furk4ngg/Server-Setup
1
1
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity

Update README.md

Browse Source
This commit is contained in:
FURK4NGG
2026-07-15 10:53:37 +03:00
committed by GitHub
parent 7825860386
commit fb395098bd
1 changed files with 186 additions and 13 deletions
Download Patch File Download Diff File Expand all files Collapse all files
README.md
+185 -12
View File
@@ -12,6 +12,7 @@ This repository helps you build a complete self-hosted environment on your own V
BASE(Yunohost)
Ad Blocker(AdGuard Home)
Video-Voice Call(Element,Synapse)
Rss(FreshRSS)
Github Repo Clone(Gitea)
@@ -88,6 +89,7 @@ CNAME www furk4ngg.me
A * IPV4
AAAA * IPV6
A ads.domain IPV4
A chat.domain IPV4
A cloud.domain IPV4
A convert.domain IPV4
@@ -103,6 +105,7 @@ A uptime.domain IPV4
A usage.domain IPV4
A visitors.domain IPV4
AAAA ads.domain IPV6
AAAA chat.domain IPV6
AAAA cloud.domain IPV6
AAAA convert.domain IPV6
@@ -129,6 +132,7 @@ curl https://install.yunohost.org | bash
After completing the local YunoHost configuration, create the following domains from 'YunoHost>Domains' for the DNS records that we created:
AdGuard Home -> ads.domain
Element -> chat.domain and Synapse -> syn.domain
FressRSS -> rss.domain
Gitea -> git.domain
@@ -150,6 +154,7 @@ Vert -> convert.domain
# Yunohost App Permissions
*visitors(Ziyaretçiler)* *all_users(Tum yunohost kullanicilari)*
AdGuard Home -> all_users
Element -> all_users
Synapse -> all_users
FreshRSS -> all_users
@@ -230,18 +235,12 @@ sudo systemctl reload nginx or sudo systemctl restart nginx
# -Lufi Settings-
Install Lufi with LDAP configuration? -> (Yes)
# -Uptime Kuma-
Choose SQLite database
# -Umami Settings-
visitors.domain -> all_users
visitors.domain/api -> visitors
visitors.domain/recorder -> visitors
visitors.domain/script -> visitors
# -AdGuard Home Settings-
ads.domain -> all_users
ads.domainre:ads.domain/control -> visitors
ads.domainre:ads.domain/dns-query -> visitors
# -Element Settings-
Enable fedration features by default -> (Yes)
@@ -261,14 +260,25 @@ git.domain -> all_users,visitors
admin -> admins
git.domain.megit.furk4ngg.me/v2 -> visitors
# -Lime Survey-
forms.domain/admin -> admin page
https://forms.domain/index.php/dashboard/view
# -Lufi Settings-
Install Lufi with LDAP configuration? -> (Yes)
# -NextCloud Settings-
Add the users' home directory in Nextcloud? -> (No)
# -Umami Settings-
visitors.domain -> all_users
visitors.domain/api -> visitors
visitors.domain/recorder -> visitors
visitors.domain/script -> visitors
# -Uptime Kuma-
Choose SQLite database
# 📦 OnlyOffice Setup
Verify that the server settings were successfully updated
Check healthcheck and api.js
@@ -937,14 +947,20 @@ sudo nano /var/www/adguardhome/AdGuardHome.yaml
sudo systemctl restart adguardhome
## Verify that AdGuard is listening (VPS)
sudo ss -lunpt | grep ':53'
>SERVER_PUBLIC_IP:53
>10.8.0.1:53
>127.0.0.1:53 (dnsmasq)
Test(PC)>ping 10.8.0.1
Test(PC)>
Open The VPN
ping 10.8.0.1
>0% packet loss
dig google.com
>status: NOERROR
>SERVER: 10.8.0.1#53
@@ -1172,3 +1188,160 @@ localhost (127.0.0.1)
Postfix
## AI-Assisted Server Setup
```text
Use the prompt below with an AI assistant. Replace the placeholders with your own server, operating system, domain, hardware, network and application requirements.
```text
You are an experienced Linux system administrator, network engineer and self-hosting specialist.
I want you to create a current, secure and machine-specific installation guide for my server. Use the README instructions provided below as a reference for my intended architecture, applications and preferences, but do not blindly copy outdated commands or configurations.
