User:Dart Raiden/Server setup: Difference between revisions

← Older edit Newer edit →

Revision as of 21:01, 8 June 2026

Export databases from old server

mysqldump --user=forum --password="p@ssword" --default-character-set=utf8 forum_miranda_ng_org > forumbackup.sql

mysqldump --user=wikimng --password="p@ssword" --default-character-set=utf8 wiki_miranda_ng_org > wikibackup.sql

mysqldump --user=prosody --password="p@ssword" --default-character-set=utf8 prosody > prosodybackup.sql

UFW

sudo apt install ufw

sudo ufw allow 22/tcp

sudo ufw enable

SSH

sudo nano /etc/ssh/sshd_config.d/ciphers_and_keying.conf

KexAlgorithms curve25519-sha256@libssh.org,ecdh-sha2-nistp521,ecdh-sha2-nistp384,ecdh-sha2-nistp256,diffie-hellman-group-exchange-sha256
Ciphers chacha20-poly1305@openssh.com,aes256-gcm@openssh.com,aes128-gcm@openssh.com,aes256-ctr,aes192-ctr,aes128-ctr
MACs hmac-sha2-512-etm@openssh.com,hmac-sha2-256-etm@openssh.com,umac-128-etm@openssh.com,hmac-sha2-512,hmac-sha2-256,umac-128@openssh.com

sudo nano /etc/ssh/sshd_config.d/deny_root_login.conf

PermitRootLogin no

sudo nano /etc/ssh/sshd_config.d/enable_pubkey_authentication.conf

PubkeyAuthentication yes

sudo systemctl restart sshd

Install PHP and memcached

sudo apt install nginx php-fpm php-mysql php-mbstring php-curl memcached

MariaDB

sudo apt install mariadb-server

sudo mysql_secure_installation (do not set a root password; enable the other restrictions)

sudo mysql -u root

CREATE USER 'forum'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE forum_miranda_ng_org;
quit

sudo mysql -u root -f forum_miranda_ng_org < ~/forumbackup.sql

sudo mysql -u root

GRANT ALL ON forum_miranda_ng_org.* to 'forum'@'localhost';
FLUSH PRIVILEGES; 
quit

sudo mysql -u root

CREATE USER 'wiki'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE wiki_miranda_ng_org;
quit

sudo mysql -u root -f wiki_miranda_ng_org < ~/wikibackup.sql

sudo mysql -u root

GRANT ALL ON wiki_miranda_ng_org.* to 'wiki'@'localhost';
FLUSH PRIVILEGES; 
quit

sudo mysql -u root

CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssword';
CREATE DATABASE prosody;
quit

sudo mysql -u root -f prosody < ~/prosodybackup.sql

sudo mysql -u root

GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES; 
quit

Restore forum backup

sudo mkdir /var/www/forum.miranda-ng.org

sudo unzip ~/forum.zip -d /var/www/forum.miranda-ng.org

sudo chown -R www-data:www-data /var/www/forum.miranda-ng.org

sudo nano /etc/nginx/sites-available/forum.miranda-ng.org

sudo ln -s /etc/nginx/sites-available/forum.miranda-ng.org /etc/nginx/sites-enabled/

sudo systemctl restart nginx

sudo chmod -R 644 /var/www/forum.miranda-ng.org

sudo find /var/www/forum.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755

sudo chmod +x /var/www/forum.miranda-ng.org/zipme.sh

Use repair_settings.php and status.php from https://github.com/SimpleMachines/tools/

Restore wiki backup

sudo mkdir /var/www/wiki.miranda-ng.org

sudo unzip ~/wiki.zip -d /var/www/wiki.miranda-ng.org

sudo chown -R www-data:www-data /var/www/wiki.miranda-ng.org

sudo nano /etc/nginx/sites-available/wiki.miranda-ng.org

sudo ln -s /etc/nginx/sites-available/wiki.miranda-ng.org /etc/nginx/sites-enabled/

sudo systemctl restart nginx

sudo chmod +x /var/www/wiki.miranda-ng.org/zipme.sh /var/www/wiki.miranda-ng.org/htdocs/extensions/Scribunto/includes/engines/LuaStandalone/binaries/lua5_1_5_linux_64_generic/lua /var/www/wiki.miranda-ng.org/htdocs/extensions/SyntaxHighlight_GeSHi/pygments/pygmentize

