Copy & paste Arch Linux x86_64 solution
from scratch.
Before you start, check the following:
Some commands must be changed by you. The keywords will start with 'your-'.
We will mark it with the words 'Input required:' above the commands.
Hit the tab key for autocompletion when typing commands.
If you're using Ethernet (cable) connection, go to Test Connection. Keep going if you want to use your WIFI.
systemctl stop dhcpcd@interface.serviceip link
Setup the wireless interface, replace the keyword 'your-interface' with the one that starts with "w" e.g. wlp2s1.
ctrl_interface=... to your interface.ip link set your-interface up
echo 'ctrl_interface=/run/wpa_supplicant' > wifi.conf
wpa_passphrase SSID passphrase >> wifi.conf
wpa_supplicant -B -i your-interface -c wifi.conf
dhcpcd -A your-interface
ping archlinux.orgIt should look like this:
PING archlinux.org (138.201.81.199) 56(84) bytes of data.
64 bytes from apollo.archlinux.org (138.201.81.199): icmp_seq=1 ttl=42 time=285 ms
64 bytes from apollo.archlinux.org (138.201.81.199): icmp_seq=2 ttl=42 time=285 ms
64 bytes from apollo.archlinux.org (138.201.81.199): icmp_seq=3 ttl=42 time=285 ms
...
stop it with:systemctl stop dhcpcd@interface where the interface name can be tab-completed.
If you have another keyboard that isn't en you can change it with the following command:
ls /usr/share/kbd/keymaps/**/*.map.gz
loadkeys your-keyboard
We will delete all partitions and add 2 new partitions.
If you have more than 1 HDD, you can use your first HDD (/dev/sda) for your /swap partition /root partition and /boot partition.
Your second HDD can be used as the /home partition.
parted -a optimal /dev/sdaprintrm 1
rm 2
rm ...mklabel msdosAdd two partitions for /boot and /root. We will use LVM on LUKS. There will be more "partitions" later.
/boot
mkpart primary ext4 5 500
toggle 1 boot
/root
mkpart primary ext4 500 100%quit
cryptsetup luksFormat --type luks2 /dev/sda2
cryptsetup open /dev/sda2 cryptlvm
pvcreate /dev/mapper/cryptlvmvgcreate myStorage /dev/mapper/cryptlvmlvcreate -L 4G myStorage -n swap
lvcreate -L 40G myStorage -n root
lvcreate -l 100%FREE myStorage -n homemkfs.ext4 /dev/myStorage/root
mkfs.ext4 /dev/myStorage/home
mkswap /dev/myStorage/swapmount /dev/myStorage/root /mnt
mkdir /mnt/home
mount /dev/myStorage/home /mnt/home
swapon /dev/myStorage/swap
cryptsetup luksFormat --type luks1 /dev/sda1cryptsetup open /dev/sda1 lvm
pvcreate /dev/mapper/lvm
vgcreate boot /dev/mapper/lvm
lvcreate -l 100%FREE boot -n boot
mkfs.ext4 /dev/boot/boot
mkdir /mnt/boot
mount /dev/boot/boot /mnt/boot
Search for your nearest mirror and put 2-3 of them on top of the list. Or just delete the lines before with ctrl + k.
nano /etc/pacman.d/mirrorlist
Check the processor type of your computer and use only one of the following command. intel-ucode OR amd-ucode? <<Note("Delete wpa_supplicant if you are using Ethernet (cable).
amd-ucode
pacstrap /mnt base base-devel openssh grub wpa_supplicant amd-ucode
intel-ucode
pacstrap /mnt base base-devel openssh grub wpa_supplicant intel-ucode
Change the GRUB_CMDLINE_LINUX="".
nano /mnt/etc/default/grubGRUB_CMDLINE_LINUX=""HDD
GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda1:lvm cryptdevice=/dev/sda2:cryptlvm root=/dev/myStorage/root resume=/dev/myStorage/swap"SSD
GRUB_CMDLINE_LINUX="cryptdevice=/dev/sda1:lvm cryptdevice=/dev/sda2:cryptlvm root=/dev/myStorage/root resume=/dev/myStorage/swap root_trim=yes"and change...
