User:Dart Raiden/Server setup: Difference between revisions

← Older edit Newer edit →

Revision as of 22:19, 9 June 2026

Export Prosody database from old server

mysqldump --user=prosody --password="p@ssword" --default-character-set=utf8 prosody > prosody.sql

Backup forum, wiki, and website

cd /var/www/forum.miranda-ng.org

sudo ./zipme.sh

cd /var/www/wiki.miranda-ng.org

sudo ./zipme.sh

cd /var/www/miranda-ng.org

sudo ./zipme.sh

UFW

sudo apt install ufw

sudo ufw allow 22/tcp

sudo ufw enable

SSH

sudo nano /etc/ssh/sshd_config.d/ciphers_and_keying.conf

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

sudo nano /etc/ssh/sshd_config.d/deny_root_login.conf

PermitRootLogin no

sudo nano /etc/ssh/sshd_config.d/enable_pubkey_authentication.conf

PubkeyAuthentication yes

sudo systemctl restart sshd

Install Nginx, PHP, and memcached

sudo apt install nginx php-fpm php-mysql php-mbstring php-curl php-gd php-xml php-intl memcached

sudo ufw allow 80/tcp

sudo ufw allow 443/tcp

MariaDB

sudo apt install mariadb-server

sudo mysql_secure_installation (do not set a root password; enable the other restrictions)

sudo nano /etc/mysql/mariadb.conf.d/50-server.cnf

max_connections         = 1000

sudo mysql -u root

CREATE USER 'forum'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE forum_miranda_ng_org;
quit

sudo mysql -u root -f forum_miranda_ng_org < ~/forum_miranda_ng_org.sql

sudo mysql -u root

GRANT ALL ON forum_miranda_ng_org.* to 'forum'@'localhost';
FLUSH PRIVILEGES;
quit

sudo mysql -u root

CREATE USER 'wiki'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE wiki_miranda_ng_org;
quit

sudo mysql -u root -f wiki_miranda_ng_org < ~/wiki_miranda_ng_org.sql

sudo mysql -u root

GRANT ALL ON wiki_miranda_ng_org.* to 'wiki'@'localhost';
FLUSH PRIVILEGES;
quit

sudo mysql -u root

CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE prosody;
quit

sudo mysql -u root -f prosody < ~/prosody.sql

sudo mysql -u root

GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit

Restore forum backup

sudo mkdir /var/www/forum.miranda-ng.org

sudo unzip ~/forum.zip -d /var/www/forum.miranda-ng.org

sudo chown -R www-data:www-data /var/www/forum.miranda-ng.org

sudo nano /etc/nginx/sites-available/forum.miranda-ng.org

server {
    listen 443 ssl;
    server_name forum.miranda-ng.org;
    root /var/www/forum.miranda-ng.org/htdocs;

    access_log /var/log/nginx/forum.miranda-ng.org_access.log main;
    error_log /var/log/nginx/forum.miranda-ng.org_error.log info;

    index index.php;

    location = /favicon.ico {
        include params.d/public.params;
    }

    location = /robots.txt {
        include params.d/public.params;
    }

    location / {
    # actions
    rewrite ^/(activate|admin|announce|ban|boardrecount|buddy|calendar|cleanperms)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(collapse|convertentities|convertutf8|coppa|deletemsg|detailedversion|display|dlattach)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(dumpdb|editpoll|editpoll2|featuresettings|featuresettings2|findmember|help|helpadmin)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(im|jsoption|jsmodify|lock|lockVoting|login|login2|logout)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(maintain|manageattachments|manageboards|managecalendar|managesearch|markasread|membergroups|mergetopics)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(mlist|modifycat|modifykarma|modlog|movetopic|movetopic2|news|notify)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(notifyboard|optimizetables|packageget|packages|permissions|pgdownload|pm|post)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(post2|postsettings|printpage|profile|profile2|quotefast|quickmod|quickmod2)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(recent|regcenter|register|register2|reminder|removetopic2|removeoldtopics2|removepoll)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(repairboards|reporttm|reports|requestmembers|search|search2|sendtopic|serversettings)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(serversettings2|smileys|smstats|spellcheck|splittopics|stats|sticky|theme)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(trackip|about:mozilla|about:unknown|unread|unreadreplies|viewErrorLog|viewmembers|viewprofile)/?$ "/index.php?pretty;action=$1" last;
    rewrite ^/(verificationcode|vote|viewquery|who|\.xml)/?$ "/index.php?pretty;action=$1" last;

