== Export Prosody database from old server ==
<tt>mysqldump --user=prosody --password="p@ssword" --default-character-set=utf8 prosody > prosody.sql</tt>

== Backup forum, wiki, and website ==
<tt>cd /var/www/forum.miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

<tt>cd /var/www/wiki.miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

<tt>cd /var/www/miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

== UFW ==
<tt>sudo apt install ufw</tt>

<tt>sudo ufw allow 22/tcp</tt>

<tt>sudo ufw enable</tt>

== SSH ==
<tt>sudo nano /etc/ssh/sshd_config.d/ciphers_and_keying.conf</tt>
<pre style="overflow:auto;">
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
</pre>

<tt>sudo nano /etc/ssh/sshd_config.d/deny_root_login.conf</tt>
<pre style="overflow:auto;">
PermitRootLogin no
</pre>

<tt>sudo nano /etc/ssh/sshd_config.d/enable_pubkey_authentication.conf</tt>
<pre style="overflow:auto;">
PubkeyAuthentication yes
</pre>

<tt>sudo systemctl restart sshd</tt>

== Install Nginx, PHP, and memcached ==
<tt>sudo apt install nginx php-fpm php-mysql php-mbstring php-curl php-gd php-xml php-intl memcached</tt>

<tt>sudo ufw allow 80/tcp</tt>

<tt>sudo ufw allow 443/tcp</tt>

== MariaDB ==
<tt>sudo apt install mariadb-server</tt>

<tt>sudo mysql_secure_installation</tt>
(do not set a root password; enable the other restrictions)

<tt>sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf</tt>
<pre style="overflow:auto;">
max_connections = 1000
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'forum'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE forum_miranda_ng_org;
quit
</pre>

<tt>sudo mysql -u root -f forum_miranda_ng_org < ~/forum_miranda_ng_org.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON forum_miranda_ng_org.* to 'forum'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'wiki'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE wiki_miranda_ng_org;
quit
</pre>

<tt>sudo mysql -u root -f wiki_miranda_ng_org < ~/wiki_miranda_ng_org.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON wiki_miranda_ng_org.* to 'wiki'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE prosody;
quit
</pre>

<tt>sudo mysql -u root -f prosody < ~/prosody.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

== Restore forum backup ==
<tt>sudo mkdir /var/www/forum.miranda-ng.org</tt>

<tt>sudo unzip ~/forum.zip -d /var/www/forum.miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/forum.miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/forum.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl;
server_name forum.miranda-ng.org;
root /var/www/forum.miranda-ng.org/htdocs;

access_log /var/log/nginx/forum.miranda-ng.org_access.log main;
error_log /var/log/nginx/forum.miranda-ng.org_error.log info;

index index.php;

location = /favicon.ico {
include params.d/public.params;
}

location = /robots.txt {
include params.d/public.params;
}

location / {
# actions
rewrite ^/(activate|admin|announce|ban|boardrecount|buddy|calendar|cleanperms)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(collapse|convertentities|convertutf8|coppa|deletemsg|detailedversion|display|dlattach)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(dumpdb|editpoll|editpoll2|featuresettings|featuresettings2|findmember|help|helpadmin)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(im|jsoption|jsmodify|lock|lockVoting|login|login2|logout)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(maintain|manageattachments|manageboards|managecalendar|managesearch|markasread|membergroups|mergetopics)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(mlist|modifycat|modifykarma|modlog|movetopic|movetopic2|news|notify)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(notifyboard|optimizetables|packageget|packages|permissions|pgdownload|pm|post)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(post2|postsettings|printpage|profile|profile2|quotefast|quickmod|quickmod2)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(recent|regcenter|register|register2|reminder|removetopic2|removeoldtopics2|removepoll)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(repairboards|reporttm|reports|requestmembers|search|search2|sendtopic|serversettings)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(serversettings2|smileys|smstats|spellcheck|splittopics|stats|sticky|theme)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(trackip|about:mozilla|about:unknown|unread|unreadreplies|viewErrorLog|viewmembers|viewprofile)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(verificationcode|vote|viewquery|who|\.xml)/?$ "/index.php?pretty;action=$1" last;

# boards + topics
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.0 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.$2 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.0 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*|msg[0-9]*|new)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.$3 last;
}

location ~* \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+.php)(.*)$;
include params.d/phpfpm.params;
}

location ~ /Packages {
allow 127.0.0.1;
deny all;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}

location ~ /\.ht {
deny all;
}
}

server {
if ($host = forum.miranda-ng.org) {
return 301 https://$host$request_uri;
} #

listen 80;
server_name forum.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/forum.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/forum.miranda-ng.org</tt>

<tt>sudo find /var/www/forum.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod +x /var/www/forum.miranda-ng.org/zipme.sh</tt>

Use repair_settings.php and status.php from https://github.com/SimpleMachines/tools/

== Restore wiki backup ==
<tt>sudo mkdir /var/www/wiki.miranda-ng.org</tt>

<tt>sudo unzip ~/wiki.zip -d /var/www/wiki.miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/wiki.miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/wiki.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name wiki.miranda-ng.org;
root /var/www/wiki.miranda-ng.org/htdocs;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;

access_log /var/log/nginx/wiki.miranda-ng.org_access.log main;
error_log /var/log/nginx/wiki.miranda-ng.org_error.log info;

index index.php;

location ~* ^(.*)(install.php|LocalSettings.php|\.git) { deny all; }

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}

location ~* \.php$ {
try_files $uri @404;
include phpfpm.params;
}

location /images/ {
location ~.*\.(php)?$ {
deny all;
}
}

location @404 {
return 404;
break;
}

# https://stackoverflow.com/questions/35446113/using-short-urls-for-mediawiki-with-nginx
location / {
try_files $uri $uri/ @mediawiki;
}

location @mediawiki {
rewrite ^/([^?]*)(?:\?(.*))? /index.php?title=$1&$2 last;
}
}

server {
if ($host = wiki.miranda-ng.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name wiki.miranda-ng.org;
return 404; # managed by Certbot
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/wiki.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/wiki.miranda-ng.org</tt>

<tt>sudo find /var/www/wiki.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod +x /var/www/wiki.miranda-ng.org/zipme.sh /var/www/wiki.miranda-ng.org/htdocs/extensions/Scribunto/includes/engines/LuaStandalone/binaries/lua5_1_5_linux_64_generic/lua /var/www/wiki.miranda-ng.org/htdocs/extensions/SyntaxHighlight_GeSHi/pygments/pygmentize</tt>

<tt>php /var/www/wiki.miranda-ng.org/htdocs/maintenance/update.php</tt>

== Restore website backup ==
<tt>sudo apt install hugo</tt>

<tt>sudo mkdir /var/www/miranda-ng.org</tt>

<tt>sudo unzip ~/mainsite.zip -d /var/www/miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/oauth.miranda-ng.org</tt>
<pre style="overflow:auto;">
# oauth for CloudFile
server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name oauth.miranda-ng.org;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;
# todo: remove this
# root /var/www/miranda-ng.org/scripts;

access_log /var/log/nginx/oauth.miranda-ng.org_access.log main;
error_log /var/log/nginx/oauth.miranda-ng.org_error.log info;

