HostMyServers, server32771 Debian 11 (Bullseye)

ssh root@45.145.166.178

deb http://deb.debian.org/debian bullseye main contrib non-free
deb-src http://deb.debian.org/debian bullseye main contrib non-free

#deb http://deb.debian.org/debian bullseye-updates main contrib non-free
#deb-src http://deb.debian.org/debian bullseye-updates main contrib non-free

deb http://security.debian.org/debian-security bullseye-security main
deb-src http://security.debian.org/debian-security bullseye-security main

apt update && apt upgrade

passwd

# This file is generated from information provided by the datasource.  Changes
# to it will not persist across an instance reboot.  To disable cloud-init's
# network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
auto lo
iface lo inet loopback
#    dns-nameservers 194.9.173.89 2a04:ecc0:4::89

auto eth0
iface eth0 inet static
    address 45.145.166.178/24
    gateway 45.145.166.1

# control-alias eth0
iface eth0 inet6 static
    address 2a04:ecc0:8:a8:4567:4989::1/64
    gateway 2a04:ecc0:8:a8::1

apt-get install locales-all

sudo apt install systemd-timesyncd

systemctl status systemd-timesyncd.service

● systemd-timesyncd.service - Network Time Synchronization
     Loaded: loaded (/lib/systemd/system/systemd-timesyncd.service; enabled; vendor preset: enabled)
     Active: active (running) since Sun 2022-09-25 02:50:09 UTC; 10h ago
       Docs: man:systemd-timesyncd.service(8)
   Main PID: 10822 (systemd-timesyn)
     Status: "Initial synchronization to time server 188.68.41.203:123 (0.debian.pool.ntp.org)."
      Tasks: 2 (limit: 4698)
     Memory: 1012.0K
        CPU: 54ms
     CGroup: /system.slice/systemd-timesyncd.service
             └─10822 /lib/systemd/systemd-timesyncd

sudo timedatectl set-timezone Europe/Paris

timedatectl

               Local time: dim. 2022-09-25 15:47:44 CEST
           Universal time: dim. 2022-09-25 13:47:44 UTC
                 RTC time: dim. 2022-09-25 13:47:45
                Time zone: Europe/Paris (CEST, +0200)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

sudo apt install dnsmasq

# Whether or not to run the dnsmasq daemon; set to 0 to disable.
# Note that this is only valid when using SYSV init. For systemd,
# use "systemctl disable dnsmasq"
ENABLED=1

# By default search this drop directory for configuration options.
# Libvirt leaves a file here to make the system dnsmasq play nice.
# Comment out this line if you don't want this. The dpkg-* are file
# endings which cause dnsmasq to skip that file. This avoids pulling
# in backups made by dpkg.
CONFIG_DIR=/etc/dnsmasq.d,.dpkg-dist,.dpkg-old,.dpkg-new

# If the resolvconf package is installed, dnsmasq will use its output
# rather than the contents of /etc/resolv.conf to find upstream
# nameservers. Uncommenting this line inhibits this behaviour.
# Note that including a "resolv-file=<filename>" line in
# /etc/dnsmasq.conf is not enough to override resolvconf if it is
# installed: the line below must be uncommented.
IGNORE_RESOLVCONF=yes

#     DO NOT EDIT THIS FILE BY HAND -- YOUR CHANGES WILL BE OVERWRITTEN
# 127.0.0.53 is the systemd-resolved stub resolver.
# run "resolvectl status" to see details about the actual nameservers.

nameserver 127.0.0.1

domain-needed
expand-hosts
localise-queries

interface=lo

resolv-file=/etc/resolv.dnsmasq.conf

nameserver 80.67.169.12
nameserver 2001:910:800::12
nameserver 80.67.169.40
nameserver 2001:910:800::40

