HETZNER VPS CX21 4Go RAM 40Go SSD debian 10 yunohost (yanfi.space,yanfi.net et cinay.eu)

ssh -i .ssh/debian-10-cx21 root@95.216.222.127

passwd

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 96:00:00:80:22:12 brd ff:ff:ff:ff:ff:ff
    inet 95.216.222.127/32 brd 95.216.222.127 scope global dynamic eth0
       valid_lft 85731sec preferred_lft 85731sec
    inet6 2a01:4f9:c010:45b3::2255/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::9400:ff:fe80:2212/64 scope link 
       valid_lft forever preferred_lft forever

Current default time zone: 'Europe/Paris'
Local time is now:      Sun Nov 22 08:06:42 CET 2020.
Universal Time is now:  Sun Nov 22 07:06:42 UTC 2020.

timedatectl status

               Local time: Sun 2020-11-22 08:45:34 CET
           Universal time: Sun 2020-11-22 07:45:34 UTC
                 RTC time: Sun 2020-11-22 07:45:35
                Time zone: Europe/Paris (CET, +0100)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

hostnamectl

   Static hostname: debian-4gb-hel1-1
         Icon name: computer-vm
           Chassis: vm
        Machine ID: 5e93c746b78b49c5a61470c448d04423
           Boot ID: 513fff3bb1db43a392217d19105e2c2d
    Virtualization: kvm
  Operating System: Debian GNU/Linux 10 (buster)
            Kernel: Linux 4.19.0-12-amd64
      Architecture: x86-64

dpkg-reconfigure locales

[*] en_US.UTF-8 UTF-8
[*] fr_FR.UTF-8 UTF-8

apt update && apt upgrade
apt install curl
curl https://install.yunohost.org | bash 

yunohost tools postinstall

Main domain: yanfi.space
[...]
Warning: The ssh configuration has been manually modified, but you need to explicitly specify category 'ssh' with --force to actually apply the changes.
Success! YunoHost is now configured
Warning: The post-install completed! To finalize your setup, please consider:
    - adding a first user through the 'Users' section of the webadmin (or 'yunohost user create <username>' in command-line);
    - diagnose potential issues through the 'Diagnosis' section of the webadmin (or 'yunohost diagnosis run' in command-line);
    - reading the 'Finalizing your setup' and 'Getting to know Yunohost' parts in the admin documentation: https://yunohost.org/admindoc.

mkdir  /home/admin/.ssh
cp /root/.ssh/authorized_keys /home/admin/.ssh/
chown admin.1007 -R /home/admin/.ssh

sudo nano /etc/ssh/sshd_config

# This configuration has been automatically generated
# by YunoHost

Protocol 2
Port 55127

ListenAddress ::
ListenAddress 0.0.0.0


HostKey /etc/ssh/ssh_host_ecdsa_key
HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key

# ##############################################
# Stuff recommended by Mozilla "modern" compat'
# https://infosec.mozilla.org/guidelines/openssh
# ##############################################


  # By default use "modern" Mozilla configuration
  # Keys, ciphers and MACS
  KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
  Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
  MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com


# LogLevel VERBOSE logs user's key fingerprint on login.
# Needed to have a clear audit track of which key was using to log in.
SyslogFacility AUTH
LogLevel VERBOSE

# #######################
# Authentication settings
# #######################

# Comment from Mozilla about the motivation behind disabling root login
#
# Root login is not allowed for auditing reasons. This is because it's difficult to track which process belongs to which root user:
#
# On Linux, user sessions are tracking using a kernel-side session id, however, this session id is not recorded by OpenSSH.
# Additionally, only tools such as systemd and auditd record the process session id.
# On other OSes, the user session id is not necessarily recorded at all kernel-side.
# Using regular users in combination with /bin/su or /usr/bin/sudo ensure a clear audit track.