#GRUB_ENABLE_CRYPTODISK=yGRUB_ENABLE_CRYPTODISK=yGRUB_TIMEOUT=5GRUB_TIMEOUT=0
genfstab -U /mnt >> /mnt/etc/fstabnano /mnt/etc/fstabUUID=your-number /boot ext4 rw,realtime,stripe=4#UUID=your-number /boot ext4 rw,realtime,stripe=4
UUID=your-number none swap defaults,pri=2 0 0/dev/mapper/myStorage-swap none swap defaults,pri=2 0 0
mkdir /mnt/hostlvm
mount --bind /run/lvm /mnt/hostlvm
arch-chroot /mnt
ln -s /hostlvm /run/lvm
ln -sf /usr/share/zoneinfo/your-region/your-city /etc/localtime
hwclock --systohc
Choose your location. For example:en_US.UTF-8 UTF-8
nano /etc/locale.genlocale-gen
nano /etc/locale.confLANG=en_US.UTF-8
/etc/vconsole.conf
KEYMAP=your-keyboard
nano /etc/hostnamemyServer or myDesktopnano /etc/hosts127.0.0.1 localhost
127.0.1.1 myserver.localdomain myServer
dd bs=512 count=4 if=/dev/urandom of=/crypto_keyfile.bin
cryptsetup luksAddKey /dev/sda2 /crypto_keyfile.bin
chmod 000 /crypto_keyfile.bin
dd bs=512 count=4 if=/dev/urandom of=/.crypto_keyfile-boot.bin
cryptsetup luksAddKey /dev/sda1 /.crypto_keyfile-boot.bin
chmod 000 /.crypto_keyfile-boot.binsudo nano /etc/fstab/dev/boot/boot /boot ext4 rw,relatime 0 2and
sudo nano /etc/crypttabboot /dev/sda1 /.crypto_keyfile-boot.bin luks
nano /etc/mkinitcpio.confFILES=()FILES=(/crypto_keyfile.bin)HOOKS=(base udev autodetect modconf block filesystem keyboard fsck)HOOKS=(base udev autodetect keyboard keymap modconf block encrypt lvm2 resume filesystems fsck)mkinitcpio -p linux
grub-install /dev/sda
grub-mkconfig -o /boot/grub/grub.cfg
chmod -R g-rwx,o-rwx /boot
nano /etc/ssh/sshd_config#port 22
#PermitRootLogin prohibit-passwordport 22
PermitRootLogin yessystemctl enable sshd.service && systemctl start sshd.serviceip a sinet 192.168.1.76/24
Set the root password:
passwd
your-passwordexit
umount -R /mnt
reboot now -hssh root@192.168.1.76
timedatectl set-ntp true && timedatectl list-timezonesChoose your timezone and copy it.
ctrl z
timedatectl set-timezone your-location
If you're using Ethernet (cable) connection, go to Test Connection. Keep going if you want to use your WIFI.
ip link
Setup the wireless interface, replace the keyword 'your-interface' with the one that starts with "w" e.g. wlp2s1.
wpa_passphrase SSID passphrase > /etc/wpa_supplicant/wpa_supplicant-your-interface.conf
nano /etc/wpa_supplicant/wpa_supplicant-your-interface.confctrl_interface=... to your interface.# Giving configuration update rights to wpa_cli
ctrl_interface=/run/wpa_supplicant
ctrl_interface_group=wheel
update_config=1
systemctl enable wpa_supplicant@your-interface
ln -s /usr/share/dhcpcd/hooks/10-wpa_supplicant /usr/lib/dhcpcd/dhcpcd-hooks/
systemctl enable dhcpcd.servicereboot now -h
ping archlinux.orgIt should look like this:
PING archlinux.org (138.201.81.199) 56(84) bytes of data.
