root@partedmagic:~# gdisk /dev/sda
GPT fdisk (gdisk) version 0.8.6

Partition table scan:
  MBR: not present
  BSD: not present
  APM: not present
  GPT: not present

Creating new GPT entries.

Command (? for help): o
This option deletes all partitions and creates a new protective MBR.
Proceed? (Y/N): y

Command (? for help): n
Partition number (1-128, default 1): 
First sector (34-234441614, default = 2048) or {+-}size{KMGTP}: 
Last sector (2048-234441614, default = 234441614) or {+-}size{KMGTP}: +32M
Current type is 'Linux filesystem'
Hex code or GUID (L to show codes, Enter = 8300): ef02
Changed type of partition to 'BIOS boot partition'

Command (? for help): n
Partition number (2-128, default 2): 
First sector (34-234441614, default = 67584) or {+-}size{KMGTP}: 
Last sector (67584-234441614, default = 234441614) or {+-}size{KMGTP}: +256M
Current type is 'Linux filesystem'
Hex code or GUID (L to show codes, Enter = 8300): 
Changed type of partition to 'Linux filesystem'

Command (? for help): n
Partition number (3-128, default 3): 
First sector (34-234441614, default = 591872) or {+-}size{KMGTP}: 
Last sector (591872-234441614, default = 234441614) or {+-}size{KMGTP}: 
Current type is 'Linux filesystem'
Hex code or GUID (L to show codes, Enter = 8300): 8e00
Changed type of partition to 'Linux LVM'

Command (? for help): p
Disk /dev/sda: 234441648 sectors, 111.8 GiB
Logical sector size: 512 bytes
Disk identifier (GUID): D83D84F4-9955-4C12-8281-55F4D695F1CA
Partition table holds up to 128 entries
First usable sector is 34, last usable sector is 234441614
Partitions will be aligned on 2048-sector boundaries
Total free space is 2014 sectors (1007.0 KiB)

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048           67583   32.0 MiB    EF02  BIOS boot partition
   2           67584          591871   256.0 MiB   8300  Linux filesystem
   3          591872       234441614   111.5 GiB   8E00  Linux LVM

Command (? for help): 

Final checks complete. About to write GPT data. THIS WILL OVERWRITE EXISTING
PARTITIONS!!

Do you want to proceed? (Y/N): Y
OK; writing new GUID partition table (GPT) to /dev/sda.
The operation has completed successfully.

Disk /dev/sda: 234441648 sectors, 111.8 GiB

Number  Start (sector)    End (sector)  Size       Code  Name
   1            2048           67583   32.0 MiB    EF02  BIOS boot partition
   2           67584          591871   256.0 MiB   8300  Linux filesystem
   3          591872       234441614   111.5 GiB   8E00  Linux LVM

pvcreate /dev/sda3

vgcreate vg-ssd-one /dev/sda3

lvcreate -L 20G -n root vg-ssd-one
lvcreate -L 60G -n home vg-ssd-one
lvcreate -L 4G -n swap vg-ssd-one

apt-get install git

git clone https://github.com/YunoHost/install_script /tmp/install_script

cd /tmp/install_script
./install_yunohost

#passer en mode su  
su  
#donner les droits à "yann"
echo "yann     ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

  PV         VG         Fmt  Attr PSize   PFree 
  /dev/sda3  vg-ssd-one lvm2 a--  111,50g 27,50g
  /dev/sdb3  vg-nas-one lvm2 a--    3,64t  2,02t

mkdir /media/{video,yanplus}

/dev/mapper/vg--nas--one-yanplus /media/yanplus  ext4    defaults          0       2
/dev/mapper/vg--nas--one-video   /media/video    ext4    defaults          0       2

mount -a

ls /media/yanplus
ls /media/video

@ 3600 IN A 78.230.171.39
* 3600 IN A 78.230.171.39
@ 3600 IN AAAA 2a01:e34:ee6a:b270:beae:c5ff:fe57:150c
* 3600 IN AAAA 2a01:e34:ee6a:b270:beae:c5ff:fe57:150c

_xmpp-client._tcp 3600 IN SRV 0 5 5222 yanspm.com.
_xmpp-server._tcp 3600 IN SRV 0 5 5269 yanspm.com.
muc 3600 IN CNAME @
pubsub 3600 IN CNAME @
vjud 3600 IN CNAME @

