Silverbox: GNU/Linux Home Server

some-command --with --some --arguments
example command output

File content goes here

sudo timedatectl set-timezone {YOUR_TIMEZONE}

timedatectl list-timezones

GRUB_CMDLINE_LINUX="ipv6.disable=1"
GRUB_CMDLINE_LINUX_DEFAULT="ipv6.disable=1"

sudo update-grub

dmesg | grep IPv6
IPv6: Loaded, but administratively disabled, reboot required to enable

ethernets:
  enp2s0: (1)
    addresses: [ {SERVER_IP_ADDR}/24 ] (2)
    gateway4: {SERVER_DEFAULT_GATEWAY}
    nameservers:
      addresses: [ 127.0.0.1 ] (3)
    dhcp4: no

sudo netplan apply

net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.send_redirects = 0
net.ipv4.conf.all.accept_source_route = 0

sudo apt autoremove --purge snapd

sudo apt autoremove --purge lxd lxcfs liblxc-common lxd-client

sudo hdparm -I /dev/sda | grep TRIM
* Data Set Management TRIM supported (limit 8 blocks)

sudo hdparm -W /dev/sda (1)
/dev/sda:
 write-caching =  1 (on)

sudo hdparm -i /dev/sda | grep WriteCache (1)
... WriteCache=enabled ...

sysctl vm.swappiness
vm.swappiness = 60

...
vm.swappiness = 40
...

tmpfs /tmp tmpfs defaults,noatime,nosuid,nodev,noexec,mode=1777,size=2G 0 0

tmpfs    2.0G  0  2.0G   0% /tmp

sudo apt install hddtemp

sudo apt install smartmontools --no-install-recommends

sudo apt install nut

sudo apt install openssh-server

ssh-keygen -t ed25519 -f ~/.ssh/silverbox-key -C "Silverbox key"

ssh-copy-id -i ~/.ssh/silverbox-key {SERVER_USER}@{SERVER_IP_ADDR}

AddressFamily inet
Protocol 2

HostKey /etc/ssh/ssh_host_ed25519_key
HostKey /etc/ssh/ssh_host_rsa_key

KexAlgorithms curve25519-sha256@libssh.org
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes256-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

LogLevel VERBOSE

LoginGraceTime 1m
PermitRootLogin no
MaxAuthTries 4
MaxSessions 5

ClientAliveCountMax 2
ClientAliveInterval 60
TCPKeepAlive no

AuthenticationMethods publickey

PubkeyAuthentication yes

HostbasedAuthentication no
IgnoreRhosts yes

PasswordAuthentication no
PermitEmptyPasswords no

ChallengeResponseAuthentication no

X11Forwarding no
AllowAgentForwarding no
AllowTcpForwarding local

Banner none
DebianBanner none

AllowUsers {SERVER_USER}

sudo systemctl restart sshd

sudo apt install monit

systemctl status monit

sudo mkdir -p /usr/local/etc/monit/scripts

set daemon 60
  with start delay 60

#!/bin/sh

if [ $# -lt 1 ]; then
    PERIOD="week"
else
    PERIOD="$1"
fi

case $PERIOD in
    day | week | month)
        ;;
    *)
        echo "Unknown time period: $PERIOD. Defaulting to week." 1>&2
        PERIOD="week"
        ;;
esac

SINCE_DATE=`date --date="1 $PERIOD ago" +"%F %T"`

MAIN_DISK=$(readlink -f "/dev/disk/by-uuid/{PART_UUID}") (1)

echo "Subject: System Summary Report ($PERIOD)"
echo ""
echo "Report Period:    $PERIOD"
echo "Report Generated: $(date)"
echo "Uptime:          $(uptime)"
echo "Memory Usage:     RAM: $(free -m | grep Mem | awk '{print $3/$2 * 100}')%, Swap: $(free -m | grep Swap | awk '{print $3/$2 * 100}')%"
echo "Disk (main):      Temp: $(hddtemp -n SATA:"$MAIN_DISK"), Health: $(smartctl -H "$MAIN_DISK" | grep overall-health | sed 's/^.\+:\s\+//')"

echo "--------------------------------------------------------------------------------"
df -h

echo "--------------------------------------------------------------------------------"
echo "Temperatures:"
sensors -A

echo "--------------------------------------------------------------------------------"
echo "Top CPU:"
ps -eo pid,user,%cpu,%mem,cmd --sort=-%cpu | head

echo "--------------------------------------------------------------------------------"
echo "Top RAM:"
ps -eo pid,user,%cpu,%mem,cmd --sort=-%mem | head

echo "--------------------------------------------------------------------------------"
echo "SSH logins during this $PERIOD:"
last -s "$SINCE_DATE"

echo "--------------------------------------------------------------------------------"
echo "Last user logins:"
lastlog | grep -iv "Never logged in"

echo "--------------------------------------------------------------------------------"
echo "Logged errors:"
journalctl --since "$SINCE_DATE" -p err --no-pager

sudo chmod u+x /usr/local/sbin/system-summary.sh

sudo apt install ssmtp

root={YOUR_EMAIL_ADDR} (1)

mailhub={SMTP_SERVER_ADDR}:{SMTP_SERVER_PORT} (2)

