Big review
This commit is contained in:
parent
bc3f4e3591
commit
725512cd85
23
README.md
23
README.md
@ -4,19 +4,26 @@ This repository contains files used to set up our NAS server on Debian. Target i
|
||||
|
||||
### Introduction
|
||||
The idea is to provide the following features, chosen at install:
|
||||
* a web interface for file management with [filebrowser](https://github.com/filebrowser/filebrowser)
|
||||
* a DLNA server with MiniDLNA
|
||||
* a BitTorrent client with Transmission, which comes with a server web interface
|
||||
* an VPN client with OpenVPN
|
||||
* a FTP server with vsftpd
|
||||
* a web interface for file management with [File Browser](https://github.com/filebrowser/filebrowser);
|
||||
* a DLNA server with MiniDLNA;
|
||||
* a BitTorrent client with Transmission, which comes with a server web interface;
|
||||
* an VPN client with OpenVPN;
|
||||
* a FTP server with vsftpd.
|
||||
In addition, Nginx is used to provide HTTPS proxy to File Browser and Transmission
|
||||
|
||||
### Requirements
|
||||
The following list of packages must be installed manually (depending on which features are needed):
|
||||
```transmission-daemon minidlna openvpn nginx```
|
||||
File Browser must be installed manually at `/usr/local/bin/filebrowser`.
|
||||
|
||||
A "NAS user" should be defined, owner of the NAS root directory: This user shall run some of above services.
|
||||
|
||||
### Files
|
||||
* `transmission-daemon.service` is a replacement for default Transmission service file, with more settings.
|
||||
* `transmission-vpn.sh` is a script which checks if a VPN connection is active and stops Transmission otherwise.
|
||||
* `transmission-vpn.service` is a service unit for above script.
|
||||
* `transmission-vpn.timer` is a timer which runs regularly above script.
|
||||
* `variables.conf.template` contains examples variables definitions, and should be copied locally to `variables.conf`
|
||||
(with any required modifications).
|
||||
* `systemd-templates/` contains Systemd units templates for all the services.
|
||||
* `nginx-blocks/` contains Nginx configuration blocks.
|
||||
##### Installation
|
||||
* `install.sh` script copies Systemd units to their destination, with correct values.
|
||||
|
||||
|
||||
@ -1,26 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
run_directory=$(dirname "$0")
|
||||
|
||||
source "$run_directory/variables.conf"
|
||||
|
||||
if [ -f $run_directory/.disabled ]; then
|
||||
echo "Installation is disabled. Exiting..."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
echo "Copying Systemd units to system directory..."
|
||||
sudo cp $run_directory/transmission-daemon.service /etc/systemd/system/
|
||||
sudo sed -i -e "s/PH_AUTHORIZED_ADDRESSES/$authorized_ips/g" /etc/systemd/system/transmission-daemon.service
|
||||
sudo sed -i -e "s/PH_USER/$user/g" /etc/systemd/system/transmission-daemon.service
|
||||
sudo sed -i -e "s/PH_PASSWORD/$password/g" /etc/systemd/system/transmission-daemon.service
|
||||
sudo sed -i -e "s:PH_DL_LOCATION:$dl_location:g" /etc/systemd/system/transmission-daemon.service
|
||||
sudo cp $run_directory/transmission-vpn.service /etc/systemd/system/
|
||||
sudo sed -i -e "s:PH_DIRECTORY:$run_directory:g" /etc/systemd/system/transmission-vpn.service
|
||||
sudo cp $run_directory/transmission-vpn.timer /etc/systemd/system/
|
||||
|
||||
echo "Reloading Systemd..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Finished install. Exiting..."
|
||||
exit 0
|
||||
@ -1,9 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# Copy this file as variables.conf, with the correct values
|
||||
|
||||
real_ip="" # for VPN check
|
||||
authorized_ips="" # for transmission web interface
|
||||
user="" # user for transmission web interface
|
||||
password="" # password for transmission web interface
|
||||
dl_location="" # location of Downloads directory
|
||||
64
install.sh
Executable file
64
install.sh
Executable file
@ -0,0 +1,64 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
run_directory=$(dirname "$0")
|
||||
user=$(whoami)
|
||||
|
||||
source "$run_directory/variables.conf"
|
||||
|
||||
if [ -f $run_directory/.disabled ]; then
|
||||
echo "Installation is disabled. Exiting..."
|
||||
exit 0
|
||||
fi
|
||||
|
||||
if [[ $user != 'root' ]]; then
|
||||
sudo="sudo"
|
||||
else
|
||||
sudo=""
|
||||
fi
|
||||
|
||||
echo "Copying Systemd units to system directory..."