sudo chmod -R 644 /var/www/wiki.miranda-ng.org

sudo find /var/www/wiki.miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755

php wikifolder/maintenance/update.php

Restore website backup

sudo apt install hugo

sudo mkdir /var/www/miranda-ng.org

sudo unzip ~/mainsite.zip -d /var/www/miranda-ng.org

sudo chown -R www-data:www-data /var/www/miranda-ng.org

sudo nano /etc/nginx/sites-available/oauth.miranda-ng.org

# oauth for CloudFile
server {
    listen 443 ssl;
    server_name oauth.miranda-ng.org;

    access_log /var/log/nginx/oauth.miranda-ng.org_access.log main;
    error_log /var/log/nginx/oauth.miranda-ng.org_error.log info;

    # todo: deny access to root (or remove root), allow only verification (or redirect whole subdomain to main domain), unify with miranda-ng.org.conf
    location ~* /verification(.*)$ { 
        return 301 https://miranda-ng.org/verification$is_args$args;
    }
}

server {
    if ($host = oauth.miranda-ng.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name oauth.miranda-ng.org;
    return 404; # managed by Certbot
}

sudo ln -s /etc/nginx/sites-available/oauth.miranda-ng.org.conf /etc/nginx/sites-enabled/

sudo nano /etc/nginx/sites-available/miranda-ng.org

# get locale
map $http_accept_language $browser_lang {
        default en;
        ~ru ru;
}
map $cookie_lang $lang {
    default $browser_lang;
    ~en en;
    ~ru ru;
}

map $http_user_agent $excluded_ua {
    ~SemrushBot 0;
    ~facebookexternalhit 0;
    default     1;
}

server {
    listen 443 ssl;
    server_name miranda-ng.org;
    root /var/www/miranda-ng.org/htdocs/public;

    include google-analytics;

    access_log /var/log/nginx/miranda-ng.org_access.log main if=$excluded_ua;
    error_log /var/log/nginx/miranda-ng.org_error.log info;

    # case sensitive http user agent blocking
    if ($excluded_ua ~ "0") {
       return 403;
    }

    index index.html;
    autoindex off;

    # CloudFile: verification.php
    location ~* \.php$ {
        try_files $uri =404;
        include params.d/phpfpm.params;
    }

    # CloudFile: /verification -> /verification.php
    location ~ /verification {
        rewrite ^/verification(.*)$ /verification.php$1 redirect;
    }

    location ~ /distr {
        root /var/www/miranda-ng.org; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
        post_action @GAlog;
        proxy_set_header Cache-Control  private;
        proxy_set_header Content-Disposition "attachment";
        autoindex on;
    }

    location ~ /(x32|x64) {
        root /var/www/miranda-ng.org/distr; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
        post_action @GAlog;
        proxy_set_header Cache-Control  private;
        proxy_set_header Content-Disposition "attachment";
        autoindex on;
    }

    # ADDONS -> addons
    location ~ /ADDONS {
        rewrite ^/ADDONS/(.*)$ /addons/$1 redirect;
    }

    location ~ /addons/images {
        root /var/www/miranda-ng.org;
        autoindex on;
    }
    
    location ~ /addons/files {
        root /var/www/miranda-ng.org;
        autoindex on;
    }

    error_page 404 /404.html;

    location = /favicon.ico {
        include params.d/public.params;
    }

    location = /robots.txt {
        include params.d/public.params;
    }
 
    location ~* \.(js|css|png|jpg|jpeg|gif|ico|pdf)$ {
        expires max;
        log_not_found off;
    }

    location ~ /hotcoffee {
        index index.html;
        add_header Cache-Control no-cache,no-store,must-revalidate;

        set $lang en;
        if ($cookie_LANG = 'ru'){ set $lang ru; }
        if ($http_accept_language ~* '(ru|be|kz|ua)'){ set $lang ru; }
        if ($cookie_LANG = 'en'){ set $lang en; }

        rewrite ^/hotcoffee(/?)$ /hotcoffee/$lang/index.html break;
        rewrite ^/hotcoffee/licenses/([^/]+\.html)(/?)$ /hotcoffee/$lang/licenses/$1 break;
        rewrite ^/hotcoffee/([^/]+)(/?)$ /hotcoffee/$lang/$1.html break;
    }

