Arch Post-Installation Checklist - Revision history

BrainwreckedTech: /* Yay */ Fixed some code blocks

2019-12-28T07:39:52Z

Yay: Fixed some code blocks

← Older revision		Revision as of 03:39, 28 December 2019
Line 147:		Line 147:
	Create a directory where AUR build files will go		Create a directory where AUR build files will go

	{{bc\|		{{bc\|1=
	sudo mkdir /var/lib/pacman/aur		sudo mkdir /var/lib/pacman/aur
	sudo chmod 1777 /var/lib/pacman/aur		sudo chmod 1777 /var/lib/pacman/aur
	$ mkdir /var/lib/pacman/aur/$(whoami)		mkdir /var/lib/pacman/aur/$(whoami)
	}}		}}

	Build {{ic\|yay}}.		Build {{ic\|yay}}.

	{{bc\|		{{bc\|1=<nowiki>
	$ cd /var/lib/pacman/aur/$(whoami)		cd /var/lib/pacman/aur/$(whoami)
	$ git clone https://aur.archlinux.org/yay.git		git clone https://aur.archlinux.org/yay.git
	$ cd yay		cd yay
	$ makepkg -Ccisr		makepkg -Ccisr
	}}		</nowiki>}}

	The create the configuration file.		The create the configuration file.

BrainwreckedTech: /* Docker */ Deleted Section -- content moved to its own page.

2019-12-11T08:18:46Z

Docker: Deleted Section -- content moved to its own page.

← Older revision		Revision as of 04:18, 11 December 2019
Line 231:		Line 231:

	Don't start {{ic\|fail2ban}} or {{ic\|sshd}} quite yet as they have configuration that needs to be done.		Don't start {{ic\|fail2ban}} or {{ic\|sshd}} quite yet as they have configuration that needs to be done.

	~~== Docker ==~~

	~~This is only needed for OnlyOffice~~

	~~{{bc\|~~
	~~yay -Syu docker~~
	~~sudo systemctl enable --now docker~~
	}}

BrainwreckedTech: /* Redis */ Deleted Section -- content moved to its own page

2019-12-11T08:18:16Z

Redis: Deleted Section -- content moved to its own page

← Older revision		Revision as of 04:18, 11 December 2019
Line 240:		Line 240:
	sudo systemctl enable --now docker		sudo systemctl enable --now docker
	}}		}}

	~~= Redis =~~

	~~Redis is used by several programs, including rspamd (e-mail), NextCloud, OnlyOffice, and Wordpress (optional).~~

	~~By default, {{ic\|redis}} is already configured to bind to 127.0.0.1:6379, but the Unix socket is not enabled.~~

	~~{{hc\|/etc/redis.conf\|2=~~
	~~...~~
	~~# Unix socket.~~
	#
	~~# Specify the path for the Unix socket that will be used to listen for~~
	~~# incoming connections. There is no default, so Redis will not listen~~
	~~# on a unix socket when not specified.~~
	#
	~~unixsocket /run/redis/redis.sock~~
	~~unixsocketperm 700~~
	~~...~~
	}}

	~~You will also need to add users to the {{ic\|redis}} group so processes can access {{ic\|redis}}~~

	~~{{bc\|for username in http rspamd; do sudo usermod -G redis ${username}; done}}~~

BrainwreckedTech: /* OnlyOffice Document Server */ Deleted section -- content moved to its own page.

2019-12-11T07:52:44Z

OnlyOffice Document Server: Deleted section -- content moved to its own page.

← Older revision		Revision as of 03:52, 11 December 2019
Line 263:		Line 263:

	{{bc\|for username in http rspamd; do sudo usermod -G redis ${username}; done}}		{{bc\|for username in http rspamd; do sudo usermod -G redis ${username}; done}}

	~~= OnlyOffice Document Server =~~

	On Arch, OnlyOffice can be installed via an [https://aur.archlinux.org/packages/onlyoffice-documentserver AUR package], with [https://helpcenter.onlyoffice.com/server/docker/document/docker-installation.aspx Docker], or with [https://snapcraft.io/onlyoffice-ds Snap].

