Precision 7540

Base System

Install Debian Gnome on preconfigured luks/lvm disk:

1. Use Expert Install from the netinst ISO.
2. Select rescue-mode in "Load installer components from installation media" step.
3. Before the "Partition disks" step, select "Execute a shell".
4. Use cryptsetup open on your LVM partition. Use lvs to confirm that your logical volumes are visible.
5. Exit the shell and select "Partition disks". Use manual partitioning and mount the right LVs at /, /home, and swap.
6. Proceed with the remaining installation steps, but stop before "Finish the installation".
7. Go to "Execute a shell" again and edit /target/etc/crypttab to unlock your LUKS partition on boot.
8. Exit the shell and select "Finish the installation".

Ad 7: The UUID must be filled, I used this command:

cryptsetup luksDump /dev/sda3 | grep -F UUID >> /target/etc/crypttab

Then I edited the file:

nano /target/etc/crypttab

cat /target/etc/crypttab
sda3_crypt UUID=[UUID from luksDump] none luks,discard

I also had to do:

update-initramfs -u -k all

https://www.reddit.com/r/debian/comments/1599rkt/how_to_reinstall_debian_12_with_existing/

Add users

Add users miel, oosterhoff and multimedia

useradd -d /home/oosterhoff -g 1003 -m -l -r -s /usr/sbin/nologin -u 1003 oosterhoff

Colored prompt and .bashrc

• Add following to /etc/profile:

if [ "$SHELL" = "/bin/bash" ]; then
  if [ -f ~/.bashrc ]; then
    . ~/.bashrc
  fi
fi

• Add following to /root/.bashrc and /home/rijk/.bashrc:

PS1='${debian_chroot:+($debian_chroot)}\[\033[01;32m\]\u@\h\[\033[00m\]:\[\033[01;34m\]\w\[\033[00m\]\$ '

####################################################################
#####  Colored man pages   #########################################
####################################################################
export LESS_TERMCAP_mb=$'\e[1;32m'
export LESS_TERMCAP_md=$'\e[1;32m'
export LESS_TERMCAP_me=$'\e[0m'
export LESS_TERMCAP_se=$'\e[0m'
export LESS_TERMCAP_so=$'\e[01;33m'
export LESS_TERMCAP_ue=$'\e[0m'
export LESS_TERMCAP_us=$'\e[1;4;31m'

####################################################################
#####  Eternal bash history  #######################################
####################################################################
# Undocumented feature which sets the size to "unlimited".
# https://stackoverflow.com/questions/9457233/unlimited-bash-history
export HISTFILESIZE=
export HISTSIZE=
export HISTTIMEFORMAT="%d-%m-%Y %H:%M:%S "
# Change the file location because certain bash sessions truncate .bash_history file upon close.
# http://superuser.com/questions/575479/bash-history-truncated-to-500-lines-on-each-login
export HISTFILE=~/.bash_eternal_history

alias ls='ls --color=auto'
alias la='ls -la'
alias ll='ls -l'
alias bat='bat -P'

export EDITOR=vim

Prevent sleep

sudo systemctl mask sleep.target suspend.target hibernate.target hybrid-sleep.target

But also: https://geitenpad.rijkenmiel.nl/mediawiki/index.php/Lenovo_U410#Disable_sleep

NTP

sudo nala install ntp

That's it, but very important for Authelia

LAMP

nala install mariadb-server mariadb-client
nala install apache2 apache2-utils
nala install ufw
ufw allow http
nala install php libapache2-mod-php php-cli php-fpm php-json php-pdo php-mysql php-zip php-gd php-mbstring php-curl php-xml php-pear php-bcmath

mysql_secure_installation

   Switch to unix_socket authentication [Y/n]. y
   Set root password? [Y/n]. n
   Remove anonymous users? [Y/n]. y
   Disallow root login remotely? [Y/n]. y
   Remove test database and access to it? [Y/n]. y
   Reload privilege tables now? [Y/n]. y

Add db user admin:

GRANT ALL PRIVILEGES ON *.* TO 'admin'@localhost IDENTIFIED BY 'password1';

See: https://wiki.debian.org/LaMp

Later we removed this, we are going full docker style!