|
||||
|
||||
if [ ! -f /etc/ssl/cert.crt ]; then
|
||||
openssl req -newkey rsa:4096 -x509 -sha256 -days 999 -nodes -out /etc/ssl/cert.crt -keyout /etc/ssl/cert.key \
|
||||
-subj "/C=/ST=/L=/O=/OU=/CN="
|
||||
fi
|
||||
|
||||
if [ "$file_browser" = "yes" ]; then
|
||||
$sudo cp $run_directory/systemd-templates/filebrowser.service /etc/systemd/system/
|
||||
$sudo sed -i -e "s/PH_NAS_USER/$nas_user/g" /etc/systemd/system/filebrowser.service
|
||||
$sudo sed -i -e "s/PH_NAS_DIRECTORY/$nas_location/g" /etc/systemd/system/filebrowser.service
|
||||
$sudo cp $run_directory/nginx-blocks/filebrowser /etc/nginx/sites-available/filebrowser
|
||||
$sudo sed -i -e "s/PH_FQDN/$(hostname)/g" /etc/nginx/sites-available/filebrowser
|
||||
$sudo ln -s ../sites-available/filebrowser /etc/nginx/sites-enabled/filebrowser
|
||||
fi
|
||||
|
||||
if [ "$dlna_server" = "yes" ]; then
|
||||
$sudo sed -i -e "s:media_dir=/var/lib/minidlna:media_dir=$nas_location:g" /etc/minidlna.conf
|
||||
$sudo sed -i -e "s:#friendly_name=:friendly_name=$(hostname -s):g" /etc/minidlna.conf
|
||||
fi
|
||||
|
||||
if [ "$dl_server" = "yes" ]; then
|
||||
$sudo cp $run_directory/systemd-templates/transmission-daemon.service /etc/systemd/system/
|
||||
$sudo sed -i -e "s/PH_NAS_USER/$nas_user/g" /etc/systemd/system/transmission-daemon.service
|
||||
$sudo sed -i -e "s/PH_AUTHORIZED_ADDRESSES/$authorized_ips/g" /etc/systemd/system/transmission-daemon.service
|
||||
$sudo sed -i -e "s/PH_USER/$user/g" /etc/systemd/system/transmission-daemon.service
|
||||
$sudo sed -i -e "s/PH_PASSWORD/$password/g" /etc/systemd/system/transmission-daemon.service
|
||||
$sudo sed -i -e "s:PH_DL_LOCATION:$dl_location:g" /etc/systemd/system/transmission-daemon.service
|
||||
$sudo cp $run_directory/systemd-templates/transmission-vpn.service /etc/systemd/system/
|
||||
$sudo sed -i -e "s:PH_DIRECTORY:$run_directory:g" /etc/systemd/system/transmission-vpn.service
|
||||
$sudo cp $run_directory/systemd-templates/transmission-vpn.timer /etc/systemd/system/
|
||||
$sudo cp $run_directory/nginx-blocks/transmission /etc/nginx/sites-available/transmission
|
||||
$sudo sed -i -e "s/PH_FQDN/$(hostname)/g" /etc/nginx/sites-available/transmission
|
||||
$sudo ln -s ../sites-available/transmission /etc/nginx/sites-enabled/transmission
|
||||
fi
|
||||
|
||||
if [ "$ftp_server" = "yes" ]; then
|
||||
$sudo sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf
|
||||
$sudo sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf
|
||||
fi
|
||||
|
||||
echo "Reloading Systemd..."
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
echo "Finished install. Exiting..."
|
||||
exit 0
|
||||
4
nginx-blocks/0-http-redirect
Normal file
4
nginx-blocks/0-http-redirect
Normal file
@ -0,0 +1,4 @@
|
||||
server {
|
||||
listen 80;
|
||||
return 301 https://$host$request_uri;
|
||||
}
|
||||
12
nginx-blocks/filebrowser
Normal file
12
nginx-blocks/filebrowser
Normal file
@ -0,0 +1,12 @@
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name nas.PH_FQDN;
|
||||
|
||||
ssl_certificate /etc/ssl/cert.crt;
|
||||
ssl_certificate_key /etc/ssl/cert.key;
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:8080;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
|
||||
}
|
||||
}
|
||||
12
nginx-blocks/transmission
Normal file
12
nginx-blocks/transmission
Normal file
@ -0,0 +1,12 @@
|
||||
server {
|
||||
listen 443 ssl;
|
||||
server_name dl.PH_FQDN;
|
||||
|
||||
ssl_certificate /etc/ssl/cert.crt;
|
||||
ssl_certificate_key /etc/ssl/cert.key;
|
||||
|
||||
location / {
|
||||
proxy_pass http://localhost:3389;