LoginGraceTime 120
PermitRootLogin no
StrictModes yes
PubkeyAuthentication yes
PermitEmptyPasswords no
ChallengeResponseAuthentication no
UsePAM yes

# Change to no to disable tunnelled clear text passwords
# (i.e. everybody will need to authenticate using ssh keys)
PasswordAuthentication no

# Post-login stuff
Banner /etc/issue.net
PrintMotd no
PrintLastLog yes
ClientAliveInterval 60
AcceptEnv LANG LC_*

# Disallow user without ssh or sftp permissions
AllowGroups ssh.main sftp.main ssh.app sftp.app admins root

# Allow users to create tunnels or forwarding
AllowTcpForwarding yes
AllowStreamLocalForwarding yes
PermitTunnel yes
PermitUserRC yes

# SFTP stuff
Subsystem sftp internal-sftp

# Apply following instructions to user with sftp perm only
Match Group sftp.main,!ssh.main
    ForceCommand internal-sftp
    # We can't restrict to /home/%u because the chroot base must be owned by root
    # So we chroot only on /home
    # See https://serverfault.com/questions/584986/bad-ownership-or-modes-for-chroot-directory-component
    ChrootDirectory /home
    # Forbid SFTP users from using their account SSH as a VPN (even if SSH login is disabled)
    AllowTcpForwarding no
    AllowStreamLocalForwarding no
    PermitTunnel no
    # Disable .ssh/rc, which could be edited (e.g. from Nextcloud or whatever) by users to execute arbitrary commands even if SSH login is disabled
    PermitUserRC no

Match Group sftp.app,!ssh.app
    ForceCommand internal-sftp
    ChrootDirectory %h
    AllowTcpForwarding no
    AllowStreamLocalForwarding no
    PermitTunnel no
    PermitUserRC no
    PasswordAuthentication yes

# root login is allowed on local networks
# It's meant to be a backup solution in case LDAP is down and
# user admin can't be used...
# If the server is a VPS, it's expected that the owner of the
# server has access to a web console through which to log in.
Match Address 192.168.0.0/16,10.0.0.0/8,172.16.0.0/12,169.254.0.0/16,fe80::/10,fd00::/8
    PermitRootLogin yes

systemctl restart sshd

yunohost firewall allow TCP 55127
yunohost firewall disallow TCP 22

ssh admin@95.216.222.127 -p 55127 -i /home/yannick/.ssh/debian-10-cx21

sudo apt install rsync curl tmux jq figlet git dnsutils tree -y

sudo rm /etc/motd && sudo nano /etc/motd

sudo usermod -a -G systemd-journal $USER

DESTINATAIRE="vps@ciany.eu"
VPHOST=$(hostname -f)
DATE=$(date "+%d.%m.%Y--%Hh%Mm")
IP=$(echo $SSH_CONNECTION | awk '{print $1}')
#IP=`echo $SSH_CONNECTION | cut -d " " -f 1`
LOCALISATION=$(curl -s ipinfo.io/"$IP" | jq -r '[.country, .city] | join(", ")')
REVERSE=$(dig -x $IP +short)
echo "Connexion de ${USER} sur $VPHOST

IP de connexion: ${IP}
Localisation appelant: ${LOCALISATION}
ReverseDNS: ${REVERSE}
Date: ${DATE}
" | mail -s "Connexion de ${USER} sur $VPHOST" $DESTINATAIRE

sudo mkdir -p /opt/sshfs

sudo apt install sshfs

sudo -s
sshfs -o allow_other userhms@hms.xoyaz.xyz:/home/userhms/sshfs /opt/sshfs -C -p 55051 -oIdentityFile=/home/admin/.ssh/hms-sto-250

userhms@hms.xoyaz.xyz:/home/userhms/sshfs /opt/sshfs fuse.sshfs _netdev,identityfile=/home/admin/.ssh/hms-sto-250,allow_other,port=55051 0 0

sudo mount -a

chmod 600 /home/admin/.ssh/OVZ-STORAGE-128

sudo -s
sshfs -o allow_other usernl@xoyaz.xyz:/home/usernl/backup /opt/sshfs -C -p 55036 -oIdentityFile=/home/admin/.ssh/OVZ-STORAGE-128

usernl@xoyaz.xyz:/home/usernl/backup /opt/sshfs fuse.sshfs _netdev,identityfile=/home/admin/.ssh/OVZ-STORAGE-128,allow_other,port=55036 0 0

sudo mount -a

yunohost domain dns-conf yanfi.space

; Basic ipv4/ipv6 records
@ 3600 IN A 95.216.222.127
@ 3600 IN AAAA 2a01:4f9:c010:45b3::2255