	~~== AUR Package ==~~

	~~The [https://aur.archlinux.org/packages/onlyoffice-documentserver/ AUR package] was broken at the time of this writing.~~

	~~== Snap ==~~

	~~Snap did not work for me. However, this might have been due to the Snap's Redis service conflicting with that of the host's.~~

	~~== Docker ==~~

	~~The Docker version requires PostreSQL, RabbitMQ, and Redis to be set up. Be sure to install and configure those first.~~

	~~Once that is complete, set up the database and database user.~~

	~~{{bc\|~~
	~~sudo -u postgres psql -c "CREATE DATABASE onlyoffice;"~~
	~~sudo -u postgres psql -c "CREATE USER onlyoffice WITH password 'onlyoffice';"~~
	~~sudo -u postgres psql -c "GRANT ALL privileges ON DATABASE onlyoffice TO onlyoffice;"~~
	}}

	~~Create the following directories.~~

	~~{{bc\|sudo mkdir /var/{lib,log}/onlyoffice}}~~

	~~Issue one command to download and start the Docker instance.~~

	~~{{bc\|<nowiki>~~
	~~sudo docker run -i -t -d -p [port]:80 --restart=always \~~
	~~-v /app/onlyoffice/DocumentServer/logs:/var/log/onlyoffice \~~
	~~-v /app/onlyoffice/DocumentServer/lib:/var/lib/onlyoffice \~~
	~~-v /app/onlyoffice/DocumentServer/db:/srv/psql onlyoffice/documentserver~~
	~~</nowiki>}}~~

	~~Configure nginx to act as a proxy~~

	~~{{hc\|/etc/nginx/sites-available/<domain>\|2=<nowiki>~~
	~~upstream docservice {~~
	~~server <docker-ip>:8888;~~
	}

	~~map $http_host $this_host {~~
	~~"" $host;~~
	~~default $http_host;~~
	}

	~~map $http_x_forwarded_proto $the_scheme {~~
	~~default $http_x_forwarded_proto;~~
	~~"" $scheme;~~

	}

	~~map $http_x_forwarded_host $the_host {~~
	~~default $http_x_forwarded_host;~~
	~~"" $this_host;~~
	}

	~~map $http_upgrade $proxy_connection {~~
	~~default upgrade;~~
	~~"" close;~~
	}

	~~proxy_set_header Upgrade $http_upgrade;~~
	~~proxy_set_header Connection $proxy_connection;~~
	~~proxy_set_header X-Forwarded-Host $the_host;~~
	~~proxy_set_header X-Forwarded-Proto $the_scheme;~~
	~~proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;~~

	~~server {~~
	~~listen 80;~~
	~~listen [::]:80;~~
	~~server_name <domain>;~~
	~~server_tokens off;~~
	~~rewrite ^ https://$host$request_uri? permanent;~~
	}

	~~server {~~

	~~listen 443 ssl http2;~~
	~~listen [::]:443 ssl http2;~~
	~~server_name ods.bwt.com.de;~~
	~~server_tokens off;~~

	~~ssl_certificate /etc/letsencrypt/live/<domain>/fullchain.pem;~~
	~~ssl_certificate_key /etc/letsencrypt/live/<domain>/privkey.pem;~~
	~~ssl_trusted_certificate /etc/letsencrypt/live/<domain>/chain.pem;~~

	~~add_header Strict-Transport-Security max-age=31536000;~~
	~~# add_header X-Frame-Options SAMEORIGIN;~~
	~~add_header X-Content-Type-Options nosniff;~~

	~~access_log /var/log/nginx/access.log main buffer=32k;~~
	~~error_log /var/log/nginx/error.log error;~~
	~~limit_req zone=gulag burst=200 nodelay;~~


	~~# ACME challenge~~
	~~location ^~ /.well-known {~~
	~~allow all;~~
	~~alias /var/lib/letsencrypt/$host/.well-known;~~
	~~default_type "text/plain";~~
	~~try_files $uri =404;~~
	}

	~~location / {~~
	~~proxy_pass http://docservice;~~
	~~proxy_http_version 1.1;~~
	}
	}
	~~</nowiki>}}~~

	After [[Arch_Post-Installation_Checklist#Finalization\|finalizing]], you should now be able to navigate to {{ic\|<nowiki>https://<domain></nowiki>}} and see the OnlyOffice Document Server welcome page with a green checkmark indicating everything is running properly.

BrainwreckedTech: /* Let's Encrypt */ Deleted section -- contents moved to its own page.

2019-12-11T06:56:32Z

Let's Encrypt: Deleted section -- contents moved to its own page.

