Archlinux --> conteneur LXC debian bullseye lxcyan

yay -S lxc arch-install-scripts

lxc-create -n lxcbullseye -t download -- --dist debian --release bullseye --arch amd64

Downloading the image index
Downloading the rootfs
[...]
The image cache is now ready
Unpacking the rootfs

---
You just created a Debian bullseye amd64 (20220731_05:25) conteneur.

To enable SSH, run: apt install openssh-server
No default root or user password are set by LXC.

# Template used to create this conteneur: /usr/share/lxc/templates/lxc-download
# Parameters passed to the template: --dist debian --release bullseye --arch amd64
# Template script checksum (SHA-1): 65b33ef65cd5762c980a1aaa3bcada08acc6f5d4
# For additional config options, please look at lxc.conteneur.conf(5)

# Uncomment the following line to support nesting conteneurs:
#lxc.include = /usr/share/lxc/config/nesting.conf
# (Be aware this has security implications)


# Distribution configuration
lxc.include = /usr/share/lxc/config/common.conf
lxc.arch = linux64

# conteneur specific configuration
lxc.rootfs.path = dir:/var/lib/lxc/lxcbullseye/rootfs
lxc.uts.name = lxcbullseye

# Network configuration
lxc.net.0.type = veth
lxc.net.0.link = lxcbr0
lxc.net.0.flags = up
lxc.net.0.hwaddr = 00:16:3e:20:10:f5

lxc.net.0.link = br0

systemctl start lxc-net.service
systemctl status lxc-net.service

● lxc-net.service - LXC network bridge setup
     Loaded: loaded (/usr/lib/systemd/system/lxc-net.service; disabled; vendor >
     Active: active (exited) since Thu 2020-12-17 20:26:30 CET; 14s ago
       Docs: man:lxc
    Process: 32027 ExecStart=/usr/lib/lxc/lxc-net start (code=exited, status=0/>
   Main PID: 32027 (code=exited, status=0/SUCCESS)

déc. 17 20:26:30 archyan systemd[1]: Starting LXC network bridge setup...
déc. 17 20:26:30 archyan systemd[1]: Finished LXC network bridge setup.

systemctl enable lxc-net.service # réseau au redémarrage

systemctl start lxc@lxcbullseye.service   

systemctl status lxc@lxcbullseye.service

● lxc@lxcbullseye.service - lxcbullseye LXC
     Loaded: loaded (/usr/lib/systemd/system/lxc@.service; disabled; preset: disabled)
     Active: active (running) since Wed 2022-08-03 15:35:16 CEST; 8s ago
    Process: 13481 ExecStart=/usr/bin/lxc-start -d -n lxcbullseye -p /run/lxc-lxcbullseye.pid (code=exited, status=0/SUCCESS)
   Main PID: 13483 (lxc-start)
      Tasks: 0 (limit: 32768)
     Memory: 1.6M
        CPU: 5ms
     CGroup: /system.slice/system-lxc.slice/lxc@lxcbullseye.service
             ‣ 13483 "[lxc monitor] /var/lib/lxc lxcbullseye"

août 03 15:35:16 archyan systemd[1]: Starting lxcbullseye LXC...
août 03 15:35:16 archyan systemd[1]: Started lxcbullseye LXC.

lxc-attach -n lxcbullseye --clear-env	# On obtient le prompt root@lxcbullseye:/#

systemctl list-units --type=service

  UNIT                               LOAD   ACTIVE SUB     DESCRIPTION
  console-getty.service              loaded active running Console Getty
  dbus.service                       loaded active running D-Bus System Message Bus
  systemd-journal-flush.service      loaded active exited  Flush Journal to Persistent Storage
  systemd-journald.service           loaded active running Journal Service
  systemd-logind.service             loaded active running User Login Management
  systemd-networkd.service           loaded active running Network Service
  systemd-remount-fs.service         loaded active exited  Remount Root and Kernel File Systems
  systemd-resolved.service           loaded active running Network Name Resolution
  systemd-sysctl.service             loaded active exited  Apply Kernel Variables
  systemd-sysusers.service           loaded active exited  Create System Users
  systemd-tmpfiles-setup-dev.service loaded active exited  Create Static Device Nodes in /dev
  systemd-tmpfiles-setup.service     loaded active exited  Create Volatile Files and Directories
  systemd-update-utmp.service        loaded active exited  Update UTMP about System Boot/Shutdown
  systemd-user-sessions.service      loaded active exited  Permit User Sessions