64 bytes from apollo.archlinux.org (138.201.81.199): icmp_seq=1 ttl=42 time=285 ms
64 bytes from apollo.archlinux.org (138.201.81.199): icmp_seq=2 ttl=42 time=285 ms
64 bytes from apollo.archlinux.org (138.201.81.199): icmp_seq=3 ttl=42 time=285 ms
...
stop it with:systemctl stop dhcpcd@interface where the interface name can be tab-completed.
useradd -m -G wheel -s /bin/bash pwoss
passwd pwoss
your-password
nano /etc/ssh/sshd_configPermitRootLogin yesPermitRootLogin noAllowUsers pwossAllowUsers pwoss underneath of PermitRootLogin no.systemctl restart sshd.servicessh root@192.168.1.76 to ssh pwoss@192.168.1.76.
pacman -S sudo --noconfirm && visudoUncomment:
# %wheel ALL=(ALL) ALLto
%wheel ALL=(ALL) ALLsu - pwoss
(AUR-Helper)
sudo pacman -S packer git base-develEnter (default=all)cd && mkdir software && cd software && git clone https://github.com/actionless/pikaur.git && cd pikaur && makepkg -fsri --noconfirm
pikaur -S downgrade --noconfirm
sudo pacman -S cronie --noconfirm && sudo systemctl enable cronie.service && sudo systemctl start cronie.service
sudo nano /etc/environmentPaste under the lines:
export EDITOR=/usr/bin/nanoctrl + x
yes
sudo pacman -S mariadb --noconfirm && sudo mysql_install_db --user=mysql --basedir=/usr/ --ldata=/var/lib/mysql/ && sudo systemctl enable mariadb.service && sudo systemctl start mariadb.service && sudo mysql_secure_installationHit enter and set up the mysql root password (use a good password) and hit the following enter for yes.
pikaur -S seahub libselinux --noconfirmsudo useradd -m -r -d /home/seafile -s /usr/bin/nologin seafile
sudo -u seafile -s /bin/shcd && mkdir installed && wget https://s3.eu-central-1.amazonaws.com/download.seadrive.org/seafile-server_7.1.1_x86-64.tar.gz && tar -xzf seafile-server_* && mv seafile-server_* installed && cd seafile-server-* && ./setup-seafile-mysql.sh
servername = newserver
ip = your-server_ipHit enter for “8082”
Hit 1
Hit enter for “localhost” and “3306”
your-passwordHit enter for “mysql user”
Create a seafile-mysql user password:
Enter the password for mysql user "seafile": your-passwordHit enter for “[ ccnet database ]”
Hit enter for “[ seafile database ]”
Hit enter for “[ seahub database ]”
Enter through and wait until it’s done
./seafile.sh start
./seahub.sh start 8000
your-@emailaddress.com
your-password
sudo nano /etc/systemd/system/seafile.service[Unit]
Description=Seafile
# add mysql.service or postgresql.service depending on your database to the line below
After=network-online.target network.target NetworkManager-wait-online.service NetworkManager.service mariadb.service
[Service]
Type=oneshot
ExecStart=/home/seafile/seafile-server-latest/seafile.sh start
ExecStop=/home/seafile/seafile-server-latest/seafile.sh stop
RemainAfterExit=yes
User=seafile
Group=seafile
[Install]
WantedBy=multi-user.targetsudo nano /etc/systemd/system/seahub.service[Unit]
Description=Seahub
After=network-online.target network.target NetworkManager-wait-online.service NetworkManager.service seafile.service
[Service]
Type=oneshot
ExecStart=/home/seafile/seafile-server-latest/seahub.sh start
ExecStop=/home/seafile/seafile-server-latest/seahub.sh stop
RemainAfterExit=yes
User=seafile
Group=seafile
[Install]
WantedBy=multi-user.targetsudo systemctl enable seafile.service && sudo systemctl enable seahub.service
cd && cd conf && nano seafdav.confChange:
enabled = falseto
enabled = truectrl + x
yes
cd && cd seafile-server-latest && ./seafile.sh restart && ./seahub.sh restart
sudo nano /etc/nginx/sites-available/seafileChange to the server_name to your IP
server {
listen 8001;
server_name 192.168.1.141;
##################Seafile WSGI mode config##################
location / {
proxy_pass http://127.0.0.1:8000;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_http_version 1.1; # if you use http2 or you get errors in nginx like connection refused ... HTTP/1.1
proxy_read_timeout 1200s;
# used for view/edit office file via Office Online Server
client_max_body_size 0;
access_log /var/log/nginx/seahub.access.log;
error_log /var/log/nginx/seahub.error.log;
}
location /seafhttp {
rewrite ^/seafhttp(.*)$ $1 break;
proxy_pass http://127.0.0.1:8082;
client_max_body_size 0;
