luxfi/pics
1
0
Fork 0
mirror of https://github.com/luxfi/pics.git synced 2026-07-26 21:08:58 +00:00
Code Issues Packages Projects Releases Wiki Activity

wip Freshen up installation and nginx configuration

Browse Source
This commit is contained in:
Thomas Lynch
2024-10-10 16:31:38 +11:00
parent 11f47920e0
commit 031a39e212
2 changed files with 37 additions and 24 deletions
Download Patch File Download Diff File Expand all files Collapse all files
INSTALLATION.md
+18 -6
View File
@@ -27,7 +27,7 @@
```bash
sudo apt update -y
sudo apt install curl wget libgeoip-dev gnupg ffmpeg imagemagick graphicsmagick fontconfig fonts-dejavu -y
sudo apt install curl wget libgeoip-dev gnupg ffmpeg imagemagick graphicsmagick fontconfig fonts-dejavu certbot -y
```
**3. Install MongoDB**
@@ -49,7 +49,10 @@ sudo systemctl enable --now mongod
NOTE: If at this point, mongod doesn't start or has an error, fix the permissions ([stackoverflow](https://stackoverflow.com/questions/64608581/mongodb-code-exited-status-14-failed-but-not-any-clear-errors/66107451#66107451)):
```bash
sudo mkdir -p /var/lib/mongodb
sudo mkdir -p /var/log/mongodb
sudo chown -R mongodb:mongodb /var/lib/mongodb
sudo chown -R mongodb:mongodb /var/log/mongodb
sudo chown mongodb:mongodb /tmp/mongodb-27017.sock
sudo service mongod restart
```
@@ -85,7 +88,7 @@ sudo systemctl restart mongod
```bash
sudo apt update -y
sudo apt install redis-server -y
sed -i 's/supervised no/supervised systemd/' /etc/redis/redis.conf
sudo sed -i -e 's/supervised no/supervised systemd/' -e '$!b' -e '/# supervised auto/!b' -e 's/# supervised auto/supervised auto/' -e '$!s/$/\nsupervised systemd/' /etc/redis/redis.conf
sudo systemctl enable --now redis-server
```
@@ -99,7 +102,7 @@ sudo systemctl restart redis-server
For easy installation, use [node version manager](https://github.com/nvm-sh/nvm#installing-and-updating) "nvm":
```bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.39.7/install.sh | bash
curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.1/install.sh | bash
export NVM_DIR="$HOME/.nvm"
[ -s "$NVM_DIR/nvm.sh" ] && \. "$NVM_DIR/nvm.sh"
[ -s "$NVM_DIR/bash_completion" ] && \. "$NVM_DIR/bash_completion"
@@ -165,15 +168,24 @@ Note down the .loki and .onion address for the next step.
**7. Setup nginx**
For standard installations, run `configs/nginx/nginx.sh`. This will prompt you for installation directory, domains, onion/lokinet, enable geoip, install a letsencrypt certificate with certbot and more:
Become root:
```bash
sudo su -
```
Once you are root:
```
wget https://raw.githubusercontent.com/fatchan/nginx-autoinstall/master/nginx-autoinstall.sh
chmod +x nginx-autoinstall.sh
sudo su
HEADLESS=y OPTION=1 NGINX_VER=STABLE SUBFILTER=y RTMP=y ./nginx-autoinstall.sh
echo "You can safely ignore that error about restarting nginx ^"
exit
rm nginx-autoinstall.sh
sudo mkdir -p /etc/nginx/snippets
exit # this exits being root
```
Back as your non-root sudo user, from within your jschan folder:
```
sudo bash configs/nginx/nginx.sh
```
configs/nginx/nginx.sh
+19 -18
View File
@@ -62,10 +62,10 @@ if [ "$CERTBOT" == "y" ]; then
#run certbot for certificate
if [ "$ADD_WWW_SUBDOMAIN" == "y" ]; then
echo "Running certbot to setup SSL cert for $CLEARNET_DOMAIN and www.$CLEARNET_COMAIN..."
sudo certbot certonly --nginx -d $CLEARNET_DOMAIN -d www.$CLEARNET_DOMAIN
sudo sudo certbot certonly --standalone --register-unsafely-without-email -d $CLEARNET_DOMAIN -d www.$CLEARNET_DOMAIN
else
echo "Running certbot to setup SSL cert for $CLEARNET_DOMAIN..."
sudo certbot certonly --nginx -d $CLEARNET_DOMAIN
sudo sudo certbot certonly --standalone --register-unsafely-without-email -d $CLEARNET_DOMAIN
fi
fi
@@ -91,22 +91,7 @@ fi
if [ "$CLEARNET_DOMAIN" != "" ]; then
HTTPS_MIDSECTION=""
HTTPS_CERT_SECTION=""
if [ "$CERTBOT" == "y" ]; then
HTTPS_CERT_SECTION="
ssl_certificate /etc/letsencrypt/live/$CLEARNET_DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/$CLEARNET_DOMAIN/privkey.pem;
include /etc/letsencrypt/options-ssl-nginx.conf;
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
"
elif [ "$SELFSIGNED" == "y" ]; then
echo "Generating self-signed SSL cert..."
mkdir /etc/ssl/private/
mkdir /etc/ssl/certs/
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt
echo "Generating dh group. This may take a while..."
sudo openssl dhparam -out /etc/nginx/dhparam.pem 4096
sudo openssl dhparam -out /etc/nginx/dhparam.pem 4096
cat > /etc/nginx/snippets/ssl-params.conf <<EOF
ssl_session_cache shared:le_nginx_SSL:10m;
ssl_session_timeout 1440m;
@@ -116,6 +101,22 @@ ssl_prefer_server_ciphers on;
ssl_ciphers "ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-SHA";
EOF
HTTPS_MIDSECTION=""
HTTPS_CERT_SECTION=""
if [ "$CERTBOT" == "y" ]; then
HTTPS_CERT_SECTION="
ssl_certificate /etc/letsencrypt/live/$CLEARNET_DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/$CLEARNET_DOMAIN/privkey.pem;
include /etc/nginx/snippets/ssl-params.conf;
ssl_dhparam /etc/nginx/dhparam.pem;
"
elif [ "$SELFSIGNED" == "y" ]; then
echo "Generating self-signed SSL cert..."
mkdir /etc/ssl/private/
mkdir /etc/ssl/certs/
sudo openssl req -x509 -nodes -days 3650 -newkey rsa:2048 -keyout /etc/ssl/private/nginx-selfsigned.key -out /etc/ssl/certs/nginx-selfsigned.crt
echo "Generating dh group. This may take a while..."
HTTPS_CERT_SECTION="
ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;