/setup_14.x | bash -
-apt install -y nodejs
-npm install --global yarn

In addition to these dependencies, it's recommended to create a dedicated PeerTube user to install and manage PeerTube.

useradd -m -d /var/www/peertube -s /bin/bash -p peertube peertube

Database

PeerTube requires a PostgreSQL database to function. To create it, first make a new Postgres user named PeerTube:

su postgres
-createuser -P peertube
-createdb -O peertube -E UTF8 -T template0 peertube_prod
-psql -c "CREATE EXTENSION pg_trgm;" peertube_prod
-psql -c "CREATE EXTENSION unaccent;" peertube_prod
-exit

Be sure to make note of your Postgres user password, as it will be needed later when setting up PeerTube.

Installation

This handy one-liner can be used to determine the latest PeerTube version:

VERSION=$(curl -s https://api.github.com/repos/chocobozzz/peertube/releases/latest | grep tag_name | cut -d '"' -f 4) && echo "Latest Peertube version is $VERSION"

Next, a basic directory structure needs to be setup in the PeerTube user's home directory (/var/www/peertube).

To ensure permissions remain the same while managing files as PeerTube, sudo can be used to perform actions:

sudo -u peertube mkdir config storage versions
-sudo -u peertube chmod 750 config

Finally, a PeerTube release can be downloaded from the GitHub page and installed using yarn:

cd versions
-sudo -u peertube ln -s versions/peertube-${VERSION} ./peertube-latest
-cd ./peertube-latest && sudo -H -u peertube yarn install --production --pure-lockfile

Configuration

PeerTube's default config file can be copied over to /var/www/peertube/config.production.yaml so it can actually be used:

cd /var/www/peertube
-	sudo -u peertube cp peertube-latest/production.yaml config/production.yaml

Now the production.yaml file must be edited in the following ways:

First, add the hostname:

webserver:
-  https: true
-  hostname: 'example.org'
-  port: 443

Then, the database:

database:
-  hostname: 'localhost'
-  port: 5432
-  ssl: false
-  suffix: '_prod'
-  username: 'peertube'
-  password: 'your_password'
-  pool:
-     max: 5

An email to generate the admin user:

admin:
-  # Used to generate the root user at first startup
-  # And to receive emails from the contact form
-  email: 'chad@example.org'

And optionally, email server information:

smtp:
-  # smtp or sendmail
-  transport: smtp
-  # Path to sendmail command. Required if you use sendmail transport
-  sendmail: null
-  hostname: mail.example.org
-  port: 465 # If you use StartTLS: 587
-  username: your_email_username
-  password: your_email_password
-  tls: true # If you use StartTLS: false
-  disable_starttls: false
-  ca_file: null # Used for self signed certificates
-  from_address: 'admin@example.org'

NGINX

PeerTube includes an NGINX configuration that can be copied over to /etc/nginx/sites-available: -

cp /var/www/peertube/peertube-latest/support/nginx/peertube /etc/nginx/sites-available/peertube

sed -i 's/${WEBSERVER_HOST}/example.org/g' /etc/nginx/sites-available/peertube
-sed -i 's/${PEERTUBE_HOST}/127.0.0.1:9000/g' /etc/nginx/sites-available/peertube

Once you're happy with the NGINX config file, link it to sites-enabled to activate it:

ln -s /etc/nginx/sites-available/peertube /etc/nginx/sites-enabled/peertube

Encryption with Certbot

It's highly recommended to generate certificates for use with your PeerTube site, and this can be easily done with Let's Encrypt's certbot command:

systemctl stop nginx
-certbot certonly --standalone -d example.org
-sudo systemctl restart nginx

The certificates are generated standalone since the PeerTube NGINX config file already includes configuration for certbot.

Running PeerTube

A config file for a systemd daemon is included in PeerTube and can be setup like so:

cp /var/www/peertube/peertube-latest/support/systemd/peertube.service /etc/systemd/system/
-systemctl daemon-reload

Now, finally, run the PeerTube daemon to start PeerTube:

systemctl start peertube

Using PeerTube

To set a password for your admin user, run:

cd /var/www/peertube/peertube-latest && NODE_CONFIG_DIR=/var/www/peertube/config NODE_ENV=production npm run reset-password -- -u root

Login to your PeerTube instance using the admin email specified in your production.yaml file and the admin password you just set.

Once logged in, it's recommended to create a separate user without admin privileges for uploading videos to PeerTube. - This can be done easily from the users tab in the administration section:

Enjoy your PeerTube instance!

Updating PeerTube

PeerTube is constantly adding new features, so it's a good idea to check for new updates and add them if you wish. Just in the past year, they have added livestreaming and more.

Updating is fairly easy now since an upgrade.sh script has been added. Just run:

cd /var/www/peertube/peertube-latest/scripts && sudo -H -u peertube ./upgrade.sh

- Although check the changelog to see if there are additional manual requirements for particular updates. -

Written by Denshi. Donate Monero here [QR]

- -]]> - - - - -Server-Side Scripting with CGI -https://landchad.net/cgi.html -https://landchad.net/cgi.html -Sun, 25 Jul 2021 14:29:44 -0400 -

Server-Side Scripting with CGI

- -

- The basic website tutorial here describes how to set up a static - website — one that just serves HTML files saved on your server, - and until you change something manually, the same content will be served - each time a given page is requested. This is perfectly enough for most - personal website needs. This is how blogs should be implemented, instead - of relying on bloatware like WordPress! -

- But sometimes you genuinely do need something more. You need your - website to serve different contents depending on the time, on who the - requester is, on the contents of a database, or maybe process user input - from a form. -

CGI

- CGI, or the Common Gateway Interface, is a specification to allow you, - the server owner, to program your web server using pretty much any - programming language you might know. The specification is almost as old - as the Internet itself and for a long time CGI scripting was the primary - method of creating dynamic websites. -

- CGI is a very simple specification indeed. You write a script in your - favorite language, the script receives input about the request in - environment variables, and whatever you print to the standard output - will be the response. Most likely, though, you will want to use a - library for your language of choice that makes a lot of this - request/response handling simpler (e.g. parsing query parameters for - you, setting appropriate headers, etc.). -

Limitations of CGI

- While in theory you could implement any sort of functionality with CGI - scripts, it's going to get difficult managing a lot of separate scripts - if they're supposed to be working in tandem to implement a dynamic - website. If you want to build a full out web application, you'd probably - be better off learning a web framework than gluing together Perl - scripts. -

- That said, just as most of the web could be replaced with static - websites, much of the remaining non-static web could be replaced with a - few simple scripts, rather than bloated Ruby on Rails or Django - applications. -

Let's write a CGI script!

- We'll implement a simple example CGI script. I'll use Ruby for this - tutorial, but you'll be able to follow along even if you don't know - Ruby, just treat it as pseudocode then find a CGI library for your - language. -

The working example

- Our working example will be the Lazy Calculator. Yeah, you're probably - tired of seeing calculator examples in every programming tutorial, but - have you ever implemented one that takes the weekends off? -

- Here's how it will work. When in a browser you submit a request to your - website like -

example.com/calculator.html?a=10&b=32

- you will receive a page with the result of the addition of 10 and 32: - 42. -

- Unless you send your request on a weekend. Then the website will - respond with -

I don't get paid to work on weekends! Come back Monday.

- This example will show a few things that CGI scripts can do that you - wouldn't have been able to get using just file hosting in your - web server: -

getting inputs from the user;
- getting external information (here just the system time, but you - could imagine instead connecting to a database); -
using the above to create dynamic output.

The code

- Here's an implementation of the lazy calculator as a Ruby CGI script: -

#!/bin/env ruby
-require 'cgi'
-require 'date'
-cgi = CGI.new
-today = Date::today
-a = cgi["a"].to_i
-b = cgi["b"].to_i
-if today.saturday? || today.sunday?
-  cgi.out do
-    "I don't get paid to work on weekends! Come back Monday."
-  end
-else
-  cgi.out do
-    (a + b).to_s
-  end
-end

- Let's go through what's happening here. -

The shebang line

- CGI works by pointing your web server to an executable program. A Ruby - or Python script by itself is not immediately executable by a computer. - But on Unix-like systems you can specify the program that will be able - to execute your file in its first line if it starts with #! - (known as the shebang; read more about it on - Wikipedia). -

- So if you're going to be using a scripting language, you'll probably - need the appropriate shebang line at the top of your script. If you use - a compiled language, you'll just point your web server to the compiled - executable binary. -

Query parameters

- The next interesting lines of code are where we set the variables - a and b. Here we are getting user inputs from - the request. -

- In the example request we mentioned above - (example.com/calculator.html?a=10&b=32), the part - starting from the question mark, ?a=10&b=32, is the - query string. This is how users can submit parameters with their - web requests. Usually these parameters are set by e.g. a form on your - website, but in our simple example we'll be just manually manipulating - the URL. -

- The query string contains key-value pairs. The Ruby CGI library makes - them available in the CGI object it provides. We just need - to index it with the desired key, and we'll get the corresponding value. -

Wrapping it up

- The remaining parts of the code should be pretty self-explanatory. We - get today's date, check if it's a Saturday or a Sunday, and depending on - that, we instruct the CGI library to output either the answer, or a - "come back later" message. -

- The Ruby library by default returns an HTML response, so we really - should have wrapped our outputs in some html, - body, etc. tags. Alternatively, we could have specified - that the response is just plain text with -

cgi.out 'text/plain' do

- In general, your CGI library will probably have ways of specifying all - sorts of HTTP response headers, like status code, content type, etc. -

Making it work

- We have a CGI script, now let's point our web server to it. -

Installing FastCGI

- If you're using Nginx, install fcgiwrap: -

apt install fcgiwrap

- This installs the necessary packages for Nginx to use FastCGI — a - layer between your web server and CGI script that allows for faster - handling of scripts than if the web server had to handle it all by - itself. -

- Other web servers will probably have a similarly simple way of enabling - FastCGI, or you can look into other methods for launching CGI scripts. -

Nginx configuration

- In the configuration file for your website, add something like the - following: -

location /calculator.html {
-  include fastcgi_params;
-  fastcgi_param SCRIPT_FILENAME /usr/local/bin/lazy-calculator.rb;
-  fastcgi_param QUERY_STRING $query_string;
-  fastcgi_pass unix:/run/fcgiwrap.socket;
-}

- fastcgi_param directives specify various parameters for - FastCGI. SCRIPT_FILENAME should point to your executable. - For QUERY_STRING, we just copy Nginx's - $query_string variable. You might want to pass other - information to your CGI script as well, see for example - the Debian wiki for - a more detailed example, including pointing to an entire directory of - CGI scripts, rather than adding each one by hand to your web server - config. -

Contribution

Martin Chrzanowski -- website, donate

- -]]> - - - - -XMPP Server (Prosody) -https://landchad.net/xmpp.html -https://landchad.net/xmpp.html -Wed, 21 Jul 2021 22:58:21 -0400 -

XMPP Server (Prosody)

- -

XMPP is a fantastically simple protocol that's usually used as a messenger. - It's highly extensible, - better than IRC, - lighter and more decentralized and Matrix - and Telegram and normie social media can't hold a candle to it. -

- XMPP is so decentralized and extensible that there are many different XMPP servers. - Here, let's set up an Prosody XMPP server. -

Installation

- Prosody is in the Debian repositories, so we can easily install it on our server with the following command: -

apt install prosody

Configuration

-The Prosody configuration file is in /etc/prosody/prosody.cfg.lua. -To set it all up, we will be changing several things. -

Setting Admins

-Let's go ahead and set who our admin(s) will be. -Find the line that says admins = { } and to this we can specify one or more server admins. -

# To add one admin:
-admins = { "chad@example.org" }
-# We can add more than one by separating them by commas. (This file is written in Lua.)
-admins = { "chad@example.org", "chadmin@example.org" }

-Note that we have not created these accounts yet, we will do this below. -

Set the Server URL

-Find the line VirtualHost "localhost" and replace localhost with your domain. -In our case, we will have VirtualHost "example.org" -

Multi-User Chats

-Most people will probably want the ability to have chats with more than two users. -This is easily enough to enable. -In the config file, add the following: -

Component "chat.example.org" "muc"
-    modules_enabled = { "muc_mam" }
-    restrict_room_creation = "admin"

-On the first line, you must have a separate subdomain for your multi-user chats. -I use the chat. subdomain, but some use muc.. -Anything if possible. -

- -

End-to-end Encryption

-Importantly, we'll want end-to-end encryption enabled for user privacy. -

-Find the array beginning with modules_enabled. -This includes a list of modules to be used. -Add -"omemo_all_access"; to that list. -Additionally, be sure to change the module pep to pep_simple or this will cause a conflict.

-This module is not installed by default, -but you can easily download it by running the following command on the command prompt -to download and install the module to the correct directory. -

curl -sL https://hg.prosody.im/prosody-modules/raw-file/785389a2d2b3/mod_omemo_all_access/mod_omemo_all_access.lua > /usr/lib/prosody/modules/mod_omemo_all_access.lua

Other things to check

Certificates

-Obviously, we want to have client-to-server and server-to-server encryption. -Nowadays, use can use Certbot to generate certificates and use a convenient command below prosodyctl to import them. -

-If you have multi-user chat enabled, be sure to get a certificate for that subdomain as well. -Include the --nginx option assuming you have an Nginx server running. -

certbot -d chat.example.org --nginx

-Once you have the certificates for encryption, run the following to import them into Prosody. -

prosodyctl --root cert import /etc/letsencrypt/live/

-For user privacy, we will definitely want to install and enable encryption with OMEMO. -

Creating users/admins manually

prosodyctl adduser chad@example.org

This will prompt you to create a password as well.

Make changes active

-With any system service, use systemctl reload or systemctl restart to make the new settings active: -

systemctl restart prosody

Using your Server!