sudo systemctl restart dnsmasq

useradd -m -d /home/hmsuser/ -s /bin/bash hmsuser

passwd hmsuser

ssh hmsuser@45.145.166.178

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/server32771

ssh-copy-id -i ~/.ssh/server32771.pub hmsuser@45.145.166.178

ssh hmsuser@45.145.166.178

sudo nano /etc/ssh/sshd_config

sudo systemctl restart sshd

ssh hmsuser@45.145.166.178 -p 55178 -i ~/.ssh/server32771  

sudo apt install rsync curl tmux jq figlet git

sudo rm /etc/motd && sudo nano /etc/motd

  _  _           _    __  __        ___                              
 | || | ___  ___| |_ |  \/  | _  _ / __| ___  _ _ __ __ ___  _ _  ___
 | __ |/ _ \(_-<|  _|| |\/| || || |\__ \/ -_)| '_|\ V // -_)| '_|(_-<
 |_||_|\___//__/ \__||_|  |_| \_, ||___/\___||_|   \_/ \___||_|  /__/
                              |__/____ ___  ____  ____  _            
      ___ ___  _ _ __ __ ___  _ _|__ /|_  )|__  ||__  |/ |           
     (_-</ -_)| '_|\ V // -_)| '_||_ \ / /   / /   / / | |           
     /__/\___||_|   \_/ \___||_| |___//___| /_/   /_/  |_|           
                         _                          __               
     ___  _  _  ___  ___| |_  _  _  __ _  _ _      / _| _ _          
    / _ \| || |/ -_)(_-<|  _|| || |/ _` || ' \  _ |  _|| '_|         
    \___/ \_,_|\___|/__/ \__| \_, |\__,_||_||_|(_)|_|  |_|           
                              |__/                                   

wget https://static.xoyaz.xyz/files/ssh_rc_bash
chmod +x ssh_rc_bash # rendre le bash exécutable
./ssh_rc_bash        # exécution

sudo apt install ufw

sudo ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

 sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
55178/tcp                  ALLOW IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443                        ALLOW IN    Anywhere                  
53 (DNS)                   ALLOW IN    Anywhere                  
55178/tcp (v6)             ALLOW IN    Anywhere (v6)             
80/tcp (v6)                ALLOW IN    Anywhere (v6)             
443 (v6)                   ALLOW IN    Anywhere (v6)             
53 (DNS (v6))              ALLOW IN    Anywhere (v6)             

wget https://static.xoyaz.xyz/files/compilation-nginx-tls1.3.sh
chmod +x compilation-nginx-tls1.3.sh # rendre le bash exécutable
./compilation-nginx-tls1.3.sh        # exécution

Versions Nginx OpenSSL
nginx version: nginx/1.20.2
OpenSSL 1.1.1n  15 Mar 2022

sudo hostnamectl set-hostname ouestyan.fr
hostnamectl

   Static hostname: ouestyan.fr
         Icon name: computer-vm
           Chassis: vm
        Machine ID: 0e0cc9839fc64a049ba55e3248fab176
           Boot ID: f3913f931a8b4090a7d40ac500e2db0f
    Virtualization: kvm
  Operating System: Debian GNU/Linux 11 (bullseye)
            Kernel: Linux 5.10.0-18-cloud-amd64
      Architecture: x86-64

$TTL 3600
@	IN SOA dns17.ovh.net. tech.ovh.net. (2022092612 86400 3600 3600000 60)
         IN NS     ns17.ovh.net.
         IN NS     dns17.ovh.net.
         IN MX     10 ouestyan.fr.
         IN A      45.145.166.178
         IN AAAA   2a04:ecc0:8:a8:4567:4989::1
         IN CAA    128 issue "letsencrypt.org"
*        IN A      45.145.166.178
*        IN AAAA   2a04:ecc0:8:a8:4567:4989::1

cd ~
# socat est prérequis (installé par défaut)
git clone https://github.com/acmesh-official/acme.sh.git
cd acme.sh
./acme.sh --install 

acme.sh --dns dns_ovh --server letsencrypt --issue --keylength ec-384 -d 'ouestyan.fr' -d '*.ouestyan.fr'

