furk4ngg/Server-Setup
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
FURK4NGG
2026-07-19 20:25:05 +03:00
committed by GitHub
parent 370ccfd36c
commit f3eec412c4
1 changed files with 116 additions and 116 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+116 -116
View File
@@ -101,48 +101,48 @@ Agent:Allow
Training:Block Training:Block
Import DNS Records:Manual only Import DNS Records:Manual only
*All Records should be DNS only* *All Records should be DNS only*
A domain IPV4 A DOMAIN IPV4
AAAA domain IPV6 AAAA DOMAIN IPV6
CNAME www furk4ngg.me CNAME www DOMAIN
A * IPV4 A * IPV4
AAAA * IPV6 AAAA * IPV6
A ads.domain IPV4 A ads.DOMAIN IPV4
A chat.domain IPV4 A chat.DOMAIN IPV4
A cloud.domain IPV4 A cloud.DOMAIN IPV4
A convert.domain IPV4 A convert.DOMAIN IPV4
A docs.domain IPV4 A docs.DOMAIN IPV4
A forms.domain IPV4 A forms.DOMAIN IPV4
A git.domain IPV4 A git.DOMAIN IPV4
A lufi.domain IPV4 A lufi.DOMAIN IPV4
A mail.domain IPV4 A mail.DOMAIN IPV4
A pair.domain IPV4 A pair.DOMAIN IPV4
A rss.domain IPV4 A rss.DOMAIN IPV4
A syn.domain IPV4 A syn.DOMAIN IPV4
A uptime.domain IPV4 A uptime.DOMAIN IPV4
A usage.domain IPV4 A usage.DOMAIN IPV4
A visitors.domain IPV4 A visitors.DOMAIN IPV4
AAAA ads.domain IPV6 AAAA ads.DOMAIN IPV6
AAAA chat.domain IPV6 AAAA chat.DOMAIN IPV6
AAAA cloud.domain IPV6 AAAA cloud.DOMAIN IPV6
AAAA convert.domain IPV6 AAAA convert.DOMAIN IPV6
AAAA docs.domain IPV6 AAAA docs.DOMAIN IPV6
AAAA forms.domain IPV6 AAAA forms.DOMAIN IPV6
AAAA git.domain IPV6 AAAA git.DOMAIN IPV6
AAAA lufi.domain IPV6 AAAA lufi.DOMAIN IPV6
AAAA mail.domain IPV6 AAAA mail.DOMAIN IPV6
AAAA pair.domain IPV6 AAAA pair.DOMAIN IPV6
AAAA rss.domain IPV6 AAAA rss.DOMAIN IPV6
AAAA syn.domain IPV6 AAAA syn.DOMAIN IPV6
AAAA uptime.domain IPV6 AAAA uptime.DOMAIN IPV6
AAAA usage.domain IPV6 AAAA usage.DOMAIN IPV6
AAAA visitors.domain IPV6 AAAA visitors.DOMAIN IPV6
In your domain provider,update your nameserver based on cloudflare nameserver such as 'sam.ns.cloudflare.com' and 'kack.ns.cloudflare.com' In your domain provider,update your nameserver based on cloudflare nameserver such as 'sam.ns.cloudflare.com' and 'kack.ns.cloudflare.com'
hostnamectl set-hostname domain hostnamectl set-hostname DOMAIN
apt update && apt full-upgrade -y apt update && apt full-upgrade -y
@@ -150,21 +150,21 @@ curl https://install.yunohost.org | bash
After completing the local YunoHost configuration, create the following domains from 'YunoHost>Domains' for the DNS records that we created: After completing the local YunoHost configuration, create the following domains from 'YunoHost>Domains' for the DNS records that we created:
AdGuard Home -> ads.domain AdGuard Home -> ads.DOMAIN
Element -> chat.domain and Synapse -> syn.domain Element -> chat.DOMAIN and Synapse -> syn.DOMAIN
FressRSS -> rss.domain FressRSS -> rss.DOMAIN
Gitea -> git.domain Gitea -> git.DOMAIN
Glances -> usage.domain Glances -> usage.DOMAIN
Lime Survey -> forms.domain Lime Survey -> forms.DOMAIN
Lufi -> lufi.domain Lufi -> lufi.DOMAIN
my_webapp -> domain my_webapp -> DOMAIN
Nextcloud -> cloud.domain Nextcloud -> cloud.DOMAIN
Only Office -> docs.domain Only Office -> docs.DOMAIN
Pair Drop -> pair.domain Pair Drop -> pair.DOMAIN
Umami -> visitors.domain Umami -> visitors.DOMAIN
