Certbot on Standalone Domains and Subdomains

One entry's "Host" is left empty, this will allow people to send Monero by merely typing landchad.net. @@ -83,13 +83,13 @@ Let's check to see if it works. In the Monero wallet, we can now type in landchad.net as a recipient:

And once we press the "Resolve" button, it automatically turns into that address we gave to the DNS!

Now people can donate Monero to you without having to worry about QR codes or copying-and-pasting super-long public addresses! @@ -106,12 +106,12 @@

And we can then check that it's working by trying to send money to landchad.net in Electrum. See that it automatically appends the address!

And that's it. Now users can easily send your website or email address Bitcoin or Monero without having to worry about hard to read addresses and QR codes. diff --git a/pleroma.html b/pleroma.html index 6b67907..bcaffdb 100644 --- a/pleroma.html +++ b/pleroma.html @@ -13,7 +13,7 @@

Hopefully by now you won't have to be sold on the invasive practices that social media companies conduct. Websites such as Facebook and Twitter aquire so much data on users that they often know more about you than you know about yourself. The simple solution to this is to not use social media. However, that just isn't an option for most people. So the next best thing is to setup a self-hosted and federalised social media site so that you have full control over your data. @@ -26,7 +26,7 @@ I've previously made a vid

Installation

- +

Setting Up and Configuring

First things first you'll need to make sure that you've hardened you SSH so that password authentication is disabled and you'll also want to setup Fail2Ban. @@ -34,109 +34,99 @@ There's a great tutorial on how to do this &2;fi;if getconf GNU_LIBC_VERSION>/dev/null;then libc_postfix="";elif [ "$(ldd 2>&1|head -c 9)" = "musl libc" ];then libc_postfix="-musl";elif [ "$(find /lib/libc.musl*|wc -l)" ];then libc_postfix="-musl";else echo "Unsupported libc">&2;fi;echo "$arch$libc_postfix" - -

-Next we'll install the required packages. Run the below comman: +Next we'll install the required packages:

sudo apt install curl unzip libncurses5 postgresql postgresql-contrib nginx certbot libmagic-dev
-

apt install -y curl unzip libncurses5 postgresql postgresql-contrib nginx certbot libmagic-dev

You can manually configure postgreSQL to suit your system better. Check out the documentation here and then run the below command:

sudo systemctl restart postgresql
-

- +

systemctl restart postgresql

Installing the Pleroma App

First as the root user

+Pleroma is not in the Debian app repositories, so we will install it manually. First create the Pleroma user by running the below command:

adduser --system --shell  /bin/false --home /opt/pleroma pleroma
-

useradd -m -s /bin/bash -d /opt/pleroma pleroma

-Next you'll need to set the FLAVOUR variable to whatever your OS flavour was from the first step using this command: +Then, still as root, we will create the required directories and give the Pleroma user ownership of them.

export FLAVOUR="amd64-musl"
-

mkdir -p /var/lib/pleroma/uploads
+chown -R pleroma /var/lib/pleroma
+mkdir -p /var/lib/pleroma/static
+chown -R pleroma /var/lib/pleroma
+mkdir -p /etc/pleroma
+chown -R pleroma /etc/pleroma

+ +

Now, as the new Pleroma user

-Using the Pleroma user previously created clone the Pleroma app: +Now run su -l pleroma to login as the Pleroma user. +Now use the curl command below to download the Pleroma software and unzip it.

su pleroma -s $SHELL -lc "
-curl 'https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=$FLAVOUR' -o /tmp/pleroma.zip
-unzip /tmp/pleroma.zip -d /tmp/
-"
-

curl 'https://git.pleroma.social/api/v4/projects/2/jobs/artifacts/stable/download?job=amd64' -o /tmp/pleroma.zip
+unzip /tmp/pleroma.zip -d /tmp/

-Then run the next list of commands to move the files the the right locations, set the permissions etc... : -

+ -

su pleroma -s $SHELL -lc "
-mv /tmp/release/* /opt/pleroma
+mv /tmp/release/* /opt/pleroma
 rmdir /tmp/release
 rm /tmp/pleroma.zip
-"
-
-mkdir -p /var/lib/pleroma/uploads
-chown -R pleroma /var/lib/pleroma
-mkdir -p /var/lib/pleroma/static
-chown -R pleroma /var/lib/pleroma
-mkdir -p /etc/pleroma
-chown -R pleroma /etc/pleroma
+./bin/pleroma_ctl instance gen --output /etc/pleroma/config.exs --output-psql /tmp/setup_db.psql
 
-su pleroma -s $SHELL -lc "./bin/pleroma_ctl instance gen --output /etc/pleroma/config.exs --output-psql /tmp/setup_db.psql"
+We need to briefly return to the root user so we can run the following command (via the postgres user) to set up the database.
+Type ctrl-d or run exit to return to the root user, then run:
+
 
-su postgres -s $SHELL -lc "psql -f /tmp/setup_db.psql"
+su postgres -s $SHELL -lc "psql -f /tmp/setup_db.psql"
 
-su pleroma -s $SHELL -lc "./bin/pleroma_ctl migrate"
+Then return to the pleroma user with su -l pleroma and we will test to see that Pleroma can run:
 
+./bin/pleroma_ctl migrate
+./bin/pleroma daemon
 
-su pleroma -s $SHELL -lc "./bin/pleroma daemon"
+
+That will initialize Pleroma. It might take as long as a minute to get started, so wait a bit, then run the following:
+
+curl http://localhost:4000/api/v1/instance
 
-sleep 20 && curl http://localhost:4000/api/v1/instance
+If everything is working, this command will give you a long line of messy output. If it is not, you will get a connection error message.
+Once it is working successfully, stop the Pleroma daemon and we will interface Pleroma with the web server.
 