@ 3600 IN MX 10 yanspm.com.
@ 3600 IN TXT "v=spf1 a mx ip4:78.230.171.39 ip6:2a01:e34:ee6a:b270:beae:c5ff:fe57:150c -all"
mail._domainkey.yanspm.com. 3600 IN TXT "v=DKIM1; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBZYXmqh/+d0zuGj/dfWsI8BPy+AUja87IysK84T8cyBSZrAzup2tiYChYRozMjDOUwHlnL8t4KkBG9o+wY0kzlN4nSTyfn4gQAV7EoymqHLXZrOIrlJGBkCKwKhevDV/vGzB6kS2SdcAoaDj4F49Bf2gAxPazgZClvm9a8rz4MQIDAQAB"
_dmarc 3600 IN TXT "v=DMARC1; p=none"

$TTL 3600
@	IN SOA dns111.ovh.net. tech.ovh.net. (2016100500 86400 3600 3600000 300)
                       IN NS     dns111.ovh.net.
                       IN NS     ns111.ovh.net.
                       IN MX 10  ouestline.net.
                       IN A      78.230.171.39
                       IN AAAA   2a01:e34:ee6a:b270:beae:c5ff:fe57:150c
                   600 IN TXT    "v=spf1 a mx ip4:78.230.171.39 ip6:2a01:e34:ee6a:b270:beae:c5ff:fe57:150c -all"
*                      IN CNAME  ouestline.net.
_dmarc                 IN TXT    "v=DMARC1; p=none"
mail._domainkey        IN TXT    "v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDHySCU3uS+lAnqe0I18wkB1SReJDxhZdYK3dDSDpxlDOfKRXNZdd/plJsmas+ZqAdxjhW/sdDdjj0YEZMcm3VqLZhwxpr3yJJm5/Lc32EfVVMXo9qhlzYByckc1azgGF0+hZTdDfsBwUh0IUdlOIgDnsfuf6p24X7P6ngaGqpghQIDAQAB"

sudo openssl dhparam -out /etc/ssl/private/dh4096.pem -outform PEM -2 4096  

sudo chown root.ssl-cert /etc/ssl/private/dh4096.pem   
sudo chmod 640 /etc/ssl/private/dh4096.pem  

ssl_dhparam /etc/ssl/private/dh4096.pem;

sudo service nginx restart

$TTL 86400
@	IN SOA dns101.ovh.net. tech.ovh.net. (2016100600 86400 3600 3600000 300)
                         IN NS     ns101.ovh.net.
                         IN NS     dns101.ovh.net.
                         IN MX 10  yanspm.com.
                         IN A      78.230.171.39
                         IN AAAA   2a01:e34:ee6a:b270:beae:c5ff:fe57:150c
                     600 IN TXT    "v=spf1 a mx ip4:78.230.171.39 ip6:2a01:e34:ee6a:b270:beae:c5ff:fe57:150c -all"
*                        IN CNAME  yanspm.com.
_dmarc                   IN TXT    "v=DMARC1; p=none"
_xmpp-client._tcp  14400 IN SRV    0 5 5222 yanspm.com.
_xmpp-server._tcp  14400 IN SRV    0 5 5269 yanspm.com.
mail._domainkey          IN TXT    "v=DKIM1; k=rsa; t=s; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDBZYXmqh/+d0zuGj/dfWsI8BPy+AUja87IysK84T8cyBSZrAzup2tiYChYRozMjDOUwHlnL8t4KkBG9o+wY0kzlN4nSTyfn4gQAV7EoymqHLXZrOIrlJGBkCKwKhevDV/vGzB6kS2SdcAoaDj4F49Bf2gAxPazgZClvm9a8rz4MQIDAQAB"

apt install nfs-kernel-server

# /etc/exports: the access control list for filesystems which may be exported
#		to NFS clients.  See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes       hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4        gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes  gss/krb5i(rw,sync,no_subtree_check)
#
# ' exportfs -a' : Met à jour la liste des systèmes de fichiers exportés
#
/media/yanplus/devel         192.168.0.0/24(rw,no_subtree_check,no_root_squash)
/media/yanplus/Musique       192.168.0.0/24(rw,no_subtree_check,no_root_squash)
/media/yanplus/BiblioCalibre 192.168.0.0/24(rw,no_subtree_check,no_root_squash)
/media/yanplus/dplus         192.168.0.0/24(rw,no_subtree_check,no_root_squash)
/media/video                 192.168.0.0/24(rw,no_subtree_check,no_root_squash)

STATDOPTS="--port 42001 --outgoing-port 42002"

RPCMOUNTDOPTS="--port 42003"

RPCRQUOTADOPTS="-p 42005"

  options lockd nlm_udpport=42004 nlm_tcpport=42004
  options nfs callback_tcpport=42000

# Tout interdire sur  portmap, nfsd et mountd
portmap:ALL
nfsd:ALL
mountd:ALL

#Autoriser ce client à se connecter aux services (essentiellement : portmap, nfsd et mountd) :
portmap: 192.168.0.
nfsd: 192.168.0.
mountd: 192.168.0.
rquotad: 192.168.0.
statd: 192.168.0.
lockd: 192.168.0.