[lun. 26 sept. 2022 08:36:37 CEST] Your cert is in: /home/hmsuser//.acme.sh/ouestyan.fr_ecc/ouestyan.fr.cer
[lun. 26 sept. 2022 08:36:37 CEST] Your cert key is in: /home/hmsuser//.acme.sh/ouestyan.fr_ecc/ouestyan.fr.key
[lun. 26 sept. 2022 08:36:38 CEST] The intermediate CA cert is in: /home/hmsuser//.acme.sh/ouestyan.fr_ecc/ca.cer
[lun. 26 sept. 2022 08:36:38 CEST] And the full chain certs is there: /home/hmsuser//.acme.sh/ouestyan.fr_ecc/fullchain.cer

sudo mkdir -p /etc/ssl/private/
sudo chown $USER -R /etc/ssl/private/
acme.sh --ecc --install-cert -d 'ouestyan.fr' -d '*.ouestyan.fr' --key-file /etc/ssl/private/ouestyan.fr-key.pem --fullchain-file /etc/ssl/private/ouestyan.fr-fullchain.pem  --reloadcmd 'sudo systemctl reload nginx.service'

crontab -e

13 0 * * * "/home/hmsuser/.acme.sh"/acme.sh --cron --home "/home/hmsuser/.acme.sh" --renew-hook "/home/hmsuser/.acme.sh/acme.sh --ecc --install-cert -d 'ouestyan.fr' -d '*.ouestyan.fr' --key-file /etc/ssl/private/ouestyan.fr-key.pem --fullchain-file /etc/ssl/private/ouestyan.fr-fullchain.pem  --reloadcmd 'sudo systemctl reload nginx.service'" > /dev/null

   # /etc/nginx/conf.d/security.conf.inc
	ssl_session_timeout 1d;
	ssl_session_cache shared:SSL:50m;  # about 200000 sessions
	ssl_session_tickets off;
	
	
	# intermediate configuration
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
        ssl_prefer_server_ciphers off;
 	
        # Pre-defined FFDHE group (RFC 7919)
        # From https://ssl-config.mozilla.org/ffdhe2048.txt
        # https://security.stackexchange.com/a/149818
        ssl_dhparam /etc/ssl/private/ffdhe2048.pem;

	# Follows the Web Security Directives from the Mozilla Dev Lab and the Mozilla Obervatory + Partners
	# https://wiki.mozilla.org/Security/Guidelines/Web_Security
	# https://observatory.mozilla.org/
	
	more_set_headers "Content-Security-Policy : upgrade-insecure-requests";
	more_set_headers "Referrer-Policy: same-origin;"
	
	more_set_headers "X-Content-Type-Options : nosniff";
	more_set_headers "X-XSS-Protection : 1; mode=block";
	more_set_headers "X-Download-Options : noopen";
	more_set_headers "X-Permitted-Cross-Domain-Policies : none";
	more_set_headers "X-Frame-Options : SAMEORIGIN";
	
	# Disable the disaster privacy thing that is FLoC
	more_set_headers "Permissions-Policy : interest-cohort=()";
	
	# Disable gzip to protect against BREACH
	# Read https://trac.nginx.org/nginx/ticket/1720 (text/html cannot be disabled!)
	gzip off;

   # Certificats Let's Encrypt 
   ssl_certificate /etc/ssl/private/ouestyan.fr-fullchain.pem;
   ssl_certificate_key /etc/ssl/private/ouestyan.fr-key.pem;
   
   # HSTS (ngx_http_headers_module is required) (63072000 seconds)
   more_set_headers "Strict-Transport-Security : max-age=63072000; includeSubDomains; preload";

   # OCSP settings
   ssl_stapling on;
   ssl_stapling_verify on;
   ssl_trusted_certificate /etc/ssl/private/ouestyan.fr-fullchain.pem;
   resolver 1.1.1.1;

echo "Test envoi via postfix smtp" | mail -s "serveur debian" root

sudo usermod -a -G users $USER

sudo mkdir -p /srv/datayan

sudo chown $USER:users -R /srv/datayan

root@ouestyan:/home/hmsuser# su - borg
$ pwd
/srv/data/borg-backups
$ cat .ssh/authorized_keys
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMs2JATwIa9fPOk0gfOgm4YNIT9ZKfWwpXDamzZ5dVsh root@ouestline.xyz
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPuVXP+pUjvedC/htJmKXamAotLESDCRqU0MOoD7vqCA root@422x.l.time4vps.cloud