UseTLS=Yes
UseSTARTTLS=Yes

[Unit]
Description=Email system summary report
After=network-online.target

[Service]
Type=oneshot
ExecStart=/bin/sh -c '/usr/local/sbin/system-summary.sh | ssmtp root'

sudo systemctl daemon-reload
sudo systemctl start system-summary-report.service

[Unit]
Description=Email system summary report

[Timer]
OnCalendar=Fri 18:00 (1)
AccuracySec=1h
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable system-summary-report.timer
sudo systemctl start system-summary-report.timer

sudo systemctl list-timers

sudo ufw allow proto tcp from {SERVER_SUBNET} to any port 53 comment "DNS TCP"
sudo ufw allow proto udp from {SERVER_SUBNET} to any port 53 comment "DNS UDP"

sudo curl -L "https://github.com/docker/compose/releases/download/{COMPOSE_VERSION}/docker-compose-$(uname -s)-$(uname -m)" -o /usr/libexec/docker/cli-plugins/docker-compose (1)

sudo chmod +x /usr/libexec/docker/cli-plugins/docker-compose

docker compose version

sudo mkdir /root/silverbox
sudo chmod 700 /root/silverbox

sudo mkdir /root/silverbox/vpn
sudo chmod 700 /root/silverbox/vpn

sudo mkdir /root/silverbox/vpn/auth
sudo chmod 700 /root/silverbox/vpn/auth

sudo chmod 400 /root/silverbox/vpn/auth/credentials

sudo mkdir /root/silverbox/vpn/proxy
sudo chmod 700 /root/silverbox/vpn/proxy

sudo docker network create --driver=bridge --subnet={DOCKER_VPN_NETWORK} vpn (1)

sudo mkdir /root/silverbox/containers
sudo chmod 700 /root/silverbox/containers

sudo mkdir /root/silverbox/containers/vpn-proxy
sudo chmod 700 /root/silverbox/containers/vpn-proxy

sudo mkdir /root/silverbox/containers/vpn-proxy/host-key
sudo chmod 700 /root/silverbox/containers/vpn-proxy/host-key

version: '3.8'

networks:
  default:
    name: vpn
    external: true

services:
  vpn-proxy:
    container_name: vpn-proxy
    init: true
    build:
      context: /root/silverbox/containers/vpn-proxy
      args:
        version: '11.5-slim' (1)
    restart: on-failure:15
    logging:
      driver: json-file
      options:
        max-size: 10mb
    ports:
      - {SERVER_IP_ADDR}:{VPN_PROXY_PORT}:{VPN_PROXY_PORT}/tcp (2)
    networks:
      default:
        ipv4_address: {VPN_PROXY_ADDR} (3)
    devices:
      - /dev/net/tun
    cap_add:
      - NET_ADMIN
    volumes:
      - /root/silverbox/vpn/proxy:/vpn-profiles
      - /root/silverbox/vpn/auth:/vpn-credentials
      - /root/silverbox/containers/vpn-proxy/host-key:/ssh-host-key

ARG version=latest

FROM debian:$version

RUN apt-get update && \
    apt-get install -y --no-install-recommends bash iputils-ping iptables openvpn openssh-server && \
    addgroup --system vpn && \
    adduser proxytunnel --disabled-password --gecos "" --shell /usr/sbin/nologin && \
    mkdir /var/run/sshd

COPY docker-entrypoint.sh /usr/local/bin/
COPY sshd_config /etc/ssh/
COPY --chown=proxytunnel:proxytunnel proxy_tunnel.pub /home/proxytunnel

HEALTHCHECK --interval=120s --timeout=20s --start-period=120s CMD ping 1.1.1.1 -c 1 (1)

VOLUME ["/vpn-profiles", "/vpn-credentials"]

EXPOSE {VPN_PROXY_PORT}/tcp (2)

ENTRYPOINT [ "/usr/local/bin/docker-entrypoint.sh" ]

Protocol 2

HostKey /etc/ssh/ssh_host_ed25519_key

KexAlgorithms curve25519-sha256@libssh.org
Ciphers aes128-gcm@openssh.com (1)
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com

AddressFamily inet
ListenAddress {VPN_PROXY_ADDR}:{VPN_PROXY_PORT} (2)

LogLevel ERROR
LoginGraceTime 1m
PermitRootLogin no
MaxAuthTries 4
MaxSessions 5
AuthenticationMethods publickey
PubkeyAuthentication yes
HostbasedAuthentication no
IgnoreRhosts yes
PasswordAuthentication no
PermitEmptyPasswords no
ChallengeResponseAuthentication no
X11Forwarding no
Banner none
AllowAgentForwarding no
AllowTcpForwarding yes
PermitTTY no

AllowUsers proxytunnel
AuthorizedKeysFile /home/proxytunnel/proxy_tunnel.pub

#!/usr/bin/env bash

function configure_iptables()
{
    set -e

    local config_file="$1"
    local host=$(awk '/^remote / {print $2}' "$config_file")
    local port=$(awk '/^remote / && NF ~ /^[0-9]*$/ {print $NF}' "$config_file")

    if [ -z "$port" ]; then
        echo "-- No port number specified in the VPN profile file"
        exit 1
    else
        echo "-- Setting up firewall rules for VPN server $host on port $port"
    fi

    iptables --flush
    iptables --delete-chain

    iptables --policy INPUT DROP
    iptables --policy OUTPUT DROP
    iptables --policy FORWARD DROP

    iptables -A INPUT -i lo -j ACCEPT
    iptables -A INPUT -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
(1)
    iptables -A INPUT -p tcp --dport {VPN_PROXY_PORT} -m conntrack --ctstate NEW -m recent --set --name SSH --mask 255.255.255.255 --rsource
    iptables -A INPUT -p tcp --dport {VPN_PROXY_PORT} -m conntrack --ctstate NEW -m recent --update --seconds 30 --hitcount 6 --name SSH --mask 255.255.255.255 --rsource -j DROP
    iptables -A INPUT -p tcp --dport {VPN_PROXY_PORT} -m conntrack --ctstate NEW -j ACCEPT

    iptables -A OUTPUT -o lo -j ACCEPT
    iptables -A OUTPUT -o tun0 -j ACCEPT
    iptables -A OUTPUT -o eth0 -d {SERVER_SUBNET} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT (2)
    iptables -A OUTPUT -o eth0 -p tcp -d $host --dport $port -m owner --gid-owner vpn -j ACCEPT