yunohost firewall allow Both 111
yunohost firewall allow Both 2049
yunohost firewall allow Both 42000:42005

systemctl reboot

rpcinfo -p

   program vers proto   port  service
    100000    4   tcp    111  portmapper
    100000    3   tcp    111  portmapper
    100000    2   tcp    111  portmapper
    100000    4   udp    111  portmapper
    100000    3   udp    111  portmapper
    100000    2   udp    111  portmapper
    100024    1   udp  42001  status
    100024    1   tcp  42001  status
    100003    2   tcp   2049  nfs
    100003    3   tcp   2049  nfs
    100003    4   tcp   2049  nfs
    100227    2   tcp   2049
    100227    3   tcp   2049
    100003    2   udp   2049  nfs
    100003    3   udp   2049  nfs
    100003    4   udp   2049  nfs
    100227    2   udp   2049
    100227    3   udp   2049
    100021    1   udp  42004  nlockmgr
    100021    3   udp  42004  nlockmgr
    100021    4   udp  42004  nlockmgr
    100021    1   tcp  42004  nlockmgr
    100021    3   tcp  42004  nlockmgr
    100021    4   tcp  42004  nlockmgr
    100005    1   udp  42003  mountd
    100005    1   tcp  42003  mountd
    100005    2   udp  42003  mountd
    100005    2   tcp  42003  mountd
    100005    3   udp  42003  mountd
    100005    3   tcp  42003  mountd

showmount -e

Export list for shuttle:
/media/yanplus/devel       192.168.0.0/24

sudo pacman -S nfs-utils

systemctl start rpcbind
systemctl status rpcbind
systemctl enable rpcbind

mkdir -p /mnt/devel

192.168.0.45:/media/yanplus/devel	  	/mnt/devel 	  nfs4 noauto,x-systemd.automount 0  0

scp ~/.ssh/shuttle.pub yann@192.168.0.45:/home/yann

mkdir ~/.ssh
chmod 700 ~/.ssh

cat shuttle.pub >> ~/.ssh/authorized_keys
#modifier les droits
chmod 600 ~/.ssh/authorized_keys
#Effacer le fichier de la clé
rm shuttle.pub

sudo nano /etc/ssh/sshd_config

Port 55022
PermitRootLogin		no
PasswordAuthentication	no
#si délai lors d'une connexion ssh sous Linux
UseDNS no

sudo systemctl restart ssh

sudo yunohost firewall allow TCP 55022
sudo yunohost firewall disallow TCP 22

#passer en mode su
sudo -s
#dmesg montre que votre UPS est détecté :
dmesg

[...]
[ 2470.480042] usb 1-1: USB disconnect, device number 3
[ 4300.332009] usb 1-2: new low-speed USB device number 4 using uhci_hcd
[ 4302.429077] usb 1-2: New USB device found, idVendor=0463, idProduct=ffff
[ 4302.429081] usb 1-2: New USB device strings: Mfr=1, Product=2, SerialNumber=4
[ 4302.429084] usb 1-2: Product: Protection Station
[ 4302.429086] usb 1-2: Manufacturer: EATON
[ 4302.429088] usb 1-2: SerialNumber: AN2E49008
[ 4304.624720] hid-generic 0003:0463:FFFF.0005: hiddev0,hidraw0: USB HID v10.10 Device [EATON Protection Station] on usb-0000:00:1d.0-2/input0

ls -l /dev/usb/
total 0
crw------- 1 root root 180, 0 oct.   7 09:30 hiddev0

apt install nut

  MODE=standalone

LISTEN 127.0.0.1 3493
LISTEN ::1 3493
MAXCONN 32 #Nombre maximal de connections simultanées