LOAD   = Reflects whether the unit definition was properly loaded.
ACTIVE = The high-level unit activation state, i.e. generalization of SUB.
SUB    = The low-level unit activation state, values depend on unit type.
14 loaded units listed. Pass --all to see loaded but inactive units, too.
To show all installed unit files use 'systemctl list-unit-files'.

apt install ssh nano sudo

export TERM="xterm-256color"

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if9: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:16:3e:20:10:f5 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.0.20/24 brd 192.168.0.255 scope global dynamic eth0
       valid_lft 43044sec preferred_lft 43044sec
    inet6 2a01:e34:eebf:5660:216:3eff:fe20:10f5/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86299sec preferred_lft 86299sec
    inet6 fe80::216:3eff:fe20:10f5/64 scope link 
       valid_lft forever preferred_lft forever

hostnamectl

   Static hostname: lxcbullseye
         Icon name: computer-container
           Chassis: container
        Machine ID: d6b8629dbef54cc98e171c4b6bf8c3d5
           Boot ID: a1401aa661994079933a16ef5e971e76
    Virtualization: lxc
  Operating System: Debian GNU/Linux 11 (bullseye)
            Kernel: Linux 5.18.15-arch1-1
      Architecture: x86-64

useradd -m -d /home/lxcyan/ -s /bin/bash lxcyan
passwd lxcyan

echo "lxcyan     ALL=(ALL) NOPASSWD: ALL" >> /etc/sudoers

[Match]
Name=eth0
[Network]
DHCP=true
[DHCPv4]
UseDomains=true

nano /etc/systemd/network/eth0.network

[Match]
Name=eth0
[Network]
  Address=192.168.0.210/24
  Gateway=192.168.0.254
  DNS=192.168.0.254

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0@if11: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc noqueue state UP group default qlen 1000
    link/ether 00:16:3e:20:10:f5 brd ff:ff:ff:ff:ff:ff link-netnsid 0
    inet 192.168.0.210/24 brd 192.168.0.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 2a01:e34:eebf:5660:216:3eff:fe20:10f5/64 scope global dynamic mngtmpaddr noprefixroute 
       valid_lft 86397sec preferred_lft 86397sec
    inet6 fe80::216:3eff:fe20:10f5/64 scope link 
       valid_lft forever preferred_lft forever

#  This file is part of systemd.
#
#  systemd is free software; you can redistribute it and/or modify it
#  under the terms of the GNU Lesser General Public License as published by
#  the Free Software Foundation; either version 2.1 of the License, or
#  (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See resolved.conf(5) for details

[Resolve]
# Some examples of DNS servers which may be used for DNS= and FallbackDNS=:
# Cloudflare: 1.1.1.1 1.0.0.1 2606:4700:4700::1111 2606:4700:4700::1001
# Google:     8.8.8.8 8.8.4.4 2001:4860:4860::8888 2001:4860:4860::8844
# Quad9:      9.9.9.9 2620:fe::fe
#DNS=
#FallbackDNS=
#Domains=
#DNSSEC=no
#DNSOverTLS=no
#MulticastDNS=yes
#LLMNR=yes
#Cache=yes
#DNSStubListener=yes
#DNSStubListenerExtra=
#ReadEtcHosts=yes
#ResolveUnicastSingleLabel=no