    # boards + topics
    rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.0 last;
    rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*)/[0-9]?/?$ /index.php?pretty%3Bboard=$1.$2 last;
    rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.0 last;
    rewrite ^/([-_!~*'()$a-zA-Z0-9]+)/([-_!~*'()$a-zA-Z0-9]+)/([0-9]*|msg[0-9]*|new)/[0-9]?/?$ /index.php?pretty%3Bboard=$1%3Btopic=$2.$3 last;
    }

    location ~* \.php$ {
        try_files $uri =404;
        fastcgi_split_path_info ^(.+.php)(.*)$;
        include params.d/phpfpm.params;
    }

    location ~ /Packages {
        allow 127.0.0.1;
        deny all;
    }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found off;
    }

    location ~ /\.ht {
        deny all;
    }
}

server {
    if ($host = forum.miranda-ng.org) {
        return 301 https://$host$request_uri;
    } #

    listen 80;
    server_name forum.miranda-ng.org;
    return 404;
}

sudo ln -s /etc/nginx/sites-available/forum.miranda-ng.org /etc/nginx/sites-enabled/

sudo chmod -R 644 /var/www/forum.miranda-ng.org

sudo find /var/www/forum.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755

sudo chmod +x /var/www/forum.miranda-ng.org/zipme.sh

Use repair_settings.php and status.php from https://github.com/SimpleMachines/tools/

Restore wiki backup

sudo mkdir /var/www/wiki.miranda-ng.org

sudo unzip ~/wiki.zip -d /var/www/wiki.miranda-ng.org

sudo chown -R www-data:www-data /var/www/wiki.miranda-ng.org

sudo nano /etc/nginx/sites-available/wiki.miranda-ng.org

server {
    listen 443 ssl;
    server_name wiki.miranda-ng.org;
    root /var/www/wiki.miranda-ng.org/htdocs;

    access_log /var/log/nginx/wiki.miranda-ng.org_access.log main;
    error_log /var/log/nginx/wiki.miranda-ng.org_error.log info;

    index index.php;

    location ~* ^(.*)(install.php|LocalSettings.php|\.git) { deny all; }

    location ~* \.(js|css|png|jpg|jpeg|gif|ico)$ {
        expires max;
        log_not_found off;
    }

    location ~* \.php$ {
        try_files       $uri @404;
        include params.d/phpfpm.params;
    }

    location /images/ {
        location ~.*\.(php)?$ {
            deny all;
        }
    }

    location @404 {
        return 404;
        break;
    }

    # https://stackoverflow.com/questions/35446113/using-short-urls-for-mediawiki-with-nginx
    location / {
        try_files $uri $uri/ @mediawiki;
    }

    location @mediawiki {
        rewrite ^/([^?]*)(?:\?(.*))? /index.php?title=$1&$2 last;
    }
}

server {
    if ($host = wiki.miranda-ng.org) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    server_name wiki.miranda-ng.org;
    return 404;
}

sudo ln -s /etc/nginx/sites-available/wiki.miranda-ng.org /etc/nginx/sites-enabled/

sudo chmod -R 644 /var/www/wiki.miranda-ng.org

sudo find /var/www/wiki.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755

sudo chmod +x /var/www/wiki.miranda-ng.org/zipme.sh /var/www/wiki.miranda-ng.org/htdocs/extensions/Scribunto/includes/engines/LuaStandalone/binaries/lua5_1_5_linux_64_generic/lua /var/www/wiki.miranda-ng.org/htdocs/extensions/SyntaxHighlight_GeSHi/pygments/pygmentize