; XMPP
_xmpp-client._tcp 3600 IN SRV 0 5 5222 yanfi.space.
_xmpp-server._tcp 3600 IN SRV 0 5 5269 yanfi.space.
muc 3600 IN CNAME @
pubsub 3600 IN CNAME @
vjud 3600 IN CNAME @
xmpp-upload 3600 IN CNAME @

; Mail
@ 3600 IN MX 10 yanfi.space.
@ 3600 IN TXT "v=spf1 a mx -all"
mail._domainkey 3600 IN TXT "v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDM7ja2oZ0efNg8WWoRY82kneRiJOciFAgyBfaDpNzRQdaphq082256m6Ol9tWEqCjWakO5nmvP03s+zw53lZoUfZyY4FE58AAesHszSyvVYhCz7uSfEijD4snvIYSqkuFvRNLv2WCYPQFelx9VPl5095f+8X0Y8dx4H2TvGGqsUQIDAQAB"
_dmarc 3600 IN TXT "v=DMARC1; p=none"

; Extra
* 3600 IN A 95.216.222.127
* 3600 IN AAAA 2a01:4f9:c010:45b3::2255
@ 3600 IN CAA 128 issue "letsencrypt.org"

yunohost domain add yanfi.net

yunohost domain dns-conf yanfi.net

; Basic ipv4/ipv6 records
@ 3600 IN A 95.216.222.127
@ 3600 IN AAAA 2a01:4f9:c010:45b3::2255

; XMPP
_xmpp-client._tcp 3600 IN SRV 0 5 5222 yanfi.net.
_xmpp-server._tcp 3600 IN SRV 0 5 5269 yanfi.net.
muc 3600 IN CNAME @
pubsub 3600 IN CNAME @
vjud 3600 IN CNAME @
xmpp-upload 3600 IN CNAME @

; Mail
@ 3600 IN MX 10 yanfi.net.
@ 3600 IN TXT "v=spf1 a mx -all"
mail._domainkey 3600 IN TXT "v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQC7jDcuICl4E9fLUhdum1TW7Pxj+pKDrn7np1nu4umYuZd7qVt69JGjtF4RvBGOASxguG1uVZLoBBYPgA8sZmmbT1Laf7g74YQm+i345yjzklT96aCJu1PvZMosvzMOBfbx6N08Nav5Rp++PTuMHFXhyDmJMr/c2/epVWm4eXbdAwIDAQAB"
_dmarc 3600 IN TXT "v=DMARC1; p=none"

; Extra
* 3600 IN A 95.216.222.127
* 3600 IN AAAA 2a01:4f9:c010:45b3::2255
@ 3600 IN CAA 128 issue "letsencrypt.org"

yunohost domain add cinay.eu

yunohost domain dns-conf cinay.eu

; Basic ipv4/ipv6 records
@ 3600 IN A 95.216.222.127
@ 3600 IN AAAA 2a01:4f9:c010:45b3::2255

; XMPP
_xmpp-client._tcp 3600 IN SRV 0 5 5222 cinay.eu.
_xmpp-server._tcp 3600 IN SRV 0 5 5269 cinay.eu.
muc 3600 IN CNAME @
pubsub 3600 IN CNAME @
vjud 3600 IN CNAME @
xmpp-upload 3600 IN CNAME @