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/lxcbullseye

ssh-copy-id -i ~/.ssh/lxcbullseye.pub lxcyan@192.168.0.210 

ssh lxcyan@192.168.0.210

sudo nano /etc/ssh/sshd_config 

sudo systemctl restart sshd

ssh -p 55210 -i ~/.ssh/lxcbullseye lxcyan@192.168.0.210

sudo usermod -a -G systemd-journal $USER

sudo apt install netcat-openbsd rsync curl tmux jq figlet git dnsutils wget tree iptables lsof rsync -y

sudo rm /etc/motd &&  sudo nano /etc/motd

     _       _     _               _  _            
  __| | ___ | |__ (_) __ _  _ _   / |/ |           
 / _` |/ -_)| '_ \| |/ _` || ' \  | || |           
 \__,_|\___||_.__/|_|\__,_||_||_| |_||_|           
  _           _           _  _                     
 | |__ __ __ | |__  _  _ | || | ___ ___  _  _  ___ 
 | |\ \ // _|| '_ \| || || || |(_-</ -_)| || |/ -_)
 |_|/_\_\\__||_.__/ \_,_||_||_|/__/\___| \_, |\___|
                                         |__/      

mkdir -p $HOME/{media,scripts}

exit

# LXC lxcbullseye dossiers partagés
/srv/media /var/lib/lxc/lxcbullseye/rootfs/home/lxcyan/media  none bind 0 0
/home/yann/scripts /var/lib/lxc/lxcbullseye/rootfs/home/lxcyan/scripts  none bind 0 0

sudo groupadd -g 985 utilisateurs

sudo usermod -aG utilisateurs $USER

uid=1000(lxcyan) gid=1000(lxcyan) groupes=1000(lxcyan),101(systemd-journal),985(utilisateurs)

echo "lxc.start.auto = 1" >> /var/lib/lxc/lxcbullseye/config
systemctl restart lxc@lxcbullseye.service

nano /etc/systemd/system/lxc-autostart.service

[Unit]
Description=Lxc-autostart service
Requires=lxc-net.service
After=lxc-net.service

[Service]
Type=oneshot
ExecStart=/usr/bin/lxc-autostart
ExecStop=/usr/bin/lxc-autostart -s
RemainAfterExit=1

[Install]
WantedBy=multi-user.target

systemctl daemon-reload

systemctl restart lxc-autostart.service
systemctl enable lxc-autostart.service

systemctl status lxc-autostart.service

● lxc-autostart.service - Lxc-autostart service
     Loaded: loaded (/etc/systemd/system/lxc-autostart.service; enabled; vendor preset: disabled)
     Active: active (exited) since Fri 2022-06-24 16:24:33 CEST; 1min 47s ago
TriggeredBy: ● lxc-autostart.timer
   Main PID: 28494 (code=exited, status=0/SUCCESS)
        CPU: 8ms

juin 24 16:24:33 archyan systemd[1]: Starting Lxc-autostart service...
juin 24 16:24:33 archyan systemd[1]: Finished Lxc-autostart service.

/var/lib/lxc/
└── lxcbullseye
    ├── config
    └── rootfs
        ├── bin -> usr/bin
        ├── boot
        ├── dev
        ├── etc
        ├── home
        ├── lib -> usr/lib
        ├── lib32 -> usr/lib32
        ├── lib64 -> usr/lib64
        ├── libx32 -> usr/libx32
        ├── media
        ├── mnt
        ├── opt
        ├── proc
        ├── root
        ├── run
        ├── sbin -> usr/sbin
        ├── srv
        ├── sys
        ├── tmp
        ├── usr
        └── var

du -hsx --exclude=/var/lib/lxc/lxcbullseye/{rootfs/home/lxcyan/media} /var/lib/lxc/lxcbullseye/*

4,0K	/var/lib/lxc/lxcbullseye/config
11G	/var/lib/lxc/lxcbullseye/rootfs

Versions Nginx OpenSSL
nginx version: nginx/1.22.0
OpenSSL 1.1.1n  15 Mar 2022

ls -l /home/lxcyan/.local/share/mkcert

mkcert 'lxcyan.local' localhost 127.0.0.1 ::1

sudo nano /etc/nginx/conf.d/lxcyan.local.conf

192.168.0.210   lxcyan lxcyan.local 

sudo apt update && sudo apt upgrade -y

sudo apt-get install ca-certificates apt-transport-https software-properties-common wget curl lsb-release -y

curl -sSL https://packages.sury.org/php/README.txt | sudo bash -x  

sudo apt update && sudo apt -y upgrade

sudo apt install php8.1 php8.1-fpm php8.1-sqlite3 php8.1-gd

PHP 8.1.8 (cli) (built: Jul 11 2022 08:55:24) (NTS)
Copyright (c) The PHP Group
Zend Engine v4.1.8, Copyright (c) Zend Technologies
    with Zend OPcache v8.1.8, Copyright (c), by Zend Technologies