# 1 seul utilisateur "ond" avec tous les droits ! 
[ond]
password = dfYRtY38
upsmon master

# Notre serveur n'a pas d'alimentation redondante = 1
MINSUPPLIES 1
# Commande d'arrêt du serveur en cas de fin d'autonomie
SHUTDOWNCMD "/sbin/shutdown -h +0"
# Commande lancée quand quelque chose se passe
NOTIFYCMD /sbin/upssched
# Interval entre deux interrogations de upsd
POLLFREQ 5
# Intervalle entre deux interrogations de upsd en mode "batterie"
POLLFREQALERT 5
# Temps d'attente pour la déconnexion des upsmon esclaves
HOSTSYNC 15
# Temps pendant lequel on tolère la non-réponse d'un onduleur, multiple de POLLFREQ
DEADTIME 15
# Fichier d'état
POWERDOWNFLAG /etc/killpower
# Intervalle de 1/2 jour, pour répéter le message de "remplacement de batteries - NOTIFY_REPLBATT"
RBWARNTIME 43200
# Interval de 5 minutes, pour répéter le message de "onduleur injoignable - NOTIFY_NOCOMM"
NOCOMMWARNTIME 300
# Intervalle entre la "notification d'arrêt - NOTIFY_SHUTDOWN" et le lancement de SHUTDOWNCMD
FINALDELAY 5
# On surveille l'onduleur qui est directement relié (master)
MONITOR eaton@localhost 1 ond dfYRtY38 master
# Actions spécifiques autres que par défaut (SYSLOG et WALL) réalisées en fonction de l'état retourné par l'onduleur
NOTIFYFLAG COMMBAD EXEC
NOTIFYFLAG ONLINE SYSLOG+EXEC
NOTIFYFLAG ONBATT SYSLOG+EXEC
NOTIFYFLAG LOWBATT EXEC
NOTIFYFLAG REPLBATT SYSLOG+EXEC
NOTIFYFLAG SHUTDOWN EXEC
NOTIFYFLAG COMMOK IGNORE

# Script lancé par upssched pour gérer les évènements et les timers associés 
CMDSCRIPT /etc/nut/upssched-cmd
# Fichier pour noter les états internes de upssched 
PIPEFN /var/run/nut/upssched.pipe
# Fichier de lock pour éviter un conflit en cas de notification de deux évènements simultanés
LOCKFN /var/run/nut/upssched.lock
 
# En cas de perte de communication avec l'onduleur
AT COMMBAD * EXECUTE perte-liaison
 
# En cas de retour secteur, on stope la minuterie et on notifie 
AT ONLINE * CANCEL-TIMER attente-retour-secteur 
AT ONLINE * EXECUTE charge-sur-secteur
 
# En cas de perte de secteur, on se laisse au maximum 20 minutes avant d'agir et on notifie 
AT ONBATT * START-TIMER attente-retour-secteur 1200 
AT ONBATT * EXECUTE charge-sur-batterie 
 
# En cas de niveau de batteries trop bas
AT LOWBATT * EXECUTE batteries-vides
 
# En cas de fin de vie des batteries on sera prévenu 
AT REPLBATT * EXECUTE batteries-hs
 
# En cas d'arrêt (fin des 20 minutes  ou fin d'autonomie), on notifie. 
AT SHUTDOWN * EXECUTE arret-en-cours

#!/usr/bin/perl -w
use Encode;
use utf8;
use strict;
use Switch;
# encodage des données transmises dans l’URL
use URI::Escape;
 
sub SendEmail
{
    my ( $from, $to, $subject, $msg ) = @_;
 
    $from = Encode::encode('MIME-Q', $from);
    $to = Encode::encode('MIME-Q', $to);
    $subject = Encode::encode('MIME-Q', $subject);
 
    open (SENDMAIL, "| /usr/sbin/sendmail -t") or die("Failed to open pipe to sendmail: $!");
    binmode(SENDMAIL, ":utf8");
    print SENDMAIL <<"EOF";
Content-Transfer-Encoding: 8bit
Content-type: text/plain; charset=UTF-8
Subject: $subject
From: $from
To: $to
$msg
EOF
    close (SENDMAIL);
}
 
my $orig= 'Onduleur@yanspm.com';
my $dest='yanspm@yanspm.com';
my $sujet="Onduleur - Arrêt en cours";
my $message="Le système est en cours d'arrêt.";
my $comment="";
#
# Début du programme
#
if ($#ARGV == -1) {
   print "Saisir argument : "; $comment=<STDIN>; chomp($comment);
  }
else {
   $comment=$ARGV[0];
   }
#
# Analyse argument
#
switch ($comment) {
 
 	case "charge-sur-batterie" { 
			$sujet="Onduleur - Charge sur batteries";
			$message="L'onduleur est passé sur batteries ...\nL'arrêt système sera demandé si le secteur ne revient pas." ;
	}
 
	case "attente-retour-secteur" {
		$sujet="Onduleur - Fin d'attente de retour secteur";
		$message="Cela fait trop longtemps que le secteur est absent.\nUn arrêt forcé est en cours !";
 
		# Demande d'arrêt forcé (force shut down)
		system "/sbin/upsmon -c fsd";
	}
 
	case "charge-sur-secteur" {
		$sujet="Onduleur - Charge sur secteur";
		$message="L'onduleur est revenu sur secteur.";
	}
 
	case "batteries-vide" {
		$sujet="Onduleur - Batteries vides";
		$message="Les batteries sont vides, l'arrêt est imminent.";
	}
 
	case "arret-en-cours" {
		$sujet="Onduleur - Arrêt en cours";
		$message="Le système est en cours d'arrêt.";
	}
 
	case "perte-liaison" {
                $sujet="Onduleur - Perte de liaison avec l'onduleur";
                $message="La communication avec l'onduleur est interrompue.";
        }
 
 
	case "batteries-hs" {
                $sujet="Onduleur - URGENT - batteries HS";
                $message="Les batteries sont à remplacer d'urgence.";
	}
 
	else {
		$sujet="Onduleur - Commande inconnue ...";
		$message="Une commande inconnue a été envoyée par l'onduleur.\nLa commande est : $comment";
	}
 