    set +e
}

function run_sshd()
{
    set -e

    if [ ! -f "/etc/ssh/ssh_host_ed25519_key" ]; then
        if [ ! -f "/ssh-host-key/ssh_host_ed25519_key" ]; then
          echo "-- Generating host key"
          ssh-keygen -f /etc/ssh/ssh_host_ed25519_key -N '' -t ed25519
          cp /etc/ssh/ssh_host_ed25519_key /ssh-host-key/ssh_host_ed25519_key
        else
          cp /ssh-host-key/ssh_host_ed25519_key /etc/ssh/ssh_host_ed25519_key
        fi
    fi

    echo "-- Adding route back to LAN"
    ip route add {SERVER_SUBNET} via {DOCKER_VPN_NETWORK_GW} (3)

    echo "-- Starting SSH server"
    /usr/sbin/sshd

    set +e
}

if [[ $# -ge 1 ]]; then
    exec "$@"
else
    if [ -f /vpn-profiles/profile ]; then
        echo "-- Profile file found: only it will be used"
        PROFILE_FILE="/vpn-profiles/profile"
    else
        echo "-- Profile file not found: random profile file will be picked"
        PROFILE_FILE="$(ls -1 /vpn-profiles/*.ovpn | shuf -n 1)"
        echo "-- Selected profile file: $PROFILE_FILE"
    fi

    configure_iptables "$PROFILE_FILE"
    run_sshd

    exec sg vpn -c "openvpn --config $PROFILE_FILE --verb 1 --auth-user-pass /vpn-credentials/credentials --auth-nocache"
fi

sudo chmod a+x docker-entrypoint.sh

ssh-keygen -t ed25519 -f ~/.ssh/silverbox-proxy-tunnel -C "Silverbox proxy tunnel key"

scp ~/.ssh/silverbox-proxy-tunnel.pub $USER@{SERVER_IP_ADDR}:proxy_tunnel.pub

sudo chown root:root proxy_tunnel.pub
sudo chmod 400 proxy_tunnel.pub

sudo docker compose -f /root/silverbox/containers/vpn-proxy/docker-compose.yaml up -d

[Unit]
Description=Start VPN proxy container
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
ExecStart=/usr/bin/docker start vpn-proxy

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable vpn-proxy-start.service

[Unit]
Description=Restart VPN proxy container
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
ExecStart=/usr/bin/docker restart vpn-proxy

sudo systemctl daemon-reload
sudo systemctl start vpn-proxy-restart.service

[Unit]
Description=Restart VPN proxy container

[Timer]
OnCalendar=*-*-* 01:00:00
AccuracySec=1h
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable vpn-proxy-restart.timer
sudo systemctl start vpn-proxy-restart.timer

#!/bin/bash

while true; do
    ssh -N silverbox-proxy-tunnel &>/dev/null
    notify-send --urgency=normal -i error "VPN proxy tunnel disconnected. Retrying in 20 seconds."
    sleep 20s
done

chmod a+x vpn-proxy-tunnel.sh

sudo docker network create --driver=bridge --subnet={DOCKER_COMMON_NETWORK} common (1)

sudo mkdir /root/silverbox/containers/dns-updater
sudo chmod 700 /root/silverbox/containers/dns-updater

FROM debian:11.5-slim (1)

RUN apt-get update && \
    apt-get install -y --no-install-recommends python3 ca-certificates

COPY update-dns.py /usr/local/bin/

VOLUME /secrets (2)

ENTRYPOINT [ "python3", "/usr/local/bin/update-dns.py" ]

#!/usr/bin/env python3
import json
import argparse
import urllib.request
import urllib.parse
from xml.dom import minidom

DEFAULT_HEADERS={ 'User-Agent': 'curl/7.58.0' } (1)

def namesilo_url(operation, api_key):
    return 'https://www.namesilo.com/api/' + operation + '?version=1&type=xml&key=' + api_key

def check_reply_code(doc, code):
    actual=doc.getElementsByTagName('reply')[0].getElementsByTagName('code')[0].firstChild.nodeValue
    if actual != str(code):
        raise BaseException('Expecting code {} got {}'.format(code, actual))

def get_dns_record(rec_type, subdomain, domain, api_key):
    response=urllib.request.urlopen(urllib.request.Request(url=(namesilo_url('dnsListRecords', api_key) + '&domain=' + domain), headers=DEFAULT_HEADERS), timeout=30)
    doc=minidom.parseString(response.read())
    check_reply_code(doc, 300)
    for e in doc.getElementsByTagName('reply')[0].getElementsByTagName('resource_record'):
        if e.getElementsByTagName('host')[0].firstChild.nodeValue == subdomain and e.getElementsByTagName('type')[0].firstChild.nodeValue == rec_type:
            return { 'val': e.getElementsByTagName('value')[0].firstChild.nodeValue,
                     'id':  e.getElementsByTagName('record_id')[0].firstChild.nodeValue,
                     'ttl': e.getElementsByTagName('ttl')[0].firstChild.nodeValue }
    raise BaseException('DNS {} record for {} not found'.format(rec_type, subdomain))

def update_dns_record(rec_type, subdomain, domain, rec_id, val, ttl, api_key):
    params='&domain={}&rrid={}&rrhost={}&rrvalue={}&rrttl={}'.format(domain, rec_id, '.'.join(subdomain.split('.')[:-2]), val, ttl)
    response=urllib.request.urlopen(urllib.request.Request(url=(namesilo_url('dnsUpdateRecord', api_key) + params), headers=DEFAULT_HEADERS), timeout=30)
    check_reply_code(minidom.parseString(response.read()), 300)

def main(rec_type, val, subdomain, domain, api_key, force, verbose):
    if rec_type == 'A':
        val=json.loads(urllib.request.urlopen(url='https://api.ipify.org?format=json', timeout=30).read())['ip'] (2)
        if verbose:
            print('Current external IP address: {}'.format(val))

