OVH vps506197 Debian 10 - REINSTALL yunohost nextcloud static ttrss -cinay.eu

ssh root@164.132.104.145

nano initres.sh

chmod +x initres.sh && ./initres.sh

ssh root@164.132.104.145

  - cinay.eu
  - yanfi.net
  - wg.cinay.eu
  - div.cinay.eu
  - zic.cinay.eu
  - gitea.cinay.eu
  - static.cinay.eu

$TTL 3600
@	IN SOA dns100.ovh.net. tech.ovh.net. (2020111200 86400 3600 3600000 300)
                         IN NS     dns100.ovh.net.
                         IN NS     ns100.ovh.net.
                         IN MX     10 cinay.eu.
                         IN A      164.132.104.145
                         IN AAAA   2001:41d0:401:3200::6e7
                         IN CAA    128 issue "letsencrypt.org"
                     600 IN TXT    "v=spf1 a mx -all"
*                        IN A      164.132.104.145
*                        IN AAAA   2001:41d0:401:3200::6e7
_dmarc                   IN TXT    "v=DMARC1;p=none;"
_xmpp-client._tcp        IN SRV    0 5 5222 cinay.eu.
_xmpp-server._tcp        IN SRV    0 5 5269 cinay.eu.
div                      IN CNAME  cinay.eu.
gitea                    IN CNAME  cinay.eu.
gitlab                   IN CNAME  cinay.eu.
mail._domainkey          IN TXT    ( "v=DKIM1;h=sha256;k=rsa;p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC8NXuslInklnSY2NdkXQcAUtaXjIDKBfiEmXJbWNlALRKs/dY5aE9u08IHaoqp8NpnwpL9DR5jlyhihah6eDQxGa704WPf7Talv4VVfMhvfapSJ0xQhyiOoZys/FP+iqL2gdlG+mwDAyE3iSQoLZi9LBniRRdojdefPACyiUGkeQIDAQAB;" )
muc                      IN CNAME  cinay.eu.
pubsub                   IN CNAME  cinay.eu.
static                   IN CNAME  cinay.eu.
vjud                     IN CNAME  cinay.eu.
wg                       IN CNAME  cinay.eu.
xmpp-upload              IN CNAME  cinay.eu.
yanfi                    IN CNAME  login.tutanota.com.
zic                      IN CNAME  cinay.eu.

hostnamectl set-hostname cinay.eu
hostnamectl

curl https://install.yunohost.org | bash

yunohost tools postinstall

yunohost user create yann

yunohost user update yann --add-mailalias discord@cinay.eu wg@cinay.eu vps@cinay.eu vpn@cinay.eu

Success! User info changed
firstname: yann
fullname: yann cinayeu
lastname: cinayeu
mail: yann@cinay.eu
mail-aliases: 
  - root@cinay.eu
  - admin@cinay.eu
  - webmaster@cinay.eu
  - postmaster@cinay.eu
  - boproyan@cinay.eu
  - discord@cinay.eu
  - wg@cinay.eu
  - vps@cinay.eu
  - vpn@cinay.eu
mailbox-quota: 
  limit: No quota
  use: 143.0K
username: yann

yunohost domain cinay.eu dnsconf

yunohost domain cert-install --no-checks

passwd debian 

echo "debian     ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/kvm-vps506197

scp ~/.ssh/kvm-vps506197.pub debian@164.132.104.145:/home/debian/

ssh debian@164.132.104.145

cd ~

mkdir .ssh
cat $HOME/kvm-vps506197.pub >> $HOME/.ssh/authorized_keys

chmod 600 $HOME/.ssh/authorized_keys

rm $HOME/kvm-vps506197.pub

sudo nano /etc/ssh/sshd_config # attention aux 2 dernières lignes

sudo apt install libpam-systemd  # installé par défaut sur debian buster

sudo systemctl restart sshd

sudo yunohost firewall allow TCP 55034
sudo yunohost firewall disallow TCP 22

ssh -p 55034 -i ~/.ssh/kvm-vps506197 debian@164.132.104.145

sudo apt install rsync curl tmux jq figlet git dnsutils tree -y

sudo rm /etc/motd && sudo nano /etc/motd

yunohost domain add yanfi.net

yunohost domain dns-conf yanfi.net

sudo -s
git clone https://github.com/YunoHost-Apps/nextcloud_ynh.git
# Changer le lien de téléchargement nextcloud : nano nextcloud_ynh/conf/app.src.default
# REMPLACER SOURCE_URL=https://download.nextcloud.com/server/releases/nextcloud-__VERSION__.tar.bz2
# PAR       SOURCE_URL=http://xoyaz.xyz/nextcloud-__VERSION__.tar.bz2
# Installer
yunohost app install nextcloud_ynh/ --debug