# todo: deny access to root (or remove root), allow only verification (or redirect whole subdomain to main domain), unify with miranda-ng.org.conf
location ~* /verification(.*)$ {
return 301 https://miranda-ng.org/verification$is_args$args;
}
}

server {
if ($host = oauth.miranda-ng.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name oauth.miranda-ng.org;
return 404; # managed by Certbot
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/oauth.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/miranda-ng.org</tt>
<pre style="overflow:auto;">
# get locale
map $http_accept_language $browser_lang {
default en;
~ru ru;
}
map $cookie_lang $lang {
default $browser_lang;
~en en;
~ru ru;
}

map $http_user_agent $excluded_ua {
~SemrushBot 0;
~facebookexternalhit 0;
default 1;
}

server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name miranda-ng.org;
root /var/www/miranda-ng.org/htdocs/public;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;

include google-analytics;

access_log /var/log/nginx/miranda-ng.org_access.log main if=$excluded_ua;
error_log /var/log/nginx/miranda-ng.org_error.log info;

# case sensitive http user agent blocking
if ($excluded_ua ~ "0") {
return 403;
}

index index.html;
autoindex off;

# CloudFile: verification.php
location ~* \.php$ {
try_files $uri =404;
include phpfpm.params;
}

# CloudFile: /verification -> /verification.php
location ~ /verification {
rewrite ^/verification(.*)$ /verification.php$1 redirect;
}

location ~ /distr {
root /var/www/miranda-ng.org; # we want to keep distr outside hugo dir so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}

location ~ /(x32|x64) {
root /var/www/miranda-ng.org/distr; # we want to keep distr outside hugo dir so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}

# ADDONS -> addons
location ~ /ADDONS {
rewrite ^/ADDONS/(.*)$ /addons/$1 redirect;
}

location ~ /addons/images {
root /var/www/miranda-ng.org;
autoindex on;
}

location ~ /addons/files {
root /var/www/miranda-ng.org;
autoindex on;
}

error_page 404 /404.html;

location = /favicon.ico {
include public.params;
}

location = /robots.txt {
include public.params;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico|pdf)$ {
expires max;
log_not_found off;
}

location ~ /hotcoffee {
index index.html;
add_header Cache-Control no-cache,no-store,must-revalidate;

set $lang en;
if ($cookie_LANG = 'ru'){ set $lang ru; }
if ($http_accept_language ~* '(ru|be|kz|ua)'){ set $lang ru; }
if ($cookie_LANG = 'en'){ set $lang en; }

rewrite ^/hotcoffee(/?)$ /hotcoffee/$lang/index.html break;
rewrite ^/hotcoffee/licenses/([^/]+\.html)(/?)$ /hotcoffee/$lang/licenses/$1 break;
rewrite ^/hotcoffee/([^/]+)(/?)$ /hotcoffee/$lang/$1.html break;
}

# redirect from miranda-ng.org/p/PluginName to wiki.miranda-ng.org/index.php?title=Plugin:PluginName
location ~ /p/ {
rewrite ^\/p\/(.*)\/?$ https://wiki.miranda-ng.org/index.php?title=Plugin:$1 redirect;
}
}

server {
listen 80;
server_name miranda-ng.org;

# IM Updater doesn't support HTTPS, so we force HTTPS only for website
location / {
return 301 https://$host$request_uri;
}

# IM Updater
location /distr {
root /var/www/miranda-ng.org; # we want to keep distr outside hugo dir so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/www.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443;
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name www.miranda-ng.org;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;

access_log off;
error_log off;

return 301 $scheme://miranda-ng.org$request_uri;
}

server {
if ($host = www.miranda-ng.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name www.miranda-ng.org;
return 404; # managed by Certbot
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/www.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/addons.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name addons.miranda-ng.org;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;
return 301 $scheme://miranda-ng.org/addons$request_uri;
}

server {
if ($host = addons.miranda-ng.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name addons.miranda-ng.org;
return 404; # managed by Certbot
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/addons.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/miranda-ng.org</tt>

<tt>sudo find /var/www/miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod -R 775 /var/www/miranda-ng.org/htdocs/content /var/www/miranda-ng.org/htdocs/static /var/www/miranda-ng.org/distr</tt>

<tt>sudo chmod +x /var/www/miranda-ng.org/zipme.sh /var/www/miranda-ng.org/scripts/*</tt>

== Certbot ==
<tt>sudo apt install certbot python3-certbot-nginx</tt>

<tt>sudo certbot --nginx -d miranda-ng.org -d www.miranda-ng.org -d addons.miranda-ng.org -d forum.miranda-ng.org -d oauth.miranda-ng.org -d wiki.miranda-ng.org</tt>

<tt>sudo systemctl restart nginx</tt>

== PHP ==
<tt>sudo nano /etc/php/8.3/fpm/pool.d/www.conf</tt>
<pre style="overflow:auto;">
listen = /run/php/php-fpm.sock

pm = static

pm.max_children = 200
</pre>

== Postfix ==
<tt>sudo DEBIAN_PRIORITY=low apt install postfix opendkim opendkim-tools</tt>

<tt>sudo dpkg-reconfigure postfix</tt>
<pre style="overflow:auto;">
Internet Site
miranda-ng.org
empty
default
No
default
0
+
all
</pre>

<tt>sudo nano /etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
myhostname = miranda-ng.org
inet_interfaces = loopback-only
</pre>

<tt>sudo systemctl enable --now opendkim</tt>

<tt>sudo opendkim-genkey -D /etc/dkimkeys/ --domain miranda-ng.org --selector dkim</tt>

<tt>sudo nano /etc/opendkim.conf</tt>
<pre style="overflow:auto;">
LogWhy yes
UMask 002
Socket local:/var/spool/postfix/run/opendkim/opendkim.sock
InternalHosts refile:/etc/dkimkeys/TrustedHosts
AutoRestart yes
AutoRestartRate 10/1h
ExternalIgnoreList refile:/etc/dkimkeys/TrustedHosts
KeyTable refile:/etc/dkimkeys/KeyTable
SigningTable refile:/etc/dkimkeys/SigningTable
SignatureAlgorithm rsa-sha256
</pre>

<tt>sudo adduser postfix opendkim</tt>

<tt>sudo mkdir -p /var/spool/postfix/run/opendkim</tt>

<tt>sudo chown opendkim:opendkim /var/spool/postfix/run/opendkim</tt>

<tt>sudo nano /etc/dkimkeys/TrustedHosts</tt>
<pre style="overflow:auto;">
127.0.0.1
localhost
*.miranda-ng.org
</pre>

<tt>sudo nano /etc/dkimkeys/KeyTable</tt>
<pre style="overflow:auto;">
dkim._domainkey.miranda-ng.org miranda-ng.org:dkim:/etc/dkimkeys/dkim.private
</pre>

<tt>sudo nano /etc/dkimkeys/SigningTable</tt>
<pre style="overflow:auto;">
*@miranda-ng.org dkim._domainkey.miranda-ng.org
</pre>