    current_record=get_dns_record(rec_type, subdomain, domain, api_key)
    if verbose:
        print('Current DNS {} record for {}: "{}"'.format(rec_type, subdomain, current_record))

    if val != current_record['val'] or force:
        update_dns_record(rec_type, subdomain, domain, current_record['id'], val, current_record['ttl'], api_key)
        print('{} record for {} updated: "{}" -> "{}"'.format(rec_type, subdomain, current_record['val'], val))

if __name__ == '__main__':
    parser=argparse.ArgumentParser()
    parser.add_argument('-v', '--verbose', help='verbose output', action='store_true')
    parser.add_argument('-f', '--force', help='force DNS record update (even if it contains the same value)', action='store_true')
    parser.add_argument('-d', '--domain', help='fully qualified domain name for which to update a record (i.e. server.example.com)', required=True)
    parser.add_argument('-a', '--action', help='action to perform: update host A record with the current external IP or update TXT record with a given value', required=True, choices=[ 'update-ip', 'update-txt' ])
    parser.add_argument('-t', '--txt', help='content of the TXT record', default='')
    parser.add_argument('-k', '--key', help='file name of the file containing API key', required=True)
    args=parser.parse_args()

    with open(args.key) as f:
        api_key=f.readline().strip()

    main('A' if args.action == 'update-ip' else 'TXT', args.txt, args.domain, '.'.join(args.domain.split('.')[-2:]), api_key, args.force, args.verbose)

sudo mkdir /root/silverbox/namesilo

sudo chown root:root /root/silverbox/namesilo/api-key
sudo chmod 400 /root/silverbox/namesilo/api-key
sudo chmod 500 /root/silverbox/namesilo

sudo docker build -t dns-updater --network common /root/silverbox/containers/dns-updater

[Unit]
Description=Update DNS Host A record with the current external IP address
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
ExecStart=/usr/bin/docker run --rm --name dns-updater --network common --cpus="1" -v /root/silverbox/namesilo:/secrets dns-updater -k /secrets/api-key -a update-ip -d {SERVER_SUBDOMAIN} (1)

sudo systemctl daemon-reload
sudo systemctl start update-dns-record.service

[Unit]
Description=Update DNS Host A record with the current external IP address

[Timer]
OnBootSec=5min (1)
OnUnitInactiveSec=30min (2)

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable update-dns-record.timer
sudo systemctl start update-dns-record.timer

local-zone: "{INTERNAL_DOMAIN}." static (1)
local-data: "silverbox.{INTERNAL_DOMAIN}. IN A {SERVER_IP_ADDR}" (2)
local-data: "client-pc.{INTERNAL_DOMAIN}. IN A {CLIENT_PC_IP_ADDR}" (3)
local-data-ptr: "{SERVER_IP_ADDR} silverbox.{INTERNAL_DOMAIN}" (4)
local-data-ptr: "{CLIENT_PC_IP_ADDR} client-pc.{INTERNAL_DOMAIN}" (5)

sudo systemctl restart unbound.service

nslookup silverbox.{INTERNAL_DOMAIN}
nslookup client-pc.{INTERNAL_DOMAIN}
nslookup {SERVER_IP_ADDR}
nslookup {CLIENT_PC_IP_ADDR}

search {INTERNAL_DOMAIN}

nslookup silverbox
nslookup client-pc

127.0.1.1   silverbox.{INTERNAL_DOMAIN} silverbox

sudo apt install krb5-kdc

[kdcdefaults]
    kdc_ports = 88

[realms]
    {INTERNAL_DOMAIN} = { (1)
        kdc_ports = 88
        max_life = 24h 0m 0s
        max_renewable_life = 7d 0h 0m 0s (2)
        master_key_type = aes256-cts
        supported_enctypes = aes256-cts:normal aes128-cts:normal
    }

sudo kdb5_util create -s

[libdefaults]
    default_realm = {INTERNAL_DOMAIN} (1)
    allow_weak_crypto = false
    ccache_type = 4
    kdc_timesync = 1
[realms]
    {INTERNAL_DOMAIN} = { (2)
        kdc = silverbox.{INTERNAL_DOMAIN} (3)
        admin_server = silverbox.{INTERNAL_DOMAIN} (4)
    }

sudo systemctl start krb5-kdc

sudo apt install krb5-admin-server

sudo systemctl disable krb5-admin-server.service

addprinc {SERVER_USER} (1)

sudo ufw allow proto tcp from {SERVER_SUBNET} to any port 88 comment 'Kerberos TCP' (1)
sudo ufw allow proto udp from {SERVER_SUBNET} to any port 88 comment 'Kerberos UDP' (2)

sudo apt install krb5-user

sudo apt install nfs-kernel-server

sudo groupadd {NFS_SHARE_GROUP}

sudo usermod -a -G {NFS_SHARE_GROUP} {SERVER_USER}

sudo mkdir -p /srv/nfs
sudo chown root:{NFS_SHARE_GROUP} /srv/nfs
sudo chmod 770 /srv/nfs

