From d765ef17c0170aa471848342f32ecb7c6e0ab91d Mon Sep 17 00:00:00 2001 From: Andrew Stowell Date: Wed, 14 Oct 2020 19:06:58 +0000 Subject: [PATCH] new nextcloud install experimental script. along with ssh-config, and some other related updates. --- one-time-stuff/basic-settings.sh | 3 +- one-time-stuff/conf/include.conf | 3 + one-time-stuff/conf/nextcloud.php | 17 ++++ one-time-stuff/conf/nginx.conf | 141 +++++++++++++++++++++++++++ one-time-stuff/conf/sshd_config.conf | 15 +++ one-time-stuff/install-software.sh | 2 +- one-time-stuff/ssh-config.sh | 35 +++++++ one-time-stuff/x-nextcloud.sh | 103 +++++++++++++++++++ 8 files changed, 316 insertions(+), 3 deletions(-) create mode 100644 one-time-stuff/conf/include.conf create mode 100644 one-time-stuff/conf/nextcloud.php create mode 100644 one-time-stuff/conf/nginx.conf create mode 100644 one-time-stuff/conf/sshd_config.conf create mode 100755 one-time-stuff/ssh-config.sh create mode 100755 one-time-stuff/x-nextcloud.sh diff --git a/one-time-stuff/basic-settings.sh b/one-time-stuff/basic-settings.sh index bcf5ce6..c78b41a 100755 --- a/one-time-stuff/basic-settings.sh +++ b/one-time-stuff/basic-settings.sh @@ -124,8 +124,7 @@ my_host="${my_host/orange/🍊}" my_host="${my_host/oracle/🔮}" my_host="${my_host/purple/💜}" my_host="${my_host/pi/🥧}" -my_host="${my_host/yellow/🟨}" -my_host="${my_host/media/📀}" +my_host="${my_host/stash/🎒♾}" if [[ $HOSTNAME == *purple* ]] ; then PS1="\[\e[32m\]\u\[\e[m\]@\[\e[35m\]$my_host\[\e[m\]:\[\e[36m\]\w\[\e[m\]\\$ " elif [[ $HOSTNAME == *orange* ]] ; then diff --git a/one-time-stuff/conf/include.conf b/one-time-stuff/conf/include.conf new file mode 100644 index 0000000..2eff23a --- /dev/null +++ b/one-time-stuff/conf/include.conf @@ -0,0 +1,3 @@ +# comment +Include /etc/ssh/sshd_config.d/*.conf + diff --git a/one-time-stuff/conf/nextcloud.php b/one-time-stuff/conf/nextcloud.php new file mode 100644 index 0000000..da03b7f --- /dev/null +++ b/one-time-stuff/conf/nextcloud.php @@ -0,0 +1,17 @@ + + array ( + 0 => 'DOMAIN_TO_USE', + ), + 'datadirectory' => 'DATA_DIRECTORY', + 'dbtype' => 'mysql', + 'dbhost' => 'localhost', + 'dbname' => 'MYSQL_NAME', + 'dbuser' => 'MYSQL_NAME', + 'dbpassword' => 'MYSQL_PASSWORD', + 'dbtableprefix' => 'oc_', + 'mysql.utf8mb4' => true, + 'installed' => false, + 'dbport' => '', +); diff --git a/one-time-stuff/conf/nginx.conf b/one-time-stuff/conf/nginx.conf new file mode 100644 index 0000000..17e63d3 --- /dev/null +++ b/one-time-stuff/conf/nginx.conf @@ -0,0 +1,141 @@ +# comment + +upstream php-handler { + #server 127.0.0.1:9000; + server unix:/var/run/php/php7.4-fpm.sock; +} + +server { + listen 80; + listen [::]:80; + server_name DOMAIN_TO_USE; + + # HSTS settings + # WARNING: Only add the preload option once you read about + # the consequences in https://hstspreload.org/. This option + # will add the domain to a hardcoded list that is shipped + # in all major browsers and getting removed from this list + # could take several months. + #add_header Strict-Transport-Security "max-age=15768000; includeSubDomains; preload;" always; + + # set max upload size + client_max_body_size 512M; + fastcgi_buffers 64 4K; + + # Enable gzip but do not remove ETag headers + gzip on; + gzip_vary on; + gzip_comp_level 4; + gzip_min_length 256; + gzip_proxied expired no-cache no-store private no_last_modified no_etag auth; + gzip_types application/atom+xml application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy; + + # Pagespeed is not supported by Nextcloud, so if your