mirror of
https://github.com/tommytran732/Linux-Setup-Scripts
synced 2024-09-07 16:23:30 -04:00
Compare commits
12 Commits
8d775f476f
...
a49ecc7dd5
Author | SHA1 | Date | |
---|---|---|---|
a49ecc7dd5 | |||
d0b40688a9 | |||
e0d297afa7 | |||
baeaf3a01d | |||
deb4cf4ce7 | |||
ba4f51674a | |||
00c53f3ee8 | |||
80641009b9 | |||
6486ea474a | |||
3cbb95a403 | |||
3a26940fb6 | |||
9fafe1704b |
@ -121,6 +121,11 @@ fi
|
||||
# Setup unbound
|
||||
sudo dnf install unbound -y
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/unbound/unbound.conf | sudo tee /etc/unbound/unbound.conf
|
||||
sudo sed -i 's; ip-transparent: yes;# ip-transparent: yes;g' /etc/unbound/unbound.conf
|
||||
sudo sed -i 's; interface: 127.0.0.1;# interface: 127.0.0.1;g' /etc/unbound/unbound.conf
|
||||
sudo sed -i 's; interface: ::1;# interface: ::1;g' /etc/unbound/unbound.conf
|
||||
sudo sed -i 's; interface: 242.242.0.1;# interface: 242.242.0.1;g' /etc/unbound/unbound.conf
|
||||
sudo sed -i 's; access-control: 242.242.0.0/16 allow;# access-control: 242.242.0.0/16 allow;g' /etc/unbound/unbound.conf
|
||||
sudo chmod 644 /etc/unbound/unbound.conf
|
||||
sudo mkdir /etc/systemd/system/unbound.service.d
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Fedora-CoreOS-Ignition/main/etc/systemd/system/unbound.service.d/override.conf | sudo tee /etc/systemd/system/unbound.service.d/override.conf
|
||||
|
@ -128,10 +128,11 @@ echo 'server:
|
||||
prefetch: yes
|
||||
prefetch-key: yes
|
||||
|
||||
ip-transparent: yes
|
||||
interface: 127.0.0.1
|
||||
interface: 242.242.0.1
|
||||
access-control: 242.242.0.0/16 allow
|
||||
# ip-transparent: yes
|
||||
# interface: 127.0.0.1
|
||||
# interface: ::1
|
||||
# interface: 242.242.0.1
|
||||
# access-control: 242.242.0.0/16 allow
|
||||
|
||||
forward-zone:
|
||||
name: "."
|
||||
|
@ -134,11 +134,7 @@ fi
|
||||
|
||||
# Setup unbound
|
||||
|
||||
sudo apt install -y unbound unbound-anchor
|
||||
sudo mkdir -p /usr/share/dns
|
||||
sudo chmod 755 /usr/share/dns
|
||||
sudo unbound-anchor
|
||||
sudo chmod 644 /usr/share/dns/root.key
|
||||
sudo apt install -y unbound dns-root-data
|
||||
|
||||
echo 'server:
|
||||
trust-anchor-signaling: yes
|
||||
@ -164,10 +160,11 @@ echo 'server:
|
||||
prefetch: yes
|
||||
prefetch-key: yes
|
||||
|
||||
ip-transparent: yes
|
||||
interface: 127.0.0.1
|
||||
interface: 242.242.0.1
|
||||
access-control: 242.242.0.0/16 allow
|
||||
# ip-transparent: yes
|
||||
# interface: 127.0.0.1
|
||||
# interface: ::1
|
||||
# interface: 242.242.0.1
|
||||
# access-control: 242.242.0.0/16 allow
|
||||
|
||||
forward-zone:
|
||||
name: "."
|
||||
@ -179,8 +176,6 @@ forward-zone:
|
||||
|
||||
sudo chmod 644 /etc/unbound/unbound.conf.d/custom.conf
|
||||
|
||||
sudo sed -i 's#/var/lib/unbound#/usr/share/dns#g' /etc/unbound/unbound.conf.d/root-auto-trust-anchor-file.conf
|
||||
|
||||
mkdir -p /etc/systemd/system/unbound.service.d
|
||||
echo $'[Service]