Uptime Kuma -> uptime.domain Uptime Kuma -> uptime.DOMAIN
Snappy -> mail.domain Snappy -> mail.DOMAIN
Vert -> convert.domain Vert -> convert.DOMAIN
@@ -184,7 +184,7 @@ my_webapp -> visitors,all_users
Nextcloud -> visitors,all_users,admins Nextcloud -> visitors,all_users,admins
Only Office -> visitors,all_users Only Office -> visitors,all_users
Pair Drop -> all_users Pair Drop -> all_users
Umami(visitors.domain) -> all_users Umami(visitors.DOMAIN) -> all_users
Uptime Kuma -> all_users Uptime Kuma -> all_users
Snappy -> all_users Snappy -> all_users
Vert -> all_users Vert -> all_users
@@ -206,13 +206,13 @@ Display tile in portal -> (Yes)
✅ Cloudflare proxy is disabled (DNS only). ✅ Cloudflare proxy is disabled (DNS only).
After the nameserver changes have fully propagated, After the nameserver changes have fully propagated,
sudo yunohost domain cert install sudo yunohost DOMAIN cert install
# -Web App Ayarlari (Make index work instead of index.html)- # -Web App Ayarlari (Make index work instead of index.html)-
sudo nano /etc/nginx/conf.d/domain.d/my_webapp.conf sudo nano /etc/nginx/conf.d/DOMAIN.d/my_webapp.conf
index index.php index.html; --> index index.html index.htm; index index.php index.html; --> index index.html index.htm;
try_files $uri $uri/ /index.php?$args =404; --> try_files $uri $uri/ $uri.html =404; try_files $uri $uri/ /index.php?$args =404; --> try_files $uri $uri/ $uri.html =404;
@@ -238,7 +238,7 @@ location ~ ^/(.+/|)\.(?!well-known/) {
} }
``` ```
sudo nano /etc/nginx/conf.d/furk4ngg.me.d/my_webapp.d/custom_headers.conf sudo nano /etc/nginx/conf.d/DOMAIN.d/my_webapp.d/custom_headers.conf
``` ```
add_header Referrer-Policy "no-referrer-when-downgrade" always; add_header Referrer-Policy "no-referrer-when-downgrade" always;
add_header Cross-Origin-Opener-Policy "same-origin" always; add_header Cross-Origin-Opener-Policy "same-origin" always;
@@ -256,34 +256,34 @@ sudo systemctl reload nginx or sudo systemctl restart nginx
# -AdGuard Home Settings- # -AdGuard Home Settings-
ads.domain -> all_users ads.DOMAIN -> all_users
ads.domainre:ads.domain/control -> visitors ads.DOMAINre:ads.DOMAIN/control -> visitors
ads.domainre:ads.domain/dns-query -> visitors ads.DOMAINre:ads.DOMAIN/dns-query -> visitors
# -Element Settings- # -Element Settings-
Enable fedration features by default -> (Yes) Enable fedration features by default -> (Yes)
chat.domain -> all_users chat.DOMAIN -> all_users
chat.domain/bundles -> visitors chat.DOMAIN/bundles -> visitors
syn.domain -> all_users syn.DOMAIN -> all_users
syn.domain/_synapse -> visitors syn.DOMAIN/_synapse -> visitors
syn.domain/livekit -> visitors syn.DOMAIN/livekit -> visitors
syn.domain/_matrix -> visitors syn.DOMAIN/_matrix -> visitors
syn.domain/.well-known/matrix -> visitors syn.DOMAIN/.well-known/matrix -> visitors
# -Gitea Settings- # -Gitea Settings-
Enable LFS support on this instance -> (Yes) Enable LFS support on this instance -> (Yes)
Enable support hover SSH protocol -> (Yes) Enable support hover SSH protocol -> (Yes)
git.domain -> all_users,visitors git.DOMAIN -> all_users,visitors
admin -> admins admin -> admins
git.domain.megit.furk4ngg.me/v2 -> visitors git.DOMAINgit.DOMAIN/v2 -> visitors