<tt>sudo chown -R opendkim:opendkim /etc/dkimkeys</tt>

<tt>sudo chmod -R 600 /etc/dkimkeys</tt>

<tt>sudo chmod 700 /etc/dkimkeys</tt>

<tt>sudo nano /etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
milter_protocol = 2
milter_default_action = accept
smtpd_milters = unix:/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/run/opendkim/opendkim.sock
</pre>

<tt>sudo nano /etc/hosts</tt>
<pre style="overflow:auto;">
139.100.207.143 miranda-ng.org
</pre>

<tt>sudo hostnamectl set-hostname miranda-ng.org</tt>

<tt>sudo systemctl restart opendkim</tt>

<tt>sudo systemctl restart postfix</tt>

DNS records:
<pre style="overflow:auto;">
miranda-ng.org MX miranda-ng.org 10
miranda-ng.org TXT v=spf1 +a +mx -all
DKIM._DOMAINKEY.miranda-ng.org TXT dkim_from_/etc/dkimkeys/dkim.txt
_DMARC.miranda-ng.org TXT v=DMARC1; p=none; aspf=r; sp=none
</pre>

<tt>echo "Subject: hello" | sendmail test@example.com</tt>

Port 25 may be blocked on cheap VPS; in this case, see the next section about SMTP relay.

== SMTP relay ==
Remove all MX, SPF and DKIM records from DNS.

Register VK WorkSpace account.

Add and confirm miranda-ng.org domain.

Create user: noreply@miranda-ng.org.

Login to this maibox via mail.ru website.

Create passwords for external application.

<tt>sudo nano /etc/postfix/sasl_passwd</tt>
<pre style="overflow:auto;">
[smtp.mail.ru]:587 noreply@miranda-ng.org:appP@ssword
</pre>

<tt>sudo postmap /etc/postfix/sasl_passwd</tt>

<tt>sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db</tt>

<tt>sudo nano /etc/postfix/generic</tt>
<pre style="overflow:auto;">
www-data noreply@miranda-ng.org
</pre>

<tt>sudo postmap /etc/postfix/generic</tt>

<tt>sudo nano etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
smtp_tls_security_level = encrypt

relayhost = [smtp.mail.ru]:587

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_loglevel = 1
smtp_generic_maps = hash:/etc/postfix/generic
</pre>

<tt>sudo apt install libsasl2-modules</tt>

<tt>sudo systemctl restart postfix</tt>

== Prosody ==
<tt>sudo wget https://prosody.im/downloads/repos/$(lsb_release -sc)/prosody.sources -O/etc/apt/sources.list.d/prosody.sources</tt>

<tt>sudo apt update</tt>

<tt>sudo apt install prosody lua-dbi-mysql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssw0rd';
CREATE DATABASE prosody;
quit
</pre>

<tt>sudo mysql -u root -f prosody < ~/prosody.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo nano /etc/prosody/prosody.cfg.lua</tt>
<pre style="overflow:auto;">
admins = { "username@miranda-ng.org", "username2@miranda-ng.org" }

modules_enabled = {
--"register"; -- Allow users to register on this server
"mam"; -- Store recent messages to allow multi-device synchronization
}

modules_disabled = {
"s2s"; -- Handle server-to-server connections
}

storage = "sql" -- Default is "internal"

sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "p@ssword", host = "localhost" }

archive_expires_after = "never" -- Keep messages forever

--VirtualHost "localhost"
-- Prosody requires at least one enabled VirtualHost to function. You can
-- safely remove or disable 'localhost' once you have added another.

VirtualHost "miranda-ng.org"
ssl = {
key = "/etc/letsencrypt/live/miranda-ng.org/privkey.pem";
certificate = "/etc/letsencrypt/live/miranda-ng.org/fullchain.pem";
protocol = "tlsv1_1+";
}

Component "conference.miranda-ng.org" "muc"
modules_enabled = { "muc_mam" }
</pre>

<tt>sudo chmod -R 755 /etc/letsencrypt/live</tt>

<tt>sudo prosodyctl adduser username@miranda-ng.org</tt>

<tt>sudo systemctl enable --now prosody</tt>

<tt>sudo ufw allow 5000/tcp</tt>

<tt>sudo ufw allow 5222/tcp</tt>

User:Dart Raiden/Server setup

2026-06-10T20:33:51Z

Dart Raiden: /* Restore website backup */

== Export Prosody database from old server ==
<tt>mysqldump --user=prosody --password="p@ssword" --default-character-set=utf8 prosody > prosody.sql</tt>

== Backup forum, wiki, and website ==
<tt>cd /var/www/forum.miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

<tt>cd /var/www/wiki.miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

<tt>cd /var/www/miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

== UFW ==
<tt>sudo apt install ufw</tt>

<tt>sudo ufw allow 22/tcp</tt>

<tt>sudo ufw enable</tt>

== SSH ==
<tt>sudo nano /etc/ssh/sshd_config.d/ciphers_and_keying.conf</tt>
<pre style="overflow:auto;">
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
</pre>

<tt>sudo nano /etc/ssh/sshd_config.d/deny_root_login.conf</tt>
<pre style="overflow:auto;">
PermitRootLogin no
</pre>

<tt>sudo nano /etc/ssh/sshd_config.d/enable_pubkey_authentication.conf</tt>
<pre style="overflow:auto;">
PubkeyAuthentication yes
</pre>

<tt>sudo systemctl restart sshd</tt>

== Install Nginx, PHP, and memcached ==
<tt>sudo apt install nginx php-fpm php-mysql php-mbstring php-curl php-gd php-xml php-intl memcached</tt>

<tt>sudo ufw allow 80/tcp</tt>

<tt>sudo ufw allow 443/tcp</tt>

== MariaDB ==
<tt>sudo apt install mariadb-server</tt>

<tt>sudo mysql_secure_installation</tt>
(do not set a root password; enable the other restrictions)

<tt>sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf</tt>
<pre style="overflow:auto;">
max_connections = 1000
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'forum'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE forum_miranda_ng_org;
quit
</pre>

<tt>sudo mysql -u root -f forum_miranda_ng_org < ~/forum_miranda_ng_org.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON forum_miranda_ng_org.* to 'forum'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'wiki'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE wiki_miranda_ng_org;
quit
</pre>

<tt>sudo mysql -u root -f wiki_miranda_ng_org < ~/wiki_miranda_ng_org.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON wiki_miranda_ng_org.* to 'wiki'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE prosody;
quit
</pre>

<tt>sudo mysql -u root -f prosody < ~/prosody.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