php /var/www/wiki.miranda-ng.org/htdocs/maintenance/update.php

Restore website backup

sudo apt install hugo

sudo mkdir /var/www/miranda-ng.org

sudo unzip ~/mainsite.zip -d /var/www/miranda-ng.org

sudo chown -R www-data:www-data /var/www/miranda-ng.org

sudo nano /etc/nginx/sites-available/oauth.miranda-ng.org

# oauth for CloudFile
server {
    listen 443 ssl;
    server_name oauth.miranda-ng.org;

    access_log /var/log/nginx/oauth.miranda-ng.org_access.log main;
    error_log /var/log/nginx/oauth.miranda-ng.org_error.log info;

    # todo: deny access to root (or remove root), allow only verification (or redirect whole subdomain to main domain), unify with miranda-ng.org.conf
    location ~* /verification(.*)$ { 
        return 301 https://miranda-ng.org/verification$is_args$args;
    }
}

server {
    if ($host = oauth.miranda-ng.org) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    server_name oauth.miranda-ng.org;
    return 404;
}

sudo ln -s /etc/nginx/sites-available/oauth.miranda-ng.org /etc/nginx/sites-enabled/

sudo nano /etc/nginx/sites-available/miranda-ng.org

# get locale
map $http_accept_language $browser_lang {
        default en;
        ~ru ru;
}
map $cookie_lang $lang {
    default $browser_lang;
    ~en en;
    ~ru ru;
}

map $http_user_agent $excluded_ua {
    ~SemrushBot 0;
    ~facebookexternalhit 0;
    default     1;
}

server {
    listen 443 ssl;
    server_name miranda-ng.org;
    root /var/www/miranda-ng.org/htdocs/public;

    include google-analytics;

    access_log /var/log/nginx/miranda-ng.org_access.log main if=$excluded_ua;
    error_log /var/log/nginx/miranda-ng.org_error.log info;

    # case sensitive http user agent blocking
    if ($excluded_ua ~ "0") {
       return 403;
    }

    index index.html;
    autoindex off;

    # CloudFile: verification.php
    location ~* \.php$ {
        try_files $uri =404;
        include params.d/phpfpm.params;
    }

    # CloudFile: /verification -> /verification.php
    location ~ /verification {
        rewrite ^/verification(.*)$ /verification.php$1 redirect;
    }

    location ~ /distr {
        root /var/www/miranda-ng.org; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
        post_action @GAlog;
        proxy_set_header Cache-Control  private;
        proxy_set_header Content-Disposition "attachment";
        autoindex on;
    }

    location ~ /(x32|x64) {
        root /var/www/miranda-ng.org/distr; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
        post_action @GAlog;
        proxy_set_header Cache-Control  private;
        proxy_set_header Content-Disposition "attachment";
        autoindex on;
    }

    # ADDONS -> addons
    location ~ /ADDONS {
        rewrite ^/ADDONS/(.*)$ /addons/$1 redirect;
    }

    location ~ /addons/images {
        root /var/www/miranda-ng.org;
        autoindex on;
    }
    
    location ~ /addons/files {
        root /var/www/miranda-ng.org;
        autoindex on;
    }

    error_page 404 /404.html;

    location = /favicon.ico {
        include params.d/public.params;
    }

    location = /robots.txt {
        include params.d/public.params;
    }
 
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|pdf)$ {
        expires max;
        log_not_found off;
    }

    location ~ /hotcoffee {
        index index.html;
        add_header Cache-Control no-cache,no-store,must-revalidate;

        set $lang en;
        if ($cookie_LANG = 'ru'){ set $lang ru; }
        if ($http_accept_language ~* '(ru|be|kz|ua)'){ set $lang ru; }
        if ($cookie_LANG = 'en'){ set $lang en; }

        rewrite ^/hotcoffee(/?)$ /hotcoffee/$lang/index.html break;
        rewrite ^/hotcoffee/licenses/([^/]+\.html)(/?)$ /hotcoffee/$lang/licenses/$1 break;
        rewrite ^/hotcoffee/([^/]+)(/?)$ /hotcoffee/$lang/$1.html break;
    }

