- on GUI disable wifi, and set boot to cli
- apt install iotop apache2 docker.io mariadb-server mariadb-client knockd golang jq tcpdump sqlite3 certbot iptraf
- a2enmod proxy_http
- a2enmod sslc
- a2enmod rewrite
- /etc/dhcpcd.conf : static IP naar 192.168.2.19 (192.168.2.3 wil niet, kan router al niet pingen)
- create /etc/systemd/system/iptables-setup.service => pointing to /home/pi/iptables-setup.service ==> de uptimerobot IPs zitten in eigen chain, zie verder
- echo "syntax on" > ~/.vimrc
- mysql:
create user 'piwigo_user'@'%' identified by "piwigopswd";
create database piwigo;
grant all privileges on piwigo.* to piwigo_user@'%';
- vim /etc/mysql/mariadb.conf.d/50-server.cnf => bind-address to 0.0.0.0
- go to www.computerhok.nl:8081 ==> setup dialog =: 192.168.2.19 piwigo_user piwigopswd .....
- copy all restored album folders to /appl/piwigo/config/www/gallery/galleries
- do the "Tools => Database synchronization with files" on the UI
- curl -sSL https://install.pi-hole.net | bash # ==> edit port80 to 81 in /etc/lighttpd/lighttpd.conf
- go to http://192.168.2.19:2080/admin/
- tweak the /etc/knockd.conf
- systemctl disable avahi-daemon.service
- systemctl disable avahi-daemon.sock
- remove wpa-supplicant and wireless-tools from /etc/networking
- systemctl disable wpa_supplicant
mkdir /usr/share/ca-certificates/local
vi computerhok-ca.crt. #. copy the contents in here
dpkg-reconfigure ca-certificates. # interactive, should show 1 new cert
cd /tmp
curl -LO https://golang.org/dl/go1.16.4.linux-armv6l.tar.gz
tar -xzf go1.16.4.linux-armv6l.tar.gz
mv go /usr/share/go-1.16.3
cd /usr/share
rm go
ln -s go-1.16.3 go
cd /usr/bin
rm go gofmt
ln -s /usr/share/go/bin/go go
ln -s /usr/share/go/bin/gofmt gofmt
Openssl generate signed server cert (or letsencrypt, see next chapter)#
Create the file sslreq.conf:
[req]
distinguished_name = req_distinguished_name
req_extensions = v3_req
prompt = no
[req_distinguished_name]
C = NL
ST = OV
L = Rijssen
O = computerhok
OU = computerhok-OU
CN = www.computerhok.nl
[v3_req]
keyUsage = keyEncipherment, dataEncipherment
extendedKeyUsage = serverAuth
subjectAltName = @alt_names
[alt_names]
DNS.1 = www.computerhok.nl
DNS.2 = computerhok.nl
Then edit /etc/apache2/sites-enabled/005-www.computerhok.nl.conf and adjust the SSLCertificateKeyFile and the SSLCertificateFile to the right location at /etc/letsencrypt/live/www.computerhok.nl/privkey.pem and /etc/letsencrypt/live/www.computerhok.nl/fullchain.pem
Then restart apache with systemctl restart apache2, and do not forget to close down the firewall again with /home/pi/iptables-setup.sh, check the results with iptables -vnL
The --keep-until-expiring will make sure the cert(s) will only be renewed if the expiry date is within 30 days. So we run this command weekly by saving the following in an executable file /etc/cron.weekly/letsencrypt:
echo -e "# TYPE temperature gauge\n# HELP temperature The temperature in Celsius\ntemperature 5.9" | curl --data-binary @- http://localhost:9091/metrics/job/openweather
git clone https://github.com/pi-hole/pi-hole.git
cd pi-hole/automated\ install
export PIHOLE_SKIP_OS_CHECK=true # 22.04 was officially not yet supported, but it just works
./basic-install.sh
Change /etc/lighttpd/lighttpd.conf : port to 81 # conflict with apache httpd
Set password with pihole -a -p
# This file is generated from information provided by
# the datasource. Changes to it will not persist across an instance.
# To disable cloud-init's network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
network:
ethernets:
eth0:
dhcp4: false
addresses: [192.168.2.19/24]
gateway4: 192.168.2.254
nameservers:
addresses: [8.8.8.8,8.8.4.4,192.168.2.254]
version: 2
Remove large apt packages (only for desktop pi-os, not for server install)#
Because uptimerobot has quite a list of IPs where it can come from, we want it in a separate chain:
iptables -N UPTIME-ROBOT
for H in $(curl -s https://uptimerobot.com/inc/files/ips/IPv4.txt | sed 's/\r$//'); do
/sbin/iptables -A UPTIME-ROBOT -s "${H}"/32 -j ACCEPT
done
iptables -I INPUT -j UPTIME-ROBOT
Raspberry Pi setup#
Bought a Raspberry Pi 4 model B with 2 GB memory.
