Rijk: 1 revision imported

2025-01-05T14:34:03Z

1 revision imported

← Older revision	Revision as of 14:34, 5 January 2025
(No difference)

Rijk: /* Disable sleep */

2023-12-04T10:17:57Z

Disable sleep

New page

== Base System ==
* Put disk from [[ProBook 6550b]] and run !

== Force https on Apache ==

Enable rewrite:
root@paardenpad:~# a2enmod rewrite-

Create rewrite rule:
root@paardenpad:~# cat /var/www/html/.htaccess
RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

== Use basic auth on proxied service ==

https://stackoverflow.com/questions/5011102/apache-reverse-proxy-with-basic-authentication

<Location /my-service>
Order deny,allow
Allow from all
Authtype Basic
Authname "Password Required"
AuthUserFile /etc/apache2/.htpasswd
Require valid-user
</Location>

== Https on Apache with Let's Encrypt ==

* Open port 80 on Fritz!box
* Redirect all traffic to https

root@paardenpad:~# vim /var/www/html/.htaccess

RewriteEngine On
RewriteCond %{HTTPS} !=on
RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R,L]

* Install certbot
root@paardenpad:~# sudo apt-get install certbot python-certbot-apache

* Get a certificate
root@paardenpad:~# certbot certonly --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
Enter email address (used for urgent renewal and security notices) (Enter 'c' to
cancel): r.oosterhoff@rijkenmiel.nl

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Please read the Terms of Service at
https://letsencrypt.org/documents/LE-SA-v1.2-November-15-2017.pdf. You must
agree in order to register with the ACME server at
https://acme-v02.api.letsencrypt.org/directory
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(A)gree/(C)ancel: A

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Would you be willing to share your email address with the Electronic Frontier
Foundation, a founding partner of the Let's Encrypt project and the non-profit
organization that develops Certbot? We'd like to send you email about our work
encrypting the web, EFF news, campaigns, and ways to support digital freedom.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
(Y)es/(N)o: Y
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated) (Enter 'c' to cancel): paardenpad.rijkenmiel.nl
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for paardenpad.rijkenmiel.nl
Waiting for verification...
Cleaning up challenges
Failed authorization procedure. paardenpad.rijkenmiel.nl (http-01): urn:ietf:params:acme:error:connection :: The server could not connect to the client to verify the domain :: Fetching http://paardenpad.rijkenmiel.nl/.well-known/acme-challenge/C0cG7hhtZz0gjjm9KUkzW92acsgM0QPXCZRUzbrqAV4: Timeout during connect (likely firewall problem)

IMPORTANT NOTES:
- The following errors were reported by the server:

Domain: paardenpad.rijkenmiel.nl
Type: connection
Detail: Fetching
http://paardenpad.rijkenmiel.nl/.well-known/acme-challenge/C0cG7hhtZz0gjjm9KUkzW92acsgM0QPXCZRUzbrqAV4:
Timeout during connect (likely firewall problem)

To fix these errors, please make sure that your domain name was
entered correctly and the DNS A/AAAA record(s) for that domain
contain(s) the right IP address. Additionally, please check that
your computer has a publicly routable IP address and that no
firewalls are preventing the server from communicating with the
client. If you're using the webroot plugin, you should also verify
that you are serving files from the webroot path you provided.
- Your account credentials have been saved in your Certbot
configuration directory at /etc/letsencrypt. You should make a
secure backup of this folder now. This configuration directory will
also contain certificates and private keys obtained by Certbot so
making regular backups of this folder is ideal.
root@paardenpad:~# certbot certonly --apache
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated) (Enter 'c' to cancel): paardenpad.rijkenmiel.nl
Obtaining a new certificate
Performing the following challenges:
http-01 challenge for paardenpad.rijkenmiel.nl
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/paardenpad.rijkenmiel.nl/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/paardenpad.rijkenmiel.nl/privkey.pem
Your cert will expire on 2020-01-03. To obtain a new or tweaked
version of this certificate in the future, simply run certbot
again. To non-interactively renew *all* of your certificates, run
"certbot renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

* change content of /etc/apache2/sites-enabled/paardenpad-ssl.conf

root@paardenpad:~# vim /etc/apache2/sites-enabled/paardenpad-ssl.conf

# A self-signed (snakeoil) certificate can be created by installing
# the ssl-cert package. See
# /usr/share/doc/apache2/README.Debian.gz for more info.
# If both key and certificate are stored in the same file, only the
# SSLCertificateFile directive is needed.
SSLCertificateFile /etc/letsencrypt/live/paardenpad.rijkenmiel.nl/fullchain.pem
SSLCertificateKeyFile /etc/letsencrypt/live/paardenpad.rijkenmiel.nl/privkey.pem