# This option is only available for Nginx >= 1.8.0. See more details below.
proxy_request_buffering off;
}
############################################seafdav-WSGI
location /seafdav {
proxy_pass http://127.0.0.1:8080;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Host $server_name;
proxy_set_header X-Forwarded-Proto https;
proxy_http_version 1.1;
#####################################################################
client_max_body_size 0;
proxy_connect_timeout 36000s;
proxy_read_timeout 36000s;
proxy_send_timeout 36000s;
send_timeout 36000s;
# This option is only available for Nginx >= 1.8.0. See more details below.
proxy_request_buffering off;
access_log /var/log/nginx/seafdav.access.log;
error_log /var/log/nginx/seafdav.error.log;
}
location /seafmedia {
root /home/seafile/seafile-server-latest/seahub;
}
}sudo ln -s /etc/nginx/sites-available/seafile /etc/nginx/sites-enabled/ && sudo systemctl restart nginx.service
sudo pacman -S radicale python-setuptools --noconfirm && sumkdir -p /var/lib/radicale/collections && chown -R radicale:radicale /var/lib/radicale/collections && chmod -R o= /var/lib/radicale/collections && nano /etc/systemd/system/radicale.serviceHit enter until the nano editor window pop up and add:
[Unit]
Description=A simple CalDAV (calendar) and CardDAV (contact) server
After=network.target
Requires=network.target
[Service]
ExecStart=/usr/bin/env python3 -m radicale
Restart=on-failure
User=radicale
# Deny other users access to the calendar data
UMask=0027
# Optional security settings
PrivateTmp=true
ProtectSystem=strict
ProtectHome=true
PrivateDevices=true
ProtectKernelTunables=true
ProtectKernelModules=true
ProtectControlGroups=true
NoNewPrivileges=true
ReadWritePaths=/var/lib/radicale/collections
[Install]
WantedBy=multi-user.targetctrl + x
yes
nano /etc/radicale/configChange:
# hosts = 127.0.0.1:5232hosts = 192.168.1.76:5232# type = none
type = htpasswd
# htpasswd_filename = /etc/radicale/users
htpasswd_filename = /etc/radicale/users
# htpasswd_encryption = bcrypt
htpasswd_encryption = bcrypt
# delay = 1
delay = 1
# max_connections = 20
max_connections = 20
# max_content_length = 10000000
max_content_length = 10000000
# timeout = 10
timeout = 10ctrl + x
yes
nano /etc/radicale/users
your-user and your-password to your Family Member for example.echo -e "your-user:`perl -le 'print crypt("your-password","salt")'`" >> /etc/radicale/users
...ctrl + x
yes
systemctl enable radicale && systemctl start radicale && systemctl status radicalesu - pwoss
Do everything with root.
supacman -S wireguard-tools
cd /etc/wireguard/
umask 077; wg genkey | tee privatekey | wg pubkey > publickey
Copy the private key number.
cat privatekeynano wg0.conf[Interface]
PrivateKey = <Private Key>
Address = 10.0.0.1/24, fd86:ea04:1115::1/64
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
SaveConfig = trueeth0 to your interface.
Go to clients first and follow the instructions.
Copy the publickey and presharedkey of your client.
cat /etc/wireguard/clients/phones/pinephone/publickey && cat /etc/wireguard/clients/phones/pinephone/presharedkeynano /etc/wireguard/wg0.conf[Peer]
# PinePhone
PublicKey = <client public key>
PresharedKey = <preshared key>
AllowedIPs = 10.0.0.2/32
Create clients for laptop, desktop, phones etc.. Whatever you prefer.
mkdir -p /etc/wireguard/clients/phones/pinephone/
cd /etc/wireguard/clients/phones/pinephone/
umask 077; wg genkey | tee privatekey | wg pubkey > publickey | wg genpsk > presharedkeycat privatekey && cat presharedkey && cat /etc/wireguard/publickeynano pinephone.conf[Interface]
PrivateKey = <pinephones-privatekey>
Address = 10.0.0.2/24,fd42:42:42::2/64
## Optional. Leave it like it is if you want to use your server DNS.
# DNS =
[Peer]
#Home server
PublicKey = <server public key>
PresharedKey = <preshared key>
Endpoint = <server public IP or domain>:51820
AllowedIPs = 0.0.0.0/0,::/0
Set the right permissions.