Table of Contents
knockd fails on startup#
It fails because eth0 is not yet up. Boot sequence is broken, see also https://www.raspberrypi.org/forums/viewtopic.php?t=187225
Add 3 lines at the end of /lib/systemd/system/knockd.service:
And install the service as indicated by the above link.
systemctl disable knockd.service
systemctl enable knockd.service
network-wait-online-service:
[Unit] Description=Wait for Network to be Online Documentation=man:systemd.service(5) man:systemd.special(7) Conflicts=shutdown.target After=network.target Before=network-online.target [Service] Type=oneshot ExecStart= \ /bin/bash -c 'ifconfig eth0;sleep 20;ifconfig eth0' TimeoutStartSec=1min 30s [Install] WantedBy=network-online.targetBackup#
see Backup laptop and Pi
CA cert trust#
For dhmb to trust computerhok-https...
Install more recent version of golang#
Openssl generate signed server cert (or letsencrypt, see next chapter)#
Create the file sslreq.conf:
create ssl-exts.conf file:
next:
Put these files into /etc/apache2/computerhok-ssl, and make sure to append the ca.cert to the server.certLetsencrypt#
The certbot command has already been installed.
First prepare: Have the following in /etc/apache2/sites-enabled/005-www.computerhok.nl.conf
<VirtualHost *:80> ServerName www.computerhok.nl ProxyPass /wiki http://localhost:8080/wiki ProxyPassReverse /wiki http://localhost:8080/wiki RewriteEngine On Alias /.well-known/acme-challenge/ "/var/www/.well-known/acme-challenge/" RewriteRule "^/.well-known/acme-challenge/" - [L] <Directory "/var/www/.well-known/acme-challenge/"> Options Indexes MultiViews AllowOverride None Order allow,deny Allow from all </Directory> CustomLog ${APACHE_LOG_DIR}/access.log combined env=!monitorrequest LogFormat "%h %l %t %D \"%{Host}i\" \"%r\" %>s %b \"%{Referer}i\" \"%{User-Agent}i\"" combined </VirtualHost>Then create a directory named /var/www/.well-known/acme-challenge/ .
Then do a dry-run:
If this succeeds, we can do the real one, put this one in /etc/cron.weekly/certbot:
Then edit /etc/apache2/sites-enabled/005-www.computerhok.nl.conf and adjust the SSLCertificateKeyFile and the SSLCertificateFile to the right location at
/etc/letsencrypt/live/www.computerhok.nl/privkey.pem and
/etc/letsencrypt/live/www.computerhok.nl/fullchain.pem
Then restart apache with systemctl restart apache2, and do not forget to close down the firewall again with /home/pi/iptables-setup.sh, check the results with iptables -vnL
The --keep-until-expiring will make sure the cert(s) will only be renewed if the expiry date is within 30 days. So we run this command weekly by saving the following in an executable file /etc/cron.weekly/letsencrypt:
Prometheus install#
Create service file /etc/systemd/system/prometheus.service:
systemctl enable prometheus && systemctl start prometheus
Install node exporter#
Create service file /etc/systemd/system/node-exporter.service:
Install prometheus pushgateway#
See instructions here
.
curl -sLO https://github.com/prometheus/pushgateway/releases/download/v1.4.2/pushgateway-1.4.2.linux-arm64.tar.gz tar -xf pushgateway-1.4.2.linux-arm64.tar.gz cp pushgateway-1.4.2.linux-arm64/pushgateway /usr/local/bin/ # install unit file: cat > /etc/systemd/system/pushgateway.service << EOF [Unit] Description=Pushgateway Wants=network-online.target After=network-online.target [Service] User=pushgateway Group=pushgateway Type=simple ExecStart=/usr/local/bin/pushgateway \ --web.listen-address=":9091" \ --web.telemetry-path="/metrics" \ --persistence.file="/tmp/metric.store" \ --persistence.interval=5m \ --log.level="info" \ --log.format="logfmt" [Install] WantedBy=multi-user.target EOF systemctl daemon-reload systemctl start pushgatewayAdd this to /usr/local/prometheus/prometheus.yml:
- job_name: 'pushgateway' honor_labels: true static_configs: - targets: [['localhost:9091']Testing pushgateway:
And checkout http://www.computerhok.nl:9091Install Grafana#
And go to http://www.computerhok.nl:3000
Install Pihole#
Change /etc/lighttpd/lighttpd.conf : port to 81 # conflict with apache httpdSet password with pihole -a -p
Set static IP for Ubuntu 22.04:#
Create file /etc/netplan/01-network-manager-all.yaml :
# This file is generated from information provided by # the datasource. Changes to it will not persist across an instance. # To disable cloud-init's network configuration capabilities, write a file # /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following: # network: {config: disabled} network: ethernets: eth0: dhcp4: false addresses: [192.168.2.19/24] gateway4: 192.168.2.254 nameservers: addresses: [8.8.8.8,8.8.4.4,192.168.2.254] version: 2Remove large apt packages (only for desktop pi-os, not for server install)#
dpkg-query -Wf '${Installed-Size}\t${Package}\n' | sort -nSearch at the bottom which can be uninstalled, and then (sample):
Uptime Robot own iptables chain#
Because uptimerobot has quite a list of IPs where it can come from, we want it in a separate chain:
iptables -N UPTIME-ROBOT for H in $(curl -s https://uptimerobot.com/inc/files/ips/IPv4.txt | sed 's/\r$//'); do /sbin/iptables -A UPTIME-ROBOT -s "${H}"/32 -j ACCEPT done iptables -I INPUT -j UPTIME-ROBOT