== Restore forum backup ==
<tt>sudo mkdir /var/www/forum.miranda-ng.org</tt>

<tt>sudo unzip ~/forum.zip -d /var/www/forum.miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/forum.miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/forum.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl;
server_name forum.miranda-ng.org;
root /var/www/forum.miranda-ng.org/htdocs;

access_log /var/log/nginx/forum.miranda-ng.org_access.log main;
error_log /var/log/nginx/forum.miranda-ng.org_error.log info;

index index.php;

location = /favicon.ico {
include params.d/public.params;
}

location = /robots.txt {
include params.d/public.params;
}

location / {
# actions
rewrite ^/(activate|admin|announce|ban|boardrecount|buddy|calendar|cleanperms)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(collapse|convertentities|convertutf8|coppa|deletemsg|detailedversion|display|dlattach)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(dumpdb|editpoll|editpoll2|featuresettings|featuresettings2|findmember|help|helpadmin)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(im|jsoption|jsmodify|lock|lockVoting|login|login2|logout)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(maintain|manageattachments|manageboards|managecalendar|managesearch|markasread|membergroups|mergetopics)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(mlist|modifycat|modifykarma|modlog|movetopic|movetopic2|news|notify)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(notifyboard|optimizetables|packageget|packages|permissions|pgdownload|pm|post)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(post2|postsettings|printpage|profile|profile2|quotefast|quickmod|quickmod2)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(recent|regcenter|register|register2|reminder|removetopic2|removeoldtopics2|removepoll)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(repairboards|reporttm|reports|requestmembers|search|search2|sendtopic|serversettings)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(serversettings2|smileys|smstats|spellcheck|splittopics|stats|sticky|theme)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(trackip|about:mozilla|about:unknown|unread|unreadreplies|viewErrorLog|viewmembers|viewprofile)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(verificationcode|vote|viewquery|who|\.xml)/?$ "/index.php?pretty;action=$1" last;

# boards + topics
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.0 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.$2 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.0 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*|msg[0-9]*|new)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.$3 last;
}

location ~* \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+.php)(.*)$;
include params.d/phpfpm.params;
}

location ~ /Packages {
allow 127.0.0.1;
deny all;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}

location ~ /\.ht {
deny all;
}
}

server {
if ($host = forum.miranda-ng.org) {
return 301 https://$host$request_uri;
} #

listen 80;
server_name forum.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/forum.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/forum.miranda-ng.org</tt>

<tt>sudo find /var/www/forum.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod +x /var/www/forum.miranda-ng.org/zipme.sh</tt>

Use repair_settings.php and status.php from https://github.com/SimpleMachines/tools/

== Restore wiki backup ==
<tt>sudo mkdir /var/www/wiki.miranda-ng.org</tt>

<tt>sudo unzip ~/wiki.zip -d /var/www/wiki.miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/wiki.miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/wiki.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl;
server_name wiki.miranda-ng.org;
root /var/www/wiki.miranda-ng.org/htdocs;

access_log /var/log/nginx/wiki.miranda-ng.org_access.log main;
error_log /var/log/nginx/wiki.miranda-ng.org_error.log info;

index index.php;

location ~* ^(.*)(install.php|LocalSettings.php|\.git) { deny all; }

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}

location ~* \.php$ {
try_files $uri @404;
include params.d/phpfpm.params;
}

location /images/ {
location ~.*\.(php)?$ {
deny all;
}
}

location @404 {
return 404;
break;
}

# https://stackoverflow.com/questions/35446113/using-short-urls-for-mediawiki-with-nginx
location / {
try_files $uri $uri/ @mediawiki;
}

location @mediawiki {
rewrite ^/([^?]*)(?:\?(.*))? /index.php?title=$1&$2 last;
}
}

server {
if ($host = wiki.miranda-ng.org) {
return 301 https://$host$request_uri;
}

listen 80;
server_name wiki.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/wiki.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/wiki.miranda-ng.org</tt>

<tt>sudo find /var/www/wiki.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod +x /var/www/wiki.miranda-ng.org/zipme.sh /var/www/wiki.miranda-ng.org/htdocs/extensions/Scribunto/includes/engines/LuaStandalone/binaries/lua5_1_5_linux_64_generic/lua /var/www/wiki.miranda-ng.org/htdocs/extensions/SyntaxHighlight_GeSHi/pygments/pygmentize</tt>

<tt>php /var/www/wiki.miranda-ng.org/htdocs/maintenance/update.php</tt>

== Restore website backup ==
<tt>sudo apt install hugo</tt>

<tt>sudo mkdir /var/www/miranda-ng.org</tt>

<tt>sudo unzip ~/mainsite.zip -d /var/www/miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/oauth.miranda-ng.org</tt>
<pre style="overflow:auto;">
# oauth for CloudFile
server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name oauth.miranda-ng.org;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;
# todo: remove this
# root /var/www/miranda-ng.org/scripts;

access_log /var/log/nginx/oauth.miranda-ng.org_access.log main;
error_log /var/log/nginx/oauth.miranda-ng.org_error.log info;

# todo: deny access to root (or remove root), allow only verification (or redirect whole subdomain to main domain), unify with miranda-ng.org.conf
location ~* /verification(.*)$ {
return 301 https://miranda-ng.org/verification$is_args$args;
}
}

server {
if ($host = oauth.miranda-ng.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name oauth.miranda-ng.org;
return 404; # managed by Certbot
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/oauth.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/miranda-ng.org</tt>
<pre style="overflow:auto;">
# get locale
map $http_accept_language $browser_lang {
default en;
~ru ru;
}
map $cookie_lang $lang {
default $browser_lang;
~en en;
~ru ru;
}

map $http_user_agent $excluded_ua {
~SemrushBot 0;
~facebookexternalhit 0;
default 1;
}

server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name miranda-ng.org;
root /var/www/miranda-ng.org/htdocs/public;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;

include google-analytics;

access_log /var/log/nginx/miranda-ng.org_access.log main if=$excluded_ua;
error_log /var/log/nginx/miranda-ng.org_error.log info;

# case sensitive http user agent blocking
if ($excluded_ua ~ "0") {
return 403;
}

index index.html;
autoindex off;

# CloudFile: verification.php
location ~* \.php$ {
try_files $uri =404;
include phpfpm.params;
}

# CloudFile: /verification -> /verification.php
location ~ /verification {
rewrite ^/verification(.*)$ /verification.php$1 redirect;
}

location ~ /distr {
root /var/www/miranda-ng.org; # we want to keep distr outside hugo dir so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}

location ~ /(x32|x64) {
root /var/www/miranda-ng.org/distr; # we want to keep distr outside hugo dir so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}

# ADDONS -> addons
location ~ /ADDONS {
rewrite ^/ADDONS/(.*)$ /addons/$1 redirect;
}

location ~ /addons/images {
root /var/www/miranda-ng.org;
autoindex on;
}

location ~ /addons/files {
root /var/www/miranda-ng.org;
autoindex on;
}

error_page 404 /404.html;

location = /favicon.ico {
include public.params;
}

location = /robots.txt {
include public.params;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico|pdf)$ {
expires max;
log_not_found off;
}

location ~ /hotcoffee {
index index.html;
add_header Cache-Control no-cache,no-store,must-revalidate;

set $lang en;
if ($cookie_LANG = 'ru'){ set $lang ru; }
if ($http_accept_language ~* '(ru|be|kz|ua)'){ set $lang ru; }
if ($cookie_LANG = 'en'){ set $lang en; }

rewrite ^/hotcoffee(/?)$ /hotcoffee/$lang/index.html break;
rewrite ^/hotcoffee/licenses/([^/]+\.html)(/?)$ /hotcoffee/$lang/licenses/$1 break;
rewrite ^/hotcoffee/([^/]+)(/?)$ /hotcoffee/$lang/$1.html break;
}