-su pleroma -s $SHELL -lc "./bin/pleroma stop"
-

./bin/pleroma stop

Setup and Configure Nginx

-For your domain name you'll need to install an SSL certificat for security. There's a guide here that will walk you through the steps. -Once you've got your cert setup copy over the Nginx configuration with the below command: +

+Return again to the root user. Let's copy Pleroma's Nginx configuration file from the template given in the installation and enable it:

cp /opt/pleroma/installation/pleroma.nginx /etc/nginx/sites-available/pleroma.conf
+ln -s /etc/nginx/sites-available/pleroma.conf /etc/nginx/sites-enabled/pleroma.conf

-ln -s /etc/nginx/sites-available/pleroma.conf /etc/nginx/sites-enabled/pleroma.conf - +

Edit the etc/nginx/sites-available/pleroma.conf file and replace example.tld with your domain name.

-Next you'll need to go into the etc/nginx/sites-enabled/pleroma.conf file and replace example.tld with your domain name. In my case my pleroma instance is shiteposting.com. -A quick tip is you can verify if the config is valid with the below command: +We now have to get a SSL certificate to enable encryption, since we have a model configuration that already includes SSL information, +just check the brief the standalone certificate page to get the needed certificate. +Once you've got your cert setup, copy over the Nginx configuration with the below command:

nginx -t
-

-Then simply restart the Nginx service with this command: +Once everything, including your Cerbot certificate is ready, simply reload Nginx with this command:

sudo systemctl restart nginx
-

systemctl reload nginx

Setting up the service

@@ -146,10 +136,8 @@ Pleroma itself runs on a SystemD service similar to other things running on your

cp /opt/pleroma/installation/pleroma.service /etc/systemd/system/pleroma.service
-
 systemctl start pleroma
-systemctl enable pleroma
-

+systemctl enable pleroma

If everything worked then when you go to your domain in the web browser you should see a bare-bones Pleroma instance. @@ -161,29 +149,20 @@ If everything worked then when you go to your domain in the web browser you shou

You'll be able to create new accounts on the Pleroma instance in the login section on the website but the easiest way to setup an admin account is with the CLI. Simply run the below command replaced with your username:

cd /opt/pleroma
-
-su pleroma -s $SHELL -lc "./bin/pleroma_ctl user new  @ --admin"
-

su -l pleroma
+./bin/pleroma_ctl user new username username@example.org --admin

If you run into any issues then feel free to checkout the documentation or send me an email or message. My details are below.

-My Website: https://biasedriot.co -

- -

-My Youtube Channel: https://www.youtube.com/channel/UCehh50T6qtDpt_kEUF33GJw -

biasedriot.co
youtube
Bitcoin: 1Dmn9jEtWAhdLk1HHWkUVNeDdAaBCwNajm
Monero: 84Y4FZiTbLeR5qc1fBrBhB1yq5agKtEdoixq2w1ysXJv486MiBCz3czGT15bqeXDPpdLoNyF93inxY3BCk6g8mrDMNKoArS

-Monero: 84Y4FZiTbLeR5qc1fBrBhB1yq5agKtEdoixq2w1ysXJv486MiBCz3czGT15bqeXDPpdLoNyF93inxY3BCk6g8mrDMNKoArS -

-Bitcoin: 1Dmn9jEtWAhdLk1HHWkUVNeDdAaBCwNajm -

The command certbot --nginx will take an unencrypted website on an Nginx configuration file, get a certificate for it and change the configuration to use that certificate and thus HTTPS.

+ +

Sometimes, however, you are given an Nginx configuration template that already has encryption/HTTPS, so running the automated certbot --nginx is not possible, as it will simply give an error saying that the certicate that Nginx is looking for doesn't already exist and thus the Nginx config is broken.

+ +

So suppose you want to get a certificate for pleroma.example.org because you are installing Pleroma and the configuration file presupposes a certificate. + In this case you would want to run this:

+ +

systemctl stop nginx
+certbot certonly --standalone -d pleroma.example.org
+systemctl start nginx

+ +

What we do here is temporarily turn of Nginx, then run a certonly subcommand that generates a certificate for the domain without changing or caring about the Nginx configuration. Then we reactivate Nginx, thus turning back on our webserver.

The reason we deactivate Nginx is that it uses the ports that Certbot will want to bind to, and thus we must temporarily turn Nginx off to let Certbot use those ports. (What it actually does is spin up a dummy webserver that doesn't need to think about the Nginx configuration.)

This is just a little note of something that might confuse people, but the three commands above should suffice. If your site is still managed by Nginx, it should still be able to renew with simple certbot renew --nginx without a problem.