← Older revision		Revision as of 02:56, 11 December 2019
Line 263:		Line 263:

	{{bc\|for username in http rspamd; do sudo usermod -G redis ${username}; done}}		{{bc\|for username in http rspamd; do sudo usermod -G redis ${username}; done}}

	~~= Let's Encrypt =~~

	~~{{bc\|sudo certbot certonly --nginx --agree-tos}}~~

	~~The {{ic\|nginx}} plugin will guide you and help automate the process.~~

	~~Take note that the {{ic\|nginx}} configuration in this guide takes into account the settings suggested by {{ic\|certbot}}.~~

	~~== Automatic Renewal ==~~

	~~These will automatically renew your certificates every 2 months on the first Sunday of the month at 4am.~~

	~~=== Systemd ===~~

	~~{{hc\|/etc/systemd/system/certbot.service\|2=~~
	~~[Unit]~~
	~~Description=Let's Encrypt renewal~~

	~~[Service]~~
	~~Type=oneshot~~
	~~ExecStart=/usr/bin/certbot renew --agree-tos --no-redirect~~
	}}

	~~{{hc\|/etc/systemd/system/certbot.timer\|2=~~
	~~[Unit]~~
	~~Description=Bi-monthly renewal of Let's Encrypt's certificates~~

	~~[Timer]~~
	~~OnCalendar=Sun *-1,3,5,7,9,11-1..7 04:00:00~~
	~~RandomizedDelaySec=1h~~
	~~Persistent=true~~

	~~[Install]~~
	~~WantedBy=timers.target~~
	}}

	~~=== Crontab ===~~

	~~{{bc\|0 4 1-7 2-12/2 0 /usr/bin/certbot renew --agree-tos --no-redirect}}~~

	= OnlyOffice Document Server =		= OnlyOffice Document Server =

BrainwreckedTech: /* Nginx Web Server and Reverse Proxy */ Deleted section -- content moved to its own section.

2019-12-10T00:56:20Z

Nginx Web Server and Reverse Proxy: Deleted section -- content moved to its own section.

← Older revision		Revision as of 20:56, 9 December 2019
Line 240:		Line 240:
	sudo systemctl enable --now docker		sudo systemctl enable --now docker
	}}		}}

	~~== Nginx Web Server and Reverse Proxy ==~~

	~~These packages are typically used when setting up web applications like MediaWiki or Wordpress.~~

	~~{{bc\|yay -Syu --needed apache-tools ca-certificates certbot-nginx nginx php-<nowiki>{acpu,fpm,gd,imagick,intl,redis,sodium}</nowiki> postgresql}}~~

	= Redis =		= Redis =

BrainwreckedTech: /* PHP-FPM */ Deleted section -- content moved to its own section

2019-12-10T00:55:26Z

PHP-FPM: Deleted section -- content moved to its own section

← Older revision		Revision as of 20:55, 9 December 2019
Line 269:		Line 269:

	{{bc\|for username in http rspamd; do sudo usermod -G redis ${username}; done}}		{{bc\|for username in http rspamd; do sudo usermod -G redis ${username}; done}}

	~~= PHP-FPM =~~

	~~Look for and edit the following lines in {{ic\|/etc/php/php.ini}}:~~

	~~{{hc\|/etc/php/php.ini\|2=~~
	~~[PHP]~~
	~~open_basedir = /srv/http/:/home/:/tmp/:/usr/share/pear/:/usr/share/webapps/:/dev/urandom:/proc/meminfo~~
	~~include_path = ".:/php/includes:/usr/share/pear"~~
	~~upload_max_filesize = 8M~~

	~~extension=apcu~~
	~~extension=dba~~
	~~extension=exif~~
	~~extension=gd~~
	~~extension=gettext~~
	~~extension=iconv~~
	~~extension=imagick~~
	~~extension=imap~~
	~~extension=intl~~
	~~extension=sodium~~
	~~extension=ldap~~
	~~extension=mysqli~~
	~~zend_extension=opcache~~
	~~extension=pdo_mysql~~
	~~extension=soap~~

	~~[Date]~~
	~~date.timezone = <timezone>~~

	~~[Pdo_mysql]~~
	~~pdo_mysql.cache_size = 2000~~

	~~[opcache]~~
	~~opcache.enable=1~~
	~~opcache.enable_cli=1~~
	~~opcache.memory_consumption=128~~
	~~opcache.interned_strings_buffer=8~~
	~~opcache.max_accelerated_files=10000~~
	~~opcache.revalidate_freq=1~~
	~~opcache.save_comments=1~~
	}}

	~~== tmpfs for PHP Sessions ==~~

	~~{{hc\|/etc/php/php.ini\|2=~~
	~~[Session]~~
	~~session.save_path = "/srv/phptmp"~~
	}}

	~~Find the id and gid of the mysql user and group:~~

	~~{{hc\|$ id mysql\|2=~~
	~~uid=27(mysql) gid=27(mysql) groups=27(mysql)~~
	}}

	~~{{hc\|/etc/fstab\|2=~~
	~~# Static information about the filesystems.~~
	~~# See fstab(5) for details.~~

	~~# <file system> <dir> <type> <options> <dump> <pass>~~
	~~...~~
	~~tmpfs /srv/phptmp tmpfs rw,noatime,gid=27,uid=27,size=100M,mode=0750 0 0~~
	~~...~~
	}}

	~~Then make sure the {{ic\|php-fpm}} service is enabled and running:~~

	~~{{bc\|sudo systemctl enable --now php-fpm}}~~

	= Let's Encrypt =		= Let's Encrypt =

BrainwreckedTech: /* Nginx */ Removed section -- content moved to its own page.