== Renew Let's Encrypt certificate on Apache ==
root@paardenpad:~# certbot
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Plugins selected: Authenticator apache, Installer apache
No names were found in your configuration files. Please enter in your domain
name(s) (comma and/or space separated) (Enter 'c' to cancel): paardenpad.rijkenmiel.nl
Cert not yet due for renewal

You have an existing certificate that has exactly the same domains or certificate name you requested and isn't close to expiry.
(ref: /etc/letsencrypt/renewal/paardenpad.rijkenmiel.nl.conf)

What would you like to do?
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: Attempt to reinstall this existing certificate
2: Renew & replace the cert (limit ~5 per 7 days)
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): 2
Renewing an existing certificate
Created an SSL vhost at /etc/apache2/sites-available/000-default-le-ssl.conf
Deploying Certificate to VirtualHost /etc/apache2/sites-available/000-default-le-ssl.conf
Enabling available site: /etc/apache2/sites-available/000-default-le-ssl.conf

Please choose whether or not to redirect HTTP traffic to HTTPS, removing HTTP access.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
1: No redirect - Make no further changes to the webserver configuration.
2: Redirect - Make all requests redirect to secure HTTPS access. Choose this for
new sites, or if you're confident your site works on HTTPS. You can undo this
change by editing your web server's configuration.
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Select the appropriate number [1-2] then [enter] (press 'c' to cancel): c

- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -
Your existing certificate has been successfully renewed, and the new certificate
has been installed.

The new certificate covers the following domains:
https://paardenpad.rijkenmiel.nl

You should test your configuration at:
https://www.ssllabs.com/ssltest/analyze.html?d=paardenpad.rijkenmiel.nl
- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - -

IMPORTANT NOTES:
- Congratulations! Your certificate and chain have been saved at:
/etc/letsencrypt/live/paardenpad.rijkenmiel.nl/fullchain.pem
Your key file has been saved at:
/etc/letsencrypt/live/paardenpad.rijkenmiel.nl/privkey.pem
Your cert will expire on 2020-02-05. To obtain a new or tweaked
version of this certificate in the future, simply run certbot again
with the "certonly" option. To non-interactively renew *all* of
your certificates, run "certbot renew"
- If you like Certbot, please consider supporting our work by:

Donating to ISRG / Let's Encrypt: https://letsencrypt.org/donate
Donating to EFF: https://eff.org/donate-le

root@paardenpad:~# systemctl restart apache2

== Fail2Ban ==
apt install fail2ban -y

Leave defaults intact

== /etc/hosts ==
root@paardenpad:~# cat /etc/hosts
127.0.0.1 localhost
127.0.1.1 paardenpad.rijkenmiel.nl paardenpad

# The following lines are desirable for IPv6 capable hosts
::1 localhost ip6-localhost ip6-loopback
ff02::1 ip6-allnodes
ff02::2 ip6-allrouters

192.168.2.30 server
192.168.2.29 milight
192.168.2.25 olimex
192.168.2.54 oldie
192.168.2.22 mielsbak
192.168.2.27 luke

== /etc/crontab ==
root@paardenpad:~# cat /etc/crontab
# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# m h dom mon dow user command
17 * * * * root cd / && run-parts --report /etc/cron.hourly
25 6 * * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.daily )
47 6 * * 7 root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.weekly )
52 6 1 * * root test -x /usr/sbin/anacron || ( cd / && run-parts --report /etc/cron.monthly )

*/15 * * * * www-data php -f /var/www/html/nextcloud/cron.php >/dev/null 2>&1
* * * * * root /root/scripts/takePicture >/dev/null 2>&1

0 2 * * * rijk mysqldump --lock-tables -u nextcloud --password='ahthuShohL1i' nextcloud > /home/rijk/Documents/Backups/nc.sql
4 2 * * * rijk mysqldump --lock-tables -u mediawiki --password='twiamfhhh' mediawiki > /home/rijk/Documents/Backups/mw.sql
10 2 * * * rijk mysqldump --lock-tables -u landisplusgyr_frontend --password='shae5Yoo' landisplusgyrjhipster > /home/rijk/Documents/Backups/lpgjh.sql
12 2 * * * rijk mysqldump --lock-tables -u churchserviceplanner --password='De0oiThee7Tochai' -h 127.0.0.1 -P 3310 churchserviceplanner > /home/rijk/Documents/Backups/csp.sql
14 2 * * * rijk mysqldump --lock-tables -u alcoholusage --password='peegee0uoSah' alcoholusage > /home/rijk/Documents/Backups/au.sql
20 2 * * * root /root/scripts/setUserRights
30 2 * * * rijk /home/rijk/scripts/createDateSymlinks.py
0 4 * * * root /root/scripts/preCacheSFPG.py >> /var/log/preCacheSFPG.log