-Once your server is set up, you just need an XMPP client to use your new and secure chat system. -

GNU/Linux: Dino or Gajim
Windows: Gajim also runs on Windows.
Android: Conversations.im
Mac/iOS: Monal IM or Siskin for iOS alone
command-line (GNU/Linux, MacOS, Windows): Profanity
See a more complete list kept by XMPP

Account addresses

-XMPP account addressed look just like email addresses: username@example.org. -You can message any account on any XMPP server on the internet with that format. -

Note on MUCs (multi-user chats)

-Remember that MUCs are kept on a separate subdomain that we created and should've gotten a certificate for above, for example, muc.example.org. -Chatrooms are created and referred to in the following format: #chatroomname@muc.example.org. -

- -]]> - - - - -Setting up RSS Bridge -https://landchad.net/rss-bridge.html -https://landchad.net/rss-bridge.html -Mon, 05 Jul 2021 18:11:15 -0400 -

Setting up RSS Bridge

- -

RSS Bridge is a useful utility you can use to help you avoid the big tech sites, like Facebook and Twitter, which instead of the feed you usually would see, will be a based and minimalist RSS feed.

Installation

Setting Up and Configuring

-Next we'll install the required packages: -

apt install -y curl unzip nginx certbot php-fpm php-mysql php-cli php7.3-mbstring php7.3-curl php7.3-xml php7.3-sqlite3 php7.3-json

We now have to create the website configuration file. Create/open the a file below:

nano /etc/nginx/sites-available/rss-bridge

And add the following content:

server {
-    root /var/www/rss-bridge;
-    index index.php index.html index.htm index.nginx-debian.html;
-    server_name rss-bridge.example.org;
-    location / {
-            try_files $uri $uri/ =404;
-    }
-    location ~ \.php$ {
-            include snippets/fastcgi-php.conf;
-            fastcgi_pass unix:/var/run/php/php7.3-fpm.sock;
-    }
-    location ~ /\.ht {
-            deny all;
-    }
-}
-

After you have saved the file, you need to create a symlink so the server actually will read the file.

ln -s /etc/nginx/sites-available/rss-bridge /etc/nginx/sites-enabled/rss-bridge

Then we have to create the folder where the service will reside in.

mkdir -p /var/www/rss-bridge
-cd /var/www/rss-bridge
-

Lets download the latest version of RSS-Bridge in the directory.

The newest version can be found here, at the time of writing that is "RSS-Bridge 2021-04-25."

wget https://github.com/RSS-Bridge/rss-bridge/archive/refs/tags/2021-04-25.zip

Unzip the file:

unzip 2021-04-25.zip

This will create a directory called rss-bridge-version-number, we now want to move all the file contents of the newly created directory to the one we are in

mv rss-bridge-2021-04-25/* .
-rm -rf rss-bridge-2021-04-25 2021-04-25.zip
-

Now all we need to do is grant read/write permissions and reload the web server.

chown -R www-data:www-data /var/www/rss-bridge
-systemctl reload nginx
-

That's it, you should now have a working rss-bridge installed. But you should definately get an SSL certifcate installed which is done briefly here.

handskemager.xyz
Bitcoin: bc1qhfjgwjzksf2auqjefwpvq20wvyugq3lhqgkxvu
Monero: 88cPx6Gzv5RWRRJLstUt6hACF1BRKPp1RMka1ukyu2iuHT7iqzkNfMogYq3YdDAC8AAYRqmqQMkCgBXiwdD5Dvqw3LsPGLU

- -]]> - - - - -Rsync: Upload and Sync Files and Websites -https://landchad.net/rsync.html -https://landchad.net/rsync.html -Sat, 03 Jul 2021 08:58:29 -0400 -

Rsync: Upload and Sync Files and Websites

rsync is a simple way to copy files and folders between your local computer and server.

It not only makes file-transfer easy, but it allows you to build and maintain your website offline, then easily upload it to the proper directory on your server so you don't need to constantly be logged into your server to modify your site.

Installing rsync

Run the following on your server and on your local machine.

apt install rsync

Uploading files with rsync

From your local machine you can upload files to your server like this:

rsync -ruvzP /path/to/file root@example.org:/path/on/the/server

You will be prompted for the root password and then uploading will commence.

If you omit root@, rsync will not attempt to log in as root, but whatever your local username is.

Options to rsync

In this command, we give several options to rsync:

-r – run recurssively (include directories)
-u – update files (do not reupload files that are not changed since last upload)
-v – visual, show files uploaded
-z – compress files for upload
-P – if uploading a large file and upload breaks, pick up where we left off rather than reuploading the entire file

Avoid using the commonly used -a option when uploading. It changes can transfer your local machine's user and group permissions to your server, which might cause breakage.

Scriptability

It's a good idea to build your website offline, then make an rsync script or bash alias like the one above to upload the edited files when you have made updates.

Password-less authentication

To avoid having to manually input your password each upload, you can set up SSH keys to securely idenitify yourself and computer as a trusted.

Picky trailing slashes

rsync is very particular about trailing slashes. This is useful, but can be confusing to some new users. Suppose we run the following wanting to mirror our offline copy of our website in the directory we use on our server (/var/www/websitefiles/):

rsync -ruvzP ~/websitefiles/ root@example.org:/var/www/websitefiles/

This will not actually do quite what we want. It will take our local websitefiles directory and put it inside websitefiles on the remote machine, ending up with: /var/www/websitefiles/websitefiles.

Instead, remove the trailing slash from the remote server location:

rsync -ruvzP ~/websitefiles/ root@example.org:/var/www/websitefiles

websitefiles/ has been replaced with websitefiles, and this will do what we want.

Downloading files with rsync

You may just as easily download files and directories from your server with rsync:

rsync -urvzP root@example.org:/path/to/file /path/to/file

Contribution

el3ctr0lyte: github, XMR: 86DBJdiG83ZDea6kJgsbVN5tMae5ScfuhJ3PihEMTHatCrGEw2gctyUB92V2fz4R4YhwRaQeAGL5M4gPRXvVvtkULJi4ayk
Substantial revisions by Luke

-]]> - - - - -Setup a Pleroma Server -https://landchad.net/pleroma.html -https://landchad.net/pleroma.html -Fri, 02 Jul 2021 09:14:32 -0400 -

Setup a Pleroma Server

- -

Hopefully by now you won't have to be sold on the invasive practices that social media companies conduct. Websites such as Facebook and Twitter aquire so much data on users that they often know more about you than you know about yourself. -The simple solution to this is to not use social media. However, that just isn't an option for most people. So the next best thing is to setup a self-hosted and federalised social media site so that you have full control over your data. -I've previously made a video showing all the steps in depth if you want to check it out. If you run into any issues I suggest you look at the video. -

Installation

Setting Up and Configuring

-Next we'll install the required packages: -

apt install -y curl unzip libncurses5 postgresql postgresql-contrib nginx certbot libmagic-dev

-You can manually configure postgreSQL to suit your system better. Check out the documentation here and then run the below command: -

systemctl restart postgresql

Installing the Pleroma App

First as the root user

-Pleroma is not in the Debian app repositories, so we will install it manually. -First create the Pleroma user by running the below command: -

useradd -m -s /bin/bash -d /opt/pleroma pleroma

-Then, still as root, we will create the required directories and give the Pleroma user ownership of them. -

mkdir -p /var/lib/pleroma/uploads
-chown -R pleroma /var/lib/pleroma
-mkdir -p /var/lib/pleroma/static
-chown -R pleroma /var/lib/pleroma
-mkdir -p /etc/pleroma
-chown -R pleroma /etc/pleroma

Now, as the new Pleroma user

-Now run su -l pleroma to login as the Pleroma user. -Now use the curl command below to download the Pleroma software and unzip it. -

curl 'https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=amd64' -o /tmp/pleroma.zip
-unzip /tmp/pleroma.zip -d /tmp/

- -

mv /tmp/release/* /opt/pleroma
-rmdir /tmp/release
-rm /tmp/pleroma.zip
-./bin/pleroma_ctl instance gen --output /etc/pleroma/config.exs --output-psql /tmp/setup_db.psql

We need to briefly return to the root user so we can run the following command (via the postgres user) to set up the database. -Type ctrl-d or run exit to return to the root user, then run: -

su postgres -s $SHELL -lc "psql -f /tmp/setup_db.psql"

Then return to the pleroma user with su -l pleroma and we will test to see that Pleroma can run:

./bin/pleroma_ctl migrate
-./bin/pleroma daemon

-That will initialize Pleroma. It might take as long as a minute to get started, so wait a bit, then run the following: -

curl http://localhost:4000/api/v1/instance

./bin/pleroma stop

Setup and Configure Nginx

-Return again to the root user. Let's copy Pleroma's Nginx configuration file from the template given in the installation and enable it: -

cp /opt/pleroma/installation/pleroma.nginx /etc/nginx/sites-available/pleroma.conf
-ln -s /etc/nginx/sites-available/pleroma.conf /etc/nginx/sites-enabled/pleroma.conf

Edit the etc/nginx/sites-available/pleroma.conf file and replace example.tld with your domain name.

-Once everything, including your Cerbot certificate is ready, simply reload Nginx with this command: -

systemctl reload nginx

Setting up the service

-Pleroma itself runs on a SystemD service similar to other things running on your server like Nginx. To start the service up run the below commands: -

cp /opt/pleroma/installation/pleroma.service /etc/systemd/system/pleroma.service
-systemctl start pleroma
-systemctl enable pleroma

-If everything worked then when you go to your domain in the web browser you should see a bare-bones Pleroma instance. -

Creating an Admin User

su -l pleroma
-./bin/pleroma_ctl user new username username@example.org --admin

-If you run into any issues then feel free to checkout the documentation or send me an email or message. My details are below. -

biasedriot.co
youtube
Bitcoin: 1Dmn9jEtWAhdLk1HHWkUVNeDdAaBCwNajm
Monero: 84Y4FZiTbLeR5qc1fBrBhB1yq5agKtEdoixq2w1ysXJv486MiBCz3czGT15bqeXDPpdLoNyF93inxY3BCk6g8mrDMNKoArS

- -]]> - - - - -Certbot on Standalone Domains and Subdomains -https://landchad.net/standalone.html -https://landchad.net/standalone.html -Fri, 02 Jul 2021 09:14:29 -0400 -

Certbot on Standalone Domains and Subdomains

- -

The command certbot --nginx will take an unencrypted website on an Nginx configuration file, get a certificate for it and change the configuration to use that certificate and thus HTTPS.

Sometimes, however, you are given an Nginx configuration template that already has encryption/HTTPS, so running the automated certbot --nginx is not possible, as it will simply give an error saying that the certicate that Nginx is looking for doesn't already exist and thus the Nginx config is broken.

So suppose you want to get a certificate for pleroma.example.org because you are installing Pleroma and the configuration file presupposes a certificate. - In this case you would want to run this:

systemctl stop nginx
-certbot certonly --standalone -d pleroma.example.org
-systemctl start nginx

What we do here is temporarily turn of Nginx, then run a certonly subcommand that generates a certificate for the domain without changing or caring about the Nginx configuration. Then we reactivate Nginx, thus turning back on our webserver.

The reason we deactivate Nginx is that it uses the ports that Certbot will want to bind to, and thus we must temporarily turn Nginx off to let Certbot use those ports. (What it actually does is spin up a dummy webserver that doesn't need to think about the Nginx configuration.)

This is just a little note of something that might confuse people, but the three commands above should suffice. If your site is still managed by Nginx, it should still be able to renew with simple certbot renew --nginx without a problem.

- -]]> - - - - -Using UFW as a Firewall -https://landchad.net/ufw.html -https://landchad.net/ufw.html -Thu, 01 Jul 2021 16:58:11 -0400 -

Using UFW as a Firewall

- -

- Uncomplicated Firewall (UFW) is a front-facing program for the more involved iptables firewall program installed in most GNU/Linux distributions. - We can use ufw to restrict machines on the internet to only access the services (SSH, websites etc) you want them to, but it can also be used to prevent programs on the computer itself from accesing parts of the internet it shouldn't. -

How to Get It

Log into your server by pulling up a terminal and typing:

ssh root@example.org

- This command will attempt to log into your server and run a remote shell. - If you leave the settings default, it should prompt you for your password, and you can just copy or type in the password from Vultr's site. -

- Some VPS providers automatically install ufw, but if you do not have it installed already, install it in the typical way: -

apt install ufw

First-Time Setup

You can check the status of ufw right now by running:

ufw status

Without any changes, it should report back Status: inactive. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:

- Careful! Enabling ufw without allowing SSH will block you from remoting to your server. - Double-check that you have allowed SSH, and if you have changed the default SSH port, put in that number instead. -

ufw default deny incoming # block all incoming connections by default
-ufw allow in ssh # or: ufw allow in 22
-ufw enable

- ufw has an internal list of protocols applications, and the ports used by them. - In this case, it knwos SSH is on port 22. - We'll go more in detail how to view all protocols ufw knows about. - By default, when you allow an incoming port, it allows that port both on IPv4 and IPv6. -

- With the firewall enabled and allowing only SSH in, all other ports are prortected from incoming requests. - To view all your rules, run: -

ufw status verbose

A firewall that allows to connect to SSH and their website may look like:

Status: active
-Logging: on (low)
-Default: deny (incoming), allow (outgoing), deny (routed)
-New profiles: skip
-To                           Action      From
---                           ------      ----
-22 (SSH)                     ALLOW IN    Anywhere
-80,443/tcp (WWW Full)        ALLOW IN    Anywhere
-22 (SSH (v6))                ALLOW IN    Anywhere (v6)
-80,443/tcp (WWW Full (v6))   ALLOW IN    Anywhere (v6)

If you want to delete e.g. the 'WWW Full' rule, run:

ufw delete allow in 'WWW Full'
-ufw reload

Enabling Common Services

- You have blocked all incoming ports but SSH, which means no outsiders would be able to access other services, like an email server or your website. - You should look at the ports your services are open on and enable them individually. - Here is a list of a few common services: -

Opening Port Numbers

Suppose you install a Gemini server, which must broadcast on port 1965. By default ufw blocks all incoming connections on all ports, so whenever you install a new service like this you will have to tell ufw to enable the desired port:

ufw allow 1985

Websites: HTTP and HTTPS

HTTP uses port 80 and HTTPS uses port 443. We can enable them like this:

ufw allow 80
-ufw allow 443

But ufw additionally knows the typical ports of common serives, so you can also run this:

ufw allow http
-ufw allow https

And that will do the same thing. There are also other abbreviations for common port lists:

ufw allow in 'WWW Full'