|
||||
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
|
||||
}
|
||||
}
|
||||
137
setup.sh
137
setup.sh
@ -1,137 +0,0 @@
|
||||
#!/usr/bin/env bash
|
||||
|
||||
# The purpose of this script is to setup our NAS server on a blank Armbian.
|
||||
# This script is to be run as root.
|
||||
|
||||
# (Keep in mind that default root password is 1234)
|
||||
# Flash SBC's SD with Armbian and copy this script as well as conf-sync.sh to /root
|
||||
|
||||
# YOU SHOULD REMOVE THIS SCRIPT AFTER SETUP
|
||||
|
||||
source "$run_directory/variables.conf"
|
||||
|
||||
# Functions
|
||||
init() {
|
||||
echo "Starting initialization"
|
||||
echo $fqdn > /etc/hostname
|
||||
localectl set-keymap $keymap
|
||||
timedatectl set-timezone $timezone
|
||||
systemctl disable apt-daily-upgrade.timer
|
||||
}
|
||||
|
||||
install_packages() {
|
||||
echo "Starting packages installation"
|
||||
sed -i -e "s/$deb_apt_default_repo/$deb_apt_repo/g" /etc/apt/sources.list
|
||||
apt update
|
||||
apt upgrade -y
|
||||
packages_to_install="vim tree tmux neofetch cryptsetup clevis clevis-luks clevis-systemd"
|
||||
if [ "$dl_server" = "yes" ]; then
|
||||
packages_to_install+=" openvpn transmission-daemon"
|
||||
fi
|
||||
if [ "$upnp_server" = "yes" ]; then
|
||||
packages_to_install+=" minidlna"
|
||||
fi
|
||||
if [ "$ftp_server" = "yes" ]; then
|
||||
packages_to_install+=" vsftpd"
|
||||
fi
|
||||
apt install -y $packages_to_install
|
||||
}
|
||||
|
||||
add_users() {
|
||||
echo "Adding users"
|
||||
useradd -U -G sudo -m -s /bin/bash $user
|
||||
chmod 700 /home/$user
|
||||
echo "Let's define a password for $user as we are about to run sudo with it. It can of course be changed after setup."
|
||||
passwd $user
|
||||
}
|
||||
|
||||
get_sync() {
|
||||
echo "Getting and deploying sync configuration"
|
||||
sudo -H -u $user mkdir $sync_directory_path
|
||||
sudo -H -u $user git clone https://gitea.kto.black/adminconf/rcs-general.git $sync_directory_path/rcs-general
|
||||
sudo -H -u $user $sync_directory_path/rcs-general/install.sh
|
||||
sudo -H -u $user git clone https://gitea.kto.black/adminconf/conf-sync.git $sync_directory_path/conf-sync
|
||||
sudo -H -u $user cp $sync_directory_path/conf-sync/variables.conf.template \
|
||||
$sync_directory_path/conf-sync/variables.conf
|
||||
sudo -H -u $user sed -i -e "s/\"desktop\"/\"server\"/g" $sync_directory_path/conf-sync/variables.conf
|
||||
sudo -H -u $user $sync_directory_path/conf-sync/install.sh
|
||||
sudo -H -u $user git clone https://gitea.kto.black/adminconf/nas-server.git $sync_directory_path/nas-server
|
||||
}
|
||||
|
||||
ssh_pubkey() {
|
||||
echo "Getting SSH public key"
|
||||
sudo -H -u $user mkdir /home/$user/.ssh
|
||||
sudo -H -u $user wget -P /home/$user/.ssh $remote_pubkey_location/$remote_pubkey
|
||||
sudo -H -u $user mv /home/$user/.ssh/$remote_pubkey /home/$user/.ssh/authorized_keys
|
||||
}
|
||||
|
||||
set_sshd_conf() {
|
||||
echo "Editing OpenSSH daemon config..."
|
||||
sed -i -e "s/#PasswordAuthentication yes/PasswordAuthentication no/g" /etc/ssh/sshd_config
|
||||
sed -i -e "s/PermitRootLogin yes/PermitRootLogin no/g" /etc/ssh/sshd_config
|
||||
}
|
||||
|
||||
set_vsftpd() {
|
||||
if [ "$ftp_server" != "yes" ]; then
|
||||
return 0
|
||||
fi
|
||||
echo "Setting vsftpd config"
|
||||
mkdir $nas_root
|
||||
chown $user:users $nas_root
|
||||
echo "nascrypt /dev/sda none noauto" >> /etc/crypttab
|
||||
sed -i -e "s/#write_enable=YES/write_enable=YES/g" /etc/vsftpd.conf
|
||||
sed -i -e "s/#utf8_filesystem=YES/utf8_filesystem=YES/g" /etc/vsftpd.conf
|
||||
}
|
||||
|
||||
# Only run if the user is root
|
||||
if [[ $USER != 'root' ]] ; then
|
||||
echo "You must run this script as root!"
