Compare commits
10
Commits
9d62ba5279
...
154b9f2ebd
| Author | SHA1 | Date | |
|---|---|---|---|
 futile
|
154b9f2ebd | ||
|
futile
|
ebe9063687 | ||
|
futile
|
24987e25b4 | ||
|
futile
|
e302605d47 | ||
|
futile
|
22178fa47a | ||
|
futile
|
d2a5bb90da | ||
|
futile
|
abc2dabd34 | ||
|
futile
|
f929547a91 | ||
|
futile
|
ae3f68b96a | ||
|
futile
|
2231626fb6 |
+4
-4
@@ -1,16 +1,16 @@
|
||||
# stalwart
|
||||
STALWART_PUBLIC_URL=https://m.example.org
|
||||
STALWART_PUBLIC_URL=https://post.example.org
|
||||
OIDC_KEY=GENERATE_STRING # openssl rand -hex 32
|
||||
OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve
|
||||
OIDC_SIGNATURE_KEY=GENERATE_PEM # openssl genpkey -algorithm EC -pkeyopt ec_paramgen_curve:secp384r1 -pkeyopt ec_param_enc:named_curve # ONE LINE, IN QUOTES, SEPARATED BY \n
|
||||
|
||||
# bulwark
|
||||
JMAP_SERVER_URL=https://m.example.org
|
||||
JMAP_SERVER_URL=https://post.example.org
|
||||
SESSION_SECRET=GENERATE_STRING # openssl rand -hex 32
|
||||
SETTINGS_SYNC_ENABLED=true
|
||||
ADMIN_PASSWORD=GENERATE_PASSWORD # tr -dc 'A-Za-z0-9' < /dev/urandom | head -c 20; echo
|
||||
|
||||
# vykar
|
||||
VYKAR_LABEL=borgbase
|
||||
VYKAR_URL=https://myrepo.repo.borgbase.com
|
||||
VYKAR_URL=https://REPO.repo.borgbase.com
|
||||
VYKAR_ACCESS_TOKEN=ACCESS_TOKEN
|
||||
VYKAR_ENCRYPTION_SECRET=GENERATE_STRING # openssl rand -hex 32
|
||||
|
||||
+1
-1
@@ -1 +1 @@
|
||||
.env
|
||||
*.env
|
||||
|
||||
@@ -3,14 +3,14 @@
|
||||
# acme_ca https://acme-staging-v02.api.letsencrypt.org/directory
|
||||
# }
|
||||
|
||||
mail.yaoi.dog {
|
||||
post.atom.town {
|
||||
reverse_proxy stalwart:8080
|
||||
}
|
||||
|
||||
post.yaoi.dog {
|
||||
mail.atom.town {
|
||||
reverse_proxy bulwark:3000
|
||||
}
|
||||
|
||||
git.yaoi.dog {
|
||||
reverse_proxy forgejo:3000
|
||||
git.atom.town {
|
||||
reverse_proxy gitea:3000
|
||||
}
|
||||
|
||||
@@ -1,4 +1,4 @@
|
||||
# thingy!
|
||||
# atom.town!
|
||||
|
||||
some kind of hosting setup
|
||||
|
||||
@@ -11,11 +11,11 @@ some kind of hosting setup
|
||||
- `sudo su - admin`
|
||||
3. use the system setup script, and log out
|
||||
- `sudo dnf install git -y`
|
||||
- `git clone https://gitlab.com/futile/thingy`
|
||||
- `./thingy/scripts/system-setup.sh`
|
||||
- `git clone https://gitlab.com/futile/atom.town`
|
||||
- `./atom.town/scripts/system-setup.sh`
|
||||
- `exit`
|
||||
4. log in again, populate the `.env` and start everything up
|
||||
- `cd thingy`
|
||||
- `cd atom.town`
|
||||
- `micro .env`
|
||||
- `docker compose up`
|
||||
5. continue with service-specific setups .....