    # redirect from miranda-ng.org/p/PluginName to wiki.miranda-ng.org/index.php?title=Plugin:PluginName
    location ~ /p/ {
	rewrite ^\/p\/(.*)\/?$ https://wiki.miranda-ng.org/index.php?title=Plugin:$1 redirect;
    }
}

server {
    listen 80;
    server_name miranda-ng.org;

    # IM Updater doesn't support HTTPS, so we force HTTPS only for website
    location / {
        return 301 https://$host$request_uri;
    }

    # IM Updater
    location /distr {
        root /var/www/miranda-ng.org; # we want to keep /distr outside hugo directory so it doesn't get copied on every build
        post_action @GAlog;
        proxy_set_header Cache-Control  private;
        proxy_set_header Content-Disposition "attachment";
        autoindex on;
    }
}

sudo ln -s /etc/nginx/sites-available/miranda-ng.org /etc/nginx/sites-enabled/

sudo nano /etc/nginx/sites-available/www.miranda-ng.org

server {
    listen 443;
    server_name www.miranda-ng.org;

    access_log off;
    error_log off;

    return 301 $scheme://miranda-ng.org$request_uri;
}

server {
    if ($host = www.miranda-ng.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name www.miranda-ng.org;
    return 404; # managed by Certbot
}

sudo ln -s /etc/nginx/sites-available/www.miranda-ng.org /etc/nginx/sites-enabled/

sudo nano /etc/nginx/sites-available/addons.miranda-ng.org

server {
    listen 443 ssl;
    server_name addons.miranda-ng.org;
    return 301 $scheme://miranda-ng.org/addons$request_uri;
}

server {
    if ($host = addons.miranda-ng.org) {
        return 301 https://$host$request_uri;
    } # managed by Certbot

    listen 80;
    server_name addons.miranda-ng.org;
    return 404; # managed by Certbot
}

sudo ln -s /etc/nginx/sites-available/addons.miranda-ng.org /etc/nginx/sites-enabled/

sudo systemctl restart nginx

sudo chmod -R 644 /var/www/miranda-ng.org

sudo find /var/www/miranda-ng.org -type d -print0 | sudo xargs -0 chmod 755

sudo chmod -R 775 /var/www/miranda-ng.org/htdocs/content /var/www/miranda-ng.org/htdocs/static /var/www/miranda-ng.org/distr

sudo chmod +x /var/www/miranda-ng.org/zipme.sh /var/www/miranda-ng.org/scripts/*

Certbot

sudo apt install certbot python3-certbot-nginx

sudo certbot --nginx -d miranda-ng.org -d www.miranda-ng.org -d addons.miranda-ng.org -d forum.miranda-ng.org -d oauth.miranda-ng.org -d wiki.miranda-ng.org

Postfix

sudo DEBIAN_PRIORITY=low apt install postfix opendkim opendkim-tools

sudo dpkg-reconfigure postfix

Internet Site
miranda-ng.org
empty
default
No
default
0
+
all

sudo nano /etc/postfix/main.cf

myhostname = miranda-ng.org
inet_interfaces = loopback-only

sudo systemctl enable -now pendkim

sudo opendkim-genkey -D /etc/dkimkeys/ --domain miranda-ng.org --selector dkim

udo nano /etc/opendkim.conf

UMask                   002
Socket                  local:/var/spool/postfix/run/opendkim/opendkim.sock
AutoRestart             Yes
AutoRestartRate         10/1h
SyslogSuccess           Yes
LogWhy                  Yes
ExternalIgnoreList      refile:/etc/dkimkeys/TrustedHosts
InternalHosts           refile:/etc/dkimkeys/TrustedHosts
KeyTable                refile:/etc/dkimkeys/KeyTable
SigningTable            refile:/etc/dkimkeys/SigningTable
SignatureAlgorithm      rsa-sha256

