Obsidian/05.02 Networks/Server Tools.md

---

Tag: ["Server", "Security", "Privacy", "App", "Web", "Tools"]
Date: 2021-09-19
DocType: "Server"
Hierarchy: "NonRoot"
Performance:
 CPU: 2Core
 RAM: 4GB
 Bandwidth: 4TB
 Speed:
Characteristics:
 OS: Ubuntu 20.04
 Domiciliation: NL
 IPv4: 41.216.181.11
 Hostname: vm919620.desivps.com
 Host: DesiVPS
 SubDomain: tools
Disk:
 Capa: 40GB
 Type: SSD
 UsedSpace: 31%
 TimeStamp: 2021-11-13
CollapseMetaTable: yes

---

Parent:: [[mfxm Website Scope|mfxm.fr]], [[Privacy & Security]], [[@IT & Computer|IT & Computer]]

---

 ^Top

 

```button
name Edit Server parameters
type command
action MetaEdit: Run MetaEdit
id EditMetaData
```
^button-ToolsServerEdit

```button
name Save
type command
action Save current file
id Save
```
^button-ToolsServerSave

 

# Tools server

 

```ad-abstract
title: Summary
collapse: open
Higher spec server to be set up with docker to host a variety of tools using containers.
```

 

```toc
style: number
```

 

---

 

### Server parameters
[[#^Top|TOP]]
 

```ad-quote
title: Dashboard access
[https://clients.desivps.com/clientarea.php](https://clients.desivps.com/clientarea.php)
```

 

```ad-quote
title: Address
The service will be located under **[tools.mfxm.fr](https://tools.mfxm.fr)** .
```

 

---

 

### Services
[[#^Top|TOP]]
 

```ad-abstract
title: Service description
The Tools server will host a variety of tools in docker containers. Several services will aim to service all others and will be installed outside of docker containers.
```

 

#### Installed server dependencies
[[#^Top|TOP]]
##### Docker

```ad-warning
title: [[Configuring Docker|docker]] for non root users
[[Configuring Docker|docker]] predominantly works for the root user. In order to let non-root users instruct Docker, users need to be added to the Docker group:

`sudo usermod -aG docker (username)`

Potentially, the Docker group needs to be defined:

`sudo groupadd docker`
```

Currently running Docker containers

```ad-bug
title:  docker network
ID: 3a4d267e8155e3ff957e15c86360de1431d177b2131455707bea99038f179481
IP: 17.27.37.x
```

 

##### Caddy
[[#^Top|TOP]]
[[Configuring Caddy|caddy]] is the webserver of choice. Refer to the dedicated note for config and parametrisation.

```ad-bug
title: authentication token
LWERS4M7njDLiAJe5A6gkv9jRDabvnzBGyYk9vPr1F5dY0LMu47FSjB0v21BAE83rYTOksElzcYmioWA
```

 

##### Security

| Program name | Type | Description
|----------------|------|-------------
| **[[Configuring Fail2ban\|fail2ban]]** | Daemon | Blocks suspicious attempts to login
| **unattended-upgrades** | Program | Enables automatic updates of installed programs and OS
| **logwatch** | Daemon | Monitors activity on server and sends activity logs

 

##### fail2ban
[[#^Top|TOP]]
Classic [[Configuring Fail2ban|fail2ban]] installation with a dedicated configuration:

```ad-command
~~~bash
sudo nano /etc/fail2ban/jail.d/sshd.local
~~~
```

With the following parameters:

```ad-code
~~~yaml
[sshd]
enabled = true
port=2227
maxretry = 10
bantime = 1m
~~~
```

 

Please refer to the [[Configuring Fail2ban|conf guide]] for a detailed description.

 

##### Prometheus

[[Configuring Prometheus|Prometheus]] is a monitoring tool for all types of programs and is based on 'structured log files'  i.e. the `JSON` format.
Please refer to the dedicated page to understand how [[Configuring Prometheus|Prometheus]] works. It needs to be paired with a visualisation software like Grafana to give its full potential.

 

##### Postfix

Mail Transfer Agent. Configuration is standard to allow for emails to be sent by programs / deamons / [[Nextcloud]] or others. Such a [[Configuring Postfix|system]] is required for every server to work correctly.

