Contabo Debian 11 (Bullseye) xoyize.xyz

ssh root@109.123.254.249

Linux vmi1083749.contaboserver.net 5.10.0-12-amd64 #1 SMP Debian 5.10.103-1 (2022-03-07) x86_64
  _____
 / ___/___  _  _ _____ _   ___  ___
| |   / _ \| \| |_   _/ \ | _ )/ _ \
| |__| (_) | .` | | |/ _ \| _ \ (_) |
 \____\___/|_|\_| |_/_/ \_|___/\___/

Welcome!

This server is hosted by Contabo. If you have any questions or need help,
please don't hesitate to contact us at support@contabo.com.

root@vmi1083749:~# 

1: lo: <LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
    link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
    inet 127.0.0.1/8 scope host lo
       valid_lft forever preferred_lft forever
    inet6 ::1/128 scope host 
       valid_lft forever preferred_lft forever
2: eth0: <BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
    link/ether 00:50:56:48:b5:5b brd ff:ff:ff:ff:ff:ff
    altname enp0s18
    altname ens18
    inet 109.123.254.249/20 brd 109.123.255.255 scope global eth0
       valid_lft forever preferred_lft forever
    inet6 2a02:c206:2108:3749::1/64 scope global 
       valid_lft forever preferred_lft forever
    inet6 fe80::250:56ff:fe48:b55b/64 scope link 
       valid_lft forever preferred_lft forever

timedatectl set-timezone Europe/Paris

timedatectl

               Local time: Mon 2022-11-14 17:15:19 CET
           Universal time: Mon 2022-11-14 16:15:19 UTC
                 RTC time: Mon 2022-11-14 16:15:20
                Time zone: Europe/Paris (CET, +0100)
System clock synchronized: yes
              NTP service: active
          RTC in local TZ: no

dpkg-reconfigure locales

Generating locales (this might take a while)...
  en_US.UTF-8... done
  fr_FR.UTF-8... done
Generation complete.

apt install dnsmasq

# The loopback network interface
auto lo
iface lo inet loopback

# The primary network interface
auto eth0
iface eth0 inet static
    address 109.123.254.249
    netmask 255.255.240.0
    gateway 109.123.240.1
    #dns-search invalid
    #dns-nameservers 161.97.189.52 161.97.189.51
    up ip route replace 109.123.240.0/20 via 109.123.240.1 dev eth0


iface eth0 inet6 static
    address 2a02:c206:2108:3749:0000:0000:0000:0001
    netmask 64
    gateway fe80::1
    accept_ra 0
    autoconf 0
    privext 0

search contaboserver.net
nameserver 161.97.189.51
nameserver 161.97.189.52

nameserver 127.0.0.1

nameserver 80.67.169.12
nameserver 2001:910:800::12
nameserver 80.67.169.40
nameserver 2001:910:800::40

systemctl restart dnsmasq

useradd -m -d /home/ctbouser/ -s /bin/bash ctbouser

passwd ctbouser

ssh ctbouser@109.123.254.249

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/contabovps

ssh-copy-id -i ~/.ssh/contabovps.pub ctbouser@109.123.254.249

ssh ctbouser@109.123.254.249

sudo nano /etc/ssh/sshd_config

sudo systemctl restart sshd

ssh ctbouser@109.123.254.249 -p 55249 -i ~/.ssh/contabovps  

sudo apt install rsync curl tmux jq figlet git tree

sudo rm /etc/motd && sudo nano /etc/motd

            ___            _          _                            
           / __| ___  _ _ | |_  __ _ | |__  ___                    
          | (__ / _ \| ' \|  _|/ _` || '_ \/ _ \                   
           \___|\___/|_||_|\__|\__,_||_.__/\___/                   
  _   __   ___    _  ___  ____    ___  ___  _ _     ___  _ _   ___ 
 / | /  \ / _ \  / ||_  )|__ /   |_  )| __|| | |   |_  )| | | / _ \
 | || () |\_, /_ | | / /  |_ \ _  / / |__ \|_  _|_  / / |_  _|\_, /
 |_| \__/  /_/(_)|_|/___||___/(_)/___||___/  |_|(_)/___|  |_|  /_/ 
                                                                   