chmod -R 600 /etc/wireguard/clients/
Copy your .conf file to your device.
scp pinephone.conf dan@192.168.1.248:~/
You can also create an QR code.
pacman -S qrencodeqrencode -t ansiutf8 < pinephone.conf
If you need more clients, just follow the clients process again and add the peer to your server among your other clients.
systemctl enable wg-quick@wg0.service && systemctl start wg-quick@wg0.service
sudo pacman -S ddclient --noconfirm && sudo nano /etc/ddclient/ddclient.conf
Add following lines and change the "login=","password=", and the domain at the bottom.
For noip
protocol=dyndns2
use=web, if=eth0
server=dynupdate.no-ip.com
login=your-@emailaddress.com
password='your-password'
your-dyndns_domainsudo crontab -eadd
#######################DDClient
45 04 * * * /usr/sbin/ddclient --force
##################################
sudo pacman -S ufw --noconfirmsudo ufw allow ssh && sudo ufw allow 51820/udp && sudo ufw allow 8001/tcp && sudo ufw allow 8080/tcp && sudo ufw allow 8082/tcp && sudo ufw allow 5232/tcpy
sudo nano /etc/ufw/sysctl.confUncomment:
#net/ipv4/ip_forward=1to
net/ipv4/ip_forward=1ctrl + x
yes
sudo ufw enable && sudo systemctl enable ufw.service && sudo systemctl start ufw.service
sudo pacman -S bash-completion --noconfirm && nano ~/.bashrcif [ -f /etc/bash_completion ]; then
. /etc/bash_completion
fi
export EDITOR=/usr/bin/nano
export VISUAL=$EDITORctrl + x
yes
sudo pacman -S nginx-mainline --noconfirm && sudo nano /etc/nginx/nginx.confworker_processes 4;include sites-enabled/*; # See Server blockssudo mkdir /etc/nginx/sites-available && sudo mkdir /etc/nginx/sites-enabled && sudo systemctl enable nginx.service && sudo systemctl start nginx.service
sudo pacman -S php php-fpm php-gd php-sqlite --noconfirmsudo nano /etc/php/php-fpm.d/www.confAdd ; before the following:
;listen.owner = http
;listen.group = httpand uncomment
listen.acl_users = http
listen.acl_groups = http
Uncomment the following lines in /etc/php/php.ini: (Delete ; )
sudo nano /etc/php/php.ini
date.timezone = your-location;open_basedir =open_basedir = /srv/http/:/home/:/tmp/:/usr/share/pear/:/usr/share/webapps/...
extension=pdo_sqlite
extension=sockets
extension=sqlite3
extension=pdo_mysql
extension=mysqli
extension=gdexpose_php = Onexpose_php = Offsudo systemctl enable php-fpm.service && sudo systemctl start php-fpm.service
pikaur -S adminer --noconfirm && sudo nano /etc/nginx/sites-available/adminerserver {
listen 22322;
server_name 192.168.1.76;
root /usr/share/webapps/adminer;
# If you want to use a .htpass file, uncomment the three following lines.
#auth_basic "Admin-Area! Password needed!";
#auth_basic_user_file /usr/share/webapps/adminer/.htpass;
#access_log /var/log/nginx/adminer-access.log;
error_log /var/log/nginx/adminer-error.log;
location / {
index index.php;
try_files $uri $uri/ /index.php?$args;
}
location ~ .php$ {
include fastcgi.conf;
# fastcgi_pass localhost:9000;
fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
fastcgi_index index.php;
fastcgi_param SCRIPT_FILENAME /usr/share/webapps/adminer$fastcgi_script_name;
}
}sudo ln -s /etc/nginx/sites-available/adminer /etc/nginx/sites-enabled/ && sudo ufw allow 22322/tcp && sudo systemctl restart nginx.service
sudo pacman -S msmtp msmtp-mta --noconfirm && sudo nano /etc/msmtprc
Add and change all PwOSS, your-@emailaddress.com and your-password settings to your provider.