 

##### Certbot
[[#^Top|TOP]]
Provides SSL certification from **Let's Encrypt**. Installation dependencies are different from Nginx and explained [here](https://linuxhint.com/secure-apache-lets-encrypt-ubuntu/)

 

##### UFW

Firewall management, see [[Configuring UFW|here]] for more details.

 

##### Nodejs & Yarn

JavaScript & JS package manager.

 

---

 

#### Dedicated Server parameters
[[#^Top|TOP]]

| Service | Used value
|---------|:---------:
|   |  
| **Network: [[Configuring Docker\|docker]] dedicated** | 17.27.37.x
**IP: pw-manager** | 17.27.37.3
**IP: StandardNotes** | 172.22.0.1
**IP: Git** | 172.21.0.3
**IP: Git db** | 172.21.0.4
**IP: Jenkins** | 172.17.0.2
**IP: Wordle** | 17.27.37.5
  |  
**Port: SSH** | 2227
**Port: SN** | 2700
**Port: Jenkins** | 8080
**Port: Git server** | 8087
**Port: Git SSH** | 2227



 

---

 

#### Password manager
[[#^Top|TOP]]
[Bitwarden](https://bitwarden.com) is a FOSS enabling self-hosting with a simple deployment through docker/docker-compose.

 

##### Service parameters (pw-manager)

```ad-info
title: service parameters
**IP**: 17.27.37.3:80
**DockerID**: 970b6f4b6150fa03be24287ae29a065c06ff7ed91a3402f8184c8a9aafa5e94d
**DockerName**: bitwarden_bitwarden_1
---
**Address**: https://pw-manager.mfxm.fr
```

 

##### User management (pw-manager)

```ad-info
title: Link
[Admin panel](https://pw-manager.mfxm.fr/admin/)
```

The admin panel needs to be set up with an authentication token and is accessed with the token. User & key management is done from within this panel.

 

---

 

#### Personal notes
[[#^Top|TOP]]
[StandardNotes](https://standardnotes.com) is a program enabling self-hosting with a server-side encryption.

 

##### Service parameters (notes)

```ad-info
title: service parameters
**IP**: 172.22.0.1:2700
**DockerNames**: api-gateway, auth-worker, syncing-server-js-worker, auth, syncing-server-js, db, cache
---
**Address**: https://st-notes.mfxm.fr
```

 

##### Configuration (notes)

2 files are used to configure the service:

```ad-path
~/standalone/.env
```

```ad-path
~/standalone/docker/auth.env
```

Docs can be found [here](https://docs.standardnotes.com/self-hosting/docker).

 

##### User management (notes)

No user management per se. .env file allows (or not) to restrict new registration.

 

###### dBeaver

[dBeaver](https://dbeaver.io) installed to view the database entries. 

```ad-info
title: Tutorial for setting up conmection
[Tutorial](https://devimalplanet.com/how-to-dbeaver-remote-database-ssh)
```

Once in the tool, select the data to see and the 'data' pane to visualise the tables.

 

##### StandardNotes extensions

```ad-info
title: service parameters
**Location**: ~/standardnotes-extensions
**reverse-proxy**: ~/standardnotes-extensions/public
---
**Address**: https://tools.mfxm.fr/extensions/index.json
```

 

StandardNotes has developped extensions to customise both the skin and editor of the app. It is a paying feature normally but can be self-hosted and free.
One GitHub user is offering a [repo](https://github.com/iganeshk/standardnotes-extensions) for extensions that can be cloned and linked to the application. 

* **Configuration file**

```ad-command
~~~bash
~/standardnotes-extensions/.env
~~~
```

* **Repository update**

```ad-command
~~~bash
sudo python3 build_repo.py
~~~
```

In the main folder.

 

---

 

#### Git repository
[[#^Top|TOP]]
[Gitea](https://gitea.io) is a FOSS enabling self-hosting a Git instance similar to GitHub.