/srv/nfs {SERVER_SUBNET}(rw,sync,crossmnt,no_subtree_check,root_squash,fsid=0,sec=krb5) (1)

sudo systemctl restart nfs-server

nfsdcltrack Failed to init database: -13

sudo mkdir -p /var/lib/nfs/nfsdcltrack
sudo nfsdcltrack init

sudo cat /proc/fs/nfsd/versions

RPCMOUNTDOPTS="--manage-gids -N2 -N3 -V4 --no-udp"
NEED_SVCGSSD="yes"
RPCNFSDOPTS="-N2 -N3 -V4 --no-udp"

sudo systemctl stop {rpcbind,rpc-gssd}.service rpcbind.socket
sudo systemctl disable {rpcbind,rpc-gssd}.service rpcbind.socket
sudo systemctl mask {rpcbind,rpc-gssd}.service rpcbind.socket

sudo netstat -lnptu

sudo ufw allow proto tcp from {SERVER_SUBNET} to any port 2049 comment 'NFSv4 Server' (1)

options nfsd nfs4_disable_idmapping=0

cat /sys/module/nfsd/parameters/nfs4_disable_idmapping

addprinc -randkey nfs/silverbox.{INTERNAL_DOMAIN} (1)
ktadd nfs/silverbox.{INTERNAL_DOMAIN} (2)

sudo systemctl status rpc-svcgssd.service

sudo apt install nfs-common

options nfs nfs4_disable_idmapping=0

sudo modprobe nfs
cat /sys/module/nfs/parameters/nfs4_disable_idmapping

sudo kadmin.local
addprinc -randkey nfs/client-pc.{INTERNAL_DOMAIN} (1)
ktadd -k /root/krb5.keytab nfs/client-pc.{INTERNAL_DOMAIN} (2)

sudo chown root:root /etc/krb5.keytab
sudo chmod 600 /etc/krb5.keytab

NEED_GSSD="yes"

sudo systemctl status rpc-gssd.service

sudo systemctl stop rpcbind.service rpcbind.socket
sudo systemctl disable rpcbind.service rpcbind.socket
sudo systemctl mask rpcbind.service rpcbind.socket

sudo groupadd {NFS_SHARE_GROUP}
sudo usermod -a -G {NFS_SHARE_GROUP} {SERVER_USER}

sudo mkdir /mnt/nfs

sudo mount -t nfs4 -o proto=tcp,port=2049,sec=krb5 silverbox.{INTERNAL_DOMAIN}:/ /mnt/nfs -vvvv

mount.nfs4: timeout set for ...
mount.nfs4: trying text-based options 'proto=tcp,port=2049,sec=krb5,vers=4.2,addr=xxx.xxx.xxx.xxx,clientaddr=xxx.xxx.xxx.xxx'

silverbox.{INTERNAL_DOMAIN}:/ /mnt/nfs nfs4 proto=tcp,port=2049,sec=krb5,lazytime,auto,_netdev,x-gvfs-show 0 0 (1)

sudo kadmin.local
ktadd -k /root/krb5.keytab {SERVER_USER}

chown {SERVER_USER}:{SERVER_USER} ~/.config/krb5.keytab
chmod 400 ~/.config/krb5.keytab

mkdir -p ~/.local/share/systemd/user/

[Unit]
Description=Perform kinit automatically

[Service]
Type=oneshot
ExecStart=/bin/bash -c "kinit -r 7d -k -t ~/.config/krb5.keytab $USER" (1)

[Install]
WantedBy=default.target

systemctl --user daemon-reload
systemctl --user enable kinit.service

sudo mkdir /root/silverbox/vpn/transmission
sudo chmod 700 /root/silverbox/vpn/transmission

mkdir -p /srv/nfs/torrents/torrentfiles (1)
mkdir -p /srv/nfs/torrents/downloads (2)
chown {SERVER_USER}:{NFS_SHARE_GROUP} -R /srv/nfs/torrents
chmod 770 -R /srv/nfs/torrents

sudo mkdir /root/silverbox/containers/transmission
sudo chmod 700 /root/silverbox/containers/transmission

version: '3.8'

networks:
  default:
    name: vpn
    external: true

services:
  transmission:
    container_name: transmission
    init: true
    build:
      context: /root/silverbox/containers/transmission
      args:
        version: '11.5-slim' (1)
    restart: on-failure:15
    logging:
      driver: json-file
      options:
        max-size: 10mb
    ports:
      - 127.0.0.1:{TRANSMISSION_UI_PORT}:{TRANSMISSION_UI_PORT}/tcp (2)
    networks:
      default:
        ipv4_address: {TRANSMISSION_ADDR} (3)
    devices:
      - /dev/net/tun
    cap_add:
      - NET_ADMIN
    volumes:
      - /srv/nfs/torrents:/data
      - /root/silverbox/vpn/transmission:/vpn-profiles
      - /root/silverbox/vpn/auth:/vpn-credentials

ARG version=latest

FROM debian:$version

ARG UID={USER_ID} (1)
ARG GID={GROUP_ID} (2)

RUN apt-get update && \
    apt-get install -y --no-install-recommends bash iputils-ping iptables openvpn transmission-daemon && \
    addgroup --system vpn && \
    addgroup --gid ${GID} transmission && \
    adduser transmission --uid ${UID} --gid ${GID} --disabled-login --no-create-home --gecos "" --shell /usr/sbin/nologin && \
    mkdir /config && chown transmission:transmission /config

COPY docker-entrypoint.sh /usr/local/bin/
COPY start-transmission.sh /usr/local/bin/
COPY --chown=transmission:transmission settings.json /config/

HEALTHCHECK --interval=120s --timeout=20s --start-period=120s CMD ping 1.1.1.1 -c 1 (3)

VOLUME ["/vpn-profiles", "/vpn-credentials", "/data"]

EXPOSE {TRANSMISSION_UI_PORT}/tcp (4)

ENTRYPOINT [ "/usr/local/bin/docker-entrypoint.sh" ]

#!/bin/bash

echo "-- Preparing to start transmission-daemon..."

if [ -f /config/transmission.log ]; then
    echo "-- Cleaning log file..."
    tail -c 10000000 /config/transmission.log > /config/transmission.log.trunc
    mv /config/transmission.log.trunc /config/transmission.log
    chown transmission:transmission /config/transmission.log
fi