Get 'Personal access tokens' from Github for clone your repos Get 'Personal access tokens' from Github for clone your repos
Github Dashboard>Settings(right top in Profile popup)>Developer Settings(at the bottom)>Personal access tokens>Tokens (classic)>Generate new token (classic)'for general use'>Choose read:org, read:user, repo and click 'Generate token' Github Dashboard>Settings(right top in Profile popup)>Developer Settings(at the bottom)>Personal access tokens>Tokens (classic)>Generate new token (classic)'for general use'>Choose read:org, read:user, repo and click 'Generate token'
then then
Go to the git.domain and click '+' icon Go to the git.DOMAIN and click '+' icon
Access Code: Github Personal access token Access Code: Github Personal access token
@@ -308,8 +308,8 @@ Click Migrate Repository(Depoyu Göç Ettir)
# -Lime Survey- # -Lime Survey-
forms.domain/admin -> admin page forms.DOMAIN/admin -> admin page
https://forms.domain/index.php/dashboard/view https://forms.DOMAIN/index.php/dashboard/view
# -Lufi Settings- # -Lufi Settings-
Install Lufi with LDAP configuration? -> (Yes) Install Lufi with LDAP configuration? -> (Yes)
@@ -318,10 +318,10 @@ Install Lufi with LDAP configuration? -> (Yes)
Add the users' home directory in Nextcloud? -> (No) Add the users' home directory in Nextcloud? -> (No)
# -Umami Settings- # -Umami Settings-
visitors.domain -> all_users visitors.DOMAIN -> all_users
visitors.domain/api -> visitors visitors.DOMAIN/api -> visitors
visitors.domain/recorder -> visitors visitors.DOMAIN/recorder -> visitors
visitors.domain/script -> visitors visitors.DOMAIN/script -> visitors
# -Uptime Kuma- # -Uptime Kuma-
Choose SQLite database Choose SQLite database
@@ -331,8 +331,8 @@ Verify that the server settings were successfully updated
Check healthcheck and api.js Check healthcheck and api.js
``` ```
sudo yunohost service status | grep -i onlyoffice sudo yunohost service status | grep -i onlyoffice
curl https://docs.domain/healthcheck curl https://docs.DOMAIN/healthcheck
curl -I https://docs.domain/web-apps/apps/api/documents/api.js curl -I https://docs.DOMAIN/web-apps/apps/api/documents/api.js
``` ```
Verify that the secret keys match Verify that the secret keys match
``` ```
@@ -342,7 +342,7 @@ sudo grep -n -A5 -B5 "secret" /var/www/onlyoffice/config/local.json
> "browser": { > "browser": {
> "string": "secret_key" > "string": "secret_key"
Paste that key into 'Nextcloud>Administration Settings>ONLYOFFICE' Paste that key into 'Nextcloud>Administration Settings>ONLYOFFICE'
>ONLYOFFICE Docs address: https://docs.domain >ONLYOFFICE Docs address: https://docs.DOMAIN
>Secret Key: Paste secret_key here >Secret Key: Paste secret_key here
Test> Test>
@@ -354,7 +354,7 @@ php occ config:app:get onlyoffice jwt_secret
Verify the SSL certificate Verify the SSL certificate
``` ```
curl -Iv https://docs.domain curl -Iv https://docs.DOMAIN
``` ```
Run the curl tests Run the curl tests
``` ```
@@ -398,12 +398,12 @@ CTRL + F5
# -Mail Settings- # -Mail Settings-
(Cloudflare) (Cloudflare)
*All Records should be DNS only* *All Records should be DNS only*
MX domain mail.domain (Priority 10) MX DOMAIN mail.DOMAIN (Priority 10)
TXT domain "v=spf1 a mx -all" TXT DOMAIN "v=spf1 a mx -all"
TXT _dmarc "v=DMARC1; p=none" TXT _dmarc "v=DMARC1; p=none"
