This file describes the commands to configure a new server. Check IPv4 & IPv6 of the server. If needed, activate [IPv6](IPv6). ## Base packages ``` apt update && apt upgrade apt dist-upgrade # make sure we have the latest LTS: https://wiki.debian.org/DebianUpgrade apt update && apt install sudo nmap curl wget git lynx htop man cron \ fail2ban unattended-upgrades apt-listchanges \ unzip \ mailutils moreutils ``` ## Configure hostname See this [config guide](https://linuxhandbook.com/debian-change-hostname/). Basically, run: `hostnamectl set-hostname ` ## Create users Add users: ``` adduser toto adduser toto sudo ``` Don't user useraddd as it will not create the user `home/` dir. ## Configure the ssh server Set the following parameter in file `/etc/ssh/sshd_config.d/30-cloud-girofle.conf`: `PermitRootLogin no` And restart the ssh service: `systemctl restart ssh` ## Nginx See `./scripts/init_nginx.sh` For Nextcloud purposes, make sure that APCu (caching) is enabled (see [this post](https://blog.cinquantehuit.org/gcc/2021/07/corriger-un-probleme-de-cache-apcu-pour-php-cli-apres-la-mise-a-jour-nextcloud-21/) Si il doit y avoir beaucoup de connexions au socket PHP, on peut atteindre la limite système, il faut [suivre cette page](https://serverfault.com/a/1029488). En gros : Ajouter à `/etc/sysctl.conf` les lignes suivantes : ``` net.core.somaxconn = 2000 # nombre max de connexions simultanées à un socket net.core.netdev_max_backlog = 6553 # nombre max de connexions en attente ``` Puis appliquer la configuration `sysctl -p` (et redémarrer `php-fpm`) ## Setup backups See [borg](borg.md) ## Setup mail - Configure the SPF DNS field (in Gandi) - Setup (in Kimsufi) the reverse-DNS entry - Install & configure postfix: `apt install postfix` (select "Internet site" in the wizard). Put the right domain name. Test & enjoy. - You can add the following lines to `/etc/postfix/main.cf` to be notified of mails in error: ``` # Girofle notify_classes=resource,software,bounce bounce_notice_recipient=root@localhost 2bounce_notice_recipient=root@localhost ``` - Configure the [redirection](https://blog.bobbyallen.me/2013/02/03/how-to-redirect-local-root-mail-to-an-external-email-address-on-linux/) to technique@chif.fr using `/etc/aliases`. It is important to run both `newaliases` AND to restart postfix. ## OnlyOffice **/!\ THIS IS IMPORTANT**. If you install fail2ban and want to run a Nextcloud instance on the current server, you need to make sure that you *whitelist* the IP of the OnlyOffice server (chif.fr in our current case) so that it does not get blacklisted. Edit `/etc/fail2ban/jail.conf` and replace the `#ignoreip` line with: ``` ignoreip = 2001:41d0:1:769d::1 91.121.67.157 #chif IP ``` Do not forget to restart fail2ban: ```sudo service fail2ban restart``` ## Setup monitoring **TODO**