120 lines
3.9 KiB
Markdown
120 lines
3.9 KiB
Markdown
---
|
|
title: mountain
|
|
---
|
|
|
|
`mountain` is an Acer Aspire 7220 running Alpine Linux at my home, and was
|
|
hosting my [French blog](https://brainshit.fr). It was also part of my group
|
|
of Syncthing devices, to make sure there is always one device ready to receive
|
|
another's changes, for near-instant online backups.
|
|
|
|
It is named after one of the sectors in Code Lyoko; my previous server was
|
|
named Carthage after the Fifth Sector. I plan on naming my next devices after
|
|
the other sectors; Desert, Forest and Ice.
|
|
|
|
I was considering hosting some other small services such as Gopher, Gemini, or
|
|
Finger. I however want everything to only be purely static; if it does not
|
|
fit in a Git repo, it does not get into my server. Syncthing is the only
|
|
exception.
|
|
|
|
A WebDAV server was also hosted there, although it is only exposed to my LAN;
|
|
I used it purely to make transfers between my IBM ThinkPads running old Windows
|
|
versions and my Linux systems easier.
|
|
|
|
I tried to write some setup docs when I first set it up, but of course I did
|
|
not write everything down, that would be too easy.
|
|
|
|
`mountain` has been migrated to [forest](./forest.html), a more
|
|
energy-efficient server. All services on `mountain` have been officially
|
|
stopped on 2022-12-04.
|
|
|
|
## Base setup
|
|
|
|
* Boot on an Alpine Linux ISO.
|
|
* Run `setup_alpine`.
|
|
* Set the keyboard to `fr-oss` (layout `fr`, then `fr-oss` variant)
|
|
* Set `mountain` as the hostname
|
|
* Set the disks up; `lvm` on all disks
|
|
* Reboot once prompted
|
|
* Uncomment the `community` repo in `/etc/apk/repositories`
|
|
* Recommended installation: `apk add --update vim figlet htop tmux pciutils zsh`
|
|
* Edit the `/etc/motd` to taste, including a `:r! figlet mountain`
|
|
|
|
## WLAN
|
|
|
|
### Manual setup
|
|
|
|
* Scan: `iwlist wlan0 scanning`
|
|
* Set SSID to `bacon`: `iwlist wlan0 essid bacon`
|
|
* Create WPA config: `wpa_passphrase bacon password > /etc/wpa_supplicant/wpa_supplicant.conf`
|
|
* Start WPA supplicant: `wpa_supplicant -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf`
|
|
* Start in the background: `wpa_supplicant -B -i wlan0 -c /etc/wpa_supplicant/wpa_supplicant.conf`
|
|
* DHCP: `udhcpc -i wlan0`
|
|
|
|
### Automated setup
|
|
|
|
* Perform the above manual setup first.
|
|
* Ensure the following is in `/etc/network/interfaces`:
|
|
```
|
|
auto wlan0
|
|
iface wlan0 inet dhcp
|
|
```
|
|
* Nuke the interface: `ifconfig wlan0 down`
|
|
* Start WPA supplicant manually: `rc-service wpa_supplicant start`
|
|
* If all goes well, `rc-update add wpa_supplicant boot`
|
|
|
|
## Graphics
|
|
|
|
* Add the graphics driver: `apk add xf86-video-nouveau` (might not be mandatory?)
|
|
* To set the screen resolution manually: `fbset -xres 1440 -yres 900 -match`
|
|
|
|
> TODO: Keep the screen resolution set permanently
|
|
|
|
## SSH
|
|
|
|
* The base setup already includes a server
|
|
* Check it with `rc-status`
|
|
* Otherwise:
|
|
```
|
|
apk add openssh
|
|
rc-update add sshd default
|
|
rc-service sshd start
|
|
```
|
|
* After updating the config at `/etc/ssh/sshd_config`, restart with `rc-service sshd restart`
|
|
* Disable `PasswordAuthentication`, `ChallengeResponseAuthentication` and `PermitRootLogin`
|
|
|
|
## Sudo
|
|
|
|
* Install sudo: `apk add sudo`
|
|
* Add a group: `addgroup sudo`
|
|
* Add a user to the group: `adduser lucidiot sudo`
|
|
* Use `visudo` to uncomment the line that allows access to the `sudo` group
|
|
|
|
## Nginx
|
|
|
|
* Install nginx: `apk add nginx`
|
|
* Start on boot: `rc-update add nginx default`
|
|
* Start manually: `rc-service nginx start`
|
|
|
|
## MariaDB
|
|
|
|
* Install MariaDB: `apk add mariadb mariadb-client`
|
|
* Start on boot: `rc-update add mariadb default`
|
|
* Initial setup: `rc-service mariadb setup`
|
|
* Start manually: `rc-service mariadb start`
|
|
* Run the installation wizard: `mariadb-secure-installation`
|
|
* Keep passwordless access for root without UNIX socket so you can do `sudo mariadb`
|
|
* Disallow remote login
|
|
* Remove anonymous users and the `test` database
|
|
* Run `sudo mariadb`
|
|
* Run `INSTALL SONAME 'auth_ed25519';`
|
|
|
|
## PHP
|
|
|
|
* `apk add php7-fpm phpmyadmin`
|
|
* `rc-update add php-fpm7 default`
|
|
* Edit `/etc/php7/php-fpm.d/www.conf`:
|
|
```
|
|
listen = /run/php-fpm7/php.sock
|
|
```
|
|
* `rc-service php-fpm7 start`
|