[...]
Choose a domain for Nextcloud (default: cinay.eu): 
Choose a path for Nextcloud (default: /nextcloud): 

Choose the Nextcloud administrator (must be an existing YunoHost user): yann
Access the users home folder from Nextcloud? [yes | no] (default: no): yes
[...]

sudo mkdir -p /opt/sshfs

sudo apt install sshfs

chmod 600 /home/debian/.ssh/OVZ-STORAGE-128

sudo -s
sshfs -o allow_other usernl@xoyaz.xyz:/home/usernl/backup /opt/sshfs -C -p 55036 -oIdentityFile=/home/debian/.ssh/OVZ-STORAGE-128

usernl@xoyaz.xyz:/home/usernl/backup /opt/sshfs fuse.sshfs _netdev,identityfile=/home/debian/.ssh/OVZ-STORAGE-128,allow_other,port=55036 0 0

sudo mount -a

ls /opt/sshfs

yunohost app install ttrss

Choose a domain for Tiny-Tiny-RSS (default: cinay.eu): 
Choose a path for Tiny-Tiny-RSS (default: /ttrss): 
Success! Installation completed

yunohost app upgrade ttrss -u https://github.com/YunoHost-Apps/ttrss_ynh/tree/testing --debug

yunohost domain add static.cinay.eu
yunohost domain cert-install static.cinay.eu --no-checks

yunohost app install https://github.com/YunoHost-Apps/my_webapp_ynh/tree/testing --debug