|
||||
exit 1
|
||||
fi
|
||||
|
||||
run_directory_path=$(pwd)
|
||||
|
||||
# Set parameters
|
||||
fqdn='hk1.jab.kto.black'
|
||||
keymap='fr'
|
||||
timezone='Europe/Paris'
|
||||
deb_apt_default_repo='deb.debian.org' # TODO check
|
||||
deb_apt_repo='ftp.fr.debian.org'
|
||||
user='alex'
|
||||
sync_directory_path="/home/$user/.sync"
|
||||
systemd_units_path='/etc/systemd/system'
|
||||
remote_pubkey_location='https://keys.kto.black'
|
||||
remote_pubkey='home.pub'
|
||||
nas_root='/srv/nas'
|
||||
|
||||
# Main process
|
||||
# You should comment below what you do not want to happen
|
||||
init
|
||||
install_packages
|
||||
add_users
|
||||
get_sync
|
||||
ssh_pubkey
|
||||
set_sshd_conf
|
||||
set_vsftpd
|
||||
|
||||
echo ""
|
||||
echo "We're all good here!"
|
||||
echo "You should now:"
|
||||
echo "* set $user's password"
|
||||
echo "* lock root account"
|
||||
echo "* remove $run_directory_path content"
|
||||
if [ "$dl_server" = "yes" ]; then
|
||||
echo "* get the OpenVPN configuration file, move it to /etc/openvpn/client/vpn.conf"
|
||||
echo " * and add at \`auth-user-pass\`: auth.txt"
|
||||
echo " * create said auth.txt with VPN login and password (on two rows)"
|
||||
fi
|
||||
echo "* reboot the SBC"
|
||||
echo "And perhaps:"
|
||||
echo "* set htop at your convenience"
|
||||
echo "* remove password for sudo" # TODO we should automate that, with a flag
|
||||
echo "* use below commands to edit SSH config:"
|
||||
echo " sed -i 's/PermitRootLogin yes/PermitRootLogin no/' /etc/ssh/sshd_config"
|
||||
echo " sed -i 's/#PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config"
|
||||
echo "* register an encrypted volume to a tang server"
|
||||
|
||||
exit 0
|
||||
10
systemd-templates/filebrowser.service
Normal file
10
systemd-templates/filebrowser.service
Normal file
@ -0,0 +1,10 @@
|
||||
[Unit]
|
||||
Description=File Browser web interface
|
||||
|
||||
[Service]
|
||||
User=PH_NAS_USER
|
||||
Type=simple
|
||||
ExecStart=/usr/local/bin/filebrowser -d PH_NAS_DIRECTORY
|
||||
|
||||
[Install]
|
||||
WantedBy=default.target
|
||||
@ -5,7 +5,7 @@ BindsTo=transmission-vpn.timer
|
||||
After=network.target transmission-vpn.timer
|
||||
|
||||
[Service]
|
||||
User=debian-transmission
|
||||
User=PH_NAS_USER
|
||||
Type=notify
|
||||
ExecStart=/usr/bin/transmission-daemon -f --log-error -a PH_AUTHORIZED_ADDRESSES -C -t -u PH_USER -v PH_PASSWORD -w PH_DL_LOCATION
|
||||
ExecStop=/bin/kill -s STOP $MAINPID
|
||||
@ -13,4 +13,4 @@ ExecReload=/bin/kill -s HUP $MAINPID
|
||||
NoNewPrivileges=true
|
||||
|
||||
[Install]
|
||||
WantedBy=multi-user.target
|
||||
WantedBy=default.target
|
||||
@ -2,7 +2,22 @@
|
||||
|
||||
# Copy this file as variables.conf, with the correct values
|
||||
|
||||
nas_location=""
|
||||
nas_user=""
|
||||
|
||||
# Set up File Browser
|
||||
filebrowser="yes"
|
||||
|
||||
# Set up MiniDLNA
|
||||
dlna_server="yes"
|
||||
|
||||
# Set up Transmission and OpenVPN
|
||||
dl_server="yes"
|
||||
real_ip="" # for VPN check
|
||||
authorized_ips="" # for transmission web interface
|
||||
user="" # user for transmission web interface
|
||||
password="" # password for transmission web interface
|
||||
dl_location="" # location of Downloads directory
|
||||
|
||||
# Set up vsftpd
|
||||
ftp_server="no"
|
||||
|
||||
Reference in New Issue
Block a user