# redirect from miranda-ng.org/p/PluginName to wiki.miranda-ng.org/index.php?title=Plugin:PluginName
location ~ /p/ {
rewrite ^\/p\/(.*)\/?$ https://wiki.miranda-ng.org/index.php?title=Plugin:$1 redirect;
}
}

server {
listen 80;
server_name miranda-ng.org;

# IM Updater doesn't support HTTPS, so we force HTTPS only for website
location / {
return 301 https://$host$request_uri;
}

# IM Updater
location /distr {
root /var/www/miranda-ng.org; # we want to keep distr outside hugo dir so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/www.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443;
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name www.miranda-ng.org;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;

access_log off;
error_log off;

return 301 $scheme://miranda-ng.org$request_uri;
}

server {
if ($host = www.miranda-ng.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name www.miranda-ng.org;
return 404; # managed by Certbot
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/www.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/addons.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/miranda-ng.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/miranda-ng.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name addons.miranda-ng.org;
add_header Strict-Transport-Security "max-age=604800; includeSubDomains" always;
return 301 $scheme://miranda-ng.org/addons$request_uri;
}

server {
if ($host = addons.miranda-ng.org) {
return 301 https://$host$request_uri;
} # managed by Certbot

listen 80;
server_name addons.miranda-ng.org;
return 404; # managed by Certbot
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/addons.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/miranda-ng.org</tt>

<tt>sudo find /var/www/miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod -R 775 /var/www/miranda-ng.org/htdocs/content /var/www/miranda-ng.org/htdocs/static /var/www/miranda-ng.org/distr</tt>

<tt>sudo chmod +x /var/www/miranda-ng.org/zipme.sh /var/www/miranda-ng.org/scripts/*</tt>

== Certbot ==
<tt>sudo apt install certbot python3-certbot-nginx</tt>

<tt>sudo certbot --nginx -d miranda-ng.org -d www.miranda-ng.org -d addons.miranda-ng.org -d forum.miranda-ng.org -d oauth.miranda-ng.org -d wiki.miranda-ng.org</tt>

<tt>sudo systemctl restart nginx</tt>

== PHP ==
<tt>sudo nano /etc/php/8.3/fpm/pool.d/www.conf</tt>
<pre style="overflow:auto;">
listen = /run/php/php-fpm.sock

pm = static

pm.max_children = 200
</pre>

== Postfix ==
<tt>sudo DEBIAN_PRIORITY=low apt install postfix opendkim opendkim-tools</tt>

<tt>sudo dpkg-reconfigure postfix</tt>
<pre style="overflow:auto;">
Internet Site
miranda-ng.org
empty
default
No
default
0
+
all
</pre>

<tt>sudo nano /etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
myhostname = miranda-ng.org
inet_interfaces = loopback-only
</pre>

<tt>sudo systemctl enable --now opendkim</tt>

<tt>sudo opendkim-genkey -D /etc/dkimkeys/ --domain miranda-ng.org --selector dkim</tt>

<tt>sudo nano /etc/opendkim.conf</tt>
<pre style="overflow:auto;">
LogWhy yes
UMask 002
Socket local:/var/spool/postfix/run/opendkim/opendkim.sock
InternalHosts refile:/etc/dkimkeys/TrustedHosts
AutoRestart yes
AutoRestartRate 10/1h
ExternalIgnoreList refile:/etc/dkimkeys/TrustedHosts
KeyTable refile:/etc/dkimkeys/KeyTable
SigningTable refile:/etc/dkimkeys/SigningTable
SignatureAlgorithm rsa-sha256
</pre>

<tt>sudo adduser postfix opendkim</tt>

<tt>sudo mkdir -p /var/spool/postfix/run/opendkim</tt>

<tt>sudo chown opendkim:opendkim /var/spool/postfix/run/opendkim</tt>

<tt>sudo nano /etc/dkimkeys/TrustedHosts</tt>
<pre style="overflow:auto;">
127.0.0.1
localhost
*.miranda-ng.org
</pre>

<tt>sudo nano /etc/dkimkeys/KeyTable</tt>
<pre style="overflow:auto;">
dkim._domainkey.miranda-ng.org miranda-ng.org:dkim:/etc/dkimkeys/dkim.private
</pre>

<tt>sudo nano /etc/dkimkeys/SigningTable</tt>
<pre style="overflow:auto;">
*@miranda-ng.org dkim._domainkey.miranda-ng.org
</pre>

<tt>sudo chown -R opendkim:opendkim /etc/dkimkeys</tt>

<tt>sudo chmod -R 600 /etc/dkimkeys</tt>

<tt>sudo chmod 700 /etc/dkimkeys</tt>

<tt>sudo nano /etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
milter_protocol = 2
milter_default_action = accept
smtpd_milters = unix:/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/run/opendkim/opendkim.sock
</pre>

<tt>sudo nano /etc/hosts</tt>
<pre style="overflow:auto;">
139.100.207.143 miranda-ng.org
</pre>

<tt>sudo hostnamectl set-hostname miranda-ng.org</tt>

<tt>sudo systemctl restart opendkim</tt>

<tt>sudo systemctl restart postfix</tt>

DNS records:
<pre style="overflow:auto;">
miranda-ng.org MX miranda-ng.org 10
miranda-ng.org TXT v=spf1 +a +mx -all
DKIM._DOMAINKEY.miranda-ng.org TXT dkim_from_/etc/dkimkeys/dkim.txt
_DMARC.miranda-ng.org TXT v=DMARC1; p=none; aspf=r; sp=none
</pre>

<tt>echo "Subject: hello" | sendmail test@example.com</tt>

Port 25 may be blocked on cheap VPS; in this case, see the next section about SMTP relay.

== SMTP relay ==
Remove all MX, SPF and DKIM records from DNS.

Register VK WorkSpace account.

Add and confirm miranda-ng.org domain.

Create user: noreply@miranda-ng.org.

Login to this maibox via mail.ru website.

Create passwords for external application.

<tt>sudo nano /etc/postfix/sasl_passwd</tt>
<pre style="overflow:auto;">
[smtp.mail.ru]:587 noreply@miranda-ng.org:appP@ssword
</pre>

<tt>sudo postmap /etc/postfix/sasl_passwd</tt>

<tt>sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db</tt>

<tt>sudo nano /etc/postfix/generic</tt>
<pre style="overflow:auto;">
www-data noreply@miranda-ng.org
</pre>

<tt>sudo postmap /etc/postfix/generic</tt>

<tt>sudo nano etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
smtp_tls_security_level = encrypt

relayhost = [smtp.mail.ru]:587

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_loglevel = 1
smtp_generic_maps = hash:/etc/postfix/generic
</pre>

<tt>sudo apt install libsasl2-modules</tt>

<tt>sudo systemctl restart postfix</tt>

== Prosody ==
<tt>sudo wget https://prosody.im/downloads/repos/$(lsb_release -sc)/prosody.sources -O/etc/apt/sources.list.d/prosody.sources</tt>

<tt>sudo apt update</tt>

<tt>sudo apt install prosody lua-dbi-mysql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssw0rd';
CREATE DATABASE prosody;
quit
</pre>

<tt>sudo mysql -u root -f prosody < ~/prosody.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo nano /etc/prosody/prosody.cfg.lua</tt>
<pre style="overflow:auto;">
admins = { "username@miranda-ng.org", "username2@miranda-ng.org" }

modules_enabled = {
--"register"; -- Allow users to register on this server
"mam"; -- Store recent messages to allow multi-device synchronization
}

modules_disabled = {
"s2s"; -- Handle server-to-server connections
}

storage = "sql" -- Default is "internal"

sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "p@ssword", host = "localhost" }

archive_expires_after = "never" -- Keep messages forever

--VirtualHost "localhost"
-- Prosody requires at least one enabled VirtualHost to function. You can
-- safely remove or disable 'localhost' once you have added another.

