Dominik Lenhardt OnkelDom

Download Image From the following URL

Lite Version

https://downloads.raspberrypi.org/raspios_lite_arm64/images/

Full OS (With GUI)

https://downloads.raspberrypi.org/raspios_arm64/images/

Installing Jekyll

Jekyll requires Ruby, so you’ll first need to install it. On Ubuntu, just run:

Install Ruby

sudo apt-get install ruby-full build-essential zlib1g-dev

Ensure RubyGems packages are installed under the user account instead of root.

Last Updated: 8/30/18

Details

I wanted to run an OpenVPN server on the USG. Since it has a Radius server built in, I figured this would be a much better way to handle OpenVPN authentication. Make sure you have the Radius server enabled on your USG under Settings > Services > Radius > Server in the controller. Add OpenVpn users under Settings > Services > Radius > Server.

Thanks to the following resources in helping to configure this:

Setup Docker Systemd on Ubuntu 20.04

This is my docker systemd setup. I stored no configs or environment vars in this gist.

Install Docker

# Install Dependencies
$ sudo apt-get update
$ sudo apt-get install -y apt-transport-https ca-certificates curl gnupg lsb-release

Squid configuration snippets - Ansible Role: ansible-role-squid

Basics

Path	Description
"/etc/squid/squid.conf"	Default config file with includes
"/etc/squid/conf.d"	Custom config folder
"/etc/squid/acl.d"	Custom acls folder
"/etc/squid/errors.d"	Custom error pages folder

	# Some UniFi devices may not have the current ISRG root cert that LE uses
	# Some devices also have an older version of OpenSSL
	# These older versions will not validate a cert if the expired DST root cert is part of the chain

	# USG
	# This has an older OpenSSL version
	# The current ISRG root cert is not included in the latest firmware
	sudo -i
	sed -i 's\|^mozilla\/DST_Root_CA_X3\.crt\|!mozilla/DST_Root_CA_X3.crt\|' /etc/ca-certificates.conf
	curl -sk https://letsencrypt.org/certs/isrgrootx1.pem -o /usr/local/share/ca-certificates/ISRG_Root_X1.crt

	- hosts: all
	vars:
	version: "1.4.2"
	interface: "enp2s0"
	dante_port: "1089"
	tasks:
	- name: install dependencies
	become: yes
	become_user: root
	yum: name={{ item }} state=present

	{
	"firewall": {
	"ipv6-name": {
	"wan_in-6": {
	"default-action": "drop",
	"description": "wan_in",
	"enable-default-log": "''",
	"rule": {
	"1": {
	"action": "accept",

	{
	"service":{
	"nat":{
	"rule":{
	"1":{
	"description":"DNS Redirect",
	"destination":{
	"port":"53"
	},
	"inbound-interface":"eth1",

	update webproxy blacklists
	configure
	set service webproxy cache-size 0
	set service webproxy default-port 3128
	set service webproxy listen-address 192.168.1.1
	set service webproxy enable-access-log
	set service webproxy administrator proxy@onkeldom.eu
	set service webproxy mem-cache-size 5
	set service webproxy url-filtering squidguard auto-update update-hour 5
	set service webproxy url-filtering squidguard block-category adult