server is built + # with the `ngx_pagespeed` module, uncomment this line to disable it. + #pagespeed off; + + # HTTP response headers borrowed from Nextcloud `.htaccess` + add_header Referrer-Policy "no-referrer" always; + add_header X-Content-Type-Options "nosniff" always; + add_header X-Download-Options "noopen" always; + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Permitted-Cross-Domain-Policies "none" always; + add_header X-Robots-Tag "none" always; + add_header X-XSS-Protection "1; mode=block" always; + + # Remove X-Powered-By, which is an information leak + fastcgi_hide_header X-Powered-By; + + # Path to the root of your installation + root NEXTCLOUD_DIRECTORY; + + # Specify how to handle directories -- specifying `/index.php$request_uri` + # here as the fallback means that Nginx always exhibits the desired behaviour + # when a client requests a path that corresponds to a directory that exists + # on the server. In particular, if that directory contains an index.php file, + # that file is correctly served; if it doesn't, then the request is passed to + # the front-end controller. This consistent behaviour means that we don't need + # to specify custom rules for certain paths (e.g. images and other assets, + # `/updater`, `/ocm-provider`, `/ocs-provider`), and thus + # `try_files $uri $uri/ /index.php$request_uri` + # always provides the desired behaviour. + index index.php index.html /index.php$request_uri; + + # Default Cache-Control policy + expires 1m; + + # Rule borrowed from `.htaccess` to handle Microsoft DAV clients + location = / { + if ( $http_user_agent ~ ^DavClnt ) { + return 302 /remote.php/webdav/$is_args$args; + } + } + + location = /robots.txt { + allow all; + log_not_found off; + access_log off; + } + + # Make a regex exception for `/.well-known` so that clients can still + # access it despite the existence of the regex rule + # `location ~ /(\.|autotest|...)` which would otherwise handle requests + # for `/.well-known`. + location ^~ /.well-known { + # The following 6 rules are borrowed from `.htaccess` + + rewrite ^/\.well-known/host-meta\.json /public.php?service=host-meta-json last; + rewrite ^/\.well-known/host-meta /public.php?service=host-meta last; + rewrite ^/\.well-known/webfinger /public.php?service=webfinger last; + rewrite ^/\.well-known/nodeinfo /public.php?service=nodeinfo last; + + location = /.well-known/carddav { return 301 /remote.php/dav/; } + location = /.well-known/caldav { return 301 /remote.php/dav/; } + + try_files $uri $uri/ =404; + } + + # Rules borrowed from `.htaccess` to hide certain paths from clients + location ~ ^/(?:build|tests|config|lib|3rdparty|templates|data)(?:$|/) { return 404; } + location ~ ^/(?:\.|autotest|occ|issue|indie|db_|console) { return 404; } + + # Ensure this block, which passes PHP files to the PHP process, is above the blocks + # which handle static assets (as seen below). If this block is not declared first, + # then Nginx will encounter an infinite rewriting loop when it prepends `/index.php` + # to the URI, resulting in a HTTP 500 error response. + location ~ \.php(?:$|/) { + fastcgi_split_path_info ^(.+?\.php)(/.*)$; + set $path_info $fastcgi_path_info; + + try_files $fastcgi_script_name =404; + + include fastcgi_params; + fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; + fastcgi_param PATH_INFO $path_info; + fastcgi_param HTTPS on; + + fastcgi_param modHeadersAvailable true; # Avoid sending the security headers twice + fastcgi_param front_controller_active true; # Enable pretty urls + fastcgi_pass php-handler; + + fastcgi_intercept_errors on; + fastcgi_request_buffering off; + } + + location ~ \.