|
||||
@@ -30,31 +30,36 @@ specifics for everything
|
||||
- **caddy** – http server & reverse proxy
|
||||
- **stalwart** – mailserver
|
||||
- **bulwark** – webmail
|
||||
- **gitea** – git server
|
||||
- via caddy
|
||||
- `mail.yaoi.dog` – mail (server & admin dash)
|
||||
- `post.yaoi.dog` – mail (webmail)
|
||||
- `post.atom.town` – mailserver, mail admin, and oidc
|
||||
- `mail.atom.town` – webmail
|
||||
- `git.atom.town` – git
|
||||
|
||||
**dns setup**
|
||||
|
||||
| type | host | value | notes |
|
||||
|-------|-----------|---------------------------- |----------------------------|
|
||||
| `A` | `@` | `<ip>` | apex domain |
|
||||
| `A` | `mail` | `<ip>` | mailserver |
|
||||
| `A` | `post` | `<ip>` | webmail |
|
||||
| `A` | `git` | `<ip>` | forgejo |
|
||||
| `A` | `post` | `<ip>` | mailserver |
|
||||
| `A` | `mail` | `<ip>` | webmail |
|
||||
| `A` | `git` | `<ip>` | gitea |
|
||||
| `CAA` | `@` | `0 issue "letsencrypt.org"` | allow caddy to issue certs |
|
||||
| `MX` | `@` | `post.atom.town` / `10` | mail record |
|
||||
|
||||
### caddy
|
||||
|
||||
todo
|
||||
> [!NOTE]
|
||||
> **todo** // detail setup
|
||||
|
||||
### stalwart
|
||||
|
||||
**first setup**
|
||||
<details>
|
||||
<summary>initial setup</summary>
|
||||
|
||||
1. server identity
|
||||
- server hostname: `mail.yaoi.dog`
|
||||
- default email domain: `yaoi.dog`
|
||||
- server hostname: `post.atom.town`
|
||||
- default email domain: `atom.town`
|
||||
- automatically obtain tls certificate: `true`
|
||||
- generate email signing keys: `true`
|
||||
2. storage
|
||||
@@ -67,11 +72,13 @@ todo
|
||||
5. automatic dns management
|
||||
- dns server type: `porkbun`
|
||||
- description: `porkbun`
|
||||
</details>
|
||||
|
||||
**further setup**
|
||||
<details>
|
||||
<summary>further setup</summary>
|
||||
|
||||
- settings -> security -> allowed ips
|
||||
- added `172.18.0.0/24`; reason: `internal`
|
||||
- added `172.18.0.0/16`; reason: `docker internal`
|
||||
- settings -> network -> http -> security
|
||||
- permissive cors policy: `true` **[restart needed]**
|
||||
- settings -> authentication -> oidc provider
|
||||
@@ -82,24 +89,75 @@ todo
|
||||
- signature algorithm: `ECDSA using P-384 and SHA-384`
|
||||
- signature key: `secret read from environment variable`
|
||||
- variable name: `OIDC_SIGNATURE_KEY`
|
||||
- management -> directory -> oauth clients
|
||||
- create oauth client
|
||||
- client id: `gitea`
|
||||
- description: `Gitea`
|
||||
- client secret: `<generate_secret>`
|
||||
- redirect uris: `https://git.atom.town/user/oauth2/Stalwart/callback`
|
||||
</details>
|
||||
|
||||
**useful links**
|
||||
<details>
|
||||
<summary>useful links</summary>
|
||||
|
||||
- https://stalw.art/docs
|
||||
- https://testconnectivity.microsoft.com/tests/Imap/input
|
||||
- https://mail-tester.com
|
||||
</details>
|
||||
|
||||
### bulwark
|
||||
|
||||
todo
|
||||
> [!NOTE]
|
||||
> **todo** // detail setup
|
||||
|
||||
**useful links**
|
||||
<details>
|
||||
<summary>useful links</summary>
|
||||
|
||||
- https://bulwarkmail.org/docs
|
||||
</details>
|
||||
|
||||
### forgejo
|
||||
### gitea
|
||||
|
||||
todo
|
||||
<details>
|
||||
<summary>initial setup</summary>
|
||||
|
||||
- database settings
|
||||
- database type: `sqlite3`
|
||||
- path: `/data/gitea/gitea.db`
|
||||
- general settings
|
||||
- site title: `We cock. Dick. BALLING.`
|
||||
- server domain: `git.atom.town`
|
||||
- ssh server port: `22`
|
||||
- gitea base url: `https://git.atom.town/`
|
||||
- enable update checker: `true`
|
||||
- email settings
|
||||
- smtp host: `post.atom.town`
|
||||
- smtp port: `465`
|
||||
- send email as: `"Gitea" <system@atom.town>`
|
||||
- smtp username: `system@atom.town`
|
||||
- smtp password: `<password>`
|
||||
- enable email notifications: `true`
|
||||
- server and third-party service settings
|
||||
- enable openid sign-in: `false`
|
||||
- disable self-registration: `false`
|
||||
- allow registration only through external services: `true`
|
||||
- enable openid self-registration: `true`
|
||||
- hidden email domain: `git.atom.town`
|
||||
- password hash algorithm: `argon2`
|
||||
</details>
|
||||
|
||||
<details>
|
||||
<summary>further setup</summary>
|
||||
|
||||
- admin settings -> identity & access -> authentication sources
|
||||
- add authentication source
|
||||
- authentication type: `OAuth2`
|
||||
- authentication name: `Stalwart`
|
||||
- oauth2 provider: `OpenID Connect`
|
||||
- client id (key): `gitea`
|
||||
- client secret: `<secret_from_stalwart>`
|
||||
- openid connect auto discovery url: `https://post.atom.town/.well-known/openid-configuration`
|
||||
</details>
|
||||
|
||||
## backups
|
||||
|
||||
@@ -114,7 +172,7 @@ always remember to `docker compose stop` before doing any of this!