   ______
  / ____/___  ____ ___  ____  ____  ________  _____
 / /   / __ \/ __ `__ \/ __ \/ __ \/ ___/ _ \/ ___/
/ /___/ /_/ / / / / / / /_/ / /_/ (__  )  __/ /
\____/\____/_/ /_/ /_/ .___/\____/____/\___/_/
                    /_/
Composer version 2.3.10 2022-07-13 15:48:23

sudo apt install mariadb-server

sudo mysql_secure_installation

nvm install --lts

npm install yarn -g

sudo usermod -aG docker ${USER}

 id lxcyan

mkcert 'lxcyan.local' 'gpx.lxcyan.local' 'fmy.lxcyan.local' localhost 127.0.0.1 ::1

sudo nano /etc/nginx/conf.d/fmy.lxcyan.local.conf

192.168.0.210   lxcyan lxcyan.local gpx.lxcyan.local fmy.lxcyan.local

sudo systemctl reload nginx

/etc/nginx/conf.d/lxcyan.d/locations.conf

location /diceware/ {

    # Path to source
    alias /home/lxcyan/media/diceware/;
    index index.html;
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		try_files $uri $uri/ =404;
}

location /osm-new/ {

    # Path to source
    alias /home/lxcyan/media/osm-new/;
    index index.html;
		# First attempt to serve request as file, then
		# as directory, then fall back to displaying a 404.
		try_files $uri $uri/ =404;
}

cd ~/media/yannstatic

source "https://rubygems.org"

# gem "github-pages", group: :jekyll_plugins
gem "jekyll-text-theme"

bundle install # Patientez ...

Bundle complete! 1 Gemfile dependency, 43 gems now installed.
Use `bundle info [gemname]` to see where a bundled gem is installed.

bundle info jekyll

  * jekyll (4.3.1)
	Summary: A simple, blog aware, static site generator.
	Homepage: https://jekyllrb.com
	Source Code: https://github.com/jekyll/jekyll
	Changelog: https://github.com/jekyll/jekyll/releases
	Bug Tracker: https://github.com/jekyll/jekyll/issues
	Path: /home/lxcyan/.rbenv/versions/3.1.2/lib/ruby/gems/3.1.0/gems/jekyll-4.3.1
	Reverse Dependencies: 
		jekyll-feed (0.17.0) depends on jekyll (>= 3.7, < 5.0)
		jekyll-sitemap (1.4.0) depends on jekyll (>= 3.7, < 5.0)
		jekyll-text-theme (2.2.6) depends on jekyll (>= 3.6, < 5.0)
		jemoji (0.13.0) depends on jekyll (>= 3.0, < 5.0)

cd ~/media/yannstatic
jekyll build

Configuration file: /home/lxcyan/media/yannstatic/_config.yml
            Source: /home/lxcyan/media/yannstatic
       Destination: /home/lxcyan/media/yannstatic/_site
 Incremental build: disabled. Enable with --incremental
      Generating... 
       Jekyll Feed: Generating feed for posts
                    done in 20.763 seconds.
 Auto-regeneration: disabled. Use --watch to enable.

mkdir -p ~/.config/systemd/user; nano ~/.config/systemd/user/yannstatic.service

systemctl --user daemon-reload
systemctl --user start yannstatic

systemctl --user status yannstatic

systemctl --user enable yannstatic

sudo loginctl enable-linger $USER

mkcert 'lxcyan.local' 'gpx.lxcyan.local' 'fmy.lxcyan.local' 'static.lxcyan.local' localhost 127.0.0.1 ::1

Created a new certificate valid for the following names 📜
 - "lxcyan.local"
 - "gpx.lxcyan.local"
 - "fmy.lxcyan.local"
 - "static.lxcyan.local"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./lxcyan.local+6.pem" and the key at "./lxcyan.local+6-key.pem" ✅