VirtualHost "miranda-ng.org"
ssl = {
key = "/etc/letsencrypt/live/miranda-ng.org/privkey.pem";
certificate = "/etc/letsencrypt/live/miranda-ng.org/fullchain.pem";
protocol = "tlsv1_1+";
}

Component "conference.miranda-ng.org" "muc"
modules_enabled = { "muc_mam" }
</pre>

<tt>sudo chmod -R 755 /etc/letsencrypt/live</tt>

<tt>sudo prosodyctl adduser username@miranda-ng.org</tt>

<tt>sudo systemctl enable --now prosody</tt>

<tt>sudo ufw allow 5000/tcp</tt>

<tt>sudo ufw allow 5222/tcp</tt>

User:Dart Raiden/Server setup

2026-06-10T01:32:44Z

Dart Raiden: /* SMTP relay */

== Export Prosody database from old server ==
<tt>mysqldump --user=prosody --password="p@ssword" --default-character-set=utf8 prosody > prosody.sql</tt>

== Backup forum, wiki, and website ==
<tt>cd /var/www/forum.miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

<tt>cd /var/www/wiki.miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

<tt>cd /var/www/miranda-ng.org</tt>

<tt>sudo ./zipme.sh</tt>

== UFW ==
<tt>sudo apt install ufw</tt>

<tt>sudo ufw allow 22/tcp</tt>

<tt>sudo ufw enable</tt>

== SSH ==
<tt>sudo nano /etc/ssh/sshd_config.d/ciphers_and_keying.conf</tt>
<pre style="overflow:auto;">
KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com
</pre>

<tt>sudo nano /etc/ssh/sshd_config.d/deny_root_login.conf</tt>
<pre style="overflow:auto;">
PermitRootLogin no
</pre>

<tt>sudo nano /etc/ssh/sshd_config.d/enable_pubkey_authentication.conf</tt>
<pre style="overflow:auto;">
PubkeyAuthentication yes
</pre>

<tt>sudo systemctl restart sshd</tt>

== Install Nginx, PHP, and memcached ==
<tt>sudo apt install nginx php-fpm php-mysql php-mbstring php-curl php-gd php-xml php-intl memcached</tt>

<tt>sudo ufw allow 80/tcp</tt>

<tt>sudo ufw allow 443/tcp</tt>

== MariaDB ==
<tt>sudo apt install mariadb-server</tt>

<tt>sudo mysql_secure_installation</tt>
(do not set a root password; enable the other restrictions)

<tt>sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf</tt>
<pre style="overflow:auto;">
max_connections = 1000
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'forum'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE forum_miranda_ng_org;
quit
</pre>

<tt>sudo mysql -u root -f forum_miranda_ng_org < ~/forum_miranda_ng_org.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON forum_miranda_ng_org.* to 'forum'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'wiki'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE wiki_miranda_ng_org;
quit
</pre>

<tt>sudo mysql -u root -f wiki_miranda_ng_org < ~/wiki_miranda_ng_org.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON wiki_miranda_ng_org.* to 'wiki'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE prosody;
quit
</pre>

<tt>sudo mysql -u root -f prosody < ~/prosody.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

== Restore forum backup ==
<tt>sudo mkdir /var/www/forum.miranda-ng.org</tt>

<tt>sudo unzip ~/forum.zip -d /var/www/forum.miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/forum.miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/forum.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl;
server_name forum.miranda-ng.org;
root /var/www/forum.miranda-ng.org/htdocs;

access_log /var/log/nginx/forum.miranda-ng.org_access.log main;
error_log /var/log/nginx/forum.miranda-ng.org_error.log info;

index index.php;

location = /favicon.ico {
include params.d/public.params;
}

location = /robots.txt {
include params.d/public.params;
}

location / {
# actions
rewrite ^/(activate|admin|announce|ban|boardrecount|buddy|calendar|cleanperms)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(collapse|convertentities|convertutf8|coppa|deletemsg|detailedversion|display|dlattach)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(dumpdb|editpoll|editpoll2|featuresettings|featuresettings2|findmember|help|helpadmin)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(im|jsoption|jsmodify|lock|lockVoting|login|login2|logout)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(maintain|manageattachments|manageboards|managecalendar|managesearch|markasread|membergroups|mergetopics)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(mlist|modifycat|modifykarma|modlog|movetopic|movetopic2|news|notify)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(notifyboard|optimizetables|packageget|packages|permissions|pgdownload|pm|post)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(post2|postsettings|printpage|profile|profile2|quotefast|quickmod|quickmod2)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(recent|regcenter|register|register2|reminder|removetopic2|removeoldtopics2|removepoll)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(repairboards|reporttm|reports|requestmembers|search|search2|sendtopic|serversettings)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(serversettings2|smileys|smstats|spellcheck|splittopics|stats|sticky|theme)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(trackip|about:mozilla|about:unknown|unread|unreadreplies|viewErrorLog|viewmembers|viewprofile)/?$ "/index.php?pretty;action=$1" last;
rewrite ^/(verificationcode|vote|viewquery|who|\.xml)/?$ "/index.php?pretty;action=$1" last;

# boards + topics
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.0 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.$2 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.0 last;
rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*|msg[0-9]*|new)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.$3 last;
}

location ~* \.php$ {
try_files $uri =404;
fastcgi_split_path_info ^(.+.php)(.*)$;
include params.d/phpfpm.params;
}

location ~ /Packages {
allow 127.0.0.1;
deny all;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}

location ~ /\.ht {
deny all;
}
}

server {
if ($host = forum.miranda-ng.org) {
return 301 https://$host$request_uri;
} #

listen 80;
server_name forum.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/forum.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/forum.miranda-ng.org</tt>

<tt>sudo find /var/www/forum.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod +x /var/www/forum.miranda-ng.org/zipme.sh</tt>

Use repair_settings.php and status.php from https://github.com/SimpleMachines/tools/