To see these other "apps" that ufw knows by default, run ufw app list

Email: IMAP, POP3, and SMTP

ufw allow in IMAPS
-ufw allow in POP3
-ufw allow in SMTP
-ufw allow in 'Postfix SMTPS'
-ufw allow in 'Mail Submission'

Fine-Tuning Rules

Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):

ufw default allow in
-ufw deny in PORT
-ufw reject in PORT
-ufw reload

You can add rules to comments to remember what they are there for:

ufw allow in PORT comment 'Secret SSH'
-ufw reload
-ufw status verbose

Output:

To                         Action      From
---                         ------      ----
-PORT                       ALLOW IN    Anywhere                   # Secret SSH
-PORT (v6)                  ALLOW IN    Anywhere (v6)              # Secret SSH

To deny outgoing ports:

ufw deny out PORT

Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:

ufw limit PORT/tcp

To blocklist IP addresses:

ufw deny from IP_ADDRESS

To read more what you can do with ufw, run:

man ufw

Recovering SSH

- If you have accidentally firewalled yourself from logging on your computer, you can recover access by using your VPS's virtual console. - On Vultr, this is on your VPS's menu. To the right of the server name, It is the leftmost icon that looks like a monitor. -

ufw disable

Creating Your Own Chat Server With IRC

- -

Installing an IRCd

- An IRCd is short for "IRC daemon", which just means an IRC server. - The most easy IRCd to setup is Ergo. -

useradd -m ergo -s /bin/bash

- Next, we want to switch to our newly created ergo user and create the server directory. -

sudo -i -u ergo
-mkdir server

- You can find the latest release of Ergo on its GitHub latest release page.
- There are several platforms available, but you want to choose Linux, most likely linux-x86_64.
- Once you have selected the correct package, copy its URL and replace <release url> with the package URL (still as the ergo user): -

wget https://github.com/ergochat/ergo/releases/download/v2.7.0/ergo-2.7.0-linux-x86_64.tar.gz
-tar -xf ergo-2.7.0-linux-x86_64.tar.gz
-mv ergo-2.7.0-linux-x86_64/*
-rm -r ergo-2.7.0-linux-x86_64*

Executing ls -l should now yield something like this:

-rw-r--r-- 1 ergo ergo  118825 Jun  8 00:51 CHANGELOG.md
--rw-r--r-- 1 ergo ergo    1983 May 31 01:48 README
--rw-r--r-- 1 ergo ergo   41440 Jun  8 00:42 default.yaml
-drwxr-xr-x 2 ergo ergo    4096 Jul  1 09:01 docs
--rwxr-xr-x 1 ergo ergo 9654272 Jun  8 00:53 ergo
--rw-r--r-- 1 ergo ergo    1753 May 31 01:48 ergo.motd
-drwxr-xr-x 2 ergo ergo   12288 Jul  1 09:01 languages
--rw-r--r-- 1 ergo ergo   39722 Jun  8 00:42 traditional.yaml

If you see something similar to the above, that means Ergo is installed, although not quite ready to run yet.

Configuring Ergo

- First thing, make sure you're still using the ergo user, and are in the ~/server directory.
- If you aren't, you can run the following to get back there: -

sudo -i -u ergo
-cd ~/server

- Next, generate certificate files for TLS: -

./ergo mkcerts

To start configuring, we need to copy some files:

cp default.yaml ircd.yaml
-cp ergo.motd ircd.motd

- The next steps involve editing the newly copied ircd.yaml file. If you do not know how to edit text files from the comment line, - you can use nano, which is very simple, using arrow keys to navigate, CTRL+O to save, and CTRL+X to exit.
- Another option is vim, which is a much more powerful text editor, but has a learning curve. It is only recommended for this guide if you already know it.
- Lastly, you can copy the ircd.yaml file to a text editor on your computer and edit it with a GUI text editor of your choice. - If that is what you choose to do, you may want to just download the file from Ergo's GitHub, - edit it on your computer, clear the ircd.yaml file on the server, and then paste the contents from your computer into the blank file.
- No matter how you do it, the next steps assume you can edit the configuration file. -

Network and server names

- One of the first properties in the config file is network name. - You can change this to whatever you like, as it will show up as the name when you connect to the server. -

# network configuration
-network:
-    # name of the network
-    name: "Land-Chat"

Change the server name to your server's domain name.

# server configuration
-server:
-    # server name
-    name: "example.org"

Network password

Generate a password to use by executing the following:

./ergo genpasswd

# password to login to the server, generated using `ergo genpasswd`:
-password: "<your hashed password>"

Message of the day (MotD)

Change the MotD (Message of the Day) file to the one you copied earlier:

# motd filename
-# if you change the motd, you should move it to ircd.motd
-motd: ircd.motd

Feel free to edit ircd.motd to your heart's content. Its contents will be sent to clients when they connect to the network.

IP limits

# IP-based DoS protection
-ip-limits:
-    # whether to limit the total number of concurrent connections per IP/CIDR
-    count: true
-    # maximum concurrent connections per IP/CIDR
-    max-concurrent-connections: 16

IP cloaking

# IP cloaking hides users' IP addresses from other users and from channel admins
-# (but not from server admins), while still allowing channel admins to ban
-# offending IP addresses or networks. In place of hostnames derived from reverse
-# DNS, users see fake domain names like pwbs2ui4377257x8.irc. These names are
-# generated deterministically from the underlying IP address, but if the underlying
-# IP is not already known, it is infeasible to recover it from the cloaked name.
-# If you disable this, you should probably enable lookup-hostnames in its place.
-ip-cloaking:
-    # whether to enable IP cloaking
-    enabled: true
-    # whether to use these cloak settings (specifically, `netname` and `num-bits`)
-    # to produce unique hostnames for always-on clients. you can enable this even if
-    # you disabled IP cloaking for normal clients above. if this is disabled,
-    # always-on clients will all have an identical hostname (the server name).
-    enabled-for-always-on: true
-    # fake TLD at the end of the hostname, e.g., pwbs2ui4377257x8.irc
-    # you may want to use your network name here
-    netname: "chad"

Password enforcement adjustments for HexChat (and possibly other clients)

- Ergo offers account registration to allow users to do things like use history and bouncer features, register channels, etc.
- In clients such as HexChat, server password may conflict with account passwords, so the following setting should be enable if you wish to use accounts with clients such as HexChat.
- Note that this could under some circumstances be considered a security hazard, as a user with an account does not need to know the server password to connect, - although that user would have needed to register an account before the server had a password, and then a password would need to have been set after the fact, so this can be considered a very small concern if your setup always has had a password.
- Also keep in mind that this setting has no effect if your network does not even have a password at all. -

# some clients (notably Pidgin and Hexchat) offer only a single password field,
-# which makes it impossible to specify a separate server password (for the PASS
-# command) and SASL password. if this option is set to true, a client that
-# successfully authenticates with SASL will not be required to send
-# PASS as well, so it can be configured to authenticate with SASL only.
-skip-server-password: true

Multiclient, always-on clients, history, etc

# multiclient controls whether Ergo allows multiple connections to
-# attach to the same client/nickname identity; this is part of the
-# functionality traditionally provided by a bouncer like ZNC
-multiclient:
-    # when disabled, each connection must use a separate nickname (as is the
-    # typical behavior of IRC servers). when enabled, a new connection that
-    # has authenticated with SASL can associate itself with an existing
-    # client
-    enabled: true
-    # if this is disabled, clients have to opt in to bouncer functionality
-    # using nickserv or the cap system. if it's enabled, they can opt out
-    # via nickserv
-    allowed-by-default: true
-    # whether to allow clients that remain on the server even
-    # when they have no active connections. The possible values are:
-    # "disabled", "opt-in", "opt-out", or "mandatory".
-    always-on: "opt-out"
-    # whether to mark always-on clients away when they have no active connections:
-    auto-away: "opt-out"
-    # QUIT always-on clients from the server if they go this long without connecting
-    # (use 0 or omit for no expiration):
-    #always-on-expiration: 90d

VHosts

# vhosts controls the assignment of vhosts (strings displayed in place of the user's
-# hostname/IP) by the HostServ service
-vhosts:
-    # are vhosts enabled at all?
-    enabled: true

Channels

# channel options
-channels:
-    # modes that are set when new channels are created
-    # +n is no-external-messages and +t is op-only-topic
-    # see  /QUOTE HELP cmodes  for more channel modes
-    default-modes: +nt
-    # how many channels can a client be in at once?
-    max-channels-per-client: 100
-    # if this is true, new channels can only be created by operators with the
-    # `chanreg` operator capability
-    operator-only-creation: false
-    # channel registration - requires an account
-    registration:
-        # can users register new channels?
-        enabled: true
-        # restrict new channel registrations to operators only?
-        # (operators can then transfer channels to regular users using /CS TRANSFER)
-        operator-only: false
-        # how many channels can each account register?
-        max-channels-per-account: 15

Operators (administrators, etc)

# operator classes
-oper-classes:
-    # chat moderator: can ban/unban users from the server, join channels,
-    # fix mode issues and sort out vhosts.
-    "chat-moderator":
-        # title shown in WHOIS
-        title: Chat Moderator
-        # capability names
-        capabilities:
-            - "kill"
-            - "ban"
-            - "nofakelag"
-            - "roleplay"
-            - "relaymsg"
-            - "vhosts"
-            - "sajoin"
-            - "samode"
-            - "snomasks"
-    # server admin: has full control of the ircd, including nickname and
-    # channel registrations
-    "server-admin":
-        # title shown in WHOIS
-        title: Server Admin
-        # oper class this extends from
-        extends: "chat-moderator"
-        # capability names
-        capabilities:
-            - "rehash"
-            - "accreg"
-            - "chanreg"
-            - "history"
-            - "defcon"
-            - "massmessage"

- The above can be kept with their default values, but you are free to modify them or create any new classes that are appropriate for your setup.
- Next, let's actually create an operator account: -

# ircd operators
-opers:
-    # default operator named 'gigachad'; log in with /OPER gigachad <password>
-    "gigachad":
-        # which capabilities this oper has access to
-        class: "server-admin"
-        # custom whois line
-        whois-line: is the server administrator
-        # custom hostname
-        vhost: "gigachad"
-        # normally, operator status is visible to unprivileged users in WHO and WHOIS
-        # responses. this can be disabled with 'hidden'. ('hidden' also causes the
-        # 'vhost' line above to be ignored.)
-        hidden: false
-        # modes are modes to auto-set upon opering-up. uncomment this to automatically
-        # enable snomasks ("server notification masks" that alert you to server events;
-        # see `/quote help snomasks` while opered-up for more information):
-        #modes: +is acjknoqtuxv
-        # operators can be authenticated either by password (with the /OPER command),
-        # or by certificate fingerprint, or both. if a password hash is set, then a
-        # password is required to oper up (e.g., /OPER dan mypassword). to generate
-        # the hash, use `ergo genpasswd`.
-        password: "<your oper password>"

Chat history

- Ergo's history configuration group is very long, so it is encouraged to read over it yourself. - This section will go over the most important pieces of that configuration group. -

- History is not endless (unless you want it to be), and the amount that can be stored for channels is configurable: -

# how many channel-specific events (messages, joins, parts) should be tracked per channel?
-channel-length: 2048

# number of messages to automatically play back on channel join (0 to disable):
-autoreplay-on-join: 250

- History older than a certain time can be configured to be deleted or be inaccessible. - The default cutoff time is 1 week, but this is configurable as well. -


-# options to delete old messages, or prevent them from being retrieved
-restrictions:
-    # if this is set, messages older than this cannot be retrieved by anyone
-    # (and will eventually be deleted from persistent storage, if that's enabled)
-    expire-time: 1w
-

# options to store history messages in a persistent database (currently only MySQL).
-# in order to enable any of this functionality, you must configure a MySQL server
-# in the `datastore.mysql` section.
-persistent:
-    enabled: true
-    # store unregistered channel messages in the persistent database?
-    unregistered-channels: true

-
-

# connection information for MySQL (currently only used for persistent history):
-mysql:
-    enabled: false
-    host: "localhost"
-    port: 3306
-    # if socket-path is set, it will be used instead of host:port
-    #socket-path: "/var/run/mysqld/mysqld.sock"
-    user: "ergo"
-    password: "hunter2"
-    history-database: "ergo_history"
-    timeout: 3s
-    max-conns: 4
-    # this may be necessary to prevent middleware from closing your connections:
-    #conn-max-lifetime: 180s

- For privacy reasons, you may want to allow users to delete their own messages in history, or export their messages to JSON: -

# options to control how messages are stored and deleted:
-retention:
-    # allow users to delete their own messages from history?
-    allow-individual-delete: true
-    # if persistent history is enabled, create additional index tables,
-    # allowing deletion of JSON export of an account's messages. this
-    # may be needed for compliance with data privacy regulations.
-    enable-account-indexing: true

Spam reduction

# fakelag: prevents clients from spamming commands too rapidly
-fakelag:
-    # whether to enforce fakelag
-    enabled: true
-    # time unit for counting command rates
-    window: 1s
-    # clients can send this many commands without fakelag being imposed
-    burst-limit: 5
-    # once clients have exceeded their burst allowance, they can send only
-    # this many commands per `window`:
-    messages-per-window: 2
-    # client status resets to the default state if they go this long without
-      # sending any commands:
-    cooldown: 2s

Starting and using your server

- Now that Ergo is both installed and configured, you can actually start using it! -

Starting the server

- First thing, make sure you're still using the ergo user, and are in the ~/server directory.
- If you aren't, you can run the following to get back there: -

sudo -i -u ergo
-cd server

- Starting the server is done in one command: -

./ergo run

Connecting to the server

- Connecting with HexChat is very easy. When you start it, you will see something like this: -

- Once you're done editing the network, click (X) Close, select your network from the network list, and click Connect.
- If all is well, you should be connected! -

Surviving restarts with a SystemD service

- Before creating your service file, make sure you are in ~/server as the ergo user.
- Once you have done that, create a file called start.sh with the following content: -

#!/bin/bash
-./ergo run

Save the file, then mark it as executable:

chmod +x start.sh

Now, create a file called ergo.service with the following content:

[Unit]
-Description=Ergo IRC server
-After=network.target
-# If you are using MySQL for history storage, comment out the above line
-# and uncomment these two instead (you must independently install and configure
-# MySQL for your system):
-# Wants=mysql.service
-# After=network.target mysql.service
-[Service]
-Type=simple
-User=ergo
-WorkingDirectory=/home/ergo/server
-ExecStart=/home/ergo/server/start.sh
-ExecReload=/bin/kill -HUP $MAINPID
-Restart=on-failure
-LimitNOFILE=1048576
-# Uncomment this for a hidden service:
-# PrivateNetwork=true
-[Install]
-WantedBy=multi-user.target

- You now have your service file, but it is not installed yet. - To install it, switch to your normal user, and execute the following lines to install, enable, and start the SystemD service: -

ln -s /home/ergo/server/ergo.service /etc/systemd/system/ergo.service
-systemctl enable ergo
-systemctl start ergo

Ergo is now installed and running as a service, and will automatically start when the system boots.