}
 
 
# Envoi du message
SendEmail($orig,$dest,$sujet,$message);

chmod +x /etc/nut/upssched-cmd

ps auxf |grep ups

root      1479  0.0  0.0  12748  2232 pts/0    S+   10:42   0:00                      \_ grep ups
nut       1373  0.0  0.0  19140  1668 ?        Ss   10:35   0:00 /lib/nut/usbhid-ups -a eaton
nut       1375  0.0  0.0  31864  2112 ?        Ss   10:35   0:00 /lib/nut/upsd
root      1377  0.0  0.0  29492  1496 ?        Ss   10:35   0:00 /lib/nut/upsmon
nut       1378  0.0  0.0  37668  4892 ?        S    10:35   0:00  \_ /lib/nut/upsmon

upsc eaton@localhost

[...]
ups.mfr: EATON
ups.model: Protection Station 800
ups.power.nominal: 800
ups.productid: ffff
ups.serial: AN2E49008
ups.status: OL CHRG
ups.timer.shutdown: 0
ups.timer.start: 0
ups.vendorid: 0463

# passer en mode su
sudo -s
# lister les applications (installed=true)  
yunohost app list

[...]
    description: App vide sans accès FTP
    id: multi_webapp
    installed: True
    label: Shaarli
    license: free
    name: Multi custom webapp
[...]

# on change le label
yunohost app setting multi_webapp label -v "Shaarli"
# actualisation
yunohost app ssowatconf && nginx -s reload

sudo yunohost app upgrade -u https://github.com/YunoHost-Apps/nextcloud_ynh

sudo yunohost app upgrade -u https://github.com/YunoHost-Apps/cops_ynh

sudo yunohost app upgrade -u https://https://github.com/YunoHost-Apps/BicBucStriim_ynh

sudo yunohost app upgrade -u https://github.com/YunoHost-Apps/multi_webapp_ynh

sudo adduser backupuser`  #mot de passe à saisir

sudo mkdir /home/backupuser/.ssh/

sudo chown backupuser. -R /home/backupuser/.ssh/
sudo chmod 644 -R /home/backupuser/.ssh/

sudo su backupuser
ssh-keygen -t rsa
chmo 400 id_rsa*       #lecture seule pour utilisateur backupuser 
exit                   # retour sur utilisateur précédent

# cat /etc/yunohost/certs/yanspm.com/crt.pem |openssl x509 -text |grep DNS
                DNS:yanspm.com

# cat /etc/yunohost/certs/ouestline.net/crt.pem |openssl x509 -text |grep DNS
                DNS:blog.ouestline.net, DNS:cartes.ouestline.net, DNS:devel.ouestline.net, DNS:lua.ouestline.net, DNS:map.ouestline.net, DNS:media.ouestline.net, DNS:music.ouestline.net, DNS:ouestline.net, DNS:photos.ouestline.net, DNS:static.ouestline.net, DNS:yannick.ouestline.net
root@shuttle:/home/yann# 

./letsencrypt-auto certonly --config /etc/letsencrypt/conf.ini -d ouestline.net -d blog.ouestline.net -d cartes.ouestline.net -d devel.ouestline.net -d lua.ouestline.net -d map.ouestline.net -d media.ouestline.net -d music.ouestline.net -d photos.ouestline.net -d static.ouestline.net -d yannick.ouestline.net -d notes.ouestline.net

$config['calibre_directory'] = '/media/yanplus/BiblioCalibre/';

location /cops {
    alias /var/www/cops/;
	auth_pam           "closed site";
	auth_pam_service_name "nginx";
       index index.php;
       try_files $uri $uri/ index.php;
       location ~ [^/]\.php(/|$) {
           fastcgi_split_path_info ^(.+?\.php)(/.*)$;
           fastcgi_pass unix:/var/run/php5-fpm.sock;
           fastcgi_index index.php;
           include fastcgi_params;
           fastcgi_param   REMOTE_USER   $remote_user;
           fastcgi_param  PATH_INFO $fastcgi_path_info;
           fastcgi_param SCRIPT_FILENAME $request_filename;
       }
}

ouestline.net
blog.ouestline.net
cartes.ouestline.net
devel.ouestline.net
map.ouestline.net
media.ouestline.net
music.ouestline.net
static.ouestline.net
notes.ouestline.net
yannick.ouestline.net      

    ssl_certificate        /etc/yunohost/certs/ouestline.net/crt.pem;
    ssl_certificate_key    /etc/yunohost/certs/ouestline.net/key.pem;