TUN_IP=$(ip address show dev tun0 | awk '/inet/{ split($2, a, "/"); print a[1] }')
if [ -z "$TUN_IP" ]; then
    echo "-- Failed to get tun0 IP address"
    exit 1
else
    echo "-- tun0 address: [$TUN_IP]. Updating config file."
    sed -i "s/\(\"bind-address-ipv4\":\)\s\+\".\+\",/\1 \"$TUN_IP\",/" /config/settings.json
    echo "-- Starting transmission-daemon..."
    su transmission -s /bin/bash -c "transmission-daemon -g /config --logfile /config/transmission.log"
    if [ $? -ne 0 ]; then
        echo "-- Failed to start transmission"
        exit 1
    else
        echo "-- Transmission started"
    fi
fi

sudo chmod a+x start-transmission.sh

#!/usr/bin/env bash

function configure_iptables()
{
    set -e

    local config_file="$1"
    local host=$(awk '/^remote / {print $2}' "$config_file")
    local port=$(awk '/^remote / && NF ~ /^[0-9]*$/ {print $NF}' "$config_file")

    if [ -z "$port" ]; then
        echo "-- No port number specified in the VPN profile file"
        exit 1
    else
        echo "-- Setting up firewall rules for VPN server $host on port $port"
    fi

    iptables --flush
    iptables --delete-chain

    iptables --policy INPUT DROP
    iptables --policy OUTPUT DROP
    iptables --policy FORWARD DROP

    iptables -A INPUT -i lo -j ACCEPT
    iptables -A INPUT -i tun0 -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    iptables -A INPUT -i eth0 -p tcp -s $host --sport $port -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT
    iptables -A INPUT -i eth0 -p tcp -s {VPN_NETWORK_GW} --dport {TRANSMISSION_UI_PORT} -j ACCEPT (1)

    iptables -A OUTPUT -o lo -j ACCEPT
    iptables -A OUTPUT -o tun0 -j ACCEPT
    iptables -A OUTPUT -o eth0 -d {VPN_NETWORK_GW} -p tcp --sport {TRANSMISSION_UI_PORT} -m conntrack --ctstate ESTABLISHED,RELATED -j ACCEPT (2)
    iptables -A OUTPUT -o eth0 -p tcp -d $host --dport $port -m owner --gid-owner vpn -j ACCEPT

    set +e
}

if [[ $# -ge 1 ]]; then
    exec "$@"
else
    if [ -f /vpn-profiles/profile ]; then
        echo "-- Profile file found: only it will be used"
        PROFILE_FILE="/vpn-profiles/profile"
    else
        echo "-- Profile file not found: random profile file will be picked"
        PROFILE_FILE="$(ls -1 /vpn-profiles/*.ovpn | shuf -n 1)"
        echo "-- Selected profile file: $PROFILE_FILE"
    fi

    configure_iptables "$PROFILE_FILE"

    exec sg vpn -c "openvpn --config $PROFILE_FILE --verb 1 --auth-user-pass /vpn-credentials/credentials --auth-nocache --script-security 2 --route-up /usr/local/bin/start-transmission.sh"
fi

sudo chmod a+x docker-entrypoint.sh

{
    "rpc-enabled": true,
    "rpc-bind-address": "{TRANSMISSION_ADDR}", (1)
    "rpc-port": {TRANSMISSION_UI_PORT}, (2)
    "rpc-whitelist": "{VPN_NETWORK_GW}", (3)
    "rpc-whitelist-enabled": true,

    "alt-speed-enabled": false,
    "speed-limit-down-enabled": true,
    "speed-limit-down": 2500,
    "speed-limit-up-enabled": true,
    "speed-limit-up": 200,

    "blocklist-enabled": false,

    "download-dir": "/data/downloads",
    "incomplete-dir-enabled": false,
    "rename-partial-files": true,
    "start-added-torrents": true,
    "trash-original-torrent-files": true,
    "watch-dir-enabled": true,
    "watch-dir": "/data/torrentfiles",
    "umask": 7,

    "cache-size-mb": 16,
    "prefetch-enabled": true,

    "encryption": 1,

    "message-level": 2,

    "dht-enabled": true,
    "lpd-enabled": false,
    "pex-enabled": true,
    "utp-enabled": false,

    "bind-address-ipv4": "127.0.0.1",

    "peer-limit-global": 100,
    "peer-limit-per-torrent": 40,
    "peer-congestion-algorithm": "",

    "peer-port": 51413,
    "peer-port-random-on-start": false,
    "port-forwarding-enabled": false,

    "download-queue-enabled": true,
    "download-queue-size": 5,
    "queue-stalled-enabled": true,
    "queue-stalled-minutes": 30,
    "seed-queue-enabled": true,
    "seed-queue-size": 3,

    "alt-speed-time-enabled": false,
    "idle-seeding-limit-enabled": false,

    "ratio-limit-enabled": true,
    "ratio-limit": 1.2
}

sudo docker compose -f /root/silverbox/containers/transmission/docker-compose.yaml up -d

[Unit]
Description=Start Transmission container
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
ExecStart=/usr/bin/docker start transmission

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable transmission-start.service

[Unit]
Description=Restart Transmission container
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
ExecStart=/usr/bin/docker restart transmission

[Unit]
Description=Restart Transmission container

[Timer]
OnCalendar=Fri *-*-* 01:00:00 (1)
AccuracySec=1h
Persistent=true

[Install]
WantedBy=timers.target

sudo systemctl daemon-reload
sudo systemctl enable transmission-restart.timer
sudo systemctl start transmission-restart.timer

sudo add-apt-repository ppa:certbot/certbot
sudo apt install certbot

sudo mkdir /root/silverbox/certbot
sudo chmod 700 /root/silverbox/certbot

#!/bin/bash

ACME_SUBDOMAIN="_acme-challenge"
DOMAIN=`awk -F '.' '{print $(NF-1)"."$NF}' <<< "$CERTBOT_DOMAIN"` || exit 1
NS=`dig "$DOMAIN" NS +short | head -1` || exit 2
echo "Performing DNS Challenge for domain: $CERTBOT_DOMAIN in $DOMAIN with authoritative NS $NS"
docker run --rm --network common --cpus="1" -v /root/silverbox/namesilo:/secrets dns-updater -k /secrets/api-key -a update-txt -d "$ACME_SUBDOMAIN.$CERTBOT_DOMAIN" -t "$CERTBOT_VALIDATION" || exit 3