It will expire on 11 April 2025 🗓

server {
  listen  80;
  server_name static.lxcyan.local;
  return 301 https://;
}
server {
  listen *:443 ssl http2;
  server_name static.lxcyan.local;
  ssl_certificate /etc/ssl/certs/lxcyan-cert.pem;
  ssl_certificate_key /etc/ssl/private/lxcyan-key.pem;
  root /home/lxcyan/media/yannstatic/_site;
  
  location / {
    index index.htm index.html;
  }

}

sudo systemctl reload nginx

192.168.0.210   lxcyan lxcyan.local gpx.lxcyan.local fmy.lxcyan.local static.lxcyan.local

sudo nano /etc/php/8.1/fpm/pool.d/devel.conf

[devel]
listen = /run/php/php8.1-fpm-devel.sock

listen.owner = lxcyan
listen.group = www-data

user = lxcyan
group = www-data

pm = ondemand
pm.max_children = 6
pm.process_idle_timeout = 60s
pm.max_requests = 500

mkcert 'lxcyan.local' 'gpx.lxcyan.local' 'fmy.lxcyan.local' 'static.lxcyan.local' 'devel.lxcyan.local' localhost 127.0.0.1 ::1

Created a new certificate valid for the following names 📜
 - "lxcyan.local"
 - "gpx.lxcyan.local"
 - "fmy.lxcyan.local"
 - "static.lxcyan.local"
 - "devel.lxcyan.local"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./lxcyan.local+8.pem" and the key at "./lxcyan.local+8-key.pem" ✅

It will expire on 24 April 2025 🗓

server {
  listen  80;
  server_name devel.lxcyan.local;
  return 301 https://;
}
server {
  listen *:443 ssl http2;
  server_name devel.lxcyan.local;
  ssl_certificate /etc/ssl/certs/lxcyan-cert.pem;
  ssl_certificate_key /etc/ssl/private/lxcyan-key.pem;
  root /home/lxcyan/media/devel;
  
    index index.php  /_h5ai/public/index.php;
      location ~ \.php$ {
        include php_fastcgi.conf;
        fastcgi_pass unix:/run/php/php8.1-fpm-devel.sock;
    }

    fancyindex on;              # Enable fancy indexes.
    fancyindex_exact_size off;  # Output human-readable file sizes.
}

sudo systemctl reload nginx

192.168.0.210   lxcyan lxcyan.local gpx.lxcyan.local fmy.lxcyan.local static.lxcyan.local devel.lxcyan.local

sudo nano /etc/php/8.1/fpm/pool.d/dplus.conf

[dplus]
listen = /run/php/php8.1-fpm-dplus.sock

listen.owner = lxcyan
listen.group = www-data

user = lxcyan
group = www-data

pm = ondemand
pm.max_children = 6
pm.process_idle_timeout = 60s
pm.max_requests = 500

mkcert 'lxcyan.local' 'gpx.lxcyan.local' 'fmy.lxcyan.local' 'static.lxcyan.local' 'devel.lxcyan.local' 'dplus.lxcyan.local' localhost 127.0.0.1 ::1

Created a new certificate valid for the following names 📜
 - "lxcyan.local"
 - "gpx.lxcyan.local"
 - "fmy.lxcyan.local"
 - "static.lxcyan.local"
 - "devel.lxcyan.local"
 - "dplus.lxcyan.local"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./lxcyan.local+8.pem" and the key at "./lxcyan.local+8-key.pem" ✅

It will expire on 25 April 2025 🗓

server {
  listen  80;
  server_name dplus.lxcyan.local;
  return 301 https://;
}
server {
  listen *:443 ssl http2;
  server_name dplus.lxcyan.local;
  ssl_certificate /etc/ssl/certs/lxcyan-cert.pem;
  ssl_certificate_key /etc/ssl/private/lxcyan-key.pem;
  root /home/lxcyan/media/dplus;
  
    index index.php  /_h5ai/public/index.php;
      location ~ \.php$ {
        include php_fastcgi.conf;
        fastcgi_pass unix:/run/php/php8.1-fpm-dplus.sock;
    }

    fancyindex on;              # Enable fancy indexes.
    fancyindex_exact_size off;  # Output human-readable file sizes.
}

sudo systemctl reload nginx

192.168.0.210   lxcyan lxcyan.local gpx.lxcyan.local fmy.lxcyan.local static.lxcyan.local dplus.lxcyan.local

sudo nano /etc/systemd/system/calibre-web.service

[Unit]
Description=Service calibre-web
After=network.target

[Service]
Type=simple
User=lxcyan
ExecStart=/usr/bin/python3 /home/lxcyan/media/www/calibre-web/cps.py