; Mail
@ 3600 IN MX 10 cinay.eu.
@ 3600 IN TXT "v=spf1 a mx -all"
mail._domainkey 3600 IN TXT "v=DKIM1; h=sha256; k=rsa; p=MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQDn4KD67wSLqb4ACbBdFniSYnPkbNHAjCdah4fYFuyVkefSW5lZjmwPiZ26GJpf1gBT4/kUc5XtRdXosCDJuGsmfq0JwA7813Gmn00wNIuOGQ5WglGSvpm73iVomF/psI/+ElbA0TX0T8babIciq+jdA7g4ZhJ/zUX93oAAOoqaOQIDAQAB"
_dmarc 3600 IN TXT "v=DMARC1; p=none"

; Extra
* 3600 IN A 95.216.222.127
* 3600 IN AAAA 2a01:4f9:c010:45b3::2255
@ 3600 IN CAA 128 issue "letsencrypt.org"

yunohost domain cert-install --no-checks # yanfi.space
yunohost domain cert-install yanfi.net --no-checks
yunohost domain cert-install cinay.eu --no-checks

yunohost user create yann

First name: yann
Last name: cinayeu
E-mail address: yann@cinay.eu
You are now about to define a new user password. The password should be at least 8 characters long—though it is good practice to use a longer password (i.e. a passphrase) and/or to a variation of characters (uppercase, lowercase, digits and special characters).
Password: 
Confirm password: 
Success! User created
fullname: yann cinayeu
mail: yann@cinay.eu
username: yann

wget https://static.xoyaz.xyz/files/ssh_rc_bash
chmod +x ssh_rc_bash # rendre le bash exécutable
./ssh_rc_bash        # exécution

yunohost app install https://github.com/YunoHost-Apps/nextcloud_ynh --debug

[...]
Choose a domain for Nextcloud (default: cinay.eu): 
Choose a path for Nextcloud (default: /nextcloud): 

Choose the Nextcloud administrator (must be an existing YunoHost user): yann
Access the users home folder from Nextcloud? [yes | no] (default: no): no
[...]

yunohost app install ttrss

Choose a domain for Tiny-Tiny-RSS (default: cinay.eu): 
Choose a path for Tiny-Tiny-RSS (default: /ttrss): 
Success! Installation completed

yunohost app upgrade ttrss -u https://github.com/YunoHost-Apps/ttrss_ynh/tree/testing --debug

yunohost app install https://github.com/YunoHost-Apps/shaarli_ynh/tree/testing

domaine : yanfi.space
racine : /shaarli
utilisateur admin : yann
Mp admin : idem mp yann
Site publique: oui 

sed -i "s/is_public\: '0'/is_public\: '1'/g" /etc/yunohost/apps/shaarli/settings.yml

yunohost app ssowatconf

yunohost domain add static.cinay.eu
yunohost domain cert-install static.cinay.eu --no-checks

yunohost app install https://github.com/YunoHost-Apps/my_webapp_ynh/tree/testing --debug

yunohost app change-label my_webapp 'Statique static.cinay.eu'

yunohost app install https://github.com/YunoHost-Apps/my_webapp_ynh/tree/testing --debug

    # Deny access to hidden files and directories
#    location ~ ^/site/(.+/|)\.(?!well-known\/) {
#        deny all;
#    }

    fancyindex on;              # Enable fancy indexes.
    fancyindex_exact_size off;  # Output human-readable file sizes.

systemctl restart nginx

yunohost app change-label my_webapp__2 'Cartographie Diceware'

yunohost domain add map.cinay.eu
yunohost domain cert-install map.cinay.eu --no-checks

yunohost app install https://github.com/YunoHost-Apps/my_webapp_ynh

Choose the domain where this app should be installed [cinay.eu | gitea.cinay.eu | map.cinay.eu | static.cinay.eu | yanfi.net | yanfi.space | searx.yanfi.space | zic.yanfi.space] (default: yanfi.space): map.cinay.eu
Choose the path where this app should be installed (default: /site): /
Do you need a SFTP access? [yes | no] (default: yes): no
Choose an administration password for this app: 
Should this app be exposed to anonymous visitors? [yes | no] (default: yes): 
Do you need a MySQL database? [yes | no] (default: no): 
[...]
Info: [####################] > Installation of my_webapp__3 completed
Success! Installation completed