Services

root@Geitenpad:~# nala install docker docker-compose git
root@Geitenpad:~# systemctl enable --now docker
root@Geitenpad:~# usermod -aG docker rijk

rijk@Geitenpad:~$ mkdir -p Development/git
rijk@Geitenpad:~$ cd Development/git/
rijk@Geitenpad:~/Development/git$ git clone git@gitlab.com:raginggoblin/docker-containers.git

root@Geitenpad:/etc/docker# cat daemon.json 
{ "dns" : [ "9.9.9.9" , "149.112.112.112" ] }

Wireguard

root@Geitenpad:/etc/wireguard# cat wg1.conf 
[Interface]
Address = 192.168.1.2/32 
ListenPort = 51820
PrivateKey = UEClTEblGB0/DBO9VYa7DM6MRiRHOPt3nxlqTL/JykM=

PreUp = sysctl -w net.ipv4.ip_forward=1
PreUp = iptables -t mangle -A PREROUTING -i wg1 -j MARK --set-mark 0x30
PreUp = iptables -t nat -A POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PreUp = iptables -A FORWARD -i wg1 -o eno1 -j ACCEPT
PreUp = iptables -A FORWARD -i eno1 -o wg1 -j ACCEPT

PostDown = iptables -t mangle -D PREROUTING -i wg1 -j MARK --set-mark 0x30
PostDown = iptables -t nat -D POSTROUTING ! -o wg1 -m mark --mark 0x30 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg1 -o eth0 -j ACCEPT
PostDown = iptables -D FORWARD -i eth0 -o wg1 -j ACCEPT 

[Peer]
PublicKey = UiijlLcPMu8hlce3XxHja/vFcuyt+XMH0ufVyDSDyys=
AllowedIPs = 192.168.1.3/32

[Peer]
PublicKey = GP6zja0ewQxaZc6t+Q50a40W14pSSoVKFSIFnnogaiA=
AllowedIPs = 192.168.1.4/32

crontab

# /etc/crontab: system-wide crontab
# Unlike any other crontab you don't have to run the `crontab'
# command to install the new version when you edit this file
# and files in /etc/cron.d. These files also have username fields,
# that none of the other crontabs do.

SHELL=/bin/sh
PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin

# Example of job definition:
# .---------------- minute (0 - 59)
# |  .------------- hour (0 - 23)
# |  |  .---------- day of month (1 - 31)
# |  |  |  .------- month (1 - 12) OR jan,feb,mar,apr ...
# |  |  |  |  .---- day of week (0 - 6) (Sunday=0 or 7) OR sun,mon,tue,wed,thu,fri,sat
# |  |  |  |  |
# *  *  *  *  * user-name command to be executed
17   *  * * *     root    cd / && run-parts --report /etc/cron.hourly
25   6  * * *     root    test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.daily; }
47   6  * * 7     root    test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.weekly; }
52   6  1 * *     root    test -x /usr/sbin/anacron || { cd / && run-parts --report /etc/cron.monthly; }
#

3    1    * * *   root    find /home/oosterhoff/ftp/scanner -type f -mtime +7 -exec rm {} \;
4    1    * * *   root    docker exec listmonk_db sh -c 'pg_dumpall -U listmonk -f /backups/listmonk.sql' && chown rijk:rijk /home/rijk/Backups/listmonk.sql

4    2    * * *   rijk    docker exec mediawiki-db sh -c 'mariadb-dump --lock-tables -u mediawiki -pwai8ea1TheeGhich5eengah9 mediawiki > /backups/mw.sql'
16   2    * * *   rijk    docker exec nextcloud_db_1 sh -c 'mariadb-dump -u root -pTNpRWF92tYgjB2n1Tj nextcloud > /backups/nc.sql'
18   2    * * *   rijk    docker exec plotalcohol-db sh -c 'mariadb-dump -u root -pio4tohqu6peeKiequohbahja plotalcohol > /backups/au.sql'
20   2    * * *   rijk    sqlite3 /var/homeassistent-data/home-assistant_v2.db ".dump" | sqlite3 /home/rijk/Backups/home-assistant_v2.db.dump
30   7    * * *   rijk    cp /var/thumbnailer-data/h2/thumbnailerlog.mv.db /home/rijk/Backups/

2    1    * * *   rijk    /home/rijk/Development/git/scripts/bash/RepairDatesOfSignalAttachments.sh

*/5  *  *   *   * rijk    curl https://nextcloud.geitenpad.rijkenmiel.nl/cron.php >> /dev/null