    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ALL:!aNULL:!eNULL:!LOW:!EXP:!RC4:!3DES:+HIGH:+MEDIUM;
    add_header Strict-Transport-Security "max-age=31536000;";

# serveur développement 
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name devel.ouestline.net;
    root /media/yanplus/devel/ouestline;

    include ssl_params;

    ssl_dhparam /etc/ssl/private/dh4096.pem;

          index index.php index.html index.htm;
          try_files $uri $uri/ index.php;
          location ~ [^/]\.php(/|$) {
            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param  REMOTE_USER $remote_user;
            fastcgi_param  PATH_INFO   $fastcgi_path_info;
            fastcgi_param SCRIPT_FILENAME $request_filename;
          }
    fancyindex on;              # Enable fancy indexes.
    fancyindex_exact_size off;  # Output human-readable file sizes.
  #logs
    access_log /var/log/nginx/devel.ouestline.net-access.log;
    error_log /var/log/nginx/devel.ouestline.net-error.log;
}

# serveur turtl pour notes (framasoft)
upstream turtl {
    server 127.0.0.1:8181;
}

client_max_body_size 2m;

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name notes.ouestline.net;

    include ssl_params;

    ssl_dhparam /etc/ssl/private/dh4096.pem;

    index index.html;

    location / {
        proxy_set_header    Host $host;
        proxy_pass http://turtl;
    }

  #logs
    access_log /var/log/nginx/notes.ouestline.net-access.log;
    error_log /var/log/nginx/notes.ouestline.net-error.log;
}

# cartes 
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name  map.ouestline.net;
    root /media/yanplus/devel/osm;

    include ssl_params;

    ssl_dhparam /etc/ssl/private/dh4096.pem;
          index index.php index.html index.htm;
          try_files $uri $uri/ index.php;
          location ~ [^/]\.php(/|$) {
            fastcgi_split_path_info ^(.+?\.php)(/.*)$;
            fastcgi_pass unix:/var/run/php5-fpm.sock;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param  REMOTE_USER $remote_user;
            fastcgi_param  PATH_INFO   $fastcgi_path_info;
            fastcgi_param SCRIPT_FILENAME $request_filename;
          }
   #autoindex on;
    fancyindex on;              # Enable fancy indexes.
    fancyindex_exact_size off;  # Output human-readable file sizes.
   #logs
    access_log /var/log/nginx/map.ouestline.net-access.log;
    error_log /var/log/nginx/map.ouestline.net-error.log;
}

# média
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name media.ouestline.net;

    include ssl_params;

    ssl_dhparam /etc/ssl/private/dh4096.pem;

    # raspberry pi - domoticz
    # log pi mp raspberry
    location / {
      proxy_pass                         http://192.168.0.35:8080;
    }
  #logs
    access_log /var/log/nginx/media.ouestline.net-access.log;
    error_log /var/log/nginx/media.ouestline.net-error.log;
}

# peoxy serveur statique type jekyll
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name static.ouestline.net;

    include ssl_params;

    ssl_dhparam /etc/ssl/private/dh4096.pem;

    location / {
      proxy_pass                         http://127.0.0.1:4000;
    }
  #logs
    access_log /var/log/nginx/static.ouestline.net-access.log;
    error_log /var/log/nginx/static.ouestline.net-error.log;
}

# proxy subsonic
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name music.ouestline.net;

    include ssl_params;

    ssl_dhparam /etc/ssl/private/dh4096.pem;

    location / {
      proxy_pass                         http://127.0.0.1:8080;
    }
  #logs
    access_log /var/log/nginx/music.ouestline.net-access.log;
    error_log /var/log/nginx/music.ouestline.net-error.log;
}

sudo apt-get install openjdk-7-jre

wget http://subsonic.org/download/subsonic-6.0.deb

sudo dpkg -i subsonic-6.0.deb

#
# This is the configuration file for the Subsonic service
# (/etc/init.d/subsonic)
#
# To change the startup parameters of Subsonic, modify
# the SUBSONIC_ARGS variable below.
#
# Type "/usr/share/subsonic/subsonic.sh --help" on the command line to read an
# explanation of the different options.
#
# For example, to specify that Subsonic should use port 80 (for http)
# and 443 (for https), and use a Java memory heap size of 200 MB, use
# the following:
#
# SUBSONIC_ARGS="--port=80 --https-port=443 --max-memory=200"

SUBSONIC_ARGS="--port=8090 --max-memory=200"


# The user which should run the Subsonic process. Default "root".
# Note that non-root users are by default not allowed to use ports
# below 1024. Also make sure to grant the user write permissions in
# the music directories, otherwise changing album art and tags will fail.