(?:css|js|svg|gif)$ { + try_files $uri /index.php$request_uri; + expires 6M; # Cache-Control policy borrowed from `.htaccess` + access_log off; # Optional: Don't log access to assets + } + + location ~ \.woff2?$ { + try_files $uri /index.php$request_uri; + expires 7d; # Cache-Control policy borrowed from `.htaccess` + access_log off; # Optional: Don't log access to assets + } + + location / { + try_files $uri $uri/ /index.php$request_uri; + } +} + diff --git a/one-time-stuff/conf/sshd_config.conf b/one-time-stuff/conf/sshd_config.conf new file mode 100644 index 0000000..b68090a --- /dev/null +++ b/one-time-stuff/conf/sshd_config.conf @@ -0,0 +1,15 @@ +# comment + +AuthenticationMethods publickey +LogLevel VERBOSE +PermitRootLogin no +UsePrivilegeSeparation sandbox +PasswordAuthentication no +ChallengeResponseAuthentication no + +UsePAM yes +X11Forwarding yes +PrintMotd no +AcceptEnv LANG LC_* +Subsystem sftp /usr/lib/openssh/sftp-server + diff --git a/one-time-stuff/install-software.sh b/one-time-stuff/install-software.sh index 7707b13..699c286 100755 --- a/one-time-stuff/install-software.sh +++ b/one-time-stuff/install-software.sh @@ -77,7 +77,7 @@ case $nginx_log in esac echo "----- Install php-fpm -------------------------------" -install_collection 'php-fpm' php-cli php-fpm php-curl php-gd php-imagick php-intl php-json php-mbstring php-mysql php-redis php-soap php-xml php-yaml php-zip +install_collection 'php-fpm' php-cli php-fpm php-bcmath php-curl php-gd php-gmp php-imagick imagemagick php-intl php-json php-mbstring php-mysql php-redis php-soap php-xml php-yaml php-zip echo "----- Install redis-server --------------------------" install_collection 'redis-server' redis-server diff --git a/one-time-stuff/ssh-config.sh b/one-time-stuff/ssh-config.sh new file mode 100755 index 0000000..cecfb68 --- /dev/null +++ b/one-time-stuff/ssh-config.sh @@ -0,0 +1,35 @@ +#!/bin/bash + +echo "----- Switch to secure ssh conf ---------------------" +read -p 'Install the secure "sshd_config" file? [y/N]: ' secure_ssh +case $secure_ssh in + [Yy]* ) + LOCATION=`dirname "$0"` + mkdir -p "/etc/ssh/sshd_config.d" + echo 'Backing up old config' + sudo mv "/etc/ssh/sshd_config" "/etc/ssh/sshd_config.backup" + echo 'Copying new config files' + sudo cp "${LOCATION}/conf/sshd_config.conf" "/etc/ssh/sshd_config.d/sshd_config.conf" + sudo cp "${LOCATION}/conf/include.conf" "/etc/ssh/sshd_config" + ;; + * ) + echo 'Skipping' + ;; +esac + +echo "----- Restart ssh now -------------------------------" +read -p 'Restart SSH to use updated config? [y/N]: ' restart_ssh +case $restart_ssh in + [Yy]* ) + echo 'calling systemctl' + sudo systemctl restart ssh.service + ;; + * ) + echo 'Skipping' + ;; +esac + +echo 'REMEMBER TO TEST SSH:' +echo 'ENSURE ROOT LOGIN BLOCKED,' +echo 'ENSURE USER ENABLED.' + diff --git a/one-time-stuff/x-nextcloud.sh b/one-time-stuff/x-nextcloud.sh new file mode 100755 index 0000000..13d7701 --- /dev/null +++ b/one-time-stuff/x-nextcloud.sh @@ -0,0 +1,103 @@ +#!/bin/bash + +LOCATION=`realpath "$0"` +LOCATION=`dirname "${LOCATION}"` +THE_PASSWD=`openssl rand -base64 40 | head -c 40` +if [[ ${#THE_PASSWD} < 40 ]]; then + THE_PASSWD=`date +%s.