== Restore wiki backup ==
<tt>sudo mkdir /var/www/wiki.miranda-ng.org</tt>

<tt>sudo unzip ~/wiki.zip -d /var/www/wiki.miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/wiki.miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/wiki.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl;
server_name wiki.miranda-ng.org;
root /var/www/wiki.miranda-ng.org/htdocs;

access_log /var/log/nginx/wiki.miranda-ng.org_access.log main;
error_log /var/log/nginx/wiki.miranda-ng.org_error.log info;

index index.php;

location ~* ^(.*)(install.php|LocalSettings.php|\.git) { deny all; }

location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
expires max;
log_not_found off;
}

location ~* \.php$ {
try_files $uri @404;
include params.d/phpfpm.params;
}

location /images/ {
location ~.*\.(php)?$ {
deny all;
}
}

location @404 {
return 404;
break;
}

# https://stackoverflow.com/questions/35446113/using-short-urls-for-mediawiki-with-nginx
location / {
try_files $uri $uri/ @mediawiki;
}

location @mediawiki {
rewrite ^/([^?]*)(?:\?(.*))? /index.php?title=$1&$2 last;
}
}

server {
if ($host = wiki.miranda-ng.org) {
return 301 https://$host$request_uri;
}

listen 80;
server_name wiki.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/wiki.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/wiki.miranda-ng.org</tt>

<tt>sudo find /var/www/wiki.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod +x /var/www/wiki.miranda-ng.org/zipme.sh /var/www/wiki.miranda-ng.org/htdocs/extensions/Scribunto/includes/engines/LuaStandalone/binaries/lua5_1_5_linux_64_generic/lua /var/www/wiki.miranda-ng.org/htdocs/extensions/SyntaxHighlight_GeSHi/pygments/pygmentize</tt>

<tt>php /var/www/wiki.miranda-ng.org/htdocs/maintenance/update.php</tt>

== Restore website backup ==
<tt>sudo apt install hugo</tt>

<tt>sudo mkdir /var/www/miranda-ng.org</tt>

<tt>sudo unzip ~/mainsite.zip -d /var/www/miranda-ng.org</tt>

<tt>sudo chown -R www-data:www-data /var/www/miranda-ng.org</tt>

<tt>sudo nano /etc/nginx/sites-available/oauth.miranda-ng.org</tt>
<pre style="overflow:auto;">
# oauth for CloudFile
server {
listen 443 ssl;
server_name oauth.miranda-ng.org;

access_log /var/log/nginx/oauth.miranda-ng.org_access.log main;
error_log /var/log/nginx/oauth.miranda-ng.org_error.log info;

# todo: deny access to root (or remove root), allow only verification (or redirect whole subdomain to main domain), unify with miranda-ng.org.conf
location ~* /verification(.*)$ {
return 301 https://miranda-ng.org/verification$is_args$args;
}
}

server {
if ($host = oauth.miranda-ng.org) {
return 301 https://$host$request_uri;
}

listen 80;
server_name oauth.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/oauth.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/miranda-ng.org</tt>
<pre style="overflow:auto;">
# get locale
map $http_accept_language $browser_lang {
default en;
~ru ru;
}
map $cookie_lang $lang {
default $browser_lang;
~en en;
~ru ru;
}

map $http_user_agent $excluded_ua {
~SemrushBot 0;
~facebookexternalhit 0;
default 1;
}

server {
listen 443 ssl;
server_name miranda-ng.org;
root /var/www/miranda-ng.org/htdocs/public;

include google-analytics;

access_log /var/log/nginx/miranda-ng.org_access.log main if=$excluded_ua;
error_log /var/log/nginx/miranda-ng.org_error.log info;

# case sensitive http user agent blocking
if ($excluded_ua ~ "0") {
return 403;
}

index index.html;
autoindex off;

# CloudFile: verification.php
location ~* \.php$ {
try_files $uri =404;
include params.d/phpfpm.params;
}

# CloudFile: /verification -> /verification.php
location ~ /verification {
rewrite ^/verification(.*)$ /verification.php$1 redirect;
}

location ~ /distr {
root /var/www/miranda-ng.org; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}

location ~ /(x32|x64) {
root /var/www/miranda-ng.org/distr; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}

# ADDONS -> addons
location ~ /ADDONS {
rewrite ^/ADDONS/(.*)$ /addons/$1 redirect;
}

location ~ /addons/images {
root /var/www/miranda-ng.org;
autoindex on;
}

location ~ /addons/files {
root /var/www/miranda-ng.org;
autoindex on;
}

error_page 404 /404.html;

location = /favicon.ico {
include params.d/public.params;
}

location = /robots.txt {
include params.d/public.params;
}

location ~* \.(js|css|png|jpg|jpeg|gif|ico|pdf)$ {
expires max;
log_not_found off;
}

location ~ /hotcoffee {
index index.html;
add_header Cache-Control no-cache,no-store,must-revalidate;

set $lang en;
if ($cookie_LANG = 'ru'){ set $lang ru; }
if ($http_accept_language ~* '(ru|be|kz|ua)'){ set $lang ru; }
if ($cookie_LANG = 'en'){ set $lang en; }

rewrite ^/hotcoffee(/?)$ /hotcoffee/$lang/index.html break;
rewrite ^/hotcoffee/licenses/([^/]+\.html)(/?)$ /hotcoffee/$lang/licenses/$1 break;
rewrite ^/hotcoffee/([^/]+)(/?)$ /hotcoffee/$lang/$1.html break;
}

# redirect from miranda-ng.org/p/PluginName to wiki.miranda-ng.org/index.php?title=Plugin:PluginName
location ~ /p/ {
rewrite ^\/p\/(.*)\/?$ https://wiki.miranda-ng.org/index.php?title=Plugin:$1 redirect;
}
}

server {
listen 80;
server_name miranda-ng.org;

# IM Updater doesn't support HTTPS, so we force HTTPS only for website
location / {
return 301 https://$host$request_uri;
}

# IM Updater
location /distr {
root /var/www/miranda-ng.org; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
post_action @GAlog;
proxy_set_header Cache-Control private;
proxy_set_header Content-Disposition "attachment";
autoindex on;
}
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/www.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443;
server_name www.miranda-ng.org;

access_log off;
error_log off;

return 301 $scheme://miranda-ng.org$request_uri;
}

server {
if ($host = www.miranda-ng.org) {
return 301 https://$host$request_uri;
}

listen 80;
server_name www.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/www.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo nano /etc/nginx/sites-available/addons.miranda-ng.org</tt>
<pre style="overflow:auto;">
server {
listen 443 ssl;
server_name addons.miranda-ng.org;
return 301 $scheme://miranda-ng.org/addons$request_uri;
}

server {
if ($host = addons.miranda-ng.org) {
return 301 https://$host$request_uri;
}

listen 80;
server_name addons.miranda-ng.org;
return 404;
}
</pre>

<tt>sudo ln -s /etc/nginx/sites-available/addons.miranda-ng.org /etc/nginx/sites-enabled/</tt>

<tt>sudo chmod -R 644 /var/www/miranda-ng.org</tt>

<tt>sudo find /var/www/miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755</tt>

<tt>sudo chmod -R 775 /var/www/miranda-ng.org/htdocs/content /var/www/miranda-ng.org/htdocs/static /var/www/miranda-ng.org/distr</tt>

<tt>sudo chmod +x /var/www/miranda-ng.org/zipme.sh /var/www/miranda-ng.org/scripts/*</tt>