yunohost app change-label my_webapp__3 'Cartes map.cinay.eu'

yunohost domain add gitea.cinay.eu
yunohost domain cert-install gitea.cinay.eu --no-checks

git clone https://github.com/YunoHost-Apps/gitea_ynh.git

nano gitea_ynh/scripts/install

# SETUP FAIL2BAN
#ynh_script_progression --message="Configuring fail2ban..."
#ynh_add_fail2ban_config --logpath "/var/log/$app/gitea.log" --failregex ".*Failed authentication attempt for .* from <HOST>" --max_retry 5

yunohost app install gitea_ynh

ynh_add_fail2ban_config --logpath /var/log/gitea/gitea.log --failregex '.*Failed authentication attempt for .* from <HOST>' --max_retry 5

yunohost app change-label gitea 'Gitea gitea.cinay.eu'

sudo yunohost domain add searx.yanfi.space
sudo yunohost domain cert-install searx.yanfi.space --no-checks

cd /home/admin
docker pull searx/searx
docker images

REPOSITORY    TAG       IMAGE ID       CREATED       SIZE
searx/searx   latest    096886989dad   6 hours ago   161MB

/etc/systemd/system/searx.service

[Unit]
Description=searx container
After=docker.service
Wants=network-online.target docker.socket
Requires=docker.socket
 
[Service]
Restart=always
ExecStartPre=/bin/bash -c "/usr/bin/docker container inspect searx 2> /dev/null || /usr/bin/docker run --name searx --rm -d -v /home/admin/searx:/etc/searx -p 8089:8080 -e BASE_URL=http://localhost:8089/ searx/searx"
ExecStart=/usr/bin/docker start -a searx
ExecStop=/usr/bin/docker stop -t 10 searx
 
[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload

sudo systemctl start searx  # sudo systemctl stop searx

curl --location --verbose --head --insecure localhost:8089

[...]
*   Trying 127.0.0.1...
* TCP_NODELAY set
* Expire in 200 ms for 4 (transfer 0x5614e62aef90)
* Connected to localhost (127.0.0.1) port 8089 (#0)
> HEAD / HTTP/1.1
> Host: localhost:8089
> User-Agent: curl/7.64.0
> Accept: */*
> 
< HTTP/1.1 200 OK
HTTP/1.1 200 OK
[...]

sudo nano ${PWD}/searx/settings.yml

general:

    instance_name : "yann-searx" # displayed name

server:
    base_url : http://localhost:8089/ # Set custom base_url. Possible values: False or "https://your.custom.host/lo
cation/"

ui:
    theme_args :
        oscar_style : logicodev-dark # default style of oscar
    results_on_new_tab: True  # Open result links in a new tab by default

# supprimer la ligne 'disabled : True' des éléments ci dessous

  - name : ddg definitions
    engine : duckduckgo_definitions
    shortcut : ddd
    weight : 2

  - name : duckduckgo
    engine : duckduckgo
    shortcut : ddg

  - name : duckduckgo images
    engine : duckduckgo_images
    shortcut : ddi
    timeout: 3.0

sudo systemctl restart searx

sudo systemctl enable searx

docker ps

CONTAINER ID   IMAGE         COMMAND                  CREATED         STATUS         PORTS                    NAMES
dfefa57f88f9   searx/searx   "/sbin/tini -- /usr/…"   9 minutes ago   Up 9 minutes   0.0.0.0:8089->8080/tcp   searx

ssh -L 9000:localhost:8089 cxuser@135.181.27.140 -p 55140 -i /home/yannick/.ssh/cx11_ed25519  

sudo yunohost app install https://github.com/YunoHost-Apps/redirect_ynh

Choose a domain for your redirect (default: cinay.eu): searx.yanfi.space
Choose a path for your redirect (default: /redirect): /
Redirect destination path (default: http://127.0.0.1): http://127.0.0.1:8089
Redirect type [public_302 | public_301 | public_proxy | private_proxy] (default: public_302): public_proxy
Info: Installing redirect...
[...]
Success! Installation completed