Registering accounts and channels

Registering an account with NickServ

/nickserv register <your password>

- At this point, you are now registered!
- The final step is to configure authentication with your client. -

In HexChat, all that needs to be done is changing Login method to SASL (username + password), and entering your NickServ password that you used earlier into the password field:

You will now be logged into your account when you connect to your network.

Registering channels with ChanServ

/chanserv register #<your channel>

Moderation

Understanding masks

Discovering real IPs

Banning someone from the network

To ban a nick from the network:

/kline andkill <nick>!*@*

To ban an IP address or host from the network:

/kline andkill *!*@<IP or mask>

To unban a mask, you can use the /unkline command with the mask you want to unban.

Banning someone from a channel

To ban someone in a channel, type the following in that channel, replacing <mask> with the user's mask:

/mode +b <mask>

Muting people in a channel

/mode +m

/mode +v <nick>

Unvoice the user by typing the above command, but replacing the + with a -.

Appointing channel administrators and operators

/mode +a <nick>

To appoint an operator, type the following, replacing <nick> with the user's nick:

/mode +o <nick>

Bringing modern-day features to IRC with TheLounge

Written by Termer

- -]]> - - - - -Setting up Gitea -https://landchad.net/gitea.html -https://landchad.net/gitea.html -Thu, 01 Jul 2021 16:14:22 -0400 -

Setting up Gitea

- -

Head over to gitea.com to see what it looks like in practice.

Although Gitea is lighter than Gitlab, if you have a VPS with only 512MB of RAM, you will probably have to upgrade. Gitea is more memory-intensive than having just a bare git repository.

Installing Gitea

First install a few dependencies:

apt install curl sqlite3

Unfortunately, Gitea itself is not in the official Debian repos, so we will add a third-party repository for it.

Add the repo's gpg key to apt's trusted keys:

curl -sL -o /etc/apt/trusted.gpg.d/morph027-gitea.asc https://packaging.gitlab.io/gitea/gpg.key

Then add the actual repository to apt:

echo "deb [arch=amd64] https://packaging.gitlab.io/gitea gitea main" > /etc/apt/sources.list.d/morph027-gitea.list

Now we can install Gitea:

apt update
-apt install gitea

Since apt automatically enables and starts the Gitea service, it should already be running on port 3000 on your server!

Setting up a Nginx reverse proxy

You should know how to generate SSL certificates and use Nginx by now. Add this to your Nginx config to proxy requests made to your git subdomain to Gitea running on port 3000:


-server {
-	listen 443 ssl;
-	listen [::]:443 ssl;
-        ssl_certificate /etc/ssl/nginx/git.example.org.crt;
-        ssl_certificate_key /etc/ssl/nginx/git.example.org.key;
-        server_name git.example.org;
-	location / {
-		proxy_pass http://localhost:3000/; # The / is important!
-		proxy_redirect off;
-		proxy_set_header Host $host;
-		proxy_set_header X-Real-IP $remote_addr;
-		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
-		proxy_set_header X-Forwarded-Proto $scheme;
-	}
-}
-

And reload Nginx:

systemctl reload nginx

Setting up Gitea

Database Type:: SQLite3
SSH Server Domain:: git.example.org
Gitea Base URL:: git.example.org

These and other settings can be changed in a configuration file later so don't worry about making wrong decisions right now.

A few extras

Automatically create a new repo on push

This is an incredicly useful feature for me. Open up /etc/gitea/app.ini and add DEFAULT_PUSH_CREATE_PRIVATE = true to the repository section like so:

-
-

If you now add a remote to a repository like this

git remote add origin 'ssh://gitea@git.example.org/username/coolproject.git'

and push, Gitea will automatically create a private coolproject repository in your account!

Change tab-width

By default Gitea displays tabs 8 spaces wide, however I prefer 4 spaces. We can change this!

mkdir -p /var/lib/gitea/custom/templates/custom/

And write this into /var/lib/gitea/custom/templates/custom/header.tmpl:

<style>
-.tab-size-8 {
-	tab-size: 4 !important;
-	-moz-tab-size: 4 !important;
-}
-</style>

Contribution

phire

- -]]> - - - - -Hosting Your Own Git Repositories -https://landchad.net/git.html -https://landchad.net/git.html -Thu, 01 Jul 2021 07:19:51 -0400 -

Hosting Your Own Git Repositories

- -

- Once you have your own VPS or other Internet-available server, you can - start hosting your own git repositories. The goal of this tutorial is - for you to go from

git clone github.com/...

git clone YourLandChadDomainName.xyz/...

- so you can cultivate your own homegrown, grass-fed code, rather than - relying on a centralized proprietary service like GitHub. -

Installing git

- You most likely already have it installed on your server, but if not, - run:

apt install git

- We don't need any additional software, git itself ships - with everything needed to host a remote repository! -

Creating bare repositories

Become the git user and create the directory

- If you're logged in to your server as root and have git - installed, you can become the git user by executing -

su git

- Now navigate to/create your desired directory, for example -

cd /srv
-mkdir git

Create the repo

- Now you can create the bare repository with -

git init --bare my-repo.git

- By convention, bare repository names end with ".git". -

- Repeat the above command for any other repositories you want to host. -

Syncing local repositories with your server

Set up SSH login for the git user

Syncing a new repository with your server

- user is git, the git user - we've already worked with before. -
- host is your domain name. - Alternatively you could even use your server's raw IP address. -
- path is the absolute path to the repository on the - server, in our example /srv/git/my-repo.git -

- So, to create a new remote, run: -

git remote add origin git@yourdomain.xyz:/srv/git/my-repo.git

- Now you'll be able to run git push origin master to push - your commits or git pull origin to pull from the remote. -

Syncing an existing repository

- If you've already set up your local repository to sync with a service - like GitHub it probably already has a remote called "origin". You can - see your repo's remotes with: -

git remote -v

- You can follow the above instructions, substituting an arbitrary other - name other than "origin" to create a differently named remote, e.g. -

git remote add vps git@...

- Now you'll be able to push/pull with git push vps master - and git pull vps, respectively. -

- Or, to completely sever ties with your centralized git provider, first - remove the original origin with: - git remote remove origin - and then follow the instructions as above. -

Contribution

Martin Chrzanowski -- website, donate

- -]]> - - - - -Requiring Passwords for Webpages (HTTP Authentication) -https://landchad.net/auth.html -https://landchad.net/auth.html -Thu, 01 Jul 2021 07:19:27 -0400 -

Requiring Passwords for Webpages

- -

HTTP basic authentication will allow you to secure parts (or all) of your website with a username and password without the trouble of PHP or Javascript. - This will work with any Nginx server. -

Installation

We will be using the command htpasswd to make username and password pairs.

apt install apache2-utils

- -

- Now think of a username and password and remember them. -

htpasswd -c /etc/nginx/myusers username

- -

- Type out your password twice to confirm. You can do this as many times as you'd like. -

Check out user name password pairs (the password will be securely hashed):

cat /etc/nginx/myusers

Nginx Config and Auth Basic

- From here, we are going to edit our websites config file in /etc/nginx/sites-enabled. - Have in mind which folder you'd like to secure. Add something like this: -

server {
-    #...
-    location /secret-folder  {
-        auth_basic "What's the Password?" ;
-        auth_basic_user_file /etc/nginx/myusers ;
-    }
-    #...
-}

- -

If you'd like to do the opposite, such as making the entire site private except for a public section, do this:

server {
-    #...
-    auth_basic "What's the Password?" ;
-    auth_basic_user_file /etc/nginx/myusers ;
-    location /public/ {
-        #...
-        auth_basic off ;
-    }
-    #...
-}

IP Addresses

If passwords aren't enough we can ban an ip or accept one.

location /api {
-    #...
-    allow 192.168.1.23:8080 ;
-    deny 127.0.0.1 ;
-}

If you want to check both a username and password with an ip address, use the satisfy directive.

location /api {
-    #...
-    satify all ;
-    allow 192.168.1.23:8080 ;
-    deny 127.0.0.1 ;
-    auth_basic "What's the Password?" ;
-    auth_basic_user_file /etc/nginx/myusers ;
-}

Complete Example

http {
-    server {
-        listen 80;
-        root /var/www/website ;
-        #...
-        location /secret-folder {
-            satisfy all ;
-            allow 192.168.1.3/24;
-            deny 127.0.0.1 ;
-            auth_basic "What's the Password?" ;
-            auth_basic_user_file /etc/nginx/myusers ;
-        }
-    }
-}

- Now check your configuration with nginx -t -

Reload nginx and you're good to go!

- Contributor - tomfasano.xyz -

- -]]> - - - - -Cronjobs -https://landchad.net/cron.html -https://landchad.net/cron.html -Thu, 01 Jul 2021 07:19:04 -0400 -

Using Cronjobs to run scheduled tasks

- -

- Cron is a service that lets you run scheduled tasks. These tasks are called cronjobs. If you have already followed the initial course you will have already used cron when you set up certbot. -

What tasks would I want to schedule?

- You can schedule anything! Some examples of what you might have done already include: -

updatedb to update your locate database
certbot to update renewing of your https certs

- Some tasks that you might want to schedule may include: -

Package updates - if you really just want to leave your server alone you can automated updating packages on your server
Backups - you may want to backup certain files every day and some every week, this is possible with cron

- And many more, anything you can do can be turned into a cronjob. -

Basic Cronjobs

- This the preferred method for personal tasks and scripts, it's also the easiest to get started with. Run the command crontab -e to access your users crontab -

- Once you have figured out the command you want to run you need to figure out how often you want to run it and when. I am going to schedule my system updates once a week on at 3:30 AM on a Monday. -

- We now have to convert this time (Every Monday at 3:30 AM) into a cron time. Cron uses a simple but effective way of scheduling when to run things. -

- Crontab expressions look like this * * * * * command-to-run - The five elements before the command tell when the command is supposed to be run automatically. -

- So for our Monday at 3:30AM job we would do the following: -

 .---------------- minute (0 - 59)
- | .------------- hour (0 - 23)
- | | .---------- day of month (1 - 31)
- | | | .------- month (1 - 12
- | | | | .---- day of week (0 - 6)
- | | | | |
- * * * * *
-30 3 * * 1 apt -y update && apt -y upgrade

Some notes

On the day of the week option, Sunday is 0 and counting up from there, Saturday will be 6.
* designates "everything". Our command above has a * in the day of month and month columns. This means it will run regardless of the day of the month or month.
The hour option uses 24 hour time. 3 = 3AM, while use 15 for 3PM.

More examples

- Let's add another job, our backup job (for the purposes of this our backup command is just called backup) We want to run backup Every evening at 11PM, once we work out the timings for this we can add the to the same file as the above by running crontab -e This would mean our full crontab would look like this: -

0 23 * * * backup

Consecutive times

- Suppose we want a command to run every weekday. - We know we can put 1 (Monday), but we can also use 1-5 - to signify from day 1 (Monday) to day 5 (Friday). -

0 6 * * 1-5 echo "Wakey, wakey, wagie!" >> /home/wagie/alarm

The above echo command runs every Monday through Friday at 6:00AM.

Non-consecutive times

- We can also randomly specify non-consecutive arguments with a comma. - Suppose you have a script you want to run at the midday of the 1st, 15th, and 20th day of every month. - You can specify that my putting 1,15,20 for the day of the month argument: -

0 12 1,15,20 * * /usr/bin/pay_bills_script

"Every X minutes/days/months"

We can also easily run a command very several minutes or months, without specifying the specific times: -

*/15 * * * * updatedb

- This cronjob will run the updatedb command every 15 minutes. -

Beware of this Rookie Mistake Though...

- Suppose you want to run a script once every other month. - You might be tempted write this: -

* * * */2 *

0 0 1 */2 *

This makes the command run only at 0:00 (12:00AM) on the first day of every two months, which is what we really want.

- Consult the website crontab.guru for an intuitive and interactive tester of cronjobs. -

User vs. Root Cronjobs

- Bear in mind that if you need root access to run a particular command, - you will usually want to add it as root. -

System-wide cron directories

- Run the command ls /etc/cron* you should see a list of directories and there contents. The directories should be something like the below -

/etc/cron.d This is a crontab like the ones that you create with crontab -e
/etc/cron.hourly
/etc/cron.daily
/etc/cron.weekly
/etc/cron.monthly

Contribution

Mark McNally -- website, Youtube
Edits and examples by Luke

- -]]> - - - - -Mirror your site over tor -https://landchad.net/tor.html -https://landchad.net/tor.html -Thu, 01 Jul 2021 07:15:39 -0400 -

Mirror Your Site Over Tor

- -

- Now that you have a website, why not offer it on a private alternative such as the onion network? -

Setting up Tor

Installing Tor

Firstly we need to add the tor repo's to have the latest up to date version or tor.

apt install -y apt-transport-https gpg
-echo "deb https://deb.torproject.org/torproject.org buster main
-deb-src https://deb.torproject.org/torproject.org buster main" > /etc/apt/sources.list.d/tor.list

Then we need to add the gpg keys to our keyring

curl -s https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --import
-gpg --export A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89 | apt-key add -

Now update and install tor

apt update
-apt install tor deb.torproject.org-keyring

Enabling Tor

Then edit the file /etc/tor/torrc, uncommenting the following lines:

HiddenServiceDir /var/lib/tor/hidden_service/
-HiddenServicePort 80 127.0.0.1:80

- -

Now start and enable tor at boot

 systemctl enable --now tor

If the next command outputs active in green you're golden!

 systemctl status tor

Now you're server is on the dark web. The following command will give you your onion address:

 cat /var/lib/tor/hidden_service/hostname

Adding the Nginx Config

        server {
-            listen 127.0.0.1:80 ;
-            root /var/www/landchad ;
-            index index.html ;
-            server_name your-onion-address.onion ;
-        }

- -

- From here we are almost done, all we have to do is enable the site and reload nginx which is also covered in the webserver tutorial. -

Update regularly!