# Set default values for all following accounts.
defaults
auth on
tls on
tls_trust_file /etc/ssl/certs/ca-certificates.crt
logfile ~/.msmtp.log
# PwOSS
account pwoss
host smtp.pwoss.org
port 587
from your-@emailaddress.com
user your-@emailaddress.com
password your-password
# Set a default account
account default : pwossIf you want to get info/emails from your crontab add the following line:
sudo nano /usr/lib/systemd/system/cronie.serviceExecStart=/usr/bin/crond -nExecStart=/usr/bin/crond -n -m '/usr/bin/msmtp -t'sudo systemctl daemon-reload && sudo systemctl restart cronie.service
Test it:
echo "PwOSS - Server" | msmtp -a default your-@emailaddress.com
pikaur -S pi-hole-server --noconfirm && sudo nano /etc/resolvconf.conf#name_servers=127.0.0.1name_servers=127.0.0.1sudo resolvconf -usudo nano /etc/hosts192.168.1.76 pi.hole myServersudo nano /etc/nginx/nginx.conf#gzip on;gzip on;gzip_min_length 1000;
gzip_proxied expired no-cache no-store private auth;
gzip_types text/plain application/xml application/json application/javascript application/octet-stream text/css;
include /etc/nginx/conf.d/*.conf;sudo cp /usr/share/pihole/configs/nginx.example.conf /etc/nginx/sites-available/pihole && sudo nano /etc/nginx/sites-available/piholelisten 80 default_server;
listen [::]:80 default_server;
server_name _;listen 987 default_server;
listen [::]:987 default_server;
server_name 192.168.1.76; # Your server IP address fastcgi_pass 127.0.0.1:9000; fastcgi_pass unix:/run/php-fpm/php-fpm.sock;sudo ln -s /etc/nginx/sites-available/pihole /etc/nginx/sites-enabled/ && sudo nano /etc/php/php.ini:/srv/http/pihole:/run/pihole-ftl/pihole-FTL.port:/run/log/pihole/pihole.log:/run/log/pihole-ftl/pihole-FTL.log:/etc/pihole:/etc/hosts:/etc/hostname:/etc/dnsmasq.d:/proc/meminfo:/proc/cpuinfo:/sys/class/thermal/thermal_zone0/temp:/dev/null
Set a password:
pihole -a -p
your-passwordsudo nano /etc/dnsmasq.d/00-openvpn.confinterface=tun0sudo ufw allow 987/tcp && sudo ufw allow from 10.8.0.0/24sudo crontab -e#######################pihole flush logs
45 23 * * 0,3 pihole -f
################################
#######################pihole update new blocks
15 23 * * 0,3 pihole -g
################################sudo nano /etc/openvpn/server/server.conf########################Pi-hole
#push "dhcp-option DNS 192.168.1.76"
#######################################################Pi-hole
push "dhcp-option DNS 192.168.1.76" # (< change the IP to your server IP)
###############################Change the home network IP (192.168.1.0)!!
sudo ufw allow from 192.168.1.0/24sudo systemctl stop systemd-resolved.service && sudo systemctl disable systemd-resolved.service && sudo systemctl restart pihole-FTL.service && sudo systemctl restart nginx.service && sudo systemctl restart php-fpm.service
sudo pacman -S unbound expat --noconfirm && wget -O root.hints https://www.internic.net/domain/named.cache && sudo mv root.hints /etc/unbound/ && sudo mv /etc/unbound/unbound.conf /etc/unbound/unbound.conf.backup && sudo nano /etc/unbound/unbound.confAdd the following and change private-address: 192.168.1.0/16 to your IP network.
server:
# If no logfile is specified, syslog is used
# logfile: "/var/log/unbound/unbound.log"
verbosity: 0
port: 5353
do-ip4: yes
do-udp: yes
do-tcp: yes
do-daemonize: no
trust-anchor-file: trusted-key.key
# May be set to yes if you have IPv6 connectivity
do-ip6: no
# Use this only when you downloaded the list of primary root servers!
root-hints: "/etc/unbound/root.hints"