    # redirect from miranda-ng.org/p/PluginName to wiki.miranda-ng.org/index.php?title=Plugin:PluginName
    location ~ /p/ {
	rewrite ^\/p\/(.*)\/?$ https://wiki.miranda-ng.org/index.php?title=Plugin:$1 redirect;
    }
}

server {
    listen 80;
    server_name miranda-ng.org;

    # IM Updater doesn't support HTTPS, so we force HTTPS only for website
    location / {
        return 301 https://$host$request_uri;
    }

    # IM Updater
    location /distr {
        root /var/www/miranda-ng.org; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
        post_action @GAlog;
        proxy_set_header Cache-Control  private;
        proxy_set_header Content-Disposition "attachment";
        autoindex on;
    }
}

sudo ln -s /etc/nginx/sites-available/miranda-ng.org /etc/nginx/sites-enabled/

sudo nano /etc/nginx/sites-available/www.miranda-ng.org

server {
    listen 443;
    server_name www.miranda-ng.org;

    access_log off;
    error_log off;

    return 301 $scheme://miranda-ng.org$request_uri;
}

server {
    if ($host = www.miranda-ng.org) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    server_name www.miranda-ng.org;
    return 404;
}

sudo ln -s /etc/nginx/sites-available/www.miranda-ng.org /etc/nginx/sites-enabled/

sudo nano /etc/nginx/sites-available/addons.miranda-ng.org

server {
    listen 443 ssl;
    server_name addons.miranda-ng.org;
    return 301 $scheme://miranda-ng.org/addons$request_uri;
}

server {
    if ($host = addons.miranda-ng.org) {
        return 301 https://$host$request_uri;
    }

    listen 80;
    server_name addons.miranda-ng.org;
    return 404;
}

sudo ln -s /etc/nginx/sites-available/addons.miranda-ng.org /etc/nginx/sites-enabled/

sudo chmod -R 644 /var/www/miranda-ng.org

sudo find /var/www/miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755

sudo chmod -R 775 /var/www/miranda-ng.org/htdocs/content /var/www/miranda-ng.org/htdocs/static /var/www/miranda-ng.org/distr

sudo chmod +x /var/www/miranda-ng.org/zipme.sh /var/www/miranda-ng.org/scripts/*

Certbot

sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx -d miranda-ng.org -d www.miranda-ng.org -d addons.miranda-ng.org -d forum.miranda-ng.org -d oauth.miranda-ng.org -d wiki.miranda-ng.org

sudo systemctl restart nginx

PHP

sudo nano /etc/php/8.3/fpm/pool.d/www.conf

listen = /run/php/php-fpm.sock

pm = static

pm.max_children = 200

Postfix

sudo DEBIAN_PRIORITY=low apt install postfix opendkim opendkim-tools

sudo dpkg-reconfigure postfix

Internet Site
miranda-ng.org
empty
default
No
default
0
+
all

sudo nano /etc/postfix/main.cf

myhostname = miranda-ng.org
inet_interfaces = loopback-only

sudo systemctl enable --now opendkim

sudo opendkim-genkey -D /etc/dkimkeys/ --domain miranda-ng.org --selector dkim

sudo nano /etc/opendkim.conf

LogWhy                  yes
UMask                   002
Socket                  local:/var/spool/postfix/run/opendkim/opendkim.sock
InternalHosts           refile:/etc/dkimkeys/TrustedHosts
AutoRestart             yes
AutoRestartRate         10/1h
ExternalIgnoreList      refile:/etc/dkimkeys/TrustedHosts
KeyTable                refile:/etc/dkimkeys/KeyTable
SigningTable            refile:/etc/dkimkeys/SigningTable
SignatureAlgorithm      rsa-sha256