# Conditions préalables à la mise à jour et à l’installation
sudo apt update && sudo apt upgrade
sudo apt install libtag1-dev ffmpeg
# Utilisateur “navidrome”
sudo useradd -r -s /bin/false navidrome
# Créez un répertoire pour stocker l’exécutable Navidrome 
# et un répertoire de travail avec les permissions appropriées
sudo install -d -o navidrome -g navidrome /opt/navidrome
sudo install -d -o navidrome -g navidrome /var/lib/navidrome
# On utilise la version compilée disponible sous ~/navidrome
sudo mv navidrome /opt/navidrome/
sudo chown -R navidrome:navidrome /opt/navidrome
sudo chmod +x /opt/navidrome/navidrome

MusicFolder = "/srv/datayan/musique"
ND_PLAYLISTSPATH = "Playlists"

[Unit]
Description=Navidrome Music Server and Streamer compatible with Subsonic/Airsonic
After=remote-fs.target network.target
AssertPathExists=/var/lib/navidrome

[Install]
WantedBy=multi-user.target

[Service]
User=navidrome
Group=navidrome
Type=simple
ExecStart=/opt/navidrome/navidrome --configfile "/var/lib/navidrome/navidrome.toml"
WorkingDirectory=/var/lib/navidrome
TimeoutStopSec=20
KillMode=process
Restart=on-failure

# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
DevicePolicy=closed
NoNewPrivileges=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
ReadWritePaths=/var/lib/navidrome

# You can uncomment the following line if you're not using the jukebox This
# will prevent navidrome from accessing any real (physical) devices
#PrivateDevices=yes

# You can change the following line to `strict` instead of `full` if you don't
# want navidrome to be able to write anything on your filesystem outside of
# /var/lib/navidrome.
ProtectSystem=full

# You can uncomment the following line if you don't have any media in /home/*.
# This will prevent navidrome from ever reading/writing anything there.
#ProtectHome=true

# You can customize some Navidrome config options by setting environment variables here. Ex:
#Environment=ND_BASEURL="/navidrome"

ssh -L 9500:localhost:4533 hmsuser@45.145.166.178 -p 55178 -i /home/yann/.ssh/server32771

server {
    listen 80;
    listen [::]:80;
    server_name zic.ouestyan.fr;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name zic.ouestyan.fr;

    include /etc/nginx/conf.d/security.conf.inc;

    location / { 
        proxy_pass              http://127.0.0.1:4533;
    } 

}

sudo nginx -t
sudo systemctl reload nginx

general:

    instance_name : "OuestSearx" # displayed name

ui:
    theme_args :
        oscar_style : logicodev-dark # default style of oscar
    results_on_new_tab: True  # Open result links in a new tab by default

# supprimer la ligne 'disabled : True' des éléments ci dessous ou positionner 'disabled : False'

  - name : ddg definitions
    engine : duckduckgo_definitions
    shortcut : ddd
    weight : 2

  - name : duckduckgo
    engine : duckduckgo
    shortcut : ddg

  - name : duckduckgo images
    engine : duckduckgo_images
    shortcut : ddi
    timeout: 3.0

  - name : startpage
    engine : startpage
    shortcut : sp
    timeout : 6.0
    disabled : False
    additional_tests:
      rosebud: *test_rosebud

# facultatif
# ajouter ligne 'disabled : True' sur certains éléments de la liste

  - name : bing
    engine : bing
    shortcut : bi
    disabled : True

  - name : bing images
    engine : bing_images
    shortcut : bii
    disabled : True

  - name : bing news
    engine : bing_news
    shortcut : bin
    disabled : True

  - name : bing videos
    engine : bing_videos
    shortcut : biv
    disabled : True

  - name : wikidata
    engine : wikidata
    shortcut : wd
    timeout : 3.0
    weight : 2
    tests: *tests_infobox
    disabled : True

  - name : google
    engine : google
    shortcut : go
    use_mobile_ui: false
    # additional_tests:
    #   android: *test_android
    disabled : True

  - name : google images
    engine : google_images
    shortcut : goi
    # additional_tests:
    #   android: *test_android
    #   dali:
    #     matrix:
    #       query: ['Dali Christ']
    #       lang: ['en', 'de', 'fr', 'zh-CN']
    #     result_container:
    #       - ['one_title_contains', 'Salvador']
    disabled : True