2019-12-10T00:15:01Z

Nginx: Removed section -- content moved to its own page.

Show changes

BrainwreckedTech: /* Nginx Web Server and Reverse Proxy */ Removed mariadb from package list -- content moved to its own page.

2019-12-09T00:19:12Z

Nginx Web Server and Reverse Proxy: Removed mariadb from package list -- content moved to its own page.

← Older revision		Revision as of 20:19, 8 December 2019
Line 245:		Line 245:
	These packages are typically used when setting up web applications like MediaWiki or Wordpress.		These packages are typically used when setting up web applications like MediaWiki or Wordpress.

	{{bc\|yay -Syu --needed apache-tools ca-certificates certbot-nginx ~~mariadb~~ nginx php-<nowiki>{acpu,fpm,gd,imagick,intl,redis,sodium}</nowiki> postgresql}}		{{bc\|yay -Syu --needed apache-tools ca-certificates certbot-nginx nginx php-<nowiki>{acpu,fpm,gd,imagick,intl,redis,sodium}</nowiki> postgresql}}

	= Redis =		= Redis =

BrainwreckedTech: /* MariaDB */ Deleted section -- content moved to its own page.

2019-12-09T00:18:14Z

MariaDB: Deleted section -- content moved to its own page.

← Older revision		Revision as of 20:18, 8 December 2019
Line 246:		Line 246:

	{{bc\|yay -Syu --needed apache-tools ca-certificates certbot-nginx mariadb nginx php-<nowiki>{acpu,fpm,gd,imagick,intl,redis,sodium}</nowiki> postgresql}}		{{bc\|yay -Syu --needed apache-tools ca-certificates certbot-nginx mariadb nginx php-<nowiki>{acpu,fpm,gd,imagick,intl,redis,sodium}</nowiki> postgresql}}

	~~= MariaDB =~~

	~~== Data Directory ==~~

	~~If you want to put your databases somewhere other than the default {{ic\|/var/lib/mysql}}:~~

	~~{{bc\|~~
	~~sudo mkdir <dir>~~
	~~sudo chown -R mysql:mysql <dir>~~
	}}

	~~== tmpfs for tmpdir ==~~

	~~The directory used by MariaDB for storing temporary files is named tmpdir. For example, it is used to perform disk based large sorts, as well as for internal and explicit temporary tables.~~

	~~Create the directory with appropriate permissions:~~

	~~{{bc\|~~
	~~sudo mkdir -pv <dir>~~
	~~sudo chown mysql:mysql <dir>~~
	}}

	~~Find the id and gid of the mysql user and group:~~

	~~{{hc\|$ id mysql\|2=~~
	~~uid=27(mysql) gid=27(mysql) groups=27(mysql)}}~~

	~~Add to your /etc/fstab file.~~

	~~{{hc\|/etc/fstab\|2=~~
	~~# Static information about the filesystems.~~
	~~# See fstab(5) for details.~~

	~~# <file system> <dir> <type> <options> <dump> <pass>~~
	~~...~~
	~~tmpfs /srv/sqltmp tmpfs rw,noatime,gid=933,uid=993,size=100M,mode=0750 0 0~~
	~~...~~
	}}

	~~== Configuration File ==~~

	~~{{hc\|/etc/my.cnf.d/server.cnf\|2=~~
	~~...~~
	~~[mysqld]~~
	~~...~~
	~~datadir=<dir>~~
	~~skip-networking~~
	~~tmpdir=<dir>~~
	~~...~~
	}}

	~~== Initial Setup ==~~

	~~{{bc\|<nowiki>sudo mariadb-install-db --user=mysql --basedir=/usr --datadir=<dir></nowiki>}}~~

	~~== Start the Server ==~~

	~~{{bc\|sudo systemctl enable --now mariadb}}~~

	~~== Security Settings ==~~

	~~{{bc\|sudo mysql_secure_installation}}~~

	~~Create a user:~~

	~~{{hc\|$ mysql -u root -p\|2=~~
	~~MariaDB> CREATE USER '<user>'@'localhost' IDENTIFIED BY '<password>';~~
	~~MariaDB> GRANT ALL PRIVILEGES ON <database>.* TO '<USER>'@'localhost';~~
	~~MariaDB> FLUSH PRIVILEGES;~~
	~~MariaDB> quit~~
	}}

	= Redis =		= Redis =