TXT mail._domainkey "v=DKIM1; h=sha256; k=rsa; p='long value that you can see in Yunohost>Diagnosis>DNS records screen'" TXT mail._domainkey "v=DKIM1; h=sha256; k=rsa; p='long value that you can see in Yunohost>Diagnosis>DNS records screen'"
CAA domain issue "letsencrypt.org" CAA DOMAIN issue "letsencrypt.org"
PTR domain mail.domain PTR DOMAIN mail.DOMAIN
``` ```
sudo yunohost diagnosis run sudo yunohost diagnosis run
@@ -415,7 +415,7 @@ sudo yunohost service status | grep -E "postfix|dovecot|rspamd|opendkim"
sudo postconf myhostname sudo postconf myhostname
sudo grep -R "mail.domain" /etc/opendkim /etc/postfix /etc/dovecot 2>/dev/null sudo grep -R "mail.DOMAIN" /etc/opendkim /etc/postfix /etc/dovecot 2>/dev/null
Which ports are open? -> Which ports are open? ->
@@ -433,24 +433,24 @@ sudo ss -tln | grep -E ":25|:465|:587"
Is STARTTLS actually working? -> Is STARTTLS actually working? ->
SMTP SMTP
openssl s_client -starttls smtp -connect domain:587 openssl s_client -starttls smtp -connect DOMAIN:587
>Verify return code: 0 (ok) >Verify return code: 0 (ok)
IMAP IMAP
openssl s_client -connect domain:993 openssl s_client -connect DOMAIN:993
openssl s_client -starttls imap -connect domain:143 openssl s_client -starttls imap -connect DOMAIN:143
Is SMTP Authentication working -> Is SMTP Authentication working ->
``` ```
doveadm auth test furk4ngg@domain doveadm auth test furk4ngg@DOMAIN
``` ```
>auth succeeded >auth succeeded
Can LDAP see the email address? -> Can LDAP see the email address? ->
``` ```
postmap -q "furk4ngg@domain" ldap:/etc/postfix/ldap-accounts.cf postmap -q "furk4ngg@DOMAIN" ldap:/etc/postfix/ldap-accounts.cf
``` ```
@@ -458,14 +458,14 @@ What is the mail server hostname? ->
``` ```
sudo postconf myhostname sudo postconf myhostname
``` ```
>myhostname = domain >myhostname = DOMAIN
Verify the mail domains -> Verify the mail domains ->
``` ```
sudo yunohost user info furk4ngg sudo yunohost user info furk4ngg
``` ```
>mail:furk4ngg@domain >mail:furk4ngg@DOMAIN
Which domains accept mail? -> Which domains accept mail? ->
@@ -477,12 +477,12 @@ Show the dedicated sender addresses used by applications (Nextcloud, Synapse, et
sudo postmap -s /etc/postfix/app_senders_login_maps sudo postmap -s /etc/postfix/app_senders_login_maps
## IMAP SETTINGS ## IMAP SETTINGS
>Admin page -> https://mail.domain/app/?admin >Admin page -> https://mail.DOMAIN/app/?admin
>username:admin >username:admin
>password:/var/www/snappymail/app/data/_data_/_default_/admin_password.txt >password:/var/www/snappymail/app/data/_data_/_default_/admin_password.txt
Server: domain Server: DOMAIN
Port: 993 Port: 993
@@ -498,7 +498,7 @@ Allow self signed: OFF
## SMTP SETTINGS ## SMTP SETTINGS
Server: domain Server: DOMAIN
Port: 587 Port: 587
@@ -523,11 +523,11 @@ Allow self signed: OFF
## DKIM 1024-bit warning (Upgrade the key to 2048-bit, as preferred by major email providers) ## DKIM 1024-bit warning (Upgrade the key to 2048-bit, as preferred by major email providers)
sudo opendkim-testkey -d domain -s mail -vvv sudo opendkim-testkey -d DOMAIN -s mail -vvv
1048 bit starts with MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ... 1048 bit starts with MIGfMA0GCSqGSIb3DQEBAQUAA4GNADCBiQKBgQ...
