From 725512cd85cd8417d9239f9ad97425533f4dd9db Mon Sep 17 00:00:00 2001 From: Alexandre CATTEAU Date: Fri, 16 Sep 2022 15:00:38 +0200 Subject: [PATCH] Big review --- README.md | 23 ++- dl-server/install.sh | 26 ---- dl-server/variables.conf.template | 9 -- install.sh | 64 ++++++++ nginx-blocks/0-http-redirect | 4 + nginx-blocks/filebrowser | 12 ++ nginx-blocks/transmission | 12 ++ setup.sh | 137 ------------------ systemd-templates/filebrowser.service | 10 ++ .../transmission-daemon.service | 4 +- .../transmission-vpn.service | 0 .../transmission-vpn.timer | 0 ...transmission-vpn.sh => transmission-vpn.sh | 0 variables.conf.template | 15 ++ 14 files changed, 134 insertions(+), 182 deletions(-) delete mode 100755 dl-server/install.sh delete mode 100644 dl-server/variables.conf.template create mode 100755 install.sh create mode 100644 nginx-blocks/0-http-redirect create mode 100644 nginx-blocks/filebrowser create mode 100644 nginx-blocks/transmission delete mode 100644 setup.sh create mode 100644 systemd-templates/filebrowser.service rename {dl-server => systemd-templates}/transmission-daemon.service (89%) rename {dl-server => systemd-templates}/transmission-vpn.service (100%) rename {dl-server => systemd-templates}/transmission-vpn.timer (100%) rename dl-server/transmission-vpn.sh => transmission-vpn.sh (100%) diff --git a/README.md b/README.md index 18f0270..0bc3c90 100644 --- a/README.md +++ b/README.md @@ -4,19 +4,26 @@ This repository contains files used to set up our NAS server on Debian. Target i ### Introduction The idea is to provide the following features, chosen at install: -* a web interface for file management with [filebrowser](https://github.com/filebrowser/filebrowser) -* a DLNA server with MiniDLNA -* a BitTorrent client with Transmission, which comes with a server web interface -* an VPN client with OpenVPN -* a FTP server with vsftpd +* a web interface for file management with [File Browser](https://github.com/filebrowser/filebrowser); +* a DLNA server with MiniDLNA; +* a BitTorrent client with Transmission, which comes with a server web interface; +* an VPN client with OpenVPN; +* a FTP server with vsftpd. +In addition, Nginx is used to provide HTTPS proxy to File Browser and Transmission + +### Requirements +The following list of packages must be installed manually (depending on which features are needed): +```transmission-daemon minidlna openvpn nginx``` +File Browser must be installed manually at `/usr/local/bin/filebrowser`. + +A "NAS user" should be defined, owner of the NAS root directory: This user shall run some of above services. ### Files -* `transmission-daemon.service` is a replacement for default Transmission service file, with more settings. * `transmission-vpn.sh` is a script which checks if a VPN connection is active and stops Transmission otherwise. -* `transmission-vpn.service` is a service unit for above script. -* `transmission-vpn.timer` is a timer which runs regularly above script. * `variables.conf.template` contains examples variables definitions, and should be copied locally to `variables.conf` (with any required modifications). +* `systemd-templates/` contains Systemd units templates for all the services. +* `nginx-blocks/` contains Nginx configuration blocks. ##### Installation * `install.sh` script copies Systemd units to their destination, with correct values. diff --git a/dl-server/install.sh b/dl-server/install.sh deleted file mode 100755 index 285fe65..0000000 --- a/dl-server/install.sh +++ /dev/null @@ -1,26 +0,0 @@ -#!