  - name : google news
    engine : google_news
    shortcut : gon
    # additional_tests:
    #   android: *test_android
    disabled : True

  - name : google videos
    engine : google_videos
    shortcut : gov
    # additional_tests:
    #   android: *test_android
    disabled : True

  - name : google scholar
    engine : google_scholar
    shortcut : gos
    disabled : True

curl --location --verbose --head --insecure localhost:8888

*   Trying 127.0.0.1:8888...
* Connected to localhost (127.0.0.1) port 8888 (#0)
> GET / HTTP/1.1
> Host: localhost:8888
> User-Agent: curl/7.74.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
[...]

sudo -H ln -s /etc/uwsgi/apps-available/searx.ini /etc/uwsgi/apps-enabled/

sudo -H service uwsgi start searx

ssh -L 9500:localhost:8888 hmsuser@45.145.166.178 -p 55178 -i /home/yann/.ssh/server32771  

server {
    listen 80;
    listen [::]:80;
    server_name searx.ouestyan.fr;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name searx.ouestyan.fr;

    include /etc/nginx/conf.d/security.conf.inc;

    location / {
      proxy_pass http://127.0.0.1:8888;

      proxy_set_header Host $host;
      proxy_set_header Connection       $http_connection;
      proxy_set_header X-Forwarded-For  $proxy_add_x_forwarded_for;
      proxy_set_header X-Scheme         $scheme;
      proxy_buffering                   off;
    }
}

sudo nginx -t
sudo systemctl reload nginx

upstream transmission  {
    server 127.0.0.1:9091;
}

server {
    listen 80;
    listen [::]:80;
    server_name transmission.ouestyan.fr;
    return 301 https://$host$request_uri;
}
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name transmission.ouestyan.fr;

    include /etc/nginx/conf.d/security.conf.inc;

    access_log /var/log/nginx/trans-access.log;
    error_log /var/log/nginx/trans-error.log;

    location / {
    return 301 https://$server_name/transmission/;
		location ^~ /transmission {
		    proxy_set_header X-Real-IP $remote_addr;
		    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
		    proxy_set_header Host $http_host;
		    proxy_set_header Connection "";
		    proxy_pass_header X-Transmission-Session-Id;
		       
			  location /transmission/rpc {
			    proxy_pass http://transmission;
			  }
			  location /transmission/web/ {
			    proxy_pass http://transmission;
			  }
			  location /transmission/upload {
			    proxy_pass http://transmission;
			  }
			  location /transmission/web/style/ {
			    alias /usr/share/transmission/web/style/;
			  }
			  location /transmission/web/javascript/ {
			    alias /usr/share/transmission/web/javascript/;
			  }
			  location /transmission/web/images/ {
			    alias /usr/share/transmission/web/images/;
			  }
			  location /transmission/ {
			    return 301 http://$server_name/transmission/web;
			  }
			  location /transmission/downloads/ {
			    alias /srv/transmission/completed/;
			    charset UTF-8;
			    autoindex on;
			    autoindex_exact_size off;
		     }
		 }

}

}

"download-dir": "/srv/transmission/completed",
"incomplete-dir": "/srv/transmission/progress",

"rpc-authentication-required": true, // Activation de l’auth par mot de passe
"rpc-url": "/",
"rpc-bind-address": "0.0.0.0", // 127.0.0.1 pour écouter en local
"rpc-enabled": true, // Activation de l’interface web
"rpc-password": "MOT_DE_PASSE", // Tapez votre mot de passe, il sera salé au reload
"rpc-port": 9091, // Port d’écoute
"rpc-url": "/transmission/", // Correspond à l’URL d’accès
"rpc-username": "UTILISATEUR", // Nom d’utilisateur pour l’auth
"rpc-host-whitelist": "",
"rpc-host-whitelist-enabled": false,
"rpc-whitelist": "127.0.0.1", // IPs à whitelist
"rpc-whitelist-enabled": true, // Activation de la whitelist

# en fin de fichier
    "utp-enabled": true,
    "watch-dir": "/srv/transmission/watched",
    "watch-dir-enabled": true
}

sudo systemctl start transmission-daemon