2048 bit starts with MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A... 2048 bit starts with MIIBIjANBgkqhkiG9w0BAQEFAAOCAQ8A...
openssl pkey -in /etc/dkim/domain.mail.key -text -noout | grep "Private-Key" openssl pkey -in /etc/dkim/DOMAIN.mail.key -text -noout | grep "Private-Key"
>Private-Key: (1024 bit, 2 primes) >Private-Key: (1024 bit, 2 primes)
- Verify your mail configuration - Verify your mail configuration
@@ -535,7 +535,7 @@ Before upgrading your DKIM key, verify the following settings
System Hostname System Hostname
hostnamectl --static hostnamectl --static
>domain >DOMAIN
Postfix Hostname Postfix Hostname
postconf myhostname postconf myhostname
@@ -543,14 +543,14 @@ postconf myhostname
MX record MX record
dig @1.1.1.1 MX example.com +short dig @1.1.1.1 MX example.com +short
>10 mail.domain. >10 mail.DOMAIN.
A record A record
dig @1.1.1.1 mail.domain A +short dig @1.1.1.1 mail.DOMAIN A +short
>VPS's IPV4 Address >VPS's IPV4 Address
AAAA record AAAA record
dig @1.1.1.1 mail.domain AAAA +short dig @1.1.1.1 mail.DOMAIN AAAA +short
>VPS's IPV6 Address >VPS's IPV6 Address
@@ -561,15 +561,15 @@ dig @1.1.1.1 mail.domain AAAA +short
and YunoHost Diagnosis still reports a hostname/EHLO warning, don't panic. and YunoHost Diagnosis still reports a hostname/EHLO warning, don't panic.
This is a common and valid mail server configuration. Using mail.example.com for SMTP while keeping the system hostname as the root domain (example.com) does not, by itself, cause mail delivery problems. This is a common and valid mail server configuration. Using mail.example.com for SMTP while keeping the system hostname as the root DOMAIN (example.com) does not, by itself, cause mail delivery problems.
If Mail Tester reports SPF, DKIM, DMARC, and Reverse DNS as valid, you can safely continue with the DKIM 2048-bit upgrade. If Mail Tester reports SPF, DKIM, DMARC, and Reverse DNS as valid, you can safely continue with the DKIM 2048-bit upgrade.