/usr/bin/env bash - -run_directory=$(dirname "$0") - -source "$run_directory/variables.conf" - -if [ -f $run_directory/.disabled ]; then - echo "Installation is disabled. Exiting..." - exit 0 -fi - -echo "Copying Systemd units to system directory..." -sudo cp $run_directory/transmission-daemon.service /etc/systemd/system/ -sudo sed -i -e "s/PH_AUTHORIZED_ADDRESSES/$authorized_ips/g" /etc/systemd/system/transmission-daemon.service -sudo sed -i -e "s/PH_USER/$user/g" /etc/systemd/system/transmission-daemon.service -sudo sed -i -e "s/PH_PASSWORD/$password/g" /etc/systemd/system/transmission-daemon.service -sudo sed -i -e "s:PH_DL_LOCATION:$dl_location:g" /etc/systemd/system/transmission-daemon.service -sudo cp $run_directory/transmission-vpn.service /etc/systemd/system/ -sudo sed -i -e "s:PH_DIRECTORY:$run_directory:g" /etc/systemd/system/transmission-vpn.service -sudo cp $run_directory/transmission-vpn.timer /etc/systemd/system/ - -echo "Reloading Systemd..." -sudo systemctl daemon-reload - -echo "Finished install. Exiting..." -exit 0 diff --git a/dl-server/variables.conf.template b/dl-server/variables.conf.template deleted file mode 100644 index b804f90..0000000 --- a/dl-server/variables.conf.template +++ /dev/null @@ -1,9 +0,0 @@ -#!/usr/bin/env bash - -# Copy this file as variables.conf, with the correct values - -real_ip="" # for VPN check -authorized_ips="" # for transmission web interface -user="" # user for transmission web interface -password="" # password for transmission web interface -dl_location="" # location of Downloads directory diff --git a/install.sh b/install.sh new file mode 100755 index 0000000..67a68de --- /dev/null +++ b/install.sh @@ -0,0 +1,64 @@ +#!/usr/bin/env bash + +run_directory=$(dirname "$0") +user=$(whoami) + +source "$run_directory/variables.conf" + +if [ -f $run_directory/.disabled ]; then + echo "Installation is disabled. Exiting..." + exit 0 +fi + +if [[ $user != 'root' ]]; then + sudo="sudo" +else + sudo="" +fi + +echo "Copying Systemd units to system directory..." + +if [ ! -f /etc/ssl/cert.crt ]; then + openssl req -newkey rsa:4096 -x509 -sha256 -days 999 -nodes -out /etc/ssl/cert.crt -keyout /etc/ssl/cert.key \ + -subj "/C=/ST=/L=/O=/OU=/CN=" +fi + +if [ "$file_browser" = "yes" ]; then + $sudo cp $run_directory/systemd-templates/filebrowser.service /etc/systemd/system/ + $sudo sed -i -e "s/PH_NAS_USER/$nas_user/g" /etc/systemd/system/filebrowser.service + $sudo sed -i -e "s/PH_NAS_DIRECTORY/$nas_location/g" /etc/systemd/system/filebrowser.service + $sudo cp $run_directory/nginx-blocks/filebrowser /etc/nginx/sites-available/filebrowser + $sudo sed -i -e "s/PH_FQDN/$(hostname)/g" /etc/nginx/sites-available/filebrowser + $sudo ln -s ../sites-available/filebrowser /etc/nginx/sites-enabled/filebrowser +fi + +if [ "$dlna_server" = "yes" ]; then + $sudo sed -i -e "s:media_dir=/var/lib/minidlna:media_dir=$nas_location:g" /etc/minidlna.conf + $sudo sed -i -e "s:#friendly_name=:friendly_name=$(hostname -s):g" /etc/minidlna.conf +fi + +if [ "$dl_server" = "yes" ]; then + $sudo cp $run_directory/systemd-templates/transmission-daemon.service /etc/systemd/system/ + $sudo sed -i -e "s/PH_NAS_USER/$nas_user/g" /etc/systemd/system/transmission-daemon.service + $sudo sed -i -e "s/PH_AUTHORIZED_ADDRESSES/$authorized_ips/g" /etc/systemd/system/transmission-daemon.service + $sudo sed -i -e "s/PH_USER/$user/g" /etc/systemd/system/transmission-daemon.service + $sudo sed -i -e "s/PH_PASSWORD/$password/g" /etc/systemd/system/transmission-daemon.service + $sudo sed -i -e "s:PH_DL_LOCATION:$dl_location:g" /etc/systemd/system/transmission-daemon.service + $sudo cp $run_directory/systemd-templates/transmission-vpn.service /etc/systemd/system/ + $sudo sed -i -e "s:PH_DIRECTORY:$run_directory:g" /etc/systemd/system/transmission-vpn.service + $sudo cp $run_directory/systemd-templates/transmission-vpn.timer /etc/systemd/system/ + $sudo cp $run_directory/nginx-blocks/transmission /etc/nginx/sites-available/transmission + $sudo sed -i -e "s/PH_FQDN/$(hostname)/g" /etc/nginx/sites-available/transmission + $sudo ln -s ../sites-available/transmission /etc/nginx/sites-enabled/transmission +fi + +if [ "$ftp_server" = "yes" ]; then + $sudo sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf + $sudo sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf +fi + +echo "Reloading Systemd..." +sudo systemctl daemon-reload + +echo "Finished install. Exiting..." +exit 0 diff --git a/nginx-blocks/0-http-redirect b/nginx-blocks/0-http-redirect new file mode 100644 