 

##### Service parameters (git server)

```ad-info
title: service parameters
**IP**: 172.21.0.3
**Docker ID**: b6ec6f3843c3c9afe13215f73e0f8002475a145e33b0f0b555970b7f6f1ae38b
**Docker Name**: gitea
**Dedicated user**: git
---
**Address**: https://git.mfxm.fr
```

 

##### Service parameters (git db)

```ad-info
title: service parameters
**IP**: 172.21.0.2
**Docker ID**: a06fac3650f8f7dca29b022401a10f63d825283d762306501690e52ab9073d33
**Docker Name**: gitea_db_1
```

 

##### User management (git)
[[#^Top|TOP]]
User management has not been parametered to exclude new users but an admin panel exists to control and remove users under the admin login.

 

##### Doc library (git)

[Link](https://docs.gitea.io/en-us/command-line)

 

##### Utilities

```ad-path
title: Config file
~/gitea/gitea/gitea/conf/app.ini
```

 

```ad-code
title: email setup
Gitea can work on internal mail points through:
~~~bash
ENABLED = true
FROM = (user addresss)
USE_SENDMAIL = false
HOST = (hostname):25
~~~
```

 

---

 

#### News Aggregator
[[#^Top|TOP]]

 

[FreshRSS](https://freshrss.org) is a News aggregator enabling to read and manage RSS feeds.
It is open-source and self-hostable.

 

##### Service parameters (News)

```ad-info
title: service parameters
**IP**: 172.20.0.3:80
**DockerNames**: app-freshrss
---
**Address**: https://news.mfxm.fr
```

 

##### Configuration (News)

Docker compose set-up.

```ad-path
~/freshrss
```

Docs can be found [here](https://github.com/freshrss/freshrss).
In addition, FreshRSS offers the ability to install extensions relatively easily from within the Settings menu.

 

---

 

#### Wordle
[[#^Top|TOP]]

 

Wordle is a word game that has been bought by the New York Times.

 

##### Service parameters (Wordle)

```ad-info
title: service parameters
**IP**: 17.27.37.5:80
**DockerNames**: Wordle
---
**Address**: https://wordle.mfxm.fr
```

 

##### Configuration (Wordle)

Docker compose set-up.

```ad-path
~/wordle
```

Docs can be found [here](https://hub.docker.com/r/modem7/wordle).

 

---

 

#### Server-side Monitoring
[[#^Top|TOP]]
Refer to the [[Configuring Monit|monit section]] for further information on installation and configuration.

List of monitored services:
- System
- SSH
- [[Configuring Fail2ban|Fail2ban]]
- cron
- [[Configuring Postfix|Postfix]]
- docker
	- Bitwarden
	- Mininote
	- Git
	- Git db

 

[[Configuring Telegram bots|Telegram bots]] are also being implemented to receive logs from logwatch & [[Configuring Monit|monit]].

 

---

 

### Utilities
[[#^Top|TOP]]
 

#### Cert storage

```ad-path
/var/lib/caddy/.local/share/caddy/certificates/acme-v02.api.letsencrypt.org-directory/
```

 

---

 

### Pricing
[[#^Top|TOP]]
 

<mark class="green">Tools Server</mark> | One-off cost | Recurring subscription p.a.
--------|---------------|:----------------------:
<p style="color:cyan">**Server hosting**</p> | &emsp; | *$60*
^ToolsServerCost

&emsp;

---

&emsp;

### Tasks & Further steps

&emsp;

- [ ] [[Server Tools]]: Backup server 🔁 every 6 months on the 1st Tuesday 📅 2022-04-05
- [x] [[Server Tools]]: Backup server 🔁 every 6 months on the 1st Tuesday 📅 2021-10-14 ✅ 2022-01-08
- [x] [[Server Tools]]: Backup server 🔁 every 6 months on the 1st Tuesday ✅ 2021-10-13
- [x]  Set-up landing page

- [ ] [[Selfhosting]], [[Server Tools|Tools]]: Upgrader Gitea & Health checks 🔁 every 4 months 📅 2022-06-18

- [ ] [[Selfhosting]], [[Server Tools|Tools]]: Upgrader Bitwarden & Health checks 🔁 every 4 months 📅 2022-04-18

- [ ] [[Selfhosting]], [[Server Tools|Tools]]: Upgrader Standard Notes & Health checks 🔁 every 4 months 📅 2022-05-18

[[#^Top|TOP]]

&emsp;
&emsp;