Back up the existing key Back up the existing key
``` ```
sudo cp -a /etc/dkim/domain.mail.key \ sudo cp -a /etc/dkim/DOMAIN.mail.key \
/etc/dkim/domain.mail.key.bak /etc/dkim/DOMAIN.mail.key.bak
``` ```
Generate a new 2048-bit key Generate a new 2048-bit key
@@ -578,7 +578,7 @@ sudo opendkim-genkey \
-b 2048 \ -b 2048 \
-r \ -r \
-s mail \ -s mail \
-d domain -d DOMAIN
``` ```
ls ls
>mail.private >mail.private
@@ -587,9 +587,9 @@ ls
Replace the private key Replace the private key
``` ```
sudo mv mail.private /etc/dkim/domain.mail.key sudo mv mail.private /etc/dkim/DOMAIN.mail.key
sudo chown opendkim:root /etc/dkim/domain.mail.key sudo chown opendkim:root /etc/dkim/DOMAIN.mail.key
sudo chmod 600 /etc/dkim/domain.mail.key sudo chmod 600 /etc/dkim/DOMAIN.mail.key
``` ```
Update the DNS record Update the DNS record
@@ -617,7 +617,7 @@ sudo systemctl restart opendkim
Verify the key Verify the key
``` ```
sudo opendkim-testkey \ sudo opendkim-testkey \
-d domain \ -d DOMAIN \
-s mail \ -s mail \
-v -v
``` ```
@@ -647,30 +647,30 @@ Web Page Quality -> https://pagespeed.web.dev/
## If its all good ## If its all good
Create a new account named dmarc@domain in YunoHost. Create a new account named dmarc@DOMAIN in YunoHost.
TXT _dmarc "v=DMARC1; p=reject; rua=mailto:dmarc@domain; adkim=s; aspf=s; pct=100" TXT _dmarc "v=DMARC1; p=reject; rua=mailto:dmarc@DOMAIN; adkim=s; aspf=s; pct=100"
Test it -> https://easydmarc.com/tools/dmarc-lookup Test it -> https://easydmarc.com/tools/dmarc-lookup
In your Server Hosting change (Reverse DNS Management>PTR Records(IPV4 to mail.domain / IPV6 to mail.domain)) In your Server Hosting change (Reverse DNS Management>PTR Records(IPV4 to mail.DOMAIN / IPV6 to mail.DOMAIN))
sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.bak sudo cp /etc/postfix/main.cf /etc/postfix/main.cf.bak
export TERM=xterm-256color export TERM=xterm-256color
sudo vim /etc/postfix/main.cf > myhostname = mail.domain sudo vim /etc/postfix/main.cf > myhostname = mail.DOMAIN
sudo postconf myhostname sudo postconf myhostname
>myhostname = mail.domain >myhostname = mail.DOMAIN
openssl s_client -starttls smtp -connect mail.domain:587 openssl s_client -starttls smtp -connect mail.DOMAIN:587
Type>EHLO test Type>EHLO test
>250-mail.domain >250-mail.DOMAIN
PTR Test PTR Test
dig -x <IPv4> +short dig -x <IPv4> +short
>mail.domain >mail.DOMAIN
If all three point to mail.domain, the mail configuration is fully consistent. If all three point to mail.DOMAIN, the mail configuration is fully consistent.
@@ -680,7 +680,7 @@ You can connect and use your mail with these mail providers:Thunderbird,Gmail,Ou
## Add a mail Alias ## Add a mail Alias
If you don't want to share your primary email address, you can create aliases for different services. If you don't want to share your primary email address, you can create aliases for different services.
Yunohost>Users>user>edit user's account>'brand@domain' add a mail alias then messages sent to brand@domain address are delivered to: user@domain Yunohost>Users>user>edit user's account>'brand@DOMAIN' add a mail alias then messages sent to brand@DOMAIN address are delivered to: user@DOMAIN
# 📦 Wireguard VPN Setup # 📦 Wireguard VPN Setup
❌ In my opinion, this is not anonymity, since all tunnel traffic exits through a single VPS IP address ❌ In my opinion, this is not anonymity, since all tunnel traffic exits through a single VPS IP address
@@ -1449,7 +1449,7 @@ What Is My Ip Adress -> https://ifconfig.me/
Disable uBlock Origin, AdGuard Browser Extension, Brave Shields, or any other third-party content blocker if the login page does not load correctly Disable uBlock Origin, AdGuard Browser Extension, Brave Shields, or any other third-party content blocker if the login page does not load correctly
Login Page -> https://ads.domain/login.html Login Page -> https://ads.DOMAIN/login.html
# DIAGRAM # DIAGRAM