== /etc/fstab ==
root@paardenpad:~# cat /etc/fstab
# /etc/fstab: static file system information.
#
# Use 'blkid' to print the universally unique identifier for a
# device; this may be used with UUID= as a more robust way to name devices
# that works even if disks are added and removed. See fstab(5).
#
# <file system> <mount point> <type> <options> <dump> <pass>
/dev/mapper/paardenpad-root / ext4 errors=remount-ro 0 1
/dev/mapper/paardenpad-rijk /home/rijk ext4 defaults 0 2
/dev/mapper/paardenpad-miel /var/spool/burp/miels_laptop ext4 defaults 0 2
/dev/mapper/paardenpad-var /var ext4 defaults 0 2
/dev/mapper/paardenpad-virtual_machines /var/lib/libvirt/images ext4 defaults 0 2

/dev/mapper/paardenpad-swap none swap sw 0 0

/dev/sr0 /media/cdrom0 udf,iso9660 user,noauto 0 0
/dev/sdb1 /media/sdcard vfat discard,noatime,errors=remount-ro,gid=1000,uid=1000 0 2

== /etc/exports ==
root@paardenpad:~# cat /etc/exports
# /etc/exports: the access control list for filesystems which may be exported
# to NFS clients. See exports(5).
#
# Example for NFSv2 and NFSv3:
# /srv/homes hostname1(rw,sync,no_subtree_check) hostname2(ro,sync,no_subtree_check)
#
# Example for NFSv4:
# /srv/nfs4 gss/krb5i(rw,sync,fsid=0,crossmnt,no_subtree_check)
# /srv/nfs4/homes gss/krb5i(rw,sync,no_subtree_check)
#

#/home/rijk/Documents 192.168.2.36(crossmnt,rw,no_root_squash,sync,no_subtree_check) 192.168.2.50(crossmnt,rw,no_root_squash,sync,no_subtree_check) 192.168.2.41(crossmnt,rw,no_root_squash,sync,no_subtree_check)
/media/sdcard 192.168.2.0/24(crossmnt,rw,no_root_squash,sync,no_subtree_check)

== Disable sleep ==

https://wiki.debian.org/Suspend#Disable_suspend_and_hibernation

root@geitenpad:~# cat /etc/systemd/sleep.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See systemd-sleep.conf(5) for details

[Sleep]
AllowSuspend=no
AllowHibernation=no
AllowSuspendThenHibernate=no
AllowHybridSleep=no
#SuspendMode=
#SuspendState=mem standby freeze
#HibernateMode=platform shutdown
#HibernateState=disk
#HybridSleepMode=suspend platform shutdown
#HybridSleepState=disk
#HibernateDelaySec=180min

root@geitenpad:~# cat /etc/systemd/logind.conf
# This file is part of systemd.
#
# systemd is free software; you can redistribute it and/or modify it
# under the terms of the GNU Lesser General Public License as published by
# the Free Software Foundation; either version 2.1 of the License, or
# (at your option) any later version.
#
# Entries in this file show the compile time defaults.
# You can change settings by editing this file.
# Defaults can be restored by simply deleting this file.
#
# See logind.conf(5) for details.

[Login]
#NAutoVTs=6
#ReserveVT=6
#KillUserProcesses=no
#KillOnlyUsers=
#KillExcludeUsers=root
#InhibitDelayMaxSec=5
#HandlePowerKey=poweroff
#HandleSuspendKey=suspend
#HandleHibernateKey=hibernate
HandleLidSwitch=ignore
HandleLidSwitchDocked=ignore
#PowerKeyIgnoreInhibited=no
#SuspendKeyIgnoreInhibited=no
#HibernateKeyIgnoreInhibited=no
#LidSwitchIgnoreInhibited=yes
#HoldoffTimeoutSec=30s
#IdleAction=ignore
#IdleActionSec=30min
#RuntimeDirectorySize=10%
#RemoveIPC=yes
#InhibitorsMax=8192
#SessionsMax=8192
#UserTasksMax=33%

Lenovo U410 - Revision history

Rijk: 1 revision imported

Rijk: /* Disable sleep */