%N | sha512sum | base64 | head -c 40` + if [[ ${#THE_PASSWD} < 40 ]]; then + echo 'Unable to generate password, no action taken' + exit 1 + fi +fi + + +echo "----- Your Email Address, for Certbot ---------------" +echo "By entering your email address, you agree to the Lets Encrypt TOS" +read -p 'Email Address (leave blank to cancel): ' email_address +if [[ -z "$email_address" ]]; then + echo 'Operation cancelled' + exit 1 +fi + +echo '(Control-C to abort)' + +echo "----- Where to install NextCloud --------------------" +read -p 'Install into (defaults to "/var/www/nextcloud"): ' dir_name +if [[ -z "$dir_name" ]]; then + dir_name='/var/www/nextcloud' +fi + +public_ip=`${LOCATION}/../public-ip.sh` +echo "----- Set NextCloud Domain --------------------------" +read -p "Domain (defaults to public-ip '${public_ip}'): " domain_name +if [[ -z "$domain_name" ]]; then + domain_name="${public_ip}" +fi + +echo "----- Set NextCloud Database ------------------------" +read -p 'Database schema and user names (defaults to "nextcloud"): ' database_name +if [[ -z "$database_name" ]]; then + database_name='nextcloud' +fi + +STARTED_IN=`pwd` +sudo mkdir -p "$dir_name" +sudo chown www-data:www-data "$dir_name" +sudo chmod g=u "$dir_name" +sudo chmod g+s "$dir_name" +cd "$dir_name" + +echo "----- Downloading Latest NextCloud ------------------" +wget -q -O latest.tar.bz2.sha512 "https://download.nextcloud.com/server/releases/latest.tar.bz2.sha512" +wget -q -O latest.tar.bz2 "https://download.nextcloud.com/server/releases/latest.tar.bz2" +echo 'Downloading completed' + +sha512sum -c --status latest.tar.bz2.sha512 +RESULT=$? + +if [[ "$RESULT" -ne 0 ]]; then + echo 'NextCloud file does not match expected checksum' + exit 1 +fi + +echo "----- Extracting Latest NextCloud -------------------" +tar --strip-components=1 -xjf latest.tar.bz2 +rm latest.tar.bz2 +rm latest.tar.bz2.sha512 + +echo "----- Provisioning Database -------------------------" +echo "create database ${database_name}; grant all privileges on ${database_name}.* to '${database_name}'@'localhost' identified by '${THE_PASSWD}';" | sudo mysql + +echo "----- Configure the NextCloud Instance --------------" +sudo cp "${LOCATION}/conf/nextcloud.php" "${dir_name}/config/config.php" +sudo sed -i "s/DOMAIN_TO_USE/${domain_name}/g" "${dir_name}/config/config.php" +sudo sed -i "s:DATA_DIRECTORY:${dir_name}/data:g" "${dir_name}/config/config.php" +sudo sed -i "s:MYSQL_PASSWORD:${THE_PASSWD}:g" "${dir_name}/config/config.php" +sudo sed -i "s:MYSQL_NAME:${database_name}:g" "${dir_name}/config/config.php" + +echo "----- Configure Nginx for NextCloud -----------------" +sudo cp "${LOCATION}/conf/nginx.conf" "/etc/nginx/sites-available/${domain_name}.conf" +sudo sed -i "s/DOMAIN_TO_USE/${domain_name}/g" "/etc/nginx/sites-available/${domain_name}.conf" +sudo sed -i "s:NEXTCLOUD_DIRECTORY:${dir_name}:g" "/etc/nginx/sites-available/${domain_name}.conf" +if [[ -f "/etc/nginx/sites-enabled/${domain_name}.conf" ]]; then + sudo rm "/etc/nginx/sites-enabled/${domain_name}.conf" +fi +sudo ln -s "/etc/nginx/sites-available/${domain_name}.conf" "/etc/nginx/sites-enabled/${domain_name}.conf" +sudo systemctl restart nginx.service + +echo "----- Certbot Secure NextCloud ----------------------" +sudo certbot --non-interactive --domain "${domain_name}" --redirect --hsts --nginx --agree-tos --email "${email_address}" +sudo systemctl restart nginx.service + +echo "----- Settings File Permissions ---------------------" +sudo chown -R www-data:www-data "$dir_name" +sudo chmod -R g=u "$dir_name" +sudo chmod -R g+s "$dir_name" + +cd "$STARTED_IN" + +echo "----- NextCloud Is Ready ----------------------------" +echo "mysql nextcloud password:" +echo "${THE_PASSWD}" +