|
||||
- to back up automatically, run `sudo EDITOR=micro crontab -e` and add the following:
|
||||
```
|
||||
TZ=UTC
|
||||
0 * * * * /home/admin/thingy/scripts/volume-backup.sh
|
||||
0 6 * * * /home/admin/atom.town/scripts/volume-backup.sh
|
||||
```
|
||||
|
||||
**restoring**
|
||||
@@ -133,8 +191,9 @@ the restore process is kind of fucked up but doable
|
||||
## todo
|
||||
|
||||
- further secure the server (ratelimiting, hardening...)
|
||||
- figure out best way to store .env, other credentials, and various secrets
|
||||
- more services
|
||||
- ~~forgejo (need to change host ssh port)~~
|
||||
- ~~gitea (need to change host ssh port)~~
|
||||
- vaultwarden
|
||||
- ~~tie all services together with an sso~~
|
||||
- use postgres for everything
|
||||
|
||||
+5
-5
@@ -54,9 +54,9 @@ services:
|
||||
depends_on:
|
||||
- stalwart
|
||||
|
||||
forgejo:
|
||||
image: codeberg.org/forgejo/forgejo:16
|
||||
container_name: forgejo
|
||||
gitea:
|
||||
image: docker.gitea.com/gitea:1.27.0
|
||||
container_name: gitea
|
||||
restart: unless-stopped
|
||||
environment:
|
||||
- USER_UID=1000
|
||||
@@ -64,7 +64,7 @@ services:
|
||||
ports:
|
||||
- "22:22"
|
||||
volumes:
|
||||
- forgejo-data:/data
|
||||
- gitea-data:/data
|
||||
networks:
|
||||
- services
|
||||
|
||||
@@ -77,7 +77,7 @@ volumes:
|
||||
bulwark-config:
|
||||
bulwark-state:
|
||||
bulwark-telemetry:
|
||||
forgejo-data:
|
||||
gitea-data:
|
||||
|
||||
networks:
|
||||
services:
|
||||
|
||||
@@ -19,13 +19,11 @@ function banner() {
|
||||
fi
|
||||
}
|
||||
|
||||
# https://patorjk.com/software/taag/#p=display&f=Small+Slant
|
||||
cat << 'EOF'
|
||||
__ __ _
|
||||
/ /_/ / (_)__ ___ ___ __
|
||||
/ __/ _ \/ / _ \/ _ `/ // /
|
||||
\__/_//_/_/_//_/\_, /\_, /
|
||||
/___//___/
|
||||
__ __
|
||||
___ _/ /____ __ _ / /____ _ _____
|
||||
/ _ `/ __/ _ \/ ' \_/ __/ _ \ |/|/ / _ \
|
||||
\_,_/\__/\___/_/_/_(_)__/\___/__,__/_//_/
|
||||
..... brought to you by futile
|
||||
|
||||
|
||||
|
||||
@@ -1,7 +1,7 @@
|
||||
#!/usr/bin/env bash
|
||||
set -euo pipefail
|
||||
|
||||
WORKING_DIR="/home/admin/thingy" # todo: better
|
||||
WORKING_DIR="/home/admin/atom.town" # todo: better
|
||||
LOG_FILE="/var/log/volume-backup.log"
|
||||
|
||||
function log() {
|
||||
|
||||
Reference in New Issue
Block a user