sudo adduser postfix opendkim

sudo mkdir -p /var/spool/postfix/run/opendkim

sudo chown opendkim:opendkim /var/spool/postfix/run/opendkim

sudo nano /etc/dkimkeys/TrustedHosts

127.0.0.1
localhost
*.miranda-ng.org

sudo nano /etc/dkimkeys/KeyTable

dkim._domainkey.miranda-ng.org miranda-ng.org:dkim:/etc/dkimkeys/dkim.private

sudo nano /etc/dkimkeys/SigningTable

*@miranda-ng.org dkim._domainkey.miranda-ng.org

sudo chown -R opendkim:opendkim /etc/dkimkeys

sudo chmod 600 /etc/dkimkeys/*

sudo nano /etc/postfix/main.cf

milter_protocol = 2  
milter_default_action = accept  
smtpd_milters = unix:/run/opendkim/opendkim.sock  
non_smtpd_milters = unix:/run/opendkim/opendkim.sock

sudo nano /etc/hosts

92.53.65.196 miranda-ng.org

sudo hostnamectl set-hostname miranda-ng.org

sudo systemctl restart opendkim

sudo systemctl restart postfix

DNS records:

miranda-ng.org MX miranda-ng.org 10
miranda-ng.org TXT v=spf1 +a +mx -all
DKIM._DOMAINKEY.miranda-ng.org TXT dkim_from_/etc/dkimkeys/dkim.txt
_DMARC.miranda-ng.org TXT v=DMARC1; p=none; aspf=r; sp=none

echo "Subject: hello" | sendmail test@example.com

Prosody

sudo wget https://prosody.im/downloads/repos/$(lsb_release -sc)/prosody.sources -O/etc/apt/sources.list.d/prosody.sources

sudo apt install prosody lua-dbi-mysql

sudo mysql -u root

CREATE USER 'prosody'@'localhost' IDENTIFIED BY 'p@ssw0rd';
CREATE DATABASE prosody;
GRANT ALL ON prosody.* to 'prosody'@'localhost';
FLUSH PRIVILEGES;
quit;

sudo nano /etc/prosody/prosody.cfg.lua

admins = { "username@miranda-ng.org", "username2@miranda-ng.org" }

modules_enabled = {
		--"register"; -- Allow users to register on this server
        "proxy65"; -- Enables a file transfer proxy service which clients behind NAT can use
}

modules_disabled = {
	"s2s"; -- Handle server-to-server connections
}

storage = "sql" -- Default is "internal"

sql = { driver = "MySQL", database = "prosody", username = "prosody", password = "p@ssword", host = "localhost" }

archive_expires_after = "4w" -- Remove archived messages after 1 week

log = {
	info = "/var/log/prosody/prosody.log"; -- Change 'info' to 'debug' for verbose logging
	error = "/var/log/prosody/prosody.err";
}

VirtualHost "miranda-ng.org"
ssl = {
	key = "/etc/letsencrypt/live/miranda-ng.org/privkey.pem";
	certificate = "/etc/letsencrypt/live/miranda-ng.org/fullchain.pem";
	protocol = "tlsv1_1+";
}

Component "conference.miranda-ng.org" "muc"
modules_enabled = { "muc_mam" }

sudo chmod -R 755 /etc/letsencrypt/live

sudo prosodyctl adduser username@miranda-ng.org

sudo systemctl enable -now prosody

@@ Line 5: / Line 5: @@
 <tt>mysqldump --user=prosody --password="p@ssword" --default-character-set=utf8 prosody > prosodybackup.sql</tt>
+== UFW ==
+<tt>sudo apt install ufw</tt>
+<tt>sudo ufw allow 22/tcp</tt>
+<tt>sudo ufw enable</tt>
 == SSH ==

User:Dart Raiden/Server setup: Difference between revisions

Revision as of 21:01, 8 June 2026

Contents

Export databases from old server

UFW

SSH

Install PHP and memcached

MariaDB

Restore forum backup

Restore wiki backup

Restore website backup

Certbot

Postfix

Prosody

Navigation menu

User:Dart Raiden/Server setup: Difference between revisions

Revision as of 21:01, 8 June 2026

Export databases from old server

UFW

SSH

Install PHP and memcached

MariaDB

Restore forum backup

Restore wiki backup

Restore website backup

Certbot

Postfix

Prosody

Navigation menu

Search