# Trust glue only if it is within the servers authority
harden-glue: yes
# Require DNSSEC data for trust-anchored zones, if such data is absent, the zone becomes BOGUS
harden-dnssec-stripped: yes
# Don't use Capitalization randomization as it known to cause DNSSEC issues sometimes
# see https://discourse.pi-hole.net/t/unbound-stubby-or-dnscrypt-proxy/9378 for further details
use-caps-for-id: no
# Reduce EDNS reassembly buffer size.
# Suggested by the unbound man page to reduce fragmentation reassembly problems
edns-buffer-size: 1472
# TTL bounds for cache
cache-min-ttl: 3600
cache-max-ttl: 86400
# Perform prefetching of close to expired message cache entries
# This only applies to domains that have been frequently queried
prefetch: yes
# One thread should be sufficient, can be increased on beefy machines
num-threads: 1
# Ensure kernel buffer is large enough to not loose messages in traffic spikes
so-rcvbuf: 1m
# Ensure privacy of local IP ranges
private-address: 192.168.1.0/16
private-address: 10.0.0.0/8
#private-address: fd00::/8 # IPv6
#private-address: fe80::/10 # IPv6sudo systemctl enable unbound.service && sudo systemctl start unbound.servicesudo nano /etc/systemd/system/roothints.service[Unit]
Description=Update root hints for unbound
After=network.target
[Service]
ExecStart=/usr/bin/curl -o /etc/unbound/root.hints https://www.internic.net/domain/named.cachesudo nano /etc/systemd/system/roothints.timer[Unit]
Description=Run root.hints monthly
[Timer]
OnCalendar=monthly
Persistent=true
[Install]
WantedBy=timers.targetsudo systemctl enable roothints.timer && sudo systemctl start roothints.timerYou need to change the settings of your Pi-hole.
Go to http://your-server_ip:987/admin/settings.php?tab=dns and disable all DNS server on the left side and add to Custom 1 (IPv4)
127.0.0.1#5353sudo pacman -S dnscrypt-proxy && sudo nano /etc/dnscrypt-proxy/dnscrypt-proxy.tomllisten_addresses = ['127.0.0.1:53', '[::1]:53']listen_addresses = ['127.0.0.1:53000', '[::1]:53000']sudo nano /etc/unbound/unbound.conf# dnscrypt-proxy
do-not-query-localhost: no
forward-zone:
name: "."
forward-addr: ::1@53000
forward-addr: 127.0.0.1@53000sudo systemctl enable dnscrypt-proxy.service && sudo systemctl start dnscrypt-proxy.service && sudo systemctl restart unbound.service
sudo pacman -S samba --noconfirm && mkdir ~/samba && sudo nano /etc/samba/smb.conf[global]
workgroup = WORKGROUP
security = user
encrypt passwords = yes
[PwOSS - User]
comment = samba
path = /mnt/samba/
read only = no
sudo smbpasswd -a pwoss
your-passwordsudo ufw allow 139/tcp && sudo ufw allow 445/tcp && sudo systemctl enable smb.service && sudo systemctl start smb.service
pikaur -S freshrss --noconfirm && sudo nano /etc/nginx/sites-available/freshrssserver {
listen 7666; # http on port 80
# your server's url(s)
server_name 192.168.1.76; # Your server IP address
# the folder p of your FreshRSS installation
root /usr/share/webapps/freshrss/p/;
index index.php index.html index.htm;
# nginx log files
access_log /var/log/nginx/rss.access.log;
error_log /var/log/nginx/rss.error.log;
# php files handling
# this regex is mandatory because of the API
location ~ ^.+?\.php(/.*)?$ {
# fastcgi_pass 127.0.0.1:9000;
fastcgi_pass unix:/run/php-fpm/php-fpm.sock;
fastcgi_split_path_info ^(.+\.php)(/.*)$;