sudo yunohost app change-label redirect 'Moteur Recherche searx.cinay.eu'

cd /home/admin

docker images

sudo systemctl stop searx.service

docker rmi 096886989dad

docker images

sudo systemctl start searx.service
sudo systemctl status searx.service

yunohost domain add zic.yanfi.space
yunohost domain cert-install zic.yanfi.space --no-checks

yunohost app install https://github.com/YunoHost-Apps/navidrome_ynh/tree/testing --debug    

nano /var/lib/navidrome/navidrome.toml

# Folder where your music library is stored. Can be read-only
MusicFolder = "/opt/sshfs/musique"

# How frequently to scan for changes in your music library. Set it to 0 to disable scans
ScanSchedule = '@every 24h'

systemctl restart navidrome.service

yunohost app change-label navidrome 'Zic Navidrome zic.cinay.eu'

yunohost app install rainloop

Choose the domain where this app should be installed [cinay.eu | gitea.cinay.eu | static.cinay.eu | yanfi.net | yanfi.space | searx.yanfi.space | zic.yanfi.space] (default: yanfi.space): 
Choose the path where this app should be installed (default: /rainloop): 
Should this app be exposed to anonymous visitors? [yes | no] (default: no): 
Choose an administration password for this app: 
Do you want to add YunoHost users to the recipients suggestions? [yes | no] (default: yes): 
Select default language [de | en | es | fr | it | pt] (default: en): fr
[...]
Info: [####################] > Installation of rainloop completed
Success! Installation completed

yunohost app install librespeed # un mot de passe administartion est demandé

/etc/nginx/conf.d/yanfi.space.d/librespeed.conf 

 rewrite ^/librespeed$ /librespeed/ permanent;
location /librespeed/ {

  # Path to source
  alias /var/www/librespeed/ ;

  # Force usage of https
  if ($scheme = http) {
    rewrite ^ https://$server_name$request_uri? permanent;
  }

### Example PHP configuration (remove it if not used)
  index yann-singleServer-full.html index.php;

  # Common parameter to increase upload size limit in conjunction with dedicated php-fpm file
  client_max_body_size 256M;

  try_files $uri $uri/ /index.php;
  location ~ [^/]\.php(/|$) {
    fastcgi_split_path_info ^(.+?\.php)(/.*)$;
    fastcgi_pass unix:/var/run/php/php7.3-fpm-librespeed.sock;
    fastcgi_index index.php;
    include fastcgi_params;
    fastcgi_param REMOTE_USER $remote_user;
    fastcgi_param PATH_INFO $fastcgi_path_info;
    fastcgi_param SCRIPT_FILENAME $request_filename;
  }
### End of PHP configuration part

  # Include SSOWAT user panel.
  include conf.d/yunohost_panel.conf.inc;
}

yunohost domain add ebook.yanfi.space
yunohost domain cert-install ebook.yanfi.space --no-checks

yunohost app install https://github.com/YunoHost-Apps/calibreweb_ynh

Choose the domain where this app should be installed [cinay.eu | gitea.cinay.eu | map.cinay.eu | static.cinay.eu | yanfi.net | yanfi.space | ebook.yanfi.space | searx.yanfi.space | zic.yanfi.space] (default: yanfi.space): ebook.yanfi.space
Choose the path where this app should be installed (default: /calibre): /
Choose an administrator user for this app [yann | claudine | yanfi]: yann
Should this app be exposed to anonymous visitors? [yes | no] (default: no): yes
Select a default language [fr | en | es | de] (default: fr): 
Do you want to allow uploading of books? [yes | no] (default: no): 
Do you want to allow access to the library to all Yunohost users?  [yes | no] (default: yes): 

rsync -avz --delete --rsync-path="sudo rsync" -e "ssh -p 55051 -i /home/admin/.ssh/hms-sto-250 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" userhms@hms.xoyaz.xyz:/home/userhms/sshfs/BiblioCalibre/* /home/yunohost.multimedia/share/eBook/  && chown calibreweb.calibreweb -R /home/yunohost.multimedia/share/eBook/