Accès au site 

Le dossier **/opt/sshfs/static/** contient le site statique qui est issu d'une synchronisation d'un conteneur debian sur un ordinateur archlinux avec jekyll comme générateur 

```bash
rm -r /var/www/my_webapp/www/  # supprimer dossier web 
chown my_webapp.my_webapp -R /var/www/my_webapp
ln -s /opt/sshfs/static /var/www/my_webapp/www  # lien et droits my_webapp

yunohost app change-label my_webapp 'Statique static.cinay.eu'

yunohost domain add gitea.cinay.eu
yunohost domain cert-install gitea.cinay.eu --no-checks

git clone https://github.com/YunoHost-Apps/gitea_ynh.git

nano gitea_ynh/scripts/install

# SETUP FAIL2BAN
#ynh_script_progression --message="Configuring fail2ban..."
#ynh_add_fail2ban_config --logpath "/var/log/$app/gitea.log" --failregex ".*Failed authentication attempt for .* from <HOST>" --max_retry 5

yunohost app install gitea_ynh

ynh_add_fail2ban_config --logpath /var/log/gitea/gitea.log --failregex '.*Failed authentication attempt for .* from <HOST>' --max_retry 5

sudo yunohost app install shaarli

sudo sed -i "s/is_public\: '0'/is_public\: '1'/g" /etc/yunohost/apps/shaarli/settings.yml

yunohost app ssowatconf

go version

sudo apt-get install curl software-properties-common -y
curl -sL https://deb.nodesource.com/setup_14.x | sudo bash -

sudo apt-get install -y nodejs

sudo install -d -o debian -g debian /opt/navidrome
sudo install -d -o debian -g debian /var/lib/navidrome

wget https://github.com/deluan/navidrome/releases/download/v0.37.0/navidrome_0.37.0_Linux_x86_64.tar.gz -O Navidrome.tar.gz
sudo tar -xvzf Navidrome.tar.gz -C /opt/navidrome/
sudo chown -R debian:debian /opt/navidrome

MusicFolder = "/opt/sshfs/musique"

[Unit]
Description=Navidrome Music Server and Streamer compatible with Subsonic/Airsonic
After=remote-fs.target network.target
AssertPathExists=/var/lib/navidrome

[Install]
WantedBy=multi-user.target

[Service]
User=debian
Group=debian
Type=simple
ExecStart=/opt/navidrome/navidrome --configfile "/var/lib/navidrome/navidrome.toml"
WorkingDirectory=/var/lib/navidrome
TimeoutStopSec=20
KillMode=process
Restart=on-failure

# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
DevicePolicy=closed
NoNewPrivileges=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
ReadWritePaths=/var/lib/navidrome

# You can uncomment the following line if you're not using the jukebox This
# will prevent navidrome from accessing any real (physical) devices
#PrivateDevices=yes

# You can change the following line to `strict` instead of `full` if you don't
# want navidrome to be able to write anything on your filesystem outside of
# /var/lib/navidrome.
ProtectSystem=full

# You can comment the following line if you don't have any media in /home/*.
# This will prevent navidrome from ever reading/writing anything there.
#ProtectHome=true

sudo systemctl daemon-reload
sudo systemctl start navidrome.service

sudo systemctl status navidrome.service

● navidrome.service - Navidrome Music Server and Streamer compatible with Subsonic/Airsonic
   Loaded: loaded (/etc/systemd/system/navidrome.service; disabled; vendor preset: enabled)
   Active: active (running) since Sat 2020-11-07 22:04:05 CET; 11s ago
 Main PID: 4407 (navidrome)
    Tasks: 6 (limit: 4603)
   Memory: 32.0M
   CGroup: /system.slice/navidrome.service
           └─4407 /opt/navidrome/navidrome --configfile /var/lib/navidrome/navidrome.toml

sudo systemctl enable  navidrome.service

ssh -L 9500:localhost:4533 debian@cinay.eu -p 55034 -i /home/yannick/.ssh/kvm-vps506197

yunohost domain add zic.cinay.eu
yunohost domain cert-install zic.cinay.eu --no-checks

yunohost app install https://github.com/YunoHost-Apps/redirect_ynh

Available domains:
- cinay.eu
- yanfi.net
- zic.cinay.eu
- static.cinay.eu
Choose a domain for your redirect (default: cinay.eu): zic.cinay.eu
Choose a path for your redirect (default: /redirect): /