[Install]
WantedBy=multi-user.target

sudo systemctl start calibre-web

systemctl status calibre-web

● calibre-web.service - Service calibre-web
     Loaded: loaded (/etc/systemd/system/calibre-web.service; disabled; vendor preset: enabled)
    Drop-In: /run/systemd/system/service.d
             └─zzz-lxc-service.conf
     Active: active (running) since Mon 2023-02-06 11:46:03 CET; 3s ago
   Main PID: 9433 (python3)
      Tasks: 3 (limit: 38341)
     Memory: 77.0M
        CPU: 1.580s
     CGroup: /system.slice/calibre-web.service
             └─9433 /usr/bin/python3 /home/lxcyan/media/www/calibre-web/cps.py

févr. 06 11:46:03 lxcbullseye systemd[1]: Started Service calibre-web.

sudo systemctl enable calibre-web

server {
  listen  80;
  server_name calibre.lxcyan.local;
  return 301 https://;
}
server {
  listen *:443 ssl http2;
  server_name calibre.lxcyan.local;
  ssl_certificate /etc/ssl/certs/lxcyan-cert.pem;
  ssl_certificate_key /etc/ssl/private/lxcyan-key.pem;
  root /home/lxcyan/media/yanncalibre/_site;
  
  location / { 
      proxy_pass              http://127.0.0.1:8083;
  } 

}

sudo nginx -t

sudo systemctl reload nginx

mkcert 'lxcyan.local' 'gpx.lxcyan.local' 'fmy.lxcyan.local' 'static.lxcyan.local' 'devel.lxcyan.local' 'dplus.lxcyan.local' 'calibre.lxcyan.local' localhost 127.0.0.1 ::1

Created a new certificate valid for the following names 📜
 - "lxcyan.local"
 - "gpx.lxcyan.local"
 - "fmy.lxcyan.local"
 - "static.lxcyan.local"
 - "devel.lxcyan.local"
 - "dplus.lxcyan.local"
 - "calibre.lxcyan.local"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./lxcyan.local+9.pem" and the key at "./lxcyan.local+9-key.pem" ✅

It will expire on 6 May 2025 🗓

[Unit]
Description=Navidrome Music Server and Streamer compatible with Subsonic/Airsonic
After=remote-fs.target network.target
AssertPathExists=/var/lib/navidrome

[Install]
WantedBy=multi-user.target

[Service]
User=navidrome
Group=navidrome
Type=simple
ExecStart=/opt/navidrome/navidrome --configfile "/var/lib/navidrome/navidrome.toml"
WorkingDirectory=/var/lib/navidrome
TimeoutStopSec=20
KillMode=process
Restart=on-failure

# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
DevicePolicy=closed
NoNewPrivileges=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
ReadWritePaths=/var/lib/navidrome

# You can uncomment the following line if you're not using the jukebox This
# will prevent navidrome from accessing any real (physical) devices
#PrivateDevices=yes

# You can change the following line to `strict` instead of `full` if you don't
# want navidrome to be able to write anything on your filesystem outside of
# /var/lib/navidrome.
ProtectSystem=full

# You can uncomment the following line if you don't have any media in /home/*.
# This will prevent navidrome from ever reading/writing anything there.
#ProtectHome=true

# You can customize some Navidrome config options by setting environment variables here. Ex:
#Environment=ND_BASEURL="/navidrome"

ssh -L 9500:localhost:4533 lxcyan@192.168.0.210 -p 55210 -i /home/yann/.ssh/lxcbullseye

sudo systemctl enable navidrome.service

mkcert 'lxcyan.local' 'gpx.lxcyan.local' 'fmy.lxcyan.local' 'static.lxcyan.local' 'devel.lxcyan.local' 'dplus.lxcyan.local' 'calibre.lxcyan.local' 'zic.lxcyan.local' localhost 127.0.0.1 ::1