Make sure to update Tor on a regular basis by running:

apt update
-apt install tor

Contributor - tomfasano.xyz

- -]]> - - - - - Cryptocurrency Tutorials Completed - https://landchad.net/index.html#crypto - https://landchad.net/index.html#crypto - Tue, 29 Jun 2021 08:10:31 -0400 - There is now a set of basic tutorials on cryptocurrency wallets and concepts up. - The goal here is to allow people to receive tips for sites using all free and open source and peer-to-peer technology.

- -

More tutorials on crypto management and exchanging may be added later, but these focus simply on basic concepts and setting up wallets. They include:

- -

]]> - - - - Welcome to LandChad.net! - https://landchad.net - https://landchad.net - Mon, 28 Jun 2021 08:21:44 -0400 - Welcome to LandChad.net!

This website is for step-by-step tutorials that allow people to host and maintain their own website and other web services on the cheap or free.

There is already a full basic tutorial on website creation on the site here. -Following the tutorials can take as little as an hour, but will help you set up a VPS, and NginX server and encrypt your new webpage with Certbot.

Next I plan adding general info on HTML and CSS and how to manage a website.

More stuff like running your own email server and more will be added shortly as more articles are finalized.

-]]> - - - - - diff --git a/rsync.html b/rsync.html deleted file mode 100644 index 965ddbc..0000000 --- a/rsync.html +++ /dev/null @@ -1,55 +0,0 @@ - - - - Rsync: Upload and Sync Files and Websites – LandChad.net - - - - - - - - -

Rsync: Upload and Sync Files and Websites

- -

rsync is a simple way to copy files and folders between your local computer and server.

Installing rsync

Run the following on your server and on your local machine.

apt install rsync

Uploading files with rsync

From your local machine you can upload files to your server like this:

rsync -rtvzP /path/to/file root@example.org:/path/on/the/server

You will be prompted for the root password and then uploading will commence.

If you omit root@, rsync will not attempt to log in as root, but whatever your local username is.

Options to rsync

In this command, we give several options to rsync:

-r – run recurssively (include directories)
-t – transfer modification times, which allows skipping files that have not been modified on future uploads
-v – visual, show files uploaded
-z – compress files for upload
-P – if uploading a large file and upload breaks, pick up where we left off rather than reuploading the entire file

Avoid using the commonly used -a option when uploading. It can transfers your local machine's user and group permissions to your server, which might cause breakage.

Scriptability

It's a good idea to build your website offline, then make an rsync script or bash alias like the one above to upload the edited files when you have made updates.

Password-less authentication

To avoid having to manually input your password each upload, you can set up SSH keys to securely idenitify yourself and computer as a trusted.

Picky trailing slashes

rsync -rtvzP ~/websitefiles/ root@example.org:/var/www/websitefiles/

Instead, remove the trailing slash from the remote server location:

rsync -rtvzP ~/websitefiles/ root@example.org:/var/www/websitefiles

websitefiles/ has been replaced with websitefiles, and this will do what we want.

Downloading files with rsync

You may just as easily download files and directories from your server with rsync:

rsync -rtvzP root@example.org:/path/to/file /path/to/file

Contribution

-Luke -

- - - diff --git a/searxng.html b/searxng.html deleted file mode 100644 index 3271899..0000000 --- a/searxng.html +++ /dev/null @@ -1,143 +0,0 @@ - - - - Setting up a public SearXNG instance – LandChad.net - - - - - - - -

Setting up a public SearXNG instance

- -

- SearXNG is a free internet metasearch engine which aggregates results from more than 70 search services. - This guide sets up a working instance that can be accessed using a domain over HTTPS. - Features include: -

Self hosted
No user tracking
No user profiling
About 70 supported search engines
Easy integration with any search engine
Cookies are not used by default
Secure, encrypted connections (HTTPS/SSL)

- -

Installation

- -

Install the required packages.

- -

apt install git nginx -y

- -

Open http and https ports.

- -

iptables -I INPUT 6 -m state --state NEW -p tcp --dport 80 -j ACCEPT
-iptables -I INPUT 6 -m state --state NEW -p tcp --dport 443 -j ACCEPT
-netfilter-persistent save
-ufw allow 80
-ufw allow 443

- -

Clone the SearXNG Repository.

- -

git clone https://github.com/searxng/searxng searxng
-cd searxng

- -

Installing SearXNG, Filtron and Morty.

- -

./utils/searx.sh install all
-./utils/filtron.sh install all
-./utils/morty.sh install all

- -

Check that both filtron and morty are running.

- -

systemctl status filtron
-systemctl status morty

- -

Configure Nginx

- -

Delete the default site.

- -

rm /etc/nginx/sites-enabled/default

- -

Create a new file /etc/nginx/sites-available/searxng.conf and add the following:

- -


-server {
-
-    # Listens on http
-    listen 80;
-    listen [::]:80;
-
-    # Your server name
-    server_name searx.example.org;
-     
-    # If you want to log user activity, comment these
-    access_log /dev/null;
-    error_log  /dev/null;
-                
-    # Searx reverse proxy
-    location / {
-            proxy_pass         http://127.0.0.1:4004/;
-                
-            proxy_set_header   Host             $host;
-            proxy_set_header   Connection       $http_connection;
-            proxy_set_header   X-Real-IP        $remote_addr;
-            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
-            proxy_set_header   X-Scheme         $scheme;
-            proxy_set_header   X-Script-Name    /searx;
-    }
-        
-    location /searx/static {
-            alias /usr/local/searx/searx-src/searx/static;
-    }
-        
-    # Morty reverse proxy
-    location /morty {
-            proxy_pass         http://127.0.0.1:3000/;
-               
-            proxy_set_header   Host             $host;
-            proxy_set_header   Connection       $http_connection;
-            proxy_set_header   X-Real-IP        $remote_addr;
-            proxy_set_header   X-Forwarded-For  $proxy_add_x_forwarded_for;
-            proxy_set_header   X-Scheme         $scheme;
-    }
-}
-

- -

Now create a symbolic link to enable this site.

- -

ln -s /etc/nginx/sites-available/searxng.conf /etc/nginx/sites-enabled/searxng.conf

- -

Restart Nginx and SearXNG.

- -

systemctl restart nginx
-service uwsgi restart searx

- -

Configure HTTPS with Certbot

- -

Install certbot.

- -

apt install python3-certbot-nginx

- -

Install a Let's Encrypt SSL certificate to Nginx and optionally let it configure HTTPS for you. - Detailed instructions and additional information.

- -

certbot --nginx

- -

SearXNG should now be available from your domain.

- -

Configuration

- -

You can change settings by editing /etc/searxng/settings.yml.

- -

Contribution

Author: goshawk22 – website

- - - diff --git a/selfhosting.html b/selfhosting.html deleted file mode 100644 index d4596fd..0000000 --- a/selfhosting.html +++ /dev/null @@ -1,120 +0,0 @@ - - - - Self hosting – LandChad.net - - - - - - - -

Self hosting

- -

Introduction

When you have a(n old) computer lying around, and you have cheap electricity and a good internet connection, self hosting might be a good option for you.

Why would you choose selfhosting?

- You have control over the hardware, and you can upgrade your server in the future. For example: if you host a file server and your hard drive goes full, you can simply add another hard drive or upgrade it. -
- No bandwith limits, storage limits, etc. (some VPSes have this) -
- It can be cheaper than using a VPS. This only is the case if you got the server for really cheap and your electricity is cheap. -
- You can have a media server to consoom your content (for example with Jellyfin). You can technically do this on a VPS, but that will be more expensive than self hosting. If you have a media server, you can stream media from your server to more devices. (I recommend just downloading it on your device, but if you have multiple devices, this could be a good solution) -

- -

Downsides

Some possible downsides of choosing to host at home could be:

- Your ISP not approving of what you're doing. Some ISP's do not condone you hosting at home. Usually when this is the case, it could be harder if you want to forward ports, or it could be impossible to get a static IP address. Check your ISP's terms of service. Sometimes, it will say that hosting a webserver, email server, and more, is not allowed. -
- This can also include blocked ports. ISPs can block certain ports to the world. Sometimes ISPs only block 445/139 (which is for the better as Samba, using these ports isn't really secure and it's outdated). But some ISPs (sadly) block crucial ports like 80 and/or 443. You need to check this before trying anything. If this is the case, a way to get around it is to get another ISP or use an alternative port. A great website to check this is: canyouseeme.org. You can also check if you did the port forwaring correctly here.
- Security. Opening your network to the public could bring security risks. For example, never open a Samba server to the public, because it's a pretty old protocol, and it has some security vulnerabilities. Be sure you are forwarding the right port, and don't just forward random ports to the internet. Also, if you are getting DDoSed, your ISP will temporarily shut down your whole internet connection. -
- When setting up an email server, it can be way harder to not have your email show up as spam in other's people email. If you use a VPS, this is way easier. -
- Space, power consumption and noise. Of course, this differs per server. -

Hardware

- -

What kind of hardware should you choose?

Usecases

Getting started

Installing Debian

Once you have the machine, you can install the OS. I recommend Debian, as all of the guides on this website are Debian specific. Debian just werks as a server OS.

Port forwaring

Basic ports:

- SSH: port 22 (open this port if you want to admin your server outside your network) -
- HTTP: port 80 (open this port if you want basic webserver functionality) -
- HTTPS: port 443 (you should open this port if you are setting up a webserver because encryption) -

- -

Static or dynamic IP address

Once you're done, you can pretty much follow every guide on this website, the only difference is that you'll need to forward the ports you'll be using for the server.

Finding the ports you'll need to forward

Local Address                    State       PID/Program name
-0.0.0.0:25                       LISTEN      887/master
-0.0.0.0:1883                     LISTEN      22452/mosquitto
-0.0.0.0:445                      LISTEN      798/smbd
-0.0.0.0:993                      LISTEN      381/dovecot
-127.0.0.1:3306                   LISTEN      560/mysqld
-0.0.0.0:587                      LISTEN      887/master
-0.0.0.0:139                      LISTEN      798/smbd
-127.0.1.1:12301                  LISTEN      412/opendkim
-0.0.0.0:143                      LISTEN      381/dovecot
-0.0.0.0:465                      LISTEN      887/master
-0.0.0.0:22                       LISTEN      472/sshd
-:::25                            LISTEN      887/master
-:::443                           LISTEN      1769/apache2
-:::1883                          LISTEN      22452/mosquitto
-:::445                           LISTEN      798/smbd

Example output

- -

- -Next: Connect Your Domain and Server - -

Written by hiddej -

- - - diff --git a/server.html b/server.html deleted file mode 100644 index fb5d6d5..0000000 --- a/server.html +++ /dev/null @@ -1,146 +0,0 @@ - - - - Get a Server – LandChad.net - - - - - - - -

Get a Server

- -

- Once you have a domain name, you'll need a server to host all your website files on. - In general, a server is just a computer that is constanly broadcasting some services on the internet. -

- Servers connected to the internet can be extremely useful with or without proper websites attached to them. - You can be your own website, email, file-sharing service and much more. -

Getting a VPS

- A Virtual Personal Server (VPS) is a very cheap and easy way to get a - web server. Without you having to buy expensive equipment. There are a - lot of online businesses that have massive server farms with great - internet connection and big power bills that allow you to rent a VPS in - that farm for pocket change. -

- -

- A VPS usually costs $5 a month. Sometimes slightly more, sometimes slightly less. - That's a good price for some internet real-estate, but in truth, you can host a huge number of websites and services on a single VPS, so you get a lot more. - I might have a dozen websites, an email server, a chat server and a file-sharing services on one VPS. -

- -

- The VPS provider that I'll be using for this guide is Vultr, since that is what I use. - Vultr provides a free one-month $100 credit to anyone who starts an account through this referral link of mine - so you can play around with their services with impunity. -

- -

Starting your server in two minutes or less

- -

- Start an account on Vultr and let's get started. -

- -

- Vultr (and other VPS providers) usually give you a choice in where and what exactly your VPS is. -

- -

Server Location

- -

- In general, it doesn't hugely matter what physical location - you have your server in. You might theoretically want it close to - where you or your audience might be, but if you host a server in - Singapore for an American audience, they won't have to be waiting a - perceptibly longer time to load the site. -

- -

- -

Some locations might have different abilities and plans than others. - For example, in Vultr, their New York location has optional DDOS protection and also has some cheaper $3.50 servers.

- -

Operating System/Server Type

- -

- I especially recommend Debian 10 for an operating system for your server. - Debian is the "classic" server OS and as such, I make my guides on this site for Debian 10. - If you use another OS, just know that your millage may vary in terms of you might need to change some instructions here minorly. -

- -

Server size

- -

- You finally have a choice in how beefy a server you want. - On Vultr, I recommend getting the cheapest option that is not IPv6 only. -

- -

- Web hosting and even moderately complicated sites do not use huge amounts of RAM or CPU power. - If you start doing more intensive stuff than hosting some webpages and an email server and such, - you can always bump up your plan on Vultr without data loss (it's not so easy to bump down). -

- -

Additional features

- -

- On Vultr, there are some final checkboxes you can select additional options. - You will want to check Enable IPv6 and also Block Storage Compatible. -

- -

- We will be setting up IPv6 because it's important for future-proofing your website as more of the web moves to the IPv6 protocol. - Block storage is the ability (if you want) to later rent large storage disks to connect to your VPS if desired. - You just might want that as an option, so it's worth activating now. -

- -

Done!