for i in {1..20}; do (1)
    echo "Checking if DNS updated, attempt $i..."
    TXT=`dig "@$NS" "$ACME_SUBDOMAIN.$CERTBOT_DOMAIN" TXT +short | sed 's/"//g'`
    if [ "$TXT" == "$CERTBOT_VALIDATION" ]; then
        echo "Record updated. Waiting extra minute before returning."
        sleep 60 (2)
        exit 0
    else
        echo "Record still contains '$TXT'. Waiting for 1 minute..."
        sleep 60 (3)
    fi
done

exit 4

#!/bin/bash

ACME_SUBDOMAIN="_acme-challenge"
DOMAIN=`awk -F '.' '{print $(NF-1)"."$NF}' <<< "$CERTBOT_DOMAIN"` || exit 1
NS=`dig "$DOMAIN" NS +short | head -1` || exit 2
echo "Performing DNS Challenge Cleanup for domain: $CERTBOT_DOMAIN in $DOMAIN with authoritative NS $NS"
docker run --rm --network common --cpus="1" -v /root/silverbox/namesilo:/secrets dns-updater -k /secrets/api-key -a update-txt -d "$ACME_SUBDOMAIN.$CERTBOT_DOMAIN" -t "none" || exit 3 (1)
echo "Record cleaned up"

sudo chmod 770 /root/silverbox/certbot/dns-challenge-auth.sh
sudo chmod 770 /root/silverbox/certbot/dns-challenge-cleanup.sh

sudo certbot certificates

#!/bin/bash
if [ "$CERTBOT_DOMAIN" = "{NEXTCLOUD_DOMAIN}" ]; then (1)
    echo "Restarting Nextcloud web server"
    docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml restart nextcloud-web
else
    echo "Skipping Nextcloud web server restart - different domain: $CERTBOT_DOMAIN"
fi

sudo chmod 770 /etc/letsencrypt/renewal-hooks/post/nextcloud-web-restart.sh

sudo apt install dnsutils

sudo certbot certonly --test-cert \
    --agree-tos \
    -m {YOUR_EMAIL_ADDR} \ (1)
    --manual \
    --preferred-challenges=dns \
    --manual-auth-hook /root/silverbox/certbot/dns-challenge-auth.sh \
    --manual-cleanup-hook /root/silverbox/certbot/dns-challenge-cleanup.sh \
    --must-staple \
    -d {NEXTCLOUD_DOMAIN} (2)

sudo certbot certificates

sudo certbot renew --test-cert --dry-run --cert-name {NEXTCLOUD_DOMAIN}

sudo certbot revoke --test-cert --cert-name {NEXTCLOUD_DOMAIN}

sudo certbot certonly \
    --agree-tos \
    -m {YOUR_EMAIL_ADDR} \
    --manual \
    --preferred-challenges=dns \
    --manual-auth-hook /root/silverbox/certbot/dns-challenge-auth.sh \
    --manual-cleanup-hook /root/silverbox/certbot/dns-challenge-cleanup.sh \
    --must-staple \
    -d {NEXTCLOUD_DOMAIN}

systemctl status certbot.timer

sudo mkdir -p /srv/nextcloud/db
sudo mkdir /srv/nextcloud/html
sudo mkdir /srv/nextcloud/data
sudo chown 33 /srv/nextcloud/data (1)
sudo chmod 750 -R /srv/nextcloud

sudo mkdir /root/silverbox/containers/nextcloud
sudo chmod 700 /root/silverbox/containers/nextcloud

version: '3.8'

networks:
  default:
    name: nextcloud
    driver: bridge
    ipam:
      config:
        - subnet: {DOCKER_NEXTCLOUD_NETWORK} (1)

services:
  nextcloud-db:
    container_name: nextcloud-db
    image: postgres:14.5 (2)
    restart: on-failure:5
    shm_size: 256mb
    logging:
      driver: json-file
      options:
        max-size: 10mb
        max-file: '3'
    volumes:
      - /srv/nextcloud/db:/var/lib/postgresql/data
    environment:
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD={POSTGRES_PASSWORD} (3)
      - POSTGRES_DB=nextcloud
      - POSTGRES_INITDB_ARGS="--data-checksums"

  nextcloud-fpm:
    container_name: nextcloud-fpm
    build:
      context: ./nextcloud-fpm
      args:
        version: '24.0.6-fpm' (4)
    restart: on-failure:5
    logging:
      driver: json-file
      options:
        max-size: 10mb
        max-file: '3'
    depends_on:
      - nextcloud-db
    volumes:
      - /srv/nextcloud/html:/var/www/html
      - /srv/nextcloud/data:/data
    environment:
      - POSTGRES_HOST=nextcloud-db
      - POSTGRES_DB=nextcloud
      - POSTGRES_USER=nextcloud
      - POSTGRES_PASSWORD={POSTGRES_PASSWORD} (5)
      - NEXTCLOUD_DATA_DIR=/data
      - NEXTCLOUD_UPDATE=1
      - NEXTCLOUD_TRUSTED_DOMAINS='{NEXTCLOUD_DOMAIN}:{NEXTCLOUD_PORT}' (6)

  nextcloud-web:
    container_name: nextcloud-web
    build:
      context: ./httpd
      args:
        version: '2.4.54' (7)
    restart: on-failure:5
    logging:
      driver: json-file
      options:
        max-size: 10mb
        max-file: '3'
    depends_on:
      - nextcloud-fpm
    volumes:
      - /srv/nextcloud/html:/usr/local/apache2/htdocs
      - /etc/letsencrypt/live/{NEXTCLOUD_DOMAIN}:/certs/live/{NEXTCLOUD_DOMAIN} (8)
      - /etc/letsencrypt/archive/{NEXTCLOUD_DOMAIN}:/certs/archive/{NEXTCLOUD_DOMAIN} (9)
    ports:
      - "{SERVER_IP_ADDR}:{NEXTCLOUD_PORT}:443" (10)

sudo ufw allow proto tcp to any port {NEXTCLOUD_PORT} comment "Nextcloud"

sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml up -d

sudo docker ps
sudo docker logs nextcloud-db
sudo docker logs nextcloud-web
sudo docker logs nextcloud-fpm