Créer une tâche crontab

sudo crontab -e

# Synchronisation du dossier local /home/yunohost.multimedia/share/eBook/ avec le dossier distant /home/userhms/sshfs/BiblioCalibre du serveur hms.xoyaz.xyz
# Tous les jours à 4h00 du matin
0 4 * * * rsync -avz --delete --rsync-path="sudo rsync" -e "ssh -p 55051 -i /home/admin/.ssh/hms-sto-250 -o StrictHostKeyChecking=no -o UserKnownHostsFile=/dev/null" userhms@hms.xoyaz.xyz:/home/userhms/sshfs/BiblioCalibre/* /home/yunohost.multimedia/share/eBook/  && chown calibreweb.calibreweb -R /home/yunohost.multimedia/share/eBook/

systemctl restart calibreweb

nano ~/backup-hms.xoyaz.xyz.sh

chmod +x ~/backup-hms.xoyaz.xyz.sh

journalctl --no-pager -t allsync --since today

-- Logs begin at Wed 2021-09-15 11:48:08 CEST, end at Wed 2021-09-15 18:47:50 CEST. --
Sep 15 18:24:45 yanfi.space allsync[16720]: Sauvegardes 20210915* -> OK

sudo crontab -e

10 02 * * * /home/admin/backup-hms.xoyaz.xyz.sh > /dev/null

ssh-keygen -t ed25519 -f ~/.ssh/borg_yanfi

ssh userhms@45.145.166.51 -p 55051 -i /home/yann/.ssh/hms-sto-250
sudo -u borgbackup -s # utilisateur borgbackup  
echo 'ssh-ed25519 AAAAkjhreszFJE5AAAAIBWaYu5BvBcpuTeP4/0QXLm3/vmKP7EagcWXi+MGygJ7 yann@archyan' >> /home/backup/.ssh/authorized_keys

ssh borgbackup@xoyaz.xyz -p 55051 -i /home/yann/.ssh/borg_yanfi

yunohost diagnosis run --force

yunohost diagnosis show --issues

reports: 
  0: 
    description: Base system
    id: basesystem
    items: 
      status: WARNING
      summary: It looks like apt (the package manager) is configured to use the backports repository. Unless you really know what you are doing, we strongly discourage from installing packages from backports, because it's likely to create unstabilities or conflicts on your system.
  1: 
    description: Email
    id: mail
    items: 
      0: 
        details: 
          - The blacklist reason is: "http://www.barracudanetworks.com/reputation/?pr=1&ip=95.216.222.127"
          - After identifying why you are listed and fixed it, feel free to ask for your IP or domaine to be removed on https://barracudacentral.org/rbl/
        status: ERROR
        summary: Your IP or domain 95.216.222.127 is blacklisted on Barracuda Reputation Block List
      1: 
        details: 
          - The blacklist reason is: "https://matrix.spfbl.net/2a01:4f9:c010:45b3:0:0:0:1"
          - After identifying why you are listed and fixed it, feel free to ask for your IP or domaine to be removed on https://spfbl.net/en/dnsbl/
        status: ERROR
        summary: Your IP or domain 2a01:4f9:c010:45b3::2255 is blacklisted on SPFBL.net RBL
  2: 
    description: System configurations
    id: regenconf
    items: 
      details: This is probably OK if you know what you're doing! YunoHost will stop updating this file automatically... But beware that YunoHost upgrades could contain important recommended changes. If you want to, you can inspect the differences with 'yunohost tools regen-conf ssh --dry-run --with-diff' and force the reset to the recommended configuration with 'yunohost tools regen-conf ssh --force'
      status: WARNING
      summary: Configuration file /etc/ssh/sshd_config appears to have been manually modified.