sudo apt install ufw

sudo ufw enable

Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup

 sudo ufw status verbose

Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip

To                         Action      From
--                         ------      ----
55249/tcp                  ALLOW IN    Anywhere                  
80/tcp                     ALLOW IN    Anywhere                  
443                        ALLOW IN    Anywhere                  
53 (DNS)                   ALLOW IN    Anywhere                  
55249/tcp (v6)             ALLOW IN    Anywhere (v6)             
80/tcp (v6)                ALLOW IN    Anywhere (v6)             
443 (v6)                   ALLOW IN    Anywhere (v6)             
53 (DNS (v6))              ALLOW IN    Anywhere (v6)             

Versions Nginx OpenSSL
nginx version: nginx/1.22.1
OpenSSL 1.1.1n  15 Mar 2022

sudo hostnamectl set-hostname xoyize.xyz
hostnamectl

   Static hostname: xoyize.xyz
         Icon name: computer-vm
           Chassis: vm
        Machine ID: 9e9b14b1d9ae21acbd3793ac63720d60
           Boot ID: 75f900123d6b48bab465343fddbf3999
    Virtualization: kvm
  Operating System: Debian GNU/Linux 11 (bullseye)
            Kernel: Linux 5.10.0-19-amd64
      Architecture: x86-64

$TTL 3600
@	IN SOA dns106.ovh.net. tech.ovh.net. (2022111412 86400 3600 3600000 300)
         IN NS     ns106.ovh.net.
         IN NS     dns106.ovh.net.
         IN MX     10 xoyize.xyz.
         IN A      109.123.254.249
         IN AAAA   2a02:c206:2108:3749::1
         IN CAA    128 issue "letsencrypt.org"
*        IN A      109.123.254.249
*        IN AAAA   2a02:c206:2108:3749::1

sudo apt install socat

cd ~
git clone https://github.com/acmesh-official/acme.sh.git
cd acme.sh
./acme.sh --install 

acme.sh --dns dns_ovh --server letsencrypt --issue --keylength ec-384 -d 'xoyize.xyz' -d '*.xoyize.xyz'

[Mon 14 Nov 2022 08:18:58 PM CET] Your cert is in: /home/ctbouser//.acme.sh/xoyize.xyz_ecc/xoyize.xyz.cer
[Mon 14 Nov 2022 08:18:58 PM CET] Your cert key is in: /home/ctbouser//.acme.sh/xoyize.xyz_ecc/xoyize.xyz.key
[Mon 14 Nov 2022 08:18:58 PM CET] The intermediate CA cert is in: /home/ctbouser//.acme.sh/xoyize.xyz_ecc/ca.cer
[Mon 14 Nov 2022 08:18:58 PM CET] And the full chain certs is there: /home/ctbouser//.acme.sh/xoyize.xyz_ecc/fullchain.cer

sudo mkdir -p /etc/ssl/private/
sudo chown $USER -R /etc/ssl/private/
acme.sh --ecc --install-cert -d 'xoyize.xyz' -d '*.xoyize.xyz' --key-file /etc/ssl/private/xoyize.xyz-key.pem --fullchain-file /etc/ssl/private/xoyize.xyz-fullchain.pem  --reloadcmd 'sudo systemctl reload nginx.service'

crontab -e

13 0 * * * "/home/ctbouser/.acme.sh"/acme.sh --cron --home "/home/ctbouser/.acme.sh" --renew-hook "/home/ctbouser/.acme.sh/acme.sh --ecc --install-cert -d 'xoyize.xyz' -d '*.xoyize.xyz' --key-file /etc/ssl/private/xoyize.xyz-key.pem --fullchain-file /etc/ssl/private/xoyize.xyz-fullchain.pem  --reloadcmd 'sudo systemctl reload nginx.service'" > /dev/null