Created a new certificate valid for the following names 📜
 - "lxcyan.local"
 - "gpx.lxcyan.local"
 - "fmy.lxcyan.local"
 - "static.lxcyan.local"
 - "devel.lxcyan.local"
 - "dplus.lxcyan.local"
 - "calibre.lxcyan.local"
 - "zic.lxcyan.local"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./lxcyan.local+10.pem" and the key at "./lxcyan.local+10-key.pem" ✅

It will expire on 20 May 2025 🗓

server {
  listen  80;
  server_name zic.lxcyan.local;
  return 301 https://;
}
server {
  listen *:443 ssl http2;
  server_name zic.lxcyan.local;
  ssl_certificate /etc/ssl/certs/lxcyan-cert.pem;
  ssl_certificate_key /etc/ssl/private/lxcyan-key.pem;
  root /home/lxcyan/media/yannzic/_site;
  
  location / { 
      proxy_pass              http://127.0.0.1:4533;
  } 

}

sudo nginx -t

sudo systemctl reload nginx

192.168.0.210   lxcyan lxcyan.local gpx.lxcyan.local fmy.lxcyan.local static.lxcyan.local devel.lxcyan.local dplus.lxcyan.local calibre.lxcyan.local zic.lxcyan.local

mkcert 'lxcyan.local' 'gpx.lxcyan.local' 'fmy.lxcyan.local' 'static.lxcyan.local' 'devel.lxcyan.local' 'dplus.lxcyan.local' 'calibre.lxcyan.local' 'traduction.lxcyan.local' 'traduction.lxcyan.local' localhost 127.0.0.1 ::1

Created a new certificate valid for the following names 📜
 - "lxcyan.local"
 - "gpx.lxcyan.local"
 - "fmy.lxcyan.local"
 - "static.lxcyan.local"
 - "devel.lxcyan.local"
 - "dplus.lxcyan.local"
 - "calibre.lxcyan.local"
 - "traduction.lxcyan.local"
 - "traduction.lxcyan.local"
 - "localhost"
 - "127.0.0.1"
 - "::1"

The certificate is at "./lxcyan.local+11.pem" and the key at "./lxcyan.local+11-key.pem" ✅

It will expire on 24 May 2025 🗓

server {
  listen  80;
  server_name traduction.lxcyan.local;
  return 301 https://;
}
server {
  listen *:443 ssl http2;
  server_name traduction.lxcyan.local;
  ssl_certificate /etc/ssl/certs/lxcyan-cert.pem;
  ssl_certificate_key /etc/ssl/private/lxcyan-key.pem;
  
  location / { 
      proxy_pass              http://127.0.0.1:5000;
  } 

}

sudo nginx -t

sudo systemctl reload nginx

192.168.0.210   lxcyan lxcyan.local gpx.lxcyan.local fmy.lxcyan.local static.lxcyan.local devel.lxcyan.local dplus.lxcyan.local calibre.lxcyan.local zic.lxcyan.local traduction.lxcyan.local

sudo nano /etc/systemd/system/media_yannstatic_site.path

sudo nano /etc/systemd/system/media_yannstatic_site.service

sudo systemctl enable media_yannstatic_site.path
sudo systemctl start media_yannstatic_site.path

sudo journalctl -f -u media_yannstatic_site.service

-- Logs begin at Sun 2020-08-09 13:26:16 UTC, end at Sun 2020-08-09 15:40:10 UTC. --
Aug 09 15:40:10 lxcbuster systemd[1]: Started "Rsync local distant".

~/.local/share/applications/lxcyan-yannstatic.desktop

[Desktop Entry]
Version=1.1
Type=Application
Name=Static-synchro (lxcyan-synchro-site.sh)
Comment=tmux-lxc.sh
Icon=xterm-color_48x48
Exec=xterm -rv -geometry 150x40+100+150 -T lxcyan-yannstatic -e '/home/yann/scripts/lxcyan-yannstatic.sh'
Actions=
Categories=Utility;
Path=
Terminal=false
StartupNotify=false

~/scripts/lxcyan-yannstatic.sh

chmod +x scripts/lxcyan-yannstatic.sh