- -

- Once you select those settings, your server will automatically be deployed. - Momentarily, you will be able to see your server's IP addresses which will be used for the next brief step: -

- - Previous: Get a domain name. - Next: Connect Your Domain and Server. - -

- -

More info

- -

VPS vs. Self-hosting

- It is very possible instead of using a VPS, hooking up an old computer to the internet and attempting to host a website from that. - That can be a valid option if you can do it if you have a great internet connection and can do so without draining your power bill. - I don't recommend it because I don't (and can't) do it given my bandwidth needs. - For newbs, there are also some extra steps you have to take care of with DNS and setting up static IPs and such. -

- -

- I might write a guide on this in the future, but I don't do it myself. -

- -

Backups

- -

- Vultr and other VPS providers often provide the ability to make backup snapshots of your server in case of dataloss or their own error. - Backups on Vultr are free right now. - When we learn how to use rsync, I will recommend you to also keep your own backup of your site, or at least an offline version of it. - There's a low chance of their whole system collapsing or something, but I say it's a good idea to be hyper-precautious. -

- - - diff --git a/sshkeys.html b/sshkeys.html deleted file mode 100644 index dc0160f..0000000 --- a/sshkeys.html +++ /dev/null @@ -1,172 +0,0 @@ - - - - Log on with SSH Keys – LandChad.net - - - - - - - -

Log on with SSH Keys

- -

- Let's generate and use SSH keys on our computer. - This allows us to ensure our identity better than a password ever could. - This allows us to do two main things: -

Password-less login: With SSH keys, we can permanently designate our profile on our local computer as safe for our server, allowing us to bypass password verification when logging into our server.
Prevent hacking: Since we no longer need a password to log in, we can simply deactivate password logins on our server altogether, which prevents hacking from people who may be so lucky as to guess our password!

- In other words, using an SSH key to login is both safer, faster and easier. -

- -

- This is especially useful once you start making scripts on your computer that interact with your server. - You can upload files in the background, edit your spam filters or anything else from your local computer without having to input - your password each time you touch the server. -

Generate an SSH key pair

- Generating an SSH key is simple. Just run: -

ssh-keygen

- It will prompt you for several options and you can generally chose the default options in each case. - It will ask you to optionally include a password on your SSH key. - I generally recommend against this unless you happen to be using a computer where you don't have root access but someone else does (it does minimize the ease of using an SSH key in our case). -

What does this SSH key do?

- Now whenever you use ssh to log into a server, you have the public key of this SSH key pair as your identifier. - You can tell your server to trust this key and it will automatically allow password-less logins from this computer. -

Backing up your key

- We will do that momentarily, but first, I recommend you backup your newly generated key if you plan to use it. - If we disable logins to this one key and then lose the key, we might be locked out of our server. -

- I suggest copying your entire ~/.ssh/ directory (user-specific) to a USB drive and storing it securely. - You may also copy it to the same place on another computer to use the key there. -

- -

Making your server trust your key.

- -

- Now that you have generated an SSH key, just run the following: -

- -

ssh-copy-id root@yourdomain.com

- -

- The command will ask for your server's root password and log you in briefly. - What this does is that it puts your public SSH key fingerprint on your server in a file /root/.ssh/authorized_keys. - This file in turn allows approved SSH keys to log in without passwords. -

- - - -

- To test if this has worked, now try logging in normally to your server with ssh: -

- -

ssh root@yourdomain.com

- -

- It should now let you log in without a password prompt! -

- If you find that this does not work try running the following, make sure you are in the directory where the keys where created. -

- chmod 700 .ssh/ -

- chmod 644 .ssh/id_rsa.pub -

- chmod 600 .ssh/id_rsa -

- chmod 644 .ssh/authorized_keys -

- For whatever reason these files due not have the correct permissions set, as ssh is very picky about correct file permissions this can cause errors. The above will fix these. -

- -

Disabling Password Logins for Security

- -

- Once we have authorized ssh keys for all the devices we need, we can actually just disable password logins. - If you've ever looked at your system logs (journalctl -xe) you will find that there are always hundreds of random Chinese computers trying to brute force every server connected to the internet with random passwords. - They are usually unsuccessful, but let's make it impossible for them. -

- -

- Log into your server and open the /etc/ssh/sshd_config file. - Here we can set settings for our SSH daemon that receives SSH requests. -

- -

- Now find, uncomment or create the following three lines and set them all to no: -

- -

PasswordAuthentication no
-ChallengeResponseAuthentication no
-UsePAM no

- -

- Once we've done that, we will reload our SSH daemon: -

- -

systemctl reload sshd

- -

We're done!

- -

- Now you can log in quickly and password-less-ly to your server, despite the fact that it is now more secure than ever! -

- With these settings, even if a hacker steals or perfectly guesses an account password, they still cannot log in without an approved SSH key! -

- - -

What if I lose my SSH key?!

- -

- Firstly, don't do this. Take every precaution that you have a backup. -

- -

- If this does happen, Vultr and most other VPS providers will have a way out. - Log onto their website and select the server you want to log into. -

- -

- -

- In the image above, to the right of your VPS name are a series of icons. - Click on the computer screen-like icon which is the leftmost one. -

- -

- This will open up a browser window emulating a terminal and you can always login with your password here, - since logins here count as being local and they do not use SSH and therefore can indeed validate with your password even if you have disabled it over SSH. -

- -

- From here, simply reverse the settings we set above and you can log in via SSH with a password and reapprove a newly created SSH key or whatever you want to do. -

- -

- - - diff --git a/standalone.html b/standalone.html deleted file mode 100644 index c9204d8..0000000 --- a/standalone.html +++ /dev/null @@ -1,32 +0,0 @@ - - - - Certbot on Standalone Domains and Subdomains – LandChad.net - - - - - - - -

Certbot on Standalone Domains and Subdomains

- -

The command certbot --nginx will take an unencrypted website on an Nginx configuration file, get a certificate for it and change the configuration to use that certificate and thus HTTPS.

- -

systemctl stop nginx
-certbot certonly --standalone -d pleroma.example.org
-systemctl start nginx