-----BEGIN DH PARAMETERS-----
MIIBCAKCAQEA//////////+t+FRYortKmq/cViAnPTzx2LnFg84tNpWp4TZBFGQz
+8yTnc4kmz75fS/jY2MMddj2gbICrsRhetPfHtXV/WVhJDP1H18GbtCFY2VVPe0a
87VXE15/V8k1mE8McODmi3fipona8+/och3xWKE2rec1MKzKT0g6eXq8CrGCsyT7
YdEIqUuyyOP7uWrat2DX9GgdT0Kj3jlN9K5W7edjcrsZCwenyO4KbXCeAvzhzffi
7MA0BM0oNC9hkXL+nOmFg/+OTxIy7vKBg8P+OxtMb61zO7X8vC7CIAXFjvGDfRaD
ssbzSibBsu/6iGtCOGEoXJf//////////wIBAg==
-----END DH PARAMETERS-----

echo "Test envoi via postfix smtp" | mail -s "serveur contabo xoyize.xyz" desti@mail.fr

sudo usermod -a -G users $USER

sudo mkdir -p /srv/datayan

sudo chown $USER:users -R /srv/datayan

ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/hms32771

ssh -p 55178 -i /home/ctbouser/.ssh/hms32771 hmsuser@45.145.166.178

sudo apt install borgbackup

sudo useradd -d /srv/data/borg-backups -m -r -U borg

root@ouestyan:/home/ctbouser# su - borg
$ pwd
/srv/data/borg-backups
$ mkdir /srv/data/borg-backups/.ssh
# Création du fichier des clés autorisées (de chaque serveur ) pour la  sauvegarde
$ nano /srv/data/borg-backups/.ssh/authorized_keys

ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIMs2JATwIa9fPOk0gfOgm4YNIT9ZKfWwpXDamzZ5dVsh root@ouestline.xyz
ssh-ed25519 AAAAC3NzaC1lZDI1NTE5AAAAIPuVXP+pUjvedC/htJmKXamAotLESDCRqU0MOoD7vqCA root@422x.l.time4vps.cloud

sudo systemctl reload nginx

MusicFolder = "/srv/datayan/musique"
ND_PLAYLISTSPATH = "/srv/datayan/musique/Playlists"

[Unit]
Description=Navidrome Music Server and Streamer compatible with Subsonic/Airsonic
After=remote-fs.target network.target
AssertPathExists=/var/lib/navidrome

[Install]
WantedBy=multi-user.target

[Service]
User=navidrome
Group=navidrome
Type=simple
ExecStart=/opt/navidrome/navidrome --configfile "/var/lib/navidrome/navidrome.toml"
WorkingDirectory=/var/lib/navidrome
TimeoutStopSec=20
KillMode=process
Restart=on-failure

# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
DevicePolicy=closed
NoNewPrivileges=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
ReadWritePaths=/var/lib/navidrome

# You can uncomment the following line if you're not using the jukebox This
# will prevent navidrome from accessing any real (physical) devices
#PrivateDevices=yes

# You can change the following line to `strict` instead of `full` if you don't
# want navidrome to be able to write anything on your filesystem outside of
# /var/lib/navidrome.
ProtectSystem=full

# You can uncomment the following line if you don't have any media in /home/*.
# This will prevent navidrome from ever reading/writing anything there.
#ProtectHome=true

# You can customize some Navidrome config options by setting environment variables here. Ex:
#Environment=ND_BASEURL="/navidrome"

ssh -L 9500:localhost:4533 ctbouser@109.123.254.249 -p 55249 -i /home/yann/.ssh/contabovps

sudo nginx -t
sudo systemctl reload nginx

general:

    instance_name : "XoSearx" # displayed name

ui:
    theme_args :
        oscar_style : logicodev-dark # default style of oscar
    results_on_new_tab: True  # Open result links in a new tab by default

# supprimer la ligne 'disabled : True' des éléments ci dessous ou positionner 'disabled : False'

  - name : ddg definitions
    engine : duckduckgo_definitions
    shortcut : ddd
    weight : 2