== Certbot ==
<tt>sudo apt install certbot python3-certbot-nginx</tt>

<tt>sudo certbot --nginx -d miranda-ng.org -d www.miranda-ng.org -d addons.miranda-ng.org -d forum.miranda-ng.org -d oauth.miranda-ng.org -d wiki.miranda-ng.org</tt>

<tt>sudo systemctl restart nginx</tt>

== PHP ==
<tt>sudo nano /etc/php/8.3/fpm/pool.d/www.conf</tt>
<pre style="overflow:auto;">
listen = /run/php/php-fpm.sock

pm = static

pm.max_children = 200
</pre>

== Postfix ==
<tt>sudo DEBIAN_PRIORITY=low apt install postfix opendkim opendkim-tools</tt>

<tt>sudo dpkg-reconfigure postfix</tt>
<pre style="overflow:auto;">
Internet Site
miranda-ng.org
empty
default
No
default
0
+
all
</pre>

<tt>sudo nano /etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
myhostname = miranda-ng.org
inet_interfaces = loopback-only
</pre>

<tt>sudo systemctl enable --now opendkim</tt>

<tt>sudo opendkim-genkey -D /etc/dkimkeys/ --domain miranda-ng.org --selector dkim</tt>

<tt>sudo nano /etc/opendkim.conf</tt>
<pre style="overflow:auto;">
LogWhy yes
UMask 002
Socket local:/var/spool/postfix/run/opendkim/opendkim.sock
InternalHosts refile:/etc/dkimkeys/TrustedHosts
AutoRestart yes
AutoRestartRate 10/1h
ExternalIgnoreList refile:/etc/dkimkeys/TrustedHosts
KeyTable refile:/etc/dkimkeys/KeyTable
SigningTable refile:/etc/dkimkeys/SigningTable
SignatureAlgorithm rsa-sha256
</pre>

<tt>sudo adduser postfix opendkim</tt>

<tt>sudo mkdir -p /var/spool/postfix/run/opendkim</tt>

<tt>sudo chown opendkim:opendkim /var/spool/postfix/run/opendkim</tt>

<tt>sudo nano /etc/dkimkeys/TrustedHosts</tt>
<pre style="overflow:auto;">
127.0.0.1
localhost
*.miranda-ng.org
</pre>

<tt>sudo nano /etc/dkimkeys/KeyTable</tt>
<pre style="overflow:auto;">
dkim._domainkey.miranda-ng.org miranda-ng.org:dkim:/etc/dkimkeys/dkim.private
</pre>

<tt>sudo nano /etc/dkimkeys/SigningTable</tt>
<pre style="overflow:auto;">
*@miranda-ng.org dkim._domainkey.miranda-ng.org
</pre>

<tt>sudo chown -R opendkim:opendkim /etc/dkimkeys</tt>

<tt>sudo chmod -R 600 /etc/dkimkeys</tt>

<tt>sudo chmod 700 /etc/dkimkeys</tt>

<tt>sudo nano /etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
milter_protocol = 2
milter_default_action = accept
smtpd_milters = unix:/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/run/opendkim/opendkim.sock
</pre>

<tt>sudo nano /etc/hosts</tt>
<pre style="overflow:auto;">
139.100.207.143 miranda-ng.org
</pre>

<tt>sudo hostnamectl set-hostname miranda-ng.org</tt>

<tt>sudo systemctl restart opendkim</tt>

<tt>sudo systemctl restart postfix</tt>

DNS records:
<pre style="overflow:auto;">
miranda-ng.org MX miranda-ng.org 10
miranda-ng.org TXT v=spf1 +a +mx -all
DKIM._DOMAINKEY.miranda-ng.org TXT dkim_from_/etc/dkimkeys/dkim.txt
_DMARC.miranda-ng.org TXT v=DMARC1; p=none; aspf=r; sp=none
</pre>

<tt>echo "Subject: hello" | sendmail test@example.com</tt>

Port 25 may be blocked on cheap VPS; in this case, see the next section about SMTP relay.

== SMTP relay ==
Remove all MX, SPF and DKIM records from DNS.

Register VK WorkSpace account.

Add and confirm miranda-ng.org domain.

Create user: noreply@miranda-ng.org.

Login to this maibox via mail.ru website.

Create passwords for external application.

<tt>sudo nano /etc/postfix/sasl_passwd</tt>
<pre style="overflow:auto;">
[smtp.mail.ru]:587 noreply@miranda-ng.org:appP@ssword
</pre>

<tt>sudo postmap /etc/postfix/sasl_passwd</tt>

<tt>sudo chmod 600 /etc/postfix/sasl_passwd /etc/postfix/sasl_passwd.db</tt>

<tt>sudo nano /etc/postfix/generic</tt>
<pre style="overflow:auto;">
www-data noreply@miranda-ng.org
</pre>

<tt>sudo postmap /etc/postfix/generic</tt>

<tt>sudo nano etc/postfix/main.cf</tt>
<pre style="overflow:auto;">
smtp_tls_security_level = encrypt

relayhost = [smtp.mail.ru]:587

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/sasl_passwd
smtp_sasl_security_options = noanonymous
smtp_tls_loglevel = 1
smtp_generic_maps = hash:/etc/postfix/generic
</pre>

<tt>sudo apt install libsasl2-modules</tt>

<tt>sudo systemctl restart postfix</tt>

== Prosody ==
<tt>sudo wget https://prosody.im/downloads/repos/$(lsb_release -sc)/prosody.sources -O/etc/apt/sources.list.d/prosody.sources</tt>

<tt>sudo apt update</tt>

<tt>sudo apt install prosody lua-dbi-mysql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssw0rd';
CREATE DATABASE prosody;
quit
</pre>

<tt>sudo mysql -u root -f prosody < ~/prosody.sql</tt>

<tt>sudo mysql -u root</tt>
<pre style="overflow:auto;">
GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit
</pre>

<tt>sudo nano /etc/prosody/prosody.cfg.lua</tt>
<pre style="overflow:auto;">
admins = { "username@miranda-ng.org", "username2@miranda-ng.org" }

modules_enabled = {
--"register"; -- Allow users to register on this server
"mam"; -- Store recent messages to allow multi-device synchronization
}

modules_disabled = {
"s2s"; -- Handle server-to-server connections
}

storage = "sql" -- Default is "internal"

sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "p@ssword", host = "localhost" }

archive_expires_after = "never" -- Keep messages forever

--VirtualHost "localhost"
-- Prosody requires at least one enabled VirtualHost to function. You can
-- safely remove or disable 'localhost' once you have added another.

VirtualHost "miranda-ng.org"
ssl = {
key = "/etc/letsencrypt/live/miranda-ng.org/privkey.pem";
certificate = "/etc/letsencrypt/live/miranda-ng.org/fullchain.pem";
protocol = "tlsv1_1+";
}

Component "conference.miranda-ng.org" "muc"
modules_enabled = { "muc_mam" }
</pre>

<tt>sudo chmod -R 755 /etc/letsencrypt/live</tt>

<tt>sudo prosodyctl adduser username@miranda-ng.org</tt>

<tt>sudo systemctl enable --now prosody</tt>

<tt>sudo ufw allow 5000/tcp</tt>

<tt>sudo ufw allow 5222/tcp</tt>