|
||||
CapabilityBoundingSet=CAP_NET_BIND_SERVICE CAP_SETGID CAP_SETUID CAP_SYS_CHROOT CAP_SYS_RESOURCE CAP_NET_RAW
|
||||
|
5
etc/apt/sources.list.d/docker.sources
Normal file
5
etc/apt/sources.list.d/docker.sources
Normal file
@ -0,0 +1,5 @@
|
||||
Types: deb
|
||||
Suites: noble
|
||||
URIs: https://download.docker.com/linux/ubuntu
|
||||
Components: stable
|
||||
Signed-By: /usr/share/keyrings/docker.asc
|
21
etc/apt/sources.list.d/mariadb.sources
Normal file
21
etc/apt/sources.list.d/mariadb.sources
Normal file
@ -0,0 +1,21 @@
|
||||
Types: deb
|
||||
URIs: https://dlm.mariadb.com/repo/mariadb-server/11.4/repo/ubuntu
|
||||
Suites: noble
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/mariadb-keyring-2019.gpg
|
||||
Architectures: amd64 arm64
|
||||
|
||||
# The jammy part is not a typo. They just haven't released it for noble yet.
|
||||
Types: deb
|
||||
URIs: https://dlm.mariadb.com/repo/maxscale/latest/apt
|
||||
Suites: jammy
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/mariadb-keyring-2019.gpg
|
||||
Architectures: amd64 arm64
|
||||
|
||||
Types: deb
|
||||
URIs: http://downloads.mariadb.com/Tools/ubuntu
|
||||
Suites: noble
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/mariadb-keyring-2019.gpg
|
||||
Architectures: amd64
|
5
etc/apt/sources.list.d/nginx.sources
Normal file
5
etc/apt/sources.list.d/nginx.sources
Normal file
@ -0,0 +1,5 @@
|
||||
Types: deb
|
||||
URIs: http://nginx.org/packages/mainline/ubuntu
|
||||
Suites: noble
|
||||
Components: nginx
|
||||
Signed-By: /usr/share/keyrings/nginx-archive-keyring.gpg
|
5
etc/apt/sources.list.d/vscode.sources
Normal file
5
etc/apt/sources.list.d/vscode.sources
Normal file
@ -0,0 +1,5 @@
|
||||
Types: deb
|
||||
Suites: stable
|
||||
URIs: https://packages.microsoft.com/repos/code
|
||||
Components: main
|
||||
Signed-By: /usr/share/keyrings/microsoft.gpg
|
5
sample-scripts/README.md
Normal file
5
sample-scripts/README.md
Normal file
@ -0,0 +1,5 @@
|
||||
# Sample Scripts
|
||||
|
||||
These are sample scripts to set up some common stacks, meant to be run after the main scripts have been run.
|
||||
|
||||
I am writing these for convenience and to do demos. I do not actually use them in production, so they will not be maintained properly like the main scripts.
|
116
sample-scripts/Ubuntu-24.04-LEMP.sh
Normal file
116
sample-scripts/Ubuntu-24.04-LEMP.sh
Normal file
@ -0,0 +1,116 @@
|
||||
#!/bin/bash
|
||||
|
||||
# Copyright (C) 2024 Thien Tran
|
||||
#
|
||||
# Licensed under the Apache License, Version 2.0 (the "License"); you may not
|
||||
# use this file except in compliance with the License. You may obtain a copy of
|
||||
# the License at
|
||||
#
|
||||
# http://www.apache.org/licenses/LICENSE-2.0
|
||||
#
|
||||
# Unless required by applicable law or agreed to in writing, software
|
||||
# distributed under the License is distributed on an "AS IS" BASIS, WITHOUT
|
||||
# WARRANTIES OR CONDITIONS OF ANY KIND, either express or implied. See the
|
||||
# License for the specific language governing permissions and limitations under
|
||||
# the License.
|
||||
|
||||
# Assumes that it is run AFTER https://github.com/TommyTran732/Linux-Setup-Scripts/blob/main/Ubuntu-24.04-Server.sh
|
||||
|
||||
output(){
|
||||
echo -e '\e[36m'"$1"'\e[0m';
|
||||
}
|
||||
|
||||
unpriv(){
|
||||
sudo -u nobody "$@"
|
||||
}
|
||||
|
||||
# Open ports
|
||||
sudo ufw allow 80/tcp
|
||||
sudo ufw allow 443
|
||||
|
||||
# Add mainline NGINX repo
|
||||
# This is extremely important as Ubuntu keeps shipping outdated NGINX
|
||||
sudo curl https://nginx.org/keys/nginx_signing.key | gpg --dearmor | sudo tee /usr/share/keyrings/nginx-archive-keyring.gpg >/dev/null
|
||||
sudo chmod 644 /usr/share/keyrings/nginx-archive-keyring.gpg
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/sources.list.d/nginx.sources | sudo tee /etc/apt/sources.list.d/nginx.sources
|
||||
chmod 644 /etc/apt/sources.list.d/nginx.sources
|
||||
|
||||
# Add the PHP PPA (Ubuntu repos do not have the latest version, and do not handle pinning properly)
|
||||
sudo add-apt-repository -y ppa:ondrej/php
|
||||
|
||||
# Add upstream MariaDB repo
|
||||
curl https://supplychain.mariadb.com/mariadb-keyring-2019.gpg | sudo tee /usr/share/keyrings/mariadb-keyring-2019.gpg
|
||||
chmod 644 /usr/share/keyrings/mariadb-keyring-2019.gpg
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/Linux-Setup-Scripts/main/etc/apt/sources.list.d/mariadb.sources | sudo tee /etc/apt/sources.list.d/mariadb.sources
|
||||
chmod 644 /etc/apt/sources.list.d/nginx.sources
|
||||
|
||||
# Update the VM again
|
||||
sudo apt update
|
||||
sudo apt full-upgrade -y
|
||||
|
||||
# Install the packages
|
||||
sudo apt install -y nginx mariadb-server mariadb-client php8.3 php8.3-cli php8.3-common php8.3-curl php8.3-fpm php8.3-gd php8.3-mbstring php8.3-mysql php8.3-opcache php8.3-readline php8.3-sqlite3 php8.3-xml php8.3-zip php8.3-apcu
|
||||
|
||||
# Install certbot
|
||||
sudo snap install --classic certbot
|
||||
sudo ln -s /snap/bin/certbot /usr/bin/certbot
|
||||
|
||||
# Secure MariaDB
|
||||
output "Running mariadb_secure_installation. You should answer yes to everything."