index 0000000..c68e7cc --- /dev/null +++ b/nginx-blocks/0-http-redirect @@ -0,0 +1,4 @@ +server { + listen 80; + return 301 https://$host$request_uri; +} diff --git a/nginx-blocks/filebrowser b/nginx-blocks/filebrowser new file mode 100644 index 0000000..665d216 --- /dev/null +++ b/nginx-blocks/filebrowser @@ -0,0 +1,12 @@ +server { + listen 443 ssl; + server_name nas.PH_FQDN; + + ssl_certificate /etc/ssl/cert.crt; + ssl_certificate_key /etc/ssl/cert.key; + + location / { + proxy_pass http://localhost:8080; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + } +} diff --git a/nginx-blocks/transmission b/nginx-blocks/transmission new file mode 100644 index 0000000..ad1a945 --- /dev/null +++ b/nginx-blocks/transmission @@ -0,0 +1,12 @@ +server { + listen 443 ssl; + server_name dl.PH_FQDN; + + ssl_certificate /etc/ssl/cert.crt; + ssl_certificate_key /etc/ssl/cert.key; + + location / { + proxy_pass http://localhost:3389; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains"; + } +} diff --git a/setup.sh b/setup.sh deleted file mode 100644 index 81dd16a..0000000 --- a/setup.sh +++ /dev/null @@ -1,137 +0,0 @@ -#!/usr/bin/env bash - -# The purpose of this script is to setup our NAS server on a blank Armbian. -# This script is to be run as root. - -# (Keep in mind that default root password is 1234) -# Flash SBC's SD with Armbian and copy this script as well as conf-sync.sh to /root - -# YOU SHOULD REMOVE THIS SCRIPT AFTER SETUP - -source "$run_directory/variables.conf" - -# Functions -init() { - echo "Starting initialization" - echo $fqdn > /etc/hostname - localectl set-keymap $keymap - timedatectl set-timezone $timezone - systemctl disable apt-daily-upgrade.timer -} - -install_packages() { - echo "Starting packages installation" - sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list - apt update - apt upgrade -y - packages_to_install="vim tree tmux neofetch cryptsetup clevis clevis-luks clevis-systemd" - if [ "$dl_server" = "yes" ]; then - packages_to_install+=" openvpn transmission-daemon" - fi - if [ "$upnp_server" = "yes" ]; then - packages_to_install+=" minidlna" - fi - if [ "$ftp_server" = "yes" ]; then - packages_to_install+=" vsftpd" - fi - apt install -y $packages_to_install -} - -add_users() { - echo "Adding users" - useradd -U -G sudo -m -s /bin/bash $user - chmod 700 /home/$user - echo "Let's define a password for $user as we are about to run sudo with it. It can of course be changed after setup." - passwd $user -} - -get_sync() { - echo "Getting and deploying sync configuration" - sudo -H -u $user mkdir $sync_directory_path - sudo -H -u $user git clone https://gitea.kto.black/adminconf/rcs-general.git $sync_directory_path/rcs-general - sudo -H -u $user $sync_directory_path/rcs-general/install.sh - sudo -H -u $user git clone https://gitea.kto.black/adminconf/conf-sync.git $sync_directory_path/conf-sync - sudo -H -u $user cp $sync_directory_path/conf-sync/variables.conf.template \ - $sync_directory_path/conf-sync/variables.conf - sudo -H -u $user sed -i -e "s/\"desktop\"/\"server\"/g" $sync_directory_path/conf-sync/variables.conf - sudo -H -u $user $sync_directory_path/conf-sync/install.sh - sudo -H -u $user git clone https://gitea.kto.black/adminconf/nas-server.git $sync_directory_path/nas-server -} - -ssh_pubkey() { - echo "Getting SSH public key" - sudo -H -u $user mkdir /home/$user/.ssh - sudo -H -u $user wget -P /home/$user/.ssh $remote_pubkey_location/$remote_pubkey - sudo -H -u $user mv /home/$user/.ssh/$remote_pubkey /home/$user/.ssh/authorized_keys -} - -set_sshd_conf() { - echo "Editing OpenSSH daemon config..." - sed -i -e "s/#PasswordAuthentication yes/PasswordAuthentication no/g" /etc/ssh/sshd_config - sed -i -e "s/PermitRootLogin yes/PermitRootLogin no/g" /etc/ssh/sshd_config -} - -set_vsftpd() { - if [ "$ftp_server" != "yes" ]; then - return 0 - fi - echo "Setting vsftpd config" - mkdir $nas_root - chown $user:users $nas_root - echo "nascrypt /dev/sda none noauto" >> /etc/crypttab - sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf - sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf -} - -# Only run if the user is root -if [[ $USER != 'root' ]] ; then - echo "You must run this script as root!" - exit 1 -fi - -run_directory_path=$(pwd) - -# Set parameters -fqdn='hk1.jab.kto.black' -keymap='fr' -timezone='Europe/Paris' -deb_apt_default_repo='deb.debian.org' # TODO check -deb_apt_repo='ftp.fr.debian.org' -user='alex' -sync_directory_path="/home/$user/.sync" -systemd_units_path='/etc/systemd/system' -remote_pubkey_location='https://keys.kto.black' -remote_pubkey='home.pub' -nas_root='/srv/nas' - -# Main process -# You should comment below what you do not want to happen -init -install_packages -add_users -get_sync -ssh_pubkey -set_sshd_conf -set_vsftpd - -echo "" -echo "We're all good here!" -echo "You should now:" -echo "* set $user's password" -echo "* lock root account" -echo "* remove $run_directory_path content" -if [ "$dl_server" = "yes" ]; then - echo "* get the OpenVPN configuration file, move it to /etc/openvpn/client/vpn.conf" - echo " * and add at \`auth-user-pass\`: auth.txt" - echo " * create said auth.txt with VPN login and password (on two rows)" -fi -echo "* reboot the SBC" -echo "And perhaps:" -echo "* set htop at your convenience" -echo "* remove password for sudo" # TODO we should automate that, with a flag -echo "* use below commands to edit SSH config:" -echo " sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config" -echo " sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config" -echo "* register an encrypted volume to a tang server" - -exit 0 diff --git a/systemd-templates/filebrowser.service b/systemd-templates/filebrowser.service new file mode 100644 index 0000000..12c10d1 --- /dev/null +++ b/systemd-templates/filebrowser.service @@ -0,0 +1,10 @@ +[Unit] +Description=File Browser web interface + +[Service] +User=PH_NAS_USER +Type=simple +ExecStart=/usr/local/bin/filebrowser -d PH_NAS_DIRECTORY + +[Install] +WantedBy=default.target diff --git a/dl-server/transmission-daemon.service b/systemd-templates/transmission-daemon.service similarity index 89% rename from dl-server/transmission-daemon.service rename to systemd-templates/transmission-daemon.service index e839231..247ea09 100644 --- a/dl-server/transmission-daemon.service +++ b/systemd-templates/transmission-daemon.service @@ -5,7 +5,7 @@ BindsTo=transmission-vpn.timer After=network.target transmission-vpn.timer [Service] -User=debian-transmission +User=PH_NAS_USER Type=notify ExecStart=/usr/bin/transmission-daemon -f --log-error -a PH_AUTHORIZED_ADDRESSES -C -t -u PH_USER -v PH_PASSWORD -w PH_DL_LOCATION ExecStop=/bin/kill -s STOP $MAINPID @@ -13,4 +13,4 @@ ExecReload=/bin/kill -s HUP $MAINPID NoNewPrivileges=true [Install] -WantedBy=multi-user.target +WantedBy=default.target diff --git a/dl-server/transmission-vpn.service b/systemd-templates/transmission-vpn.service similarity index 100% rename from dl-server/transmission-vpn.service rename to systemd-templates/transmission-vpn.service diff --git a/dl-server/transmission-vpn.timer b/systemd-templates/transmission-vpn.timer similarity index 100% rename from dl-server/transmission-vpn.timer rename to systemd-templates/transmission-vpn.timer diff --git a/dl-server/transmission-vpn.sh b/transmission-vpn.sh similarity index 100% rename from dl-server/transmission-vpn.sh rename to transmission-vpn.sh diff --git a/variables.conf.template b/variables.conf.template index 20f93be..77db1a2 100644 --- a/variables.conf.template +++ b/variables.conf.template @@ -2,7 +2,22 @@ # Copy this file as variables.conf, with the correct values +nas_location="" +nas_user="" + +# Set up File Browser filebrowser="yes" + +# Set up MiniDLNA dlna_server="yes" + +# Set up Transmission and OpenVPN dl_server="yes" +real_ip="" # for VPN check +authorized_ips="" # for transmission web interface +user="" # user for transmission web interface +password="" # password for transmission web interface +dl_location="" # location of Downloads directory + +# Set up vsftpd ftp_server="no"