- -

- - - diff --git a/static/favicon.ico b/static/favicon.ico new file mode 100644 index 0000000..d8f549d Binary files /dev/null and b/static/favicon.ico differ diff --git a/static/pix/auth.svg b/static/pix/auth.svg new file mode 100644 index 0000000..5b17192 --- /dev/null +++ b/static/pix/auth.svg @@ -0,0 +1,1461 @@ + + + + diff --git a/static/pix/bat.svg b/static/pix/bat.svg new file mode 100644 index 0000000..2154658 --- /dev/null +++ b/static/pix/bat.svg @@ -0,0 +1,22 @@ + + + diff --git a/static/pix/bitcoin-01.png b/static/pix/bitcoin-01.png new file mode 100644 index 0000000..8f38d0e Binary files /dev/null and b/static/pix/bitcoin-01.png differ diff --git a/static/pix/bitcoin-02.png b/static/pix/bitcoin-02.png new file mode 100644 index 0000000..a566a18 Binary files /dev/null and b/static/pix/bitcoin-02.png differ diff --git a/static/pix/bitcoin-03.png b/static/pix/bitcoin-03.png new file mode 100644 index 0000000..dd02d8d Binary files /dev/null and b/static/pix/bitcoin-03.png differ diff --git a/static/pix/bitcoin-04.png b/static/pix/bitcoin-04.png new file mode 100644 index 0000000..104f179 Binary files /dev/null and b/static/pix/bitcoin-04.png differ diff --git a/static/pix/btc.png b/static/pix/btc.png new file mode 100644 index 0000000..bbe842c Binary files /dev/null and b/static/pix/btc.png differ diff --git a/static/pix/btc.svg b/static/pix/btc.svg new file mode 100644 index 0000000..b3fd9e3 --- /dev/null +++ b/static/pix/btc.svg @@ -0,0 +1,7 @@ + + \ No newline at end of file diff --git a/static/pix/btcpay.svg b/static/pix/btcpay.svg new file mode 100644 index 0000000..bb9f410 --- /dev/null +++ b/static/pix/btcpay.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/static/pix/calibre.png b/static/pix/calibre.png new file mode 100644 index 0000000..81adc85 Binary files /dev/null and b/static/pix/calibre.png differ diff --git a/static/pix/calibre/calibre-1.png b/static/pix/calibre/calibre-1.png new file mode 100644 index 0000000..cf767e0 Binary files /dev/null and b/static/pix/calibre/calibre-1.png differ diff --git a/static/pix/calibre/calibre-2.png b/static/pix/calibre/calibre-2.png new file mode 100644 index 0000000..e0c76ba Binary files /dev/null and b/static/pix/calibre/calibre-2.png differ diff --git a/static/pix/certbot-01.png b/static/pix/certbot-01.png new file mode 100644 index 0000000..37d81f8 Binary files /dev/null and b/static/pix/certbot-01.png differ diff --git a/static/pix/certbot-02.png b/static/pix/certbot-02.png new file mode 100644 index 0000000..24905f8 Binary files /dev/null and b/static/pix/certbot-02.png differ diff --git a/static/pix/certbot-03.png b/static/pix/certbot-03.png new file mode 100644 index 0000000..1a60fe9 Binary files /dev/null and b/static/pix/certbot-03.png differ diff --git a/static/pix/cgit.svg b/static/pix/cgit.svg new file mode 100644 index 0000000..72eafa6 --- /dev/null +++ b/static/pix/cgit.svg @@ -0,0 +1,58 @@ + + + + diff --git a/static/pix/chad.gif b/static/pix/chad.gif new file mode 100644 index 0000000..98b8904 Binary files /dev/null and b/static/pix/chad.gif differ diff --git a/static/pix/devault.jpg b/static/pix/devault.jpg new file mode 100644 index 0000000..a3dc88a Binary files /dev/null and b/static/pix/devault.jpg differ diff --git a/static/pix/dkim-01.png b/static/pix/dkim-01.png new file mode 100644 index 0000000..ab8a9a4 Binary files /dev/null and b/static/pix/dkim-01.png differ diff --git a/static/pix/dns-epik.png b/static/pix/dns-epik.png new file mode 100644 index 0000000..33d2c40 Binary files /dev/null and b/static/pix/dns-epik.png differ diff --git a/static/pix/dns-ipv4-done.png b/static/pix/dns-ipv4-done.png new file mode 100644 index 0000000..1195f06 Binary files /dev/null and b/static/pix/dns-ipv4-done.png differ diff --git a/static/pix/dns-ipv4.png b/static/pix/dns-ipv4.png new file mode 100644 index 0000000..d9c14cd Binary files /dev/null and b/static/pix/dns-ipv4.png differ diff --git a/static/pix/dns-ipv6-done.png b/static/pix/dns-ipv6-done.png new file mode 100644 index 0000000..0559575 Binary files /dev/null and b/static/pix/dns-ipv6-done.png differ diff --git a/static/pix/dns-ipv6.png b/static/pix/dns-ipv6.png new file mode 100644 index 0000000..8fffd6a Binary files /dev/null and b/static/pix/dns-ipv6.png differ diff --git a/static/pix/dns-ping.png b/static/pix/dns-ping.png new file mode 100644 index 0000000..f900774 Binary files /dev/null and b/static/pix/dns-ping.png differ diff --git a/static/pix/dns-vultr.png b/static/pix/dns-vultr.png new file mode 100644 index 0000000..9db0be7 Binary files /dev/null and b/static/pix/dns-vultr.png differ diff --git a/static/pix/domain-cart.png b/static/pix/domain-cart.png new file mode 100644 index 0000000..7f55880 Binary files /dev/null and b/static/pix/domain-cart.png differ diff --git a/static/pix/domain-search.png b/static/pix/domain-search.png new file mode 100644 index 0000000..e99ca2a Binary files /dev/null and b/static/pix/domain-search.png differ diff --git a/static/pix/ejabberd-admin.jpg b/static/pix/ejabberd-admin.jpg new file mode 100644 index 0000000..9bbd4ed Binary files /dev/null and b/static/pix/ejabberd-admin.jpg differ diff --git a/static/pix/ejabberd-login.jpg b/static/pix/ejabberd-login.jpg new file mode 100644 index 0000000..8904aaf Binary files /dev/null and b/static/pix/ejabberd-login.jpg differ diff --git a/static/pix/ejabberd.png b/static/pix/ejabberd.png new file mode 100644 index 0000000..694e435 Binary files /dev/null and b/static/pix/ejabberd.png differ diff --git a/static/pix/element.svg b/static/pix/element.svg new file mode 100644 index 0000000..d29423e --- /dev/null +++ b/static/pix/element.svg @@ -0,0 +1,6 @@ + \ No newline at end of file diff --git a/static/pix/fren_apu_tongue.png b/static/pix/fren_apu_tongue.png new file mode 100644 index 0000000..eb525be Binary files /dev/null and b/static/pix/fren_apu_tongue.png differ diff --git a/static/pix/git.svg b/static/pix/git.svg new file mode 100644 index 0000000..2e42bc7 --- /dev/null +++ b/static/pix/git.svg @@ -0,0 +1,15 @@ + + + + diff --git a/static/pix/gitea.svg b/static/pix/gitea.svg new file mode 100644 index 0000000..9df6b83 --- /dev/null +++ b/static/pix/gitea.svg @@ -0,0 +1,31 @@ + + diff --git a/static/pix/github.svg b/static/pix/github.svg new file mode 100644 index 0000000..93af7db --- /dev/null +++ b/static/pix/github.svg @@ -0,0 +1,3 @@ + \ No newline at end of file diff --git a/static/pix/html-01.png b/static/pix/html-01.png new file mode 100644 index 0000000..c984971 Binary files /dev/null and b/static/pix/html-01.png differ diff --git a/static/pix/html-02.png b/static/pix/html-02.png new file mode 100644 index 0000000..d2f70d0 Binary files /dev/null and b/static/pix/html-02.png differ diff --git a/static/pix/html2-01.png b/static/pix/html2-01.png new file mode 100644 index 0000000..b808c0e Binary files /dev/null and b/static/pix/html2-01.png differ diff --git a/static/pix/i2p.svg b/static/pix/i2p.svg new file mode 100644 index 0000000..5dc629b --- /dev/null +++ b/static/pix/i2p.svg @@ -0,0 +1,98 @@ + + + \ No newline at end of file diff --git a/static/pix/imgcompress-cat.png b/static/pix/imgcompress-cat.png new file mode 100644 index 0000000..7243ae8 Binary files /dev/null and b/static/pix/imgcompress-cat.png differ diff --git a/static/pix/imgcompress-network.png b/static/pix/imgcompress-network.png new file mode 100644 index 0000000..09bc401 Binary files /dev/null and b/static/pix/imgcompress-network.png differ diff --git a/static/pix/inok.jpg b/static/pix/inok.jpg new file mode 100644 index 0000000..5bf7fdb Binary files /dev/null and b/static/pix/inok.jpg differ diff --git a/static/pix/irc.svg b/static/pix/irc.svg new file mode 100644 index 0000000..0f48379 --- /dev/null +++ b/static/pix/irc.svg @@ -0,0 +1,57 @@ + + + diff --git a/static/pix/irc/hexchat-connection-complete.png b/static/pix/irc/hexchat-connection-complete.png new file mode 100644 index 0000000..096ae01 Binary files /dev/null and b/static/pix/irc/hexchat-connection-complete.png differ diff --git a/static/pix/irc/hexchat-network-edit.png b/static/pix/irc/hexchat-network-edit.png new file mode 100644 index 0000000..4a0fb6f Binary files /dev/null and b/static/pix/irc/hexchat-network-edit.png differ diff --git a/static/pix/irc/hexchat-network-select.png b/static/pix/irc/hexchat-network-select.png new file mode 100644 index 0000000..9f4ffe3 Binary files /dev/null and b/static/pix/irc/hexchat-network-select.png differ diff --git a/static/pix/irc/hexchat-sasl.png b/static/pix/irc/hexchat-sasl.png new file mode 100644 index 0000000..ce77149 Binary files /dev/null and b/static/pix/irc/hexchat-sasl.png differ diff --git a/static/pix/irc/textual-identity.png b/static/pix/irc/textual-identity.png new file mode 100644 index 0000000..a2fce22 Binary files /dev/null and b/static/pix/irc/textual-identity.png differ diff --git a/static/pix/irc/textual-network-edit.png b/static/pix/irc/textual-network-edit.png new file mode 100644 index 0000000..1eb4dc7 Binary files /dev/null and b/static/pix/irc/textual-network-edit.png differ diff --git a/static/pix/itoopie.svg b/static/pix/itoopie.svg new file mode 100644 index 0000000..39e430d --- /dev/null +++ b/static/pix/itoopie.svg @@ -0,0 +1 @@ + diff --git a/static/pix/jitsi-01.webp b/static/pix/jitsi-01.webp new file mode 100644 index 0000000..a71f1ae Binary files /dev/null and b/static/pix/jitsi-01.webp differ diff --git a/static/pix/jitsi.svg b/static/pix/jitsi.svg new file mode 100644 index 0000000..5a3526a --- /dev/null +++ b/static/pix/jitsi.svg @@ -0,0 +1,650 @@ + + + + diff --git a/static/pix/landchad.gif b/static/pix/landchad.gif new file mode 100644 index 0000000..302cd26 Binary files /dev/null and b/static/pix/landchad.gif differ diff --git a/static/pix/matrix.svg b/static/pix/matrix.svg new file mode 100644 index 0000000..9a8b8dd --- /dev/null +++ b/static/pix/matrix.svg @@ -0,0 +1,48 @@ + + + diff --git a/static/pix/monero-01.png b/static/pix/monero-01.png new file mode 100644 index 0000000..44f7a62 Binary files /dev/null and b/static/pix/monero-01.png differ diff --git a/static/pix/monero-02.png b/static/pix/monero-02.png new file mode 100644 index 0000000..1ef8bbc Binary files /dev/null and b/static/pix/monero-02.png differ diff --git a/static/pix/monero-03.png b/static/pix/monero-03.png new file mode 100644 index 0000000..52bebbe Binary files /dev/null and b/static/pix/monero-03.png differ diff --git a/static/pix/monero-04.png b/static/pix/monero-04.png new file mode 100644 index 0000000..228734c Binary files /dev/null and b/static/pix/monero-04.png differ diff --git a/static/pix/movim.svg b/static/pix/movim.svg new file mode 100644 index 0000000..9a34dd7 --- /dev/null +++ b/static/pix/movim.svg @@ -0,0 +1,20 @@ + + \ No newline at end of file diff --git a/static/pix/nextcloud.svg b/static/pix/nextcloud.svg new file mode 100644 index 0000000..6f2e1a3 --- /dev/null +++ b/static/pix/nextcloud.svg @@ -0,0 +1 @@ + \ No newline at end of file diff --git a/static/pix/nginx-password.png b/static/pix/nginx-password.png new file mode 100644 index 0000000..a1ae5e5 Binary files /dev/null and b/static/pix/nginx-password.png differ diff --git a/static/pix/nginx-website.png b/static/pix/nginx-website.png new file mode 100644 index 0000000..40d5236 Binary files /dev/null and b/static/pix/nginx-website.png differ diff --git a/static/pix/openalias-01.png b/static/pix/openalias-01.png new file mode 100644 index 0000000..b239634 Binary files /dev/null and b/static/pix/openalias-01.png differ diff --git a/static/pix/openalias-02.png b/static/pix/openalias-02.png new file mode 100644 index 0000000..03a45b0 Binary files /dev/null and b/static/pix/openalias-02.png differ diff --git a/static/pix/openalias-03.png b/static/pix/openalias-03.png new file mode 100644 index 0000000..9e2ba0b Binary files /dev/null and b/static/pix/openalias-03.png differ diff --git a/static/pix/openalias-04.png b/static/pix/openalias-04.png new file mode 100644 index 0000000..35caf10 Binary files /dev/null and b/static/pix/openalias-04.png differ diff --git a/static/pix/openalias-05.png b/static/pix/openalias-05.png new file mode 100644 index 0000000..a435462 Binary files /dev/null and b/static/pix/openalias-05.png differ diff --git a/static/pix/peertube-login.jpg b/static/pix/peertube-login.jpg new file mode 100644 index 0000000..d191cc4 Binary files /dev/null and b/static/pix/peertube-login.jpg differ diff --git a/static/pix/peertube.svg b/static/pix/peertube.svg new file mode 100644 index 0000000..38992a5 --- /dev/null +++ b/static/pix/peertube.svg @@ -0,0 +1,118 @@ + + diff --git a/static/pix/pleroma.svg b/static/pix/pleroma.svg new file mode 100644 index 0000000..c92da7c --- /dev/null +++ b/static/pix/pleroma.svg @@ -0,0 +1,2 @@ + + diff --git a/static/pix/prosody.svg b/static/pix/prosody.svg new file mode 100644 index 0000000..9edae9b --- /dev/null +++ b/static/pix/prosody.svg @@ -0,0 +1,9 @@ + \ No newline at end of file diff --git a/static/pix/radicale.svg b/static/pix/radicale.svg new file mode 100644 index 0000000..546d3d1 --- /dev/null +++ b/static/pix/radicale.svg @@ -0,0 +1,10 @@ + + diff --git a/static/pix/rainloop-.png b/static/pix/rainloop-.png new file mode 100644 index 0000000..640ac85 Binary files /dev/null and b/static/pix/rainloop-.png differ diff --git a/static/pix/rainloop.png b/static/pix/rainloop.png new file mode 100644 index 0000000..93500ab Binary files /dev/null and b/static/pix/rainloop.png differ diff --git a/static/pix/rdns-01.png b/static/pix/rdns-01.png new file mode 100644 index 0000000..464bb07 Binary files /dev/null and b/static/pix/rdns-01.png differ diff --git a/static/pix/rdns-02.png b/static/pix/rdns-02.png new file mode 100644 index 0000000..35eefec Binary files /dev/null and b/static/pix/rdns-02.png differ diff --git a/static/pix/rss.svg b/static/pix/rss.svg new file mode 100644 index 0000000..35afbe2 --- /dev/null +++ b/static/pix/rss.svg @@ -0,0 +1,33 @@ + + + + \ No newline at end of file diff --git a/static/pix/rsync.png b/static/pix/rsync.png new file mode 100644 index 0000000..7190b41 Binary files /dev/null and b/static/pix/rsync.png differ diff --git a/static/pix/searxng.svg b/static/pix/searxng.svg new file mode 100644 index 0000000..417e7ed --- /dev/null +++ b/static/pix/searxng.svg @@ -0,0 +1,19 @@ + + \ No newline at end of file diff --git a/static/pix/server-features.png b/static/pix/server-features.png new file mode 100644 index 0000000..6891b46 Binary files /dev/null and b/static/pix/server-features.png differ diff --git a/static/pix/server-location.png b/static/pix/server-location.png new file mode 100644 index 0000000..b97e8d2 Binary files /dev/null and b/static/pix/server-location.png differ diff --git a/static/pix/server-size.png b/static/pix/server-size.png new file mode 100644 index 0000000..39ddc33 Binary files /dev/null and b/static/pix/server-size.png differ diff --git a/static/pix/server-type.png b/static/pix/server-type.png new file mode 100644 index 0000000..188b101 Binary files /dev/null and b/static/pix/server-type.png differ diff --git a/static/pix/smtp-01.png b/static/pix/smtp-01.png new file mode 100644 index 0000000..8b023d7 Binary files /dev/null and b/static/pix/smtp-01.png differ diff --git a/static/pix/smtp-02.png b/static/pix/smtp-02.png new file mode 100644 index 0000000..82f8774 Binary files /dev/null and b/static/pix/smtp-02.png differ diff --git a/static/pix/ssh-01.png b/static/pix/ssh-01.png new file mode 100644 index 0000000..855f313 Binary files /dev/null and b/static/pix/ssh-01.png differ diff --git a/static/pix/tor.svg b/static/pix/tor.svg new file mode 100644 index 0000000..4d7eefd --- /dev/null +++ b/static/pix/tor.svg @@ -0,0 +1,41 @@ + + \ No newline at end of file diff --git a/static/pix/webrtc.svg b/static/pix/webrtc.svg new file mode 100644 index 0000000..582a506 --- /dev/null +++ b/static/pix/webrtc.svg @@ -0,0 +1,16 @@ + + \ No newline at end of file diff --git a/static/pix/xmpp.svg b/static/pix/xmpp.svg new file mode 100644 index 0000000..c9d7536 --- /dev/null +++ b/static/pix/xmpp.svg @@ -0,0 +1,26 @@ + + + + diff --git a/static/pix/xmr.png b/static/pix/xmr.png new file mode 100644 index 0000000..00cfa96 Binary files /dev/null and b/static/pix/xmr.png differ diff --git a/static/pix/xmr.svg b/static/pix/xmr.svg new file mode 100644 index 0000000..002ad9b --- /dev/null +++ b/static/pix/xmr.svg @@ -0,0 +1,7 @@ + + diff --git a/static/style.css b/static/style.css new file mode 100644 index 0000000..cb6e6b9 --- /dev/null +++ b/static/style.css @@ -0,0 +1,323 @@ +/* Since this site is about teaching web concepts, even this file is a learning + * opportunity. */ + +body { + color: beige ; + background: #111 ; + margin-bottom: 200px ; + font-family: sans-serif ; +} + +h1 { + text-align: center ; + color: lightgreen ; +} + +header h1 { + font-size: 40px ; +} + +h2 { + text-align: center ; + color: deeppink ; + font-size: 24pt ; + border-bottom: dashed #ddd 1px ; + max-width: 500px ; + margin: 1em auto ; + clear: both ; +} + +h3 { + color: gold ; + clear: both ; +} + +/* "a" is for links. */ +a { + color: lightblue ; +} + +/* The "hover" option, which can be used with pretty much anything, allows you + * to set different settings if someone hovers over something with their mouse. + * */ +a:hover { + color: white ; +} + +dt { + font-weight: bold ; +} + +/* code and pre are for formatting monospace text commands. Use code generally, + * but pre is for separate code blocks. pre is also sensitive to whitespace, + * unlike most of HTML. */ +code { + border-radius: 5px ; +} +pre { + background: #111222 ; + border: 1px solid lime ; + border-radius: 20px ; + padding: 1em ; + white-space: pre-wrap; + overflow-wrap: break-word ; + max-width: 600px ; + margin: auto ; +} + +.wide { max-width: inherit ; } + +p img, li img, h1 img, h2 img, h3 img, h4 img, dt img, .inline { + vertical-align: middle ; + max-width: 1em; + max-height: 1em; + border: none ; + display: inline ; +} + +p img, li img, h1 img, h2 img, h3 img, h4 img, dt img, .inline { + vertical-align: middle ; + max-width: 1em; + max-height: 1em; + border: none ; + display: inline ; +} + +img { + max-width: 90% ; + margin: auto ; + display: block ; + border: solid 5px beige ; +} +.titleimg { + border: none ; + height: 150px ; +} +strong { + color: orange ; +} + +footer { + text-align: center ; + font-variant: small-caps ; + clear: both ; + padding: 2em 0 ; +} +footer li { + display: inline-block ; + padding: 0 .5em ; + font-size: x-large ; +} +footer li:hover { + background: lightblue ; +} + +nav { font-size: small ;} + +footer { font-size: large ; } + +nav ul, footer ul, #taglist { + padding: 0; +} + +main { + margin: auto ; +} + +/* asides are used for minor tangential notes. I have them shrunk down in + * softer colors in a box with soft corners (border-radius). */ + +aside { + border: solid 1px black ; + border-radius: 20px ; + padding: 0 1em 0 1em ; + font-size: small ; +} + +aside p { + color: gray ; +} + +aside code { + color: green ; +} + +/* .callout here is refencing any aside given the class name callout + * An example being:

*/ +aside.callout { + border: solid 1px orange; +} + +.cnp { + width: 100% ; + +} + +/* This "@media" block defines rules that will only be applied when the minimum + * width of the screen is 55em or greater. In essence, they are settings that + * only apply on normal weide screens, but *not* phones and low res monitors. + * Since we have more room on widescreens, we change a couple things. */ + +@media (min-width: 55em) { + + aside { + margin: 0 30px 0 30px; + } + + .resright, .disappear { + display: block ; + float: right; + padding: 20px ; + clear: both ; + max-height: 400px ; + max-width: 300px ; + } + + header { max-width: 900px ; margin: auto;} + main { max-width: 850px ; } +} + +.ll { + font-size: large ; + line-height: 1.3em ; + max-width: 600px; + margin: auto ; + display: block ; +} + +.ll dt { + display: inline-block ; + width: 6em ; + background: gray ; + max-width: 30% ; +} + +.ll dd { + display: inline ; + background: blue ; + max-width: 60% ; +} + +.ll dd:after { + display:block; + content: '' ; +} + + +/* These settings are for the cryptocurrency donation QR codes and info on the + * main page. */ +.qr { max-width: 150px ; padding: 10px; border: none; } +.cryptocontainer { + display: flex ; + flex-wrap: wrap ; + justify-content: center ; +} +.cryptoinfo { + max-width: 350px ; + text-align: center ; + padding-left: 10px ; + padding-right: 10px ; +} +.cryptoinfo code,.crypto { + font-size: small ; + overflow-wrap: break-word ; +} + +/* The "Next Article" Button changes color and also has a 👉 automatically + * added to its front. */ + +@-webkit-keyframes next { + 0% {color: yellow ;} + 100% {color: lightblue} +} + +.prev { + font-size: large ; + text-align: center ; + margin: auto ; + display: block ; + font-weight: bold ; +} + +.prev:before { + content: "👈" ; +} + +.next a { + color: inherit ; +} + +.next { + -webkit-animation:next 1s infinite alternate ; + font-size: xx-large ; + text-align: center ; + margin: auto ; + display: block ; + font-weight: bold ; + padding: 0 1em 1em 1em ; +} + +#servicelist { + text-align: center ; +} + +.next:before { + content: "👉" ; +} + +#servicelist { + padding-left: 0 ; +} + +#servicelist li { + display: inline-block ; + height: 150px ; + width: 150px ; + position: relative ; +} + +#servicelist img { + height: 80% ; + width: 80% ; + max-height: none ; + max-width: none ; + position: absolute ; + left: 50% ; + transform: translateX(-50%); +} + +#servicelist .title, #servicelist li:hover .desc { + display: block ; + position: absolute ; + color: white ; + width: 100% ; + text-align: center ; + top: 50%; + transform: translateY(-50%); + border-radius: 1em ; + font-size: large ; + +} + +.left { + width: 45% ; + float: left ; + clear: both ; +} + +.right { + width: 45% ; + float: right ; +} + +#servicelist .title { + font-size: xx-large ; + background-color: rgba(3,3,3,0.6) ; +} +#servicelist li:hover .desc { + background-color: rgba(3,3,3,0.9) ; +} + +#servicelist li:hover .title, .desc, .tags { + display: none ; +} diff --git a/style.css b/style.css deleted file mode 100644 index 5167903..0000000 --- a/style.css +++ /dev/null @@ -1,249 +0,0 @@ -/* Since this site is about teaching web concepts, even this file is a learning - * opportunity. */ - -body { - color: beige ; - background: #111 ; - margin-bottom: 200px ; - font-family: sans-serif ; -} - -h1 { - text-align: center ; - color: lightgreen ; -} - -header h1 { - font-size: 40px ; -} - -h2 { - text-align: center ; - color: deeppink ; - font-variant: small-caps; - font-size: 24pt ; - border-bottom: dashed #ddd 1px ; - max-width: 500px ; - margin: 1em auto ; -} - -h3 { - color: gold ; -} - -/* "a" is for links. */ -a { - color: lightblue ; -} - -/* The "hover" option, which can be used with pretty much anything, allows you - * to set different settings if someone hovers over something with their mouse. - * */ -a:hover { - color: white ; -} - -dt { - font-weight: bold ; -} - -/* code and pre are for formatting monospace text commands. Use code generally, - * but pre is for separate code blocks. pre is also sensitive to whitespace, - * unlike most of HTML. */ -code { - color: lime ; - border-radius: 5px ; -} -pre { - background: #111222 ; - border: 1px solid lime ; - border-radius: 20px ; - padding: 1em ; - white-space: pre-wrap; - overflow-wrap: break-word ; - max-width: 600px ; - margin: auto ; -} - -.wide { max-width: inherit ; } - -p img, li img, h1 img, h2 img, h3 img, h4 img, dt img { - vertical-align: middle ; - max-width: 1em; - max-height: 1em; - border: none ; - display: inline ; -} - -img { - max-width: 90% ; - margin: auto ; - display: block ; - border: solid 5px beige ; -} -.titleimg { - border: none ; - height: 150px ; -} -strong { - color: orange ; -} - -footer { - text-align: center ; - font-variant: small-caps ; - clear: both ; - padding: 2em 0 ; -} -footer li { - display: inline-block ; - padding: 0 .5em ; - font-size: x-large ; -} -footer li:hover { - background: lightblue ; -} - -nav { font-size: small ;} - -footer { font-size: large ; } - -nav ul, footer ul, #taglist { - padding: 0; -} - -main { - margin: auto ; -} - -/* asides are used for minor tangential notes. I have them shrunk down in - * softer colors in a box with soft corners (border-radius). */ - -aside { - border: solid 1px black ; - border-radius: 20px ; - padding: 0 1em 0 1em ; - font-size: small ; -} - -aside p { - color: gray ; -} - -aside code { - color: green ; -} - -/* .callout here is refencing any aside given the class name callout - * An example being:

*/ -aside.callout { - border: solid 1px orange; -} - -.cnp { - width: 100% ; - -} - -/* This "@media" block defines rules that will only be applied when the minimum - * width of the screen is 55em or greater. In essence, they are settings that - * only apply on normal weide screens, but *not* phones and low res monitors. - * Since we have more room on widescreens, we change a couple things. */ - -@media (min-width: 55em) { - - aside { - margin: 0 30px 0 30px; - } - - .resright, .disappear { - display: block ; - float: right; - padding: 20px ; - clear: both ; - max-height: 400px ; - max-width: 300px ; - } - - header { max-width: 900px ; margin: auto;} - main { max-width: 850px ; } -} - -.ll { - font-size: large ; - line-height: 1.3em ; - max-width: 600px; - margin: auto ; -} - -.ll dd { - display: inline ; -} - -.ll dt { - display: inline-block ; - width: 6em ; -} - -.ll dd:after { - display:block; - content: '' ; -} - - -/* These settings are for the cryptocurrency donation QR codes and info on the - * main page. */ -.qr { max-width: 150px ; padding: 10px; border: none; } -.cryptocontainer { - display: flex ; - flex-wrap: wrap ; - justify-content: center ; -} -.cryptoinfo { - max-width: 350px ; - text-align: center ; - padding-left: 10px ; - padding-right: 10px ; -} -.cryptoinfo code,.crypto { - font-size: small ; - overflow-wrap: break-word ; -} - -/* The "Next Article" Button changes color and also has a 👉 automatically - * added to its front. */ - -@-webkit-keyframes next { - 0% {color: yellow ;} - 100% {color: lightblue} -} - -.prev { - font-size: large ; - text-align: center ; - margin: auto ; - display: block ; - font-weight: bold ; -} - -.prev:before { - content: "👈" ; -} - -.next a { - color: inherit ; -} - -.next { - -webkit-animation:next 1s infinite alternate ; - font-size: xx-large ; - text-align: center ; - margin: auto ; - display: block ; - font-weight: bold ; - padding: 0 1em 1em 1em ; -} - -.next:before { - content: "👉" ; -} diff --git a/template.html b/template.html deleted file mode 100644 index b7485fc..0000000 --- a/template.html +++ /dev/null @@ -1,20 +0,0 @@ - - - - <++> – LandChad.net - - - - - - - -

<++>

- -

- <++> - Next:<++> -

- - - diff --git a/tor.html b/tor.html deleted file mode 100644 index 594c70c..0000000 --- a/tor.html +++ /dev/null @@ -1,111 +0,0 @@ - - - - Mirror your site over Tor - - - - - - - -

Mirror Your Site Over Tor

- -

- Now that you have a website, why not offer it on a private alternative such as the onion network? -

- -

Setting up Tor

- -

Installing Tor

- -

First, we need to ensure that our CPU architecture is supported. Ensure that it is either amd64, arm64, or i386:

dpkg --print-architecture

- -

We need to add the Tor repos to our system to get the latest version of Tor:

apt install -y apt-transport-https gpg
-echo "deb     [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $(lsb_release -cs) main
-deb-src [signed-by=/usr/share/keyrings/tor-archive-keyring.gpg] https://deb.torproject.org/torproject.org $(lsb_release -cs) main" > /etc/apt/sources.list.d/tor.list

- -

Then we need to add the GPG keys to our keyring:

- -

curl -s https://deb.torproject.org/torproject.org/A3C4F0F979CAA22CDBA8F512EE8CBC9E886DDD89.asc | gpg --dearmor > /usr/share/keyrings/tor-archive-keyring.gpg

- -

Now install Tor:

- -

apt update
-apt install tor deb.torproject.org-keyring

- -

Enabling Tor

- -

Next edit the file /etc/tor/torrc, uncommenting the following lines:

HiddenServiceDir /var/lib/tor/hidden_service/
-HiddenServicePort 80 127.0.0.1:80

- - -

Now start and enable Tor at boot:

 systemctl enable --now tor

- -

If the next command outputs active in green you're golden!

 systemctl status tor

- -

Now your server is on the dark web. The following command will give you your onion address:

 cat /var/lib/tor/hidden_service/hostname

- -

Adding the Nginx Config

- From here, the steps are almost identical to setting up a normal website configuration file. - Follow the steps as if you were making a new website in the webserver - tutorial up until the server block of code. Instead, paste this: -

- -

        server {
-            listen 127.0.0.1:80 ;
-            root /var/www/landchad ;
-            index index.html ;
-            server_name your-onion-address.onion ;
-        }

- - -

- Now we are almost done, all we have to do is enable the site and reload nginx which, is also covered in the webserver tutorial. -

- -

Advertise your onion service

- -

You can add the Onion-Location header to your normal website to advertise your onion service to Tor users. On your regular site's nginx config, add the following line:

server {
-    ...
-    add_header Onion-Location http://your-onion-address.onion$request_uri;
-}

After doing this and reloading nginx, when visiting your regular site via Tor, you should see a ".onion available" button on the address bar, which should take you to the onion service.

- -

Update regularly!

- -

Make sure to update Tor on a regular basis by running:

apt update
-apt install tor

- -

Note:

You do not need to run certbot for an ssl certificate. HTTP over tor is plenty secure!

- -

Contributor - tomfasano.co

- -

- - - diff --git a/ufw.html b/ufw.html deleted file mode 100644 index 721be4d..0000000 --- a/ufw.html +++ /dev/null @@ -1,193 +0,0 @@ - - - - Using UFW as a Firewall – LandChad.net - - - - - - - -

Using UFW as a Firewall

- -

How to Get It

- -

Log into your server by pulling up a terminal and typing:

- -

ssh root@example.org

- -

- Some VPS providers automatically install ufw, but if you do not have it installed already, install it in the typical way: -

- -

apt install ufw

- -

First-Time Setup

- -

You can check the status of ufw right now by running:

- -

ufw status

- -

Without any changes, it should report back Status: inactive. Let's set it up so that only connections to SSH (standardized at port 22) are allowed in, and then enable the firewall:

- -

ufw default deny incoming # block all incoming connections by default
-ufw allow in ssh # or: ufw allow in 22
-ufw enable

- -

- ufw has an internal list of protocols applications, and the ports used by them. - In this case, it knows SSH is on port 22. - We'll go more in detail how to view all protocols ufw knows about. - By default, when you allow an incoming port, it allows that port both on IPv4 and IPv6. -

- -

- With the firewall enabled and allowing only SSH in, all other ports are protected from incoming requests. - To view all your rules, run: -

- -

ufw status verbose

- -

A firewall that allows to connect to SSH and their website may look like:

- -

Status: active
-Logging: on (low)
-Default: deny (incoming), allow (outgoing), deny (routed)
-New profiles: skip
-
-To                           Action      From
---                           ------      ----
-22 (SSH)                     ALLOW IN    Anywhere
-80,443/tcp (WWW Full)        ALLOW IN    Anywhere
-22 (SSH (v6))                ALLOW IN    Anywhere (v6)
-80,443/tcp (WWW Full (v6))   ALLOW IN    Anywhere (v6)

- -

If you want to delete e.g. the 'WWW Full' rule, run:

- -

ufw delete allow in 'WWW Full'
-ufw reload

- -

Enabling Common Services

- -

Opening Port Numbers

- -

ufw allow 1985

- -

Websites: HTTP and HTTPS

- -

HTTP uses port 80 and HTTPS uses port 443. We can enable them like this:

- -

ufw allow 80
-ufw allow 443

- -

But ufw additionally knows the typical ports of common serives, so you can also run this:

- -

ufw allow http
-ufw allow https

- -

And that will do the same thing. There are also other abbreviations for common port lists:

- -

ufw allow in 'WWW Full'

- - -

To see these other "apps" that ufw knows by default, run ufw app list

- - -

Email: IMAP, POP3, and SMTP

- -

ufw allow in IMAPS
-ufw allow in POP3
-ufw allow in SMTP
-ufw allow in 'Postfix SMTPS'
-ufw allow in 'Mail Submission'

- -

Fine-Tuning Rules

- -

Instead of denying all ports by default, you may want to deny (ignores incoming requests) or reject (explicitly tells requests they're not allowed):

- -

ufw default allow in
-ufw deny in PORT
-ufw reject in PORT
-ufw reload

- -

You can add rules to comments to remember what they are there for:

- -

ufw allow in PORT comment 'Secret SSH'
-ufw reload
-ufw status verbose

- -

Output:

- -

To                         Action      From
---                         ------      ----
-PORT                       ALLOW IN    Anywhere                   # Secret SSH
-PORT (v6)                  ALLOW IN    Anywhere (v6)              # Secret SSH

- -

To deny outgoing ports:

- -

ufw deny out PORT

- -

Ratelimiting is useful to protect against brute-force login attacks, like in SSH. Only IPv4 is supported for now. Enable it by running:

- -

ufw limit PORT/tcp

- -

To blocklist IP addresses:

- -

ufw deny from IP_ADDRESS

- -

To read more what you can do with ufw, run:

- -

man ufw

- -

Recovering SSH

- -

ufw disable

- - -