My system:
- Server type: [VPS / home server / mini PC / Raspberry Pi / other]
- Provider or hardware model: [PROVIDER_OR_MODEL]
- Operating system and version: [OPERATING_SYSTEM]
- CPU architecture: [amd64 / arm64 / other]
- RAM: [RAM]
- Storage: [STORAGE]
- Public IPv4: [YES / NO]
- Public IPv6: [YES / NO]
- Private IP or local network: [PRIVATE_NETWORK_OR_NONE]
- Domain: [DOMAIN]
- DNS provider: [DNS_PROVIDER]
- Reverse proxy or server platform: [YunoHost / Docker / Podman / native packages / other]
- Firewall system: [YunoHost firewall / nftables / firewalld / UFW / other]
- VPN clients: [Linux / Windows / Android / iOS / macOS]
- Linux network manager: [NetworkManager / systemd-networkd / other]
- Linux DNS manager: [NetworkManager / systemd-resolved / openresolv / other / unknown]
Applications I want to install:
[LIST_THE_APPLICATIONS]
Examples:
- YunoHost
- WireGuard
- AdGuard Home
- Nextcloud
- ONLYOFFICE
- Gitea
- Element and Synapse
- FreshRSS
- Glances
- LimeSurvey
- Lufi
- PairDrop
- Umami
- Uptime Kuma
- SnappyMail
- Vert
- A mail server
- A custom web application
Requirements:
1. Check current official documentation and current package names before providing commands.
2. Adapt every command to my exact operating system, release, network manager, DNS manager, firewall and CPU architecture.
3. Do not use deprecated packages, obsolete configuration paths or hard-coded software versions unless they are required by the installed platform.
4. Clearly label every command with where it must be run:
- VPS / server
- Client / PC
- Phone
- DNS provider dashboard
- YunoHost web administration
5. Present the installation in the correct execution order.
6. Explain briefly what each major step does and what problem it prevents.
7. Before changing a configuration file:
- show how to create a backup;
- state the exact file path;
- show only the section that must be added or changed.
8. Never expose or request private keys, passwords, API tokens, JWT secrets or full credentials in the response.
9. Use placeholders such as:
- SERVER_PUBLIC_IP
- SERVER_IPV6
- DOMAIN
- VPN_SERVER_PRIVATE_KEY
- VPN_SERVER_PUBLIC_KEY
- CLIENT_PRIVATE_KEY
- CLIENT_PUBLIC_KEY
10. Verify the real outbound interface instead of assuming that it is eth0.
11. Avoid manual PreUp and PostDown endpoint routes unless they are genuinely required. Explain why they are needed before adding them.
12. Prevent NetworkManager, systemd-resolved and openresolv from simultaneously managing the same resolv.conf file.
13. For NetworkManager clients, prefer NetworkManager-native WireGuard and DNS management.
14. For wg-quick clients, explain which DNS manager is required and how DNS is restored when the VPN is disconnected.
15. Keep the server’s local DNS resolution working for mail services, package management and system applications.
16. Do not create a DNS loop between dnsmasq and AdGuard Home.
17. If AdGuard Home must bind to a public IP because the VPS has no private IP:
- allow DNS only from localhost and the WireGuard network;
- block public TCP and UDP port 53;
- verify that the server is not an open resolver.
18. Preserve YunoHost, Fail2Ban, mail, NAT and WireGuard firewall rules.
19. Do not delete or replace the entire nftables ruleset without first analysing which service manages each table.
20. Make firewall changes persistent using the method supported by the installed platform.
21. For mail:
- verify Postfix, Dovecot, Rspamd and OpenDKIM;
- verify local DNS and MX resolution;
- verify STARTTLS;
- verify SMTP authentication;
- verify DKIM, SPF, DMARC, MX and PTR;
- verify that queued messages reach status=sent.
22. For Nextcloud and ONLYOFFICE:
- verify healthcheck;
- verify api.js;
- verify SSL;
- verify matching JWT secrets;
- use the application-specific YunoHost shell or correct application user for occ commands;
- use the currently installed PHP version rather than hard-coding PHP 8.2.
23. Include recovery and rollback commands for risky changes.
24. Include tests after each section.
25. For every test, provide:
- where to run it;
- whether the VPN must be enabled;
- the expected output;
- what the result means;
- what to check if the result is different.
26. At the end, include a complete final validation checklist.
27. Clearly identify any step that may be overwritten by a YunoHost upgrade, application upgrade, firewall reload or reboot.
28. Do not claim that a configuration is persistent until it has been tested after a reboot.
29. Do not assume that an application permission should be public. Explain the security impact of visitor and all-user access before recommending it.
30. Prefer the safest configuration that still satisfies my requirements.
Important:
- Treat the README below as an architecture reference, not as an unquestionable source.
- Correct any unsafe, duplicated, outdated or technically incorrect instruction you find.
- If the README conflicts with current official documentation, use the current official method and explicitly state what changed.
- Do not skip a required step merely because it is absent from the README.
- Do not add unrelated software.
- Do not ask unnecessary questions when the system information above is sufficient.
- When essential information is missing, list the missing values first and then provide the parts of the guide that can already be completed safely.
Output format:
1. Architecture summary
2. Assumptions and detected risks
3. Preparation
4. DNS and domain configuration
5. Base platform installation
6. Application installation order
7. WireGuard setup
8. AdGuard Home setup
9. Client-specific VPN and DNS configuration
10. Mail configuration
11. Nextcloud and ONLYOFFICE integration
12. Firewall and persistence
13. Security hardening
14. Tests and expected results
15. Reboot validation
16. Rollback instructions
17. Final checklist
Here is the existing README reference:
[PASTE_THE_FULL_README_HERE]
...