SUBSONIC_USER=yann

# proxy subsonic
server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name music.ouestline.net;

    include ssl_params;

    ssl_dhparam /etc/ssl/private/dh4096.pem;

    location / {
      proxy_pass                         http://127.0.0.1:8090;
    }
  #logs
    access_log /var/log/nginx/music.ouestline.net-access.log;
    error_log /var/log/nginx/music.ouestline.net-error.log;
}

sudo systemctl restart nginx

sudo update-alternatives --config java

Il existe 2 choix pour l'alternative java (qui fournit /usr/bin/java).

  Sélection   Chemin                                          Priorité  État
------------------------------------------------------------
  0            /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java   1071      mode automatique
  1            /usr/lib/jvm/java-7-openjdk-amd64/jre/bin/java   1071      mode manuel
* 2            /usr/lib/jvm/java-8-openjdk-amd64/jre/bin/java   1069      mode manuel

Appuyez sur <Entrée> pour conserver la valeur par défaut[*] ou choisissez le numéro sélectionné :

server {
    listen 443 ssl;
    listen [::]:443 ssl;
    server_name music.ouestline.net;
    ssl_certificate        /etc/yunohost/certs/ouestline.net/crt.pem;
    ssl_certificate_key    /etc/yunohost/certs/ouestline.net/key.pem;

    ssl_session_timeout 5m;
    ssl_session_cache shared:SSL:50m;
    ssl_prefer_server_ciphers on;
    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
    ssl_ciphers ALL:!aNULL:!eNULL:!LOW:!EXP:!RC4:!3DES:+HIGH:+MEDIUM;
    add_header Strict-Transport-Security "max-age=31536000;";

    ssl_dhparam /etc/ssl/private/dh4096.pem;

    location / {
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
      proxy_set_header X-Forwarded-Proto https;
      proxy_set_header Host              $http_host;
      proxy_max_temp_file_size           0;
      proxy_pass                         http://127.0.0.1:8080;
      proxy_redirect                     http:// https://;

    }
  #logs
    access_log /var/log/nginx/music.ouestline.net-access.log;
    error_log /var/log/nginx/music.ouestline.net-error.log;
}

sudo yunohost app install https://github.com/YunoHost-Apps/libresonic_ynh

Choisissez un nom de domaine pour Libresonic (default: yanspm.com) : ouestline.net
Choisissez un chemin pour Libresonic (default: /libresonic) : 
Choisissez l’administrateur : yanspm
Succès ! La configuration de SSOwat a été générée
Succès ! Installation terminée

sudo rm /etc/nginx/conf.d/ouestline.net.d/libresonic.conf
sudo rm /etc/default/libresonic
sudo service tomcat8 stop
sudo rm /var/lib/tomcat8/webapps/libresonic.war
sudo rm -r /var/libresonic/
sudo systemctl disable tomcat8
sudo service nginx reload
sudo yunohost app ssowatconf 

(in-package :turtl)

(defparameter *root* (asdf:system-relative-pathname :turtl #P"")
  "Defines the root directory turtl is loading from (basically the ASDF path).")

(defparameter *pid-file* nil
  "File to write the current proc's PID to.")

(defvar *server-bind* nil
  "The address to bind Turtl to (nil is the same as 0.0.0.0).")

(defvar *server-port* 8181
  "The port we want to start the Turtl service on.")

(defvar *db-name* "turtl"
  "The name of the database we'll be using LOL")

(defvar *db-host* "127.0.0.1"
  "The database hostname/ip.")

(defvar *db-port* 28015
  "The database port number.")

(defvar *production-error-handling* nil
  "If t, will attempt to catch all errors that make it to top-level and not let
   the parent process enter the debugger.")

(defvar *enable-hsts-header* nil
  "If NIL, Turtl won't pass back an HSTS security header. If this is set, it
   should be set to a integer value, which will be passed to the max-age value
   of the header.")

(defvar *enabled-cors-resources* "resource://turtl-at-lyonbros-dot-com"
  "When set, will enable CORS for resource:// origins if they match the given
   string. Entries should be comma separated (this string is passed verbatim in
   the Access-Control-Allow-Origin header).")

(defvar *site-url* "https://notes.ouestline.net"
  "The main URL the site will load from.")

(defvar *api-path* ""
  "The path the API lives under. Can be blank.")

(defvar *admin-email* "contact@ouestline.net"
  "The email used for admin communications. This is reported to users on a
   server error, and possibly other instances.")