Redirect destination path (default: http://127.0.0.1): http://127.0.0.1:4533
Redirect type [public_302 | public_301 | public_proxy | private_proxy] (default: public_302): public_proxy
Info: Installing redirect...
Warning: /!\ Packagers! This app is still using the skipped/protected/unprotected_uris/regex settings which are now obsolete and deprecated... Instead, you should use the new helpers 'ynh_permission_{create,urls,update,delete}' and the 'visitors' group to initialize the public/private access. Check out the documentation at the bottom of yunohost.org/groups_and_permissions to learn how to use the new permission mechanism.
Success! Installation completed

yunohost app change-label redirect 'Audio zic.cinay.eu'

#!/bin/bash

BACKUPREP="/opt/sshfs/cinay.eu"

# Vérifier le point de montage 
if [ ! -d "$BACKUPREP" ];then
 echo "ERREUR, point de montage SSHFS $BACKUPREP inexistant !" | systemd-cat -t backup -p emerg ;
 exit 1
fi

# Dossier mysql
if [ ! -d "$BACKUPREP/mysql" ];then
 echo "Création du dossier  $BACKUPREP/mysql"
 mkdir "$BACKUPREP/mysql"
fi

#################################################
# Sauvegarde des bases mysql 
#################################################

# Configuration de base: datestamp e.g. YYYYMMDD
DATE=$(date +"%Y%m%d")

# Dossier où sauvegarder les backups (créez le d'abord!)
BACKUP_DIR="$BACKUPREP/mysql"

# Identifiants MySQL
MYSQL_USER="root"
MYSQL_PASSWORD=$(cat /etc/yunohost/mysql )
GZIP="$(which gzip)"

# Commandes MySQL (aucune raison de modifier ceci)
MYSQL="$(which mysql)"
MYSQLDUMP="$(which mysqldump)"

# Bases de données MySQL à ignorer
SKIPDATABASES="Database|information_schema|performance_schema|mysql"

# Nombre de jours à garder les dossiers (seront effacés après X jours)
RETENTION=7

# ---- NE RIEN MODIFIER SOUS CETTE LIGNE ------------------------------------------
#
# Create a new directory into backup directory location for this date
mkdir -p "$BACKUP_DIR/$DATE"

# Retrieve a list of all databases
databases=`$MYSQL -u$MYSQL_USER -p$MYSQL_PASSWORD -e "SHOW DATABASES;" | grep -Ev "($SKIPDATABASES)"`

# Dump the databases in seperate names and gzip the .sql file
for db in $databases; do
echo $db
$MYSQLDUMP --force --opt --user=$MYSQL_USER -p$MYSQL_PASSWORD --skip-lock-tables --events --databases $db | $GZIP > "$BACKUP_DIR/$DATE/$db.sql.gz"
echo "OK Mysql Dump $BACKUP_DIR/$DATE/$db.sql.gz" | systemd-cat -t backup -p info ;
done

# Remove files older than X days

find $BACKUP_DIR/* -mtime +$RETENTION -delete

# Sauvegarde complète 
#rsync -aAXv  --fake-super --delete --exclude={"/opt/sshfs/*","/dev/*","/proc/*","/sys/*","/tmp/*","/run/*","/mnt/*","/media/*","/home/*","/lost+found"} / "$BACKUPREP"

sudo -s
apt update

apt install borgbackup

useradd -M borg

mkdir -p /root/.ssh
ssh-keygen -t ed25519 -o -a 100 -f /root/.ssh/cinay.eu_ed25519

ls /root/.ssh
    cinay.eu_ed25519  cinay.eu_ed25519.pub

echo "borg ALL=NOPASSWD: /usr/bin/borg" >> /etc/sudoers

ssh usernl@5.2.79.107 -p 55036 -i /home/yannick/.ssh/OVZ-STORAGE-128 # connexion SSH serveur backup depuis PC1
sudo -s # passer en super utilisateur
cat >> /srv/data/borg-backups/.ssh/authorized_keys

sudo -s
ssh -p 55036 -i /root/.ssh/cinay.eu_ed25519 borg@xoyaz.xyz

The authenticity of host '[xoyaz.xyz]:55036 ([2a04:52c0:101:7ae::7a5e]:55036)' can't be established.
ECDSA key fingerprint is SHA256:PDXQBhTh4oj0cSzgnjCun+J60JDUEk7VeLH2YHZbwMc.
Are you sure you want to continue connecting (yes/no)? yes
hosts.
Linux vps70253415 4.19.0-9-amd64 #1 SMP Debian 4.19.118-2+deb10u1 (2020-06-07) x86_64
                 ____  __  ___  ___  ____ _ _   _  ___ 
 __ __ _ __  ___|__  |/  \|_  )| __||__ /| | | / || __|
 \ V /| '_ \(_-<  / /| () |/ / |__ \ |_ \|_  _|| ||__ \
  \_/ | .__//__/ /_/  \__//___||___/|___/  |_| |_||___/
    __|_|   ___    ____  ___    _  ___  ____           