[Unit]
Description=Start Nextcloud
Requires=docker.service
After=docker.service

[Service]
Type=oneshot
ExecStart=/usr/bin/docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml up -d

[Install]
WantedBy=multi-user.target

sudo systemctl daemon-reload
sudo systemctl enable nextcloud-start.service

sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml exec --user www-data nextcloud-fpm php occ maintenance:mode --on
sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml exec --user www-data nextcloud-fpm php occ db:convert-filecache-bigint --no-interaction
sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml exec --user www-data nextcloud-fpm php occ maintenance:mode --off

'loglevel' => 1, (1)
'overwrite.cli.url' => 'https://{NEXTCLOUD_DOMAIN}:{NEXTCLOUD_PORT}', (2)
'htaccess.RewriteBase' => '/', (3)
'default_language' => 'en',
'default_locale' => 'en_CA',
'knowledgebaseenabled' => false, (4)
'token_auth_enforced' => true, (5)
'default_phone_region' => 'CA' (6)

sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml exec --user www-data nextcloud-fpm php occ maintenance:update:htaccess

sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml restart

...
nextcloud-fpm:
  ...
  volumes:
    ...
    - /srv/nfs/videos:/nfs/videos
    - /srv/nfs/photos:/nfs/photos
...

sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml stop
sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml kill nextcloud-fpm
sudo docker compose -f /root/silverbox/containers/nextcloud/docker-compose.yml up -d

autovacuum_naptime = 15min

sudo adduser --disabled-password --gecos "" --shell `which git-shell` git

sudo usermod -a -G gitusers git

sudo su --shell $SHELL git
cd
mkdir .ssh && chmod 700 .ssh
touch .ssh/authorized_keys && chmod 600 .ssh/authorized_keys
touch .hushlogin
exit

AllowUsers {SERVER_USER} git

sudo mkdir /srv/git/example
sudo chown git:gitusers /srv/git/example
sudo chmod 750 /srv/git/example

sudo su --shell $SHELL git
cd /srv/git/example
git init --bare --shared=0640 (1)

ssh-keygen -t ed25519 -f ~/.ssh/silverbox-git -C "Silverbox Git key"

scp ~/.ssh/silverbox-git.pub $USER@{SERVER_IP_ADDR}:.

sudo bash -c "printf '%s ' 'no-port-forwarding,no-X11-forwarding,no-agent-forwarding,no-pty' | cat - /home/$USER/silverbox-git.pub >> /home/git/.ssh/authorized_keys" (1)
rm silverbox-git.pub

host silverbox-git
  HostName {SERVER_IP_ADDR} (1)
  IdentityFile ~/.ssh/silverbox-git
  User git

git clone silverbox-git:/srv/git/example

#!/bin/bash
if [ "$CERTBOT_DOMAIN" = "{INTERNAL_DOMAIN}" ]; then (1)
    echo "Restarting reverse proxy server"
    docker compose -f /root/silverbox/containers/reverse-proxy/docker-compose.yml restart proxy
else
    echo "Skipping reverse proxy server restart - different domain: $CERTBOT_DOMAIN"
fi

sudo chmod 770 /etc/letsencrypt/renewal-hooks/post/reverse-proxy-restart.sh

sudo certbot certonly --test-cert \
    --agree-tos \
    -m {YOUR_EMAIL_ADDR} \ (1)
    --manual \
    --preferred-challenges=dns \
    --manual-auth-hook /root/silverbox/certbot/dns-challenge-auth.sh \
    --manual-cleanup-hook /root/silverbox/certbot/dns-challenge-cleanup.sh \
    --must-staple \
    -d *.{INTERNAL_DOMAIN} (2)

sudo certbot certificates

sudo certbot renew --test-cert --dry-run --cert-name {INTERNAL_DOMAIN}

sudo certbot revoke --test-cert --cert-name {INTERNAL_DOMAIN}

sudo certbot certonly \
    --agree-tos \
    -m {YOUR_EMAIL_ADDR} \ (1)
    --manual \
    --preferred-challenges=dns \
    --manual-auth-hook /root/silverbox/certbot/dns-challenge-auth.sh \
    --manual-cleanup-hook /root/silverbox/certbot/dns-challenge-cleanup.sh \
    --must-staple \
    -d *.{INTERNAL_DOMAIN} (2)

systemctl status certbot.timer

sudo mkdir /root/silverbox/containers/reverse-proxy
sudo chmod 700 /root/silverbox/containers/reverse-proxy

version: '3.8'

services:
  proxy:
    container_name: reverse-proxy
    image: 'httpd:2.4.54' (1)
    restart: on-failure:5
    network_mode: host (2)
    logging:
      driver: json-file
      options:
        max-size: 10mb
        max-file: '3'
    volumes:
      - /etc/letsencrypt/live/{INTERNAL_DOMAIN}:/certs/live/{INTERNAL_DOMAIN}:ro (3)
      - /etc/letsencrypt/archive/{INTERNAL_DOMAIN}:/certs/archive/{INTERNAL_DOMAIN}:ro (4)
      - ./httpd.conf:/usr/local/apache2/conf/httpd.conf:ro
      - ./htpasswd:/usr/local/apache2/.htpasswd:ro