(defvar *email-from* "noreply@ouestline.net"
  "The email address all turtl emails come from.")

(defvar *email-user* ""
  "The username used for sending email. Needs to be set on load.")
  (defvar *email-pass* ""
    "The password used for sending email. Needs to be set on load.")

(defvar *display-errors* t
  "Whether or not to show errors in HTTP responses. Useful for debugging, bad
   for production.")

(defparameter *public-actions*
  `((:post . ,(concatenate 'string *api-path* "/users"))
    (:post . ,(concatenate 'string *api-path* "/log/error"))
        (:post . "/cla/sign")
	    (:get . ,(cl-ppcre:create-scanner (concatenate 'string *api-path* "/invites/codes/([0-9a-f-]+)"))))
  "A list of public resources/actions that do not require authentication.")

(defparameter *default-storage-limit* 100
  "The max amount of data a profile can hold (in megabytes). Set to nil to allow
   infinite size profiles.")

(defparameter *storage-invite-credit* 25
  "The amount of storage (in mb) to credit a user when they refer someone.")

;; setup the logger
(vom:config :turtl :info)

(defvar *analytics* '(:enabled t
                      :db "analytics")
		        "Holds analytics config")

;; -----------------------------------------------------------------------------
;; File storage section.
;; -----------------------------------------------------------------------------

;; Choose either local uploads or S3.

(defvar *local-upload* nil
  "NIL disables local files storage (files are uploaded to S3). Set to a local
   path to save files locally instead of remotely. No trailing slash!")
   (defvar *local-upload-url* nil
     "Define the URL that local files will be loaded from. Generally, this will be
   the same URL the API is accessed from and only needs to be defined if the
   *local-upload* variable has a value. This should *not* include the /files
   path, and there should be no trailing slash. Example:

     https://notes.ouestline.net")

(defvar *amazon-s3* '(:token ""
                      :secret ""
                      :bucket ""
                      :endpoint "https://s3.amazonaws.com")
  "Holds Amazon S3 config.")

# Création des dossiers
sudo mkdir -p /media/yanplus/devel/ouestline-jekyll{_posts,images}
# droits
sudo chown $USER.users -R /media/yanplus/devel/ouestline-jekyll{_posts,images}
# les liens , on supprime les dossiers existants sur dbyll/
sudo rm -r /srv/jekyll/dbyll/{_posts,images}
# création des liens
sudo ln -s /media/yanplus/devel/ouestline-jekyll_posts /srv/jekyll/dbyll/_posts
sudo ln -s /media/yanplus/devel/ouestline-jekyllimages /srv/jekyll/dbyll/images

/srv
├── jekyll
│   └── dbyll
│       ├── 404.html
│       ├── assets
│       ├── categories.html
│       ├── _config.yml
│       ├── favicon.png
│       ├── feed.xml
│       ├── Gemfile
│       ├── Gemfile.lock
│       ├── images -> /media/yanplus/devel/ouestline-jekyllimages
│       ├── _includes
│       ├── index.html
│       ├── js
│       ├── _layouts
│       ├── LICENSE
│       ├── _posts -> /media/yanplus/devel/ouestline-jekyll_posts
│       ├── README.md
│       ├── search.html
│       ├── _site
│       └── tags.html
└── start_jekyll.sh

https://github.com/YunoHost-Apps/nextcloud_ynh

## Nginx compilé , http/2

Compilé nginx pour une version qui accepte le **http2**  
Il faut interdire la mise à jour par dpkg ou apt des paquets nginx  
Liste des paquets concernés

    dpkg -l |grep nginx

Les paquets **nginx-common** et **nginx-extras** ne doivent pas faire l'objet d'une mise à jour

Pour avoir la liste des paquets bloqués

    dpkg --get-selections | grep hold

[Compilation Nginx](post_url 2017-10-03-Serveur-web-nginx-PHP7 %})

Mise en place du nouveau binaire nginx

sudo -s
# Arrêt et sauvegarde binaire nginx 1.6.2  
systemctl stop nginx
mv /usr/sbin/nginx .
# copie du nouveau binaire nginx
cp /usr/share/nginx/sbin/nginx /usr/sbin/
# relance
systemctl start nginx
# Vérification version
nginx -V
nginx version: nginx/1.11.3 ```

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    ...

nginx -t
systemctl restart nginx

sudo systemctl stop gitlab-runsvdir.service
sudo systemctl disable gitlab-runsvdir.service
sudo gitlab-ctl uninstall
# Your config files have been backed up to /root/gitlab-cleanse-2017-06-07T21:55
sudo dpkg -r gitlab-ce
sudo rm -r /root/gitlab-cleanse-2017-06-07T21\:55/
sudo rm -r /opt/gitlab/