# By default, the variable PATH_INFO is not set under PHP-FPM
# But FreshRSS API greader.php need it. If you have a "Bad Request" error, double check this var !
fastcgi_param PATH_INFO $fastcgi_path_info;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
}
location / {
try_files $uri $uri/ index.php;
}
}sudo ufw allow 7666/tcp && sudo nano /etc/php/php.iniAdd:
/var/lib/webapps/freshrss/
behind
open_basedir = ....:
and uncomment:
;extension=gmpextension=gmpsudo ln -s /etc/nginx/sites-available/freshrss /etc/nginx/sites-enabled/sudo systemctl restart php-fpm.service && sudo systemctl restart nginx
mysql -u root -p
your-password
CREATE DATABASE FreshRSS;
CREATE USER 'FreshRSS'@'localhost' IDENTIFIED BY 'your-password';
GRANT ALL ON FreshRSS.* TO 'FreshRSS'@'localhost';
FLUSH PRIVILEGES;
exitDatabase = FreshRSS
Database USER = FreshRSS
Password = your-password
sudo crontab -e#######################FreshRSS Updates
0 */3 * * * php -f /usr/share/webapps/freshrss/app/actualize_script.php > /tmp/FreshRSS.log 2>&1
################################
sudo pacman -S python2-virtualenv --noconfirm && cd && cd software && git clone https://github.com/mozilla-services/syncserver.git && cd syncserver && make build
mysql -u root -p
your-password
CREATE DATABASE ffsync;
CREATE USER 'ffsync'@'localhost' IDENTIFIED BY 'your-password';
GRANT ALL ON ffsync.* TO 'ffsync'@'localhost';
FLUSH PRIVILEGES;
exitnano syncserver.ini#sqluri = sqlite:////tmp/syncserver.db
sqluri = pymysql://ffsync:your-password@localhost:3306/ffsyncpublic_url = http://192.168.1.76:5000/crontab -e#####################ffsync
@reboot sleep 120 && cd /home/pwoss/software/syncserver/ && make serve
##########################################sudo ufw allow 5000/tcpcd && cd /home/pwoss/software/syncserver/ && make serveIt work's! Should be the answer!ctrl + c
To cancel the action.
To configure desktop Firefox to talk to your new Sync server, go to “about:config”, search for “identity.sync.tokenserver.uri” and change its value to the URL of your server with a path of “token/1.0/sync/1.5”:
Alternatively, if you’re running your own Firefox Accounts server, and running Firefox 52 or later, see the documentation on how to Run your own Firefox Accounts Server for how to configure your client for both Sync and Firefox Accounts with a single preference.
Since Firefox 33, Firefox for Android has supported custom sync servers. To configure Android Firefox 44 and later to talk to your new Sync server, just set the “identity.sync.tokenserver.uri” exactly as above before signing in to Firefox Accounts and Sync on your Android device.
Important: after creating the Android account, changes to “identity.sync.tokenserver.uri” will be ignored. (If you need to change the URI, delete the Android account using the Settings > Sync > Disconnect... menu item, update the pref, and sign in again.) Non-default TokenServer URLs are displayed in the Settings > Sync panel in Firefox for Android, so you should be able to verify your URL there.
Prior to Firefox 44, a custom add-on was needed to configure Firefox for Android. For Firefox 43 and earlier, see the blog post How to connect Firefox for Android to self-hosted Firefox Account and Firefox Sync servers.
(Prior to Firefox 42, the TokenServer preference name for Firefox Desktop was “services.sync.tokenServerURI”. While the old preference name will work in Firefox 42 and later, the new preference is recommended as the old preference name will be reset when the user signs out from Sync causing potential confusion.)
You should periodically update your code to make sure you’ve got the latest fixes. The following commands will update syncserver in place:
cd /home/pwoss/software/syncserver
$ git stash # to save any local changes to the config file
$ git pull # to fetch latest updates from github
$ git stash pop # to re-apply any local changes to the config file
$ make build # to pull in any updated dependencies
ps aux | grep makekill (id number)
cd /home/pwoss/software/syncserver/ && make serve
sudo pacman -S fail2ban --noconfirm && sudo systemctl enable fail2ban.service && sudo systemctl start fail2ban.service
sudo nano /etc/motd################################################
Welcome to your PwOSS-Server
Website: https://pwoss.org
Wiki: https://wiki.pwoss.org
Git: https://git.pwoss.org
################################################
This image is based on Arch Linux | ARM
Website: http://archlinuxarm.org
Forum: http://archlinuxarm.org/forum
IRC: #archlinux-arm on irc.Freenode.net
################################################
sudo reboot now -h
Now you’re able to save your personal data on your own servers. To keep it safe against a burglar, natural disasters, hardware defects we suggest to set up the same or similar servers with a friend or family member.
ENJOY
This version of the page was edited by Dan at 2020-04-08 23:19:11. View the most recent version.