sudo adduser postfix opendkim

sudo mkdir -p /var/spool/postfix/run/opendkim

sudo chown opendkim:opendkim /var/spool/postfix/run/opendkim

sudo nano /etc/dkimkeys/TrustedHosts

127.0.0.1
localhost
*.miranda-ng.org

sudo nano /etc/dkimkeys/KeyTable

dkim._domainkey.miranda-ng.org miranda-ng.org:dkim:/etc/dkimkeys/dkim.private

sudo nano /etc/dkimkeys/SigningTable

*@miranda-ng.org dkim._domainkey.miranda-ng.org

sudo chown -R opendkim:opendkim /etc/dkimkeys

sudo chmod -R 600 /etc/dkimkeys

sudo chmod 700 /etc/dkimkeys

sudo nano /etc/postfix/main.cf

milter_protocol = 2
milter_default_action = accept
smtpd_milters = unix:/run/opendkim/opendkim.sock
non_smtpd_milters = unix:/run/opendkim/opendkim.sock

sudo nano /etc/hosts

139.100.207.143 miranda-ng.org

sudo hostnamectl set-hostname miranda-ng.org

sudo systemctl restart opendkim

sudo systemctl restart postfix

DNS records:

miranda-ng.org MX miranda-ng.org 10
miranda-ng.org TXT v=spf1 +a +mx -all
DKIM._DOMAINKEY.miranda-ng.org TXT dkim_from_/etc/dkimkeys/dkim.txt
_DMARC.miranda-ng.org TXT v=DMARC1; p=none; aspf=r; sp=none

echo "Subject: hello" | sendmail test@example.com

Port 25 may be blocked on cheap VPS; in this case, see the next section.

Prosody

sudo wget https://prosody.im/downloads/repos/$(lsb_release -sc)/prosody.sources -O/etc/apt/sources.list.d/prosody.sources

sudo apt update

sudo apt install prosody lua-dbi-mysql

sudo mysql -u root

CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssw0rd';
CREATE DATABASE prosody;
quit

sudo mysql -u root -f prosody < ~/prosody.sql

sudo mysql -u root

GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit

sudo nano /etc/prosody/prosody.cfg.lua

admins = { "username@miranda-ng.org", "username2@miranda-ng.org" }

modules_enabled = {
		--"register"; -- Allow users to register on this server
        "mam"; -- Store recent messages to allow multi-device synchronization
}

modules_disabled = {
        "s2s"; -- Handle server-to-server connections
}

storage = "sql" -- Default is "internal"

sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "p@ssword", host = "localhost" }

archive_expires_after = "never" -- Keep messages forever

--VirtualHost "localhost"
-- Prosody requires at least one enabled VirtualHost to function. You can
-- safely remove or disable 'localhost' once you have added another.

VirtualHost "miranda-ng.org"
ssl = {
        key = "/etc/letsencrypt/live/miranda-ng.org/privkey.pem";
        certificate = "/etc/letsencrypt/live/miranda-ng.org/fullchain.pem";
        protocol = "tlsv1_1+";
}

Component "conference.miranda-ng.org" "muc"
modules_enabled = { "muc_mam" }

sudo chmod -R 755 /etc/letsencrypt/live

sudo prosodyctl adduser username@miranda-ng.org

sudo systemctl enable --now prosody

sudo ufw allow 5000/tcp

sudo ufw allow 5222/tcp

User:Dart Raiden/Server setup: Difference between revisions

Revision as of 22:19, 9 June 2026

Contents

Export Prosody database from old server

Backup forum, wiki, and website

UFW

SSH

Install Nginx, PHP, and memcached

MariaDB

Restore forum backup

Restore wiki backup

Restore website backup

Certbot

PHP

Postfix

Prosody

Navigation menu

User:Dart Raiden/Server setup: Difference between revisions

Revision as of 22:19, 9 June 2026

Export Prosody database from old server

Backup forum, wiki, and website

UFW

SSH

Install Nginx, PHP, and memcached

MariaDB

Restore forum backup

Restore wiki backup

Restore website backup

Certbot

PHP

Postfix

Prosody

Navigation menu

Search