  - name : duckduckgo
    engine : duckduckgo
    shortcut : ddg

  - name : duckduckgo images
    engine : duckduckgo_images
    shortcut : ddi
    timeout: 3.0

  - name : startpage
    engine : startpage
    shortcut : sp
    timeout : 6.0
    disabled : False
    additional_tests:
      rosebud: *test_rosebud

# facultatif
# ajouter ligne 'disabled : True' sur certains éléments de la liste

  - name : bing
    engine : bing
    shortcut : bi
    disabled : True

  - name : bing images
    engine : bing_images
    shortcut : bii
    disabled : True

  - name : bing news
    engine : bing_news
    shortcut : bin
    disabled : True

  - name : bing videos
    engine : bing_videos
    shortcut : biv
    disabled : True

  - name : wikidata
    engine : wikidata
    shortcut : wd
    timeout : 3.0
    weight : 2
    tests: *tests_infobox
    disabled : True

  - name : google
    engine : google
    shortcut : go
    use_mobile_ui: false
    # additional_tests:
    #   android: *test_android
    disabled : True

  - name : google images
    engine : google_images
    shortcut : goi
    # additional_tests:
    #   android: *test_android
    #   dali:
    #     matrix:
    #       query: ['Dali Christ']
    #       lang: ['en', 'de', 'fr', 'zh-CN']
    #     result_container:
    #       - ['one_title_contains', 'Salvador']
    disabled : True

  - name : google news
    engine : google_news
    shortcut : gon
    # additional_tests:
    #   android: *test_android
    disabled : True

  - name : google videos
    engine : google_videos
    shortcut : gov
    # additional_tests:
    #   android: *test_android
    disabled : True

  - name : google scholar
    engine : google_scholar
    shortcut : gos
    disabled : True

curl --location --verbose --head --insecure localhost:8888

*   Trying 127.0.0.1:8888...
* Connected to localhost (127.0.0.1) port 8888 (#0)
> GET / HTTP/1.1
> Host: localhost:8888
> User-Agent: curl/7.74.0
> Accept: */*
> 
* Mark bundle as not supporting multiuse
* HTTP 1.0, assume close after body
< HTTP/1.0 200 OK
[...]

ssh -L 9500:localhost:8888 ctbouser@109.123.254.249 -p 55249 -i /home/yann/.ssh/contabovps

sudo -H ln -s /etc/uwsgi/apps-available/searx.ini /etc/uwsgi/apps-enabled/

ssh -L 9500:localhost:8888 ctbouser@109.123.254.249 -p 55249 -i /home/yann/.ssh/contabovps  

sudo nginx -t
sudo systemctl reload nginx

sudo systemctl stop transmission-daemon.service

"download-dir": "/srv/transmission/completed",
"incomplete-dir": "/srv/transmission/progress",

"rpc-authentication-required": true, // Activation de l’auth par mot de passe
"rpc-url": "/",
"rpc-bind-address": "0.0.0.0", // 127.0.0.1 pour écouter en local
"rpc-enabled": true, // Activation de l’interface web
"rpc-password": "MOT_DE_PASSE", // Tapez votre mot de passe, il sera salé au reload
"rpc-port": 9091, // Port d’écoute
"rpc-url": "/transmission/", // Correspond à l’URL d’accès
"rpc-username": "UTILISATEUR", // Nom d’utilisateur pour l’auth
"rpc-host-whitelist": "",
"rpc-host-whitelist-enabled": false,
"rpc-whitelist": "127.0.0.1", // IPs à whitelist
"rpc-whitelist-enabled": true, // Activation de la whitelist

# en fin de fichier
    "utp-enabled": true,
    "watch-dir": "/srv/transmission/watched",
    "watch-dir-enabled": true
}

    "rpc-authentication-required": true,
    "rpc-password": "Mot de passe utilisateur",
    "rpc-username": "yako",

net.ipv4.ping_group_range="0 2147483647"

sysctl net.ipv4.ping_group_range="0 2147483647"