|
||||
mariadb_secure_installation
|
||||
|
||||
# Port NGINX configs from https://github.com/TommyTran732/NGINX-Configs
|
||||
|
||||
sudo rm -rf /etc/nginx/conf.d/default.conf
|
||||
|
||||
## Setup webroot for NGINX
|
||||
sudo mkdir -p /srv/nginx
|
||||
sudo mkdir -p /srv/nginx/.well-known/acme-challenge
|
||||
|
||||
## NGINX hardening
|
||||
sudo mkdir -p /etc/systemd/system/nginx.service.d
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/nginx.service.d/local.conf | sudo tee /etc/systemd/system/nginx.service.d/override.conf
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
## Setup certbot-ocsp-fetcher
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/certbot-ocsp-fetcher | sudo tee /usr/local/bin/certbot-ocsp-fetcher
|
||||
sudo mkdir -p /var/cache/certbot-ocsp-fetcher/
|
||||
|
||||
## Setup nginx-create-session-ticket-keys
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/nginx-create-session-ticket-keys | sudo tee /usr/local/bin/nginx-create-session-ticket-keys
|
||||
|
||||
## Setup nginx-rotate-session-ticket-keys
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/nginx-rotate-session-ticket-keys | sudo tee /usr/local/bin/nginx-rotate-session-ticket-keys
|
||||
|
||||
## Download the units
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/certbot-ocsp-fetcher.service | sudo tee /etc/systemd/system/certbot-ocsp-fetcher.service
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/certbot-ocsp-fetcher.timer | sudo tee /etc/systemd/system/certbot-ocsp-fetcher.timer
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/nginx-create-session-ticket-keys.service | sudo tee /etc/systemd/system/nginx-create-session-ticket-keys.service
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/nginx-rotate-session-ticket-keys.service | sudo tee /etc/systemd/system/nginx-rotate-session-ticket-keys.service
|
||||
unpriv curl https://raw.githubusercontent.com/GrapheneOS/infrastructure/main/systemd/system/nginx-rotate-session-ticket-keys.timer | sudo tee /etc/systemd/system/nginx-rotate-session-ticket-keys.timer
|
||||
|
||||
## Systemd Hardening
|
||||
sudo mkdir -p /etc/systemd/system/nginx.service.d
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/systemd/system/nginx.service.d/override.conf | sudo tee /etc/systemd/system/nginx.service.d/override.conf
|
||||
sudo systemctl daemon-reload
|
||||
|
||||
## Enable the units
|
||||
sudo systemctl enable certbot-ocsp-fetcher.timer
|
||||
sudo systemctl enable --now nginx-create-session-ticket-keys.service
|
||||
sudo systemctl enable --now nginx-rotate-session-ticket-keys.timer
|
||||
|
||||
## Download NGINX configs
|
||||
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/http2.conf | sudo tee /etc/nginx/conf.d/http2.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/sites_default.conf | sudo tee /etc/nginx/conf.d/sites_default.conf
|
||||
sudo sed -i 's/ipv4_1://g' /etc/nginx/conf.d/sites_default.conf
|
||||
sudo sed -i 's/ipv6_1/::/g' /etc/nginx/conf.d/sites_default.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/conf.d/tls.conf | sudo tee /etc/nginx/conf.d/tls.conf
|
||||
|
||||
sudo mkdir -p /etc/nginx/snippets
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/tls.conf | sudo tee /etc/nginx/snippets/tls.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/proxy.conf | sudo tee /etc/nginx/snippets/proxy.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/quic.conf | sudo tee /etc/nginx/snippets/quic.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/security.conf | sudo tee /etc/nginx/snippets/security.conf
|
||||
unpriv curl https://raw.githubusercontent.com/TommyTran732/NGINX-Configs/main/etc/nginx/snippets/universal_paths.conf | sudo tee /etc/nginx/snippets/universal_paths.conf
|
||||
|
Loading…
Reference in New Issue
Block a user