   | __|   |_  )  |__  |/ _ \  / ||_  )|__  |          
   |__ \ _  / /  _  / / \_, /_ | | / /   / /           
   |___/(_)/___|(_)/_/   /_/(_)|_|/___| /_/ 
Last login: Wed Jun 10 15:34:07 2020 from 51.91.249.57
$ 

sudo -s

export BORG_RSH='ssh -i /root/.ssh/cinay.eu_ed25519' # ce n'est pas la clé par défaut id_rsa
borg init --encryption=repokey-blake2 ssh://borg@xoyaz.xyz:55036/srv/data/borg-backups/cinay.eu

Enter new passphrase: 
Enter same passphrase again: 
Do you want your passphrase to be displayed for verification? [yN]: 

By default repositories initialized with this version will produce security
errors if written to with an older version (up to and including Borg 1.0.8).

If you want to use these older versions, you can disable the check by running:
borg upgrade --disable-tam ssh://borg@xoyaz.xyz:55036/srv/data/borg-backups/cinay.eu

See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications.

IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!
Use "borg key export" to export the key, optionally in printable format.
Write down the passphrase. Store both at safe place(s).

mkdir -p /root/.borg
nano /root/.borg/passphrase

borg create ssh://borg@xoyize.xyz:55029/srv/ssd-two/borg-backups/cinay.eu::2019-01-11 /home/yanfi

Enter passphrase for key ssh://borg@xoyize.xyz:55029/srv/ssd-two/borg-backups/cinay.eu: 

nano /root/.borg/borg-backup 

#!/bin/sh
#
# Script de sauvegarde.
#
# Envoie les sauvegardes sur un serveur distant, via le programme Borg.
# Les sauvegardes sont chiffrées
#
 
set -e
 
BACKUP_DATE=`date +%Y-%m-%d-%Hh%M`
LOG_PATH=/var/log/borg-backup.log
 
export BORG_PASSPHRASE="`cat ~root/.borg/passphrase`"
export BORG_RSH='ssh -i /root/.ssh/cinay.eu_ed25519'
BORG_REPOSITORY=ssh://borg@xoyaz.xyz:55036/srv/data/borg-backups/cinay.eu
BORG_ARCHIVE=${BORG_REPOSITORY}::${BACKUP_DATE}
 
borg create \
-v --progress --stats --compression lzma,9 \
--exclude-from /root/.borg/exclusions --exclude-caches \
$BORG_ARCHIVE \
/ \
>> ${LOG_PATH} 2>&1
 
# Nettoyage des anciens backups
# On conserve
# - une archive par jour les 7 derniers jours,
# - une archive par semaine pour les 4 dernières semaines,
# - une archive par mois pour les 6 derniers mois.
 
borg prune \
-v --list --stats --keep-daily=7 --keep-weekly=4 --keep-monthly=6 \
$BORG_REPOSITORY \
>> ${LOG_PATH} 2>&1

root@cinay:/home/debian# nano /root/.borg/borg-backup 
root@cinay:/home/debian# cat /root/.borg/borg-backup 
#!/bin/sh
#
# Script de sauvegarde.
#
# Envoie les sauvegardes sur un serveur distant, via le programme Borg.
# Les sauvegardes sont chiffrées
#
 
set -e
 
BACKUP_DATE=`date +%Y-%m-%d-%Hh%M`
LOG_PATH=/var/log/borg-backup.log
 
export BORG_PASSPHRASE="`cat ~root/.borg/passphrase`"
export BORG_RSH='ssh -i /root/.ssh/cinay.eu_ed25519'
BORG_REPOSITORY=ssh://borg@xoyaz.xyz:55036/srv/data/borg-backups/cinay.eu
BORG_ARCHIVE=${BORG_REPOSITORY}::${BACKUP_DATE}
 
borg create \
-v --progress --stats --compression lzma,9 \
--exclude-caches --exclude-from /root/.borg/exclusions \
$BORG_ARCHIVE \
/ \
>> ${LOG_PATH} 2>&1
 
# Nettoyage des anciens backups
# On conserve
# - une archive par jour les 7 derniers jours,
# - une archive par semaine pour les 4 dernières semaines,
# - une archive par mois pour les 6 derniers mois.
 
borg prune \
-v --list --stats --keep-daily=7 --keep-weekly=4 --keep-monthly=6 \
$BORG_REPOSITORY \
>> ${LOG_PATH} 2>&1

exit 0
# Ancien backup
borg create \
-v --progress --stats --compression lzma,9 \
--exclude-from /root/.borg/exclusions --exclude-caches \
$BORG_ARCHIVE \
/ \
>> ${LOG_PATH} 2>&1

chmod +x /root/.borg/borg-backup

nano /root/.borg/exclusions

/dev/*
/proc/*
/sys/*
/tmp/*
/run/*
/mnt/*
/media/*
lost+found
/home/yunohost.multimedia
/home/yunohost.backup
/home/yunohost.transmission
/home/yunohost.app
/opt/sshfs

crontab -e

# Sauvegarde sur distant avec BorgBackup
40 02 * * * /root/.borg/borg-backup > /dev/null