          - The blacklist reason is: "http://www.barracudanetworks.com/reputation/?pr=1&ip=95.216.222.127"
          - After identifying why you are listed and fixed it, feel free to ask for your IP or domaine to be removed on https://barracudacentral.org/rbl/
        status: ERROR
        summary: Your IP or domain 95.216.222.127 is blacklisted on Barracuda Reputation Block List

Demande reçue

Merci d'avoir soumis votre demande. S'il s'agit de votre première demande, la réputation de votre adresse IP sera portée à "normale" pendant 48 heures, le temps que nous menions notre enquête. Il peut s'écouler jusqu'à une heure avant que la réputation ne se propage à tous les pare-feu antispam Barracuda dans le monde. Nous vous remercions de votre patience et vous prions de nous excuser pour tout désagrément.

Votre numéro de confirmation est BBR21612284433-86752-13901.

EmailReg.org

Une façon d'éviter que votre courrier électronique soit bloqué par inadvertance est d'enregistrer votre domaine et vos adresses IP sur EmailReg.org. Les courriels provenant de noms de domaine et d'adresses IP correctement enregistrés sur EmailReg.org peuvent être automatiquement exemptés des couches de défense du filtrage du spam sur les pare-feu antispam Barracuda et d'autres solutions antispam, ce qui permet d'éviter que votre courriel soit accidentellement bloqué. 

          - The blacklist reason is: "https://matrix.spfbl.net/2a01:4f9:c010:45b3:0:0:0:1"
          - After identifying why you are listed and fixed it, feel free to ask for your IP or domaine to be removed on https://spfbl.net/en/dnsbl/
        status: ERROR
        summary: Your IP or domain 2a01:4f9:c010:45b3::2255 is blacklisted on SPFBL.net RBL

[yann@archyan ~]$ dig ptr 127.222.216.95.in-addr.arpa +noall +answer
127.222.216.95.in-addr.arpa. 86400 IN	PTR	yanfi.space.
[yann@archyan ~]$ dig PTR 1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.b.5.4.0.1.0.c.9.f.4.0.1.0.a.2.ip6.arpa +noall +answer
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.3.b.5.4.0.1.0.c.9.f.4.0.1.0.a.2.ip6.arpa. 86400	IN PTR yanfi.space.

yunohost tools update
# si mise à jour possible
yunohost tools upgrade apps
yunohost tools upgrade system

YunoHost update

positional arguments:
  TARGET      What to update, "apps" (application catalog) or "system" (fetch
              available package upgrades, equivalent to apt update), "all" for
              both

optional arguments:
  -h, --help  show this help message and exit
  --apps      (Deprecated, see first positional arg) Fetch the application
              list to check which apps can be upgraded
  --system    (Deprecated, see first positional arg) Fetch available system
              packages upgrades (equivalent to apt update)
root@yanfi:/home/admin# yunohost tools upgrade -h
usage: yunohost tools upgrade [{apps,system}] [-h] [--apps] [--system]

YunoHost upgrade

positional arguments:
  {apps,system}  What to upgrade, either "apps" (all apps) or "system" (all
                 system packages)

optional arguments:
  -h, --help     show this help message and exit
  --apps         (Deprecated, see first positional arg) Upgrade all
                 applications
  --system       (Deprecated, see first positional arg) Upgrade only the
                 system packages

sudo systemctl stop navidrome.service
sudo cp ~/navidrome /opt/yunohost/navidrome/navidrome
sudo chown -R navidrome:navidrome /opt/yunohost/navidrome
sudo chmod +x /opt/yunohost/navidrome

sudo systemctl restart navidrome
sudo yunohost service log navidrome

[...]
apps: 
  0: 
    current_version: 0.42.1~ynh1
    id: navidrome
    label: Zic Navidrome zic.cinay.eu
    new_version: 0.42.1~ynh2

sed -i 's/0.42.1~ynh1/0.42.1~ynh2/g' /etc/yunohost/apps/navidrome/manifest.json