amanjuman

sudo apt-get update && sudo apt-get -y upgrade && sudo apt-get autoremove -y
sudo apt install software-properties-common && sudo apt install linux-headers-$(uname -r)
sudo apt install wireguard wireguard-dkms wireguard-tools resolvconf -y
wg genkey | sudo tee /etc/wireguard/privatekey | wg pubkey | sudo tee /etc/wireguard/publickey
ifconfig

sudo nano /etc/wireguard/wg0.conf

## WireGuard VPN Server Config File

amanjuman

echo 'deb http://deb.debian.org/debian buster-backports main' | sudo tee /etc/apt/sources.list.d/buster-backports.list

sudo apt -t buster-backports upgrade

sudo apt install -y net-tools dphys-swapfile gnupg2

wget -O- http://downloads-global.3cx.com/downloads/3cxpbx/public.key | sudo apt-key add -

echo "deb http://downloads-global.3cx.com/downloads/debian buster main" | sudo tee /etc/apt/sources.list.d/3cxpbx.list

amanjuman

hostnamectl set-hostname yourdomain.tld
wget -O - https://nightly.odoo.com/odoo.key | sudo apt-key add -
echo "deb http://nightly.odoo.com/13.0/nightly/deb/ ./" | sudo tee /etc/apt/sources.list.d/odoo.list

sudo apt update
sudo apt -y upgrade
sudo apt-get install software-properties-common && sudo add-apt-repository ppa:certbot/certbot -y
sudo apt install nginx nano postgresql postgresql-client odoo python3-certbot-nginx -y

sudo certbot --nginx --agree-tos --register-unsafely-without-email -d yourdomain.tld -d www.yourdomain.tld

amanjuman

## SWAP
sudo fallocate -l 1G /swapfile;
ls -lh /swapfile;
sudo chmod 600 /swapfile;
sudo mkswap /swapfile;
sudo swapon /swapfile;
sudo nano /etc/fstab
	/swapfile	swap	swap	defaults	0	0
swapon --show

amanjuman

## System Update and Install required softwares

sudo apt-get update && sudo apt-get -y upgrade && sudo apt-get autoremove -y && sudo add-apt-repository ppa:ondrej/php -y && add-apt-repository ppa:nginx/stable -y
sudo apt-get install curl cron nano nginx mariadb-server unzip zip python3-certbot-nginx php-pear php8.0-{curl,fpm,imap,gd,memcache,mbstring,mysql,pspell,sqlite3,tidy,xsl,xml,xmlrpc,zip} -y
sudo update-alternatives --set php /usr/bin/php8.0

## Create DATABASE

sudo mysql_secure_installation
mysql -u root -p

amanjuman

## For 3CX backup

sudo nano /opt/3cx-server-s3-backup.sh
#!/bin/bash
DATE=`date +%Y-%m-%d_%Hh%Mm%Ss`
echo "------------ start S3 Move $DATE" >> /var/log/3cx-server-s3-backup.log
sudo /usr/bin/aws s3 mv /var/lib/3cxpbx/Instance1/Data/Backups/* s3://bucket-name/3cx-backup/ --recursive --storage-class STANDARD_IA >> /var/log/3cx-server-s3-backup.log
DATE=`date +%Y-%m-%d_%Hh%Mm%Ss`
echo "------------ end S3 Move $DATE" >> /var/log/3cx-server-s3-backup.log

amanjuman

sudo apt-get update && sudo apt-get upgrade -y && sudo apt-get autoremove -y
apt-get -y install build-essential wget curl gcc make wget tzdata git libreadline-dev libncurses-dev libssl-dev zlib1g-dev dnsmasq

wget https://github.com/SoftEtherVPN/SoftEtherVPN_Stable/releases/download/v4.34-9745-beta/softether-vpnserver-v4.34-9745-beta-2020.04.05-linux-x64-64bit.tar.gz
tar xzf softether-vpnserver-v4.34-9745-beta-2020.04.05-linux-x64-64bit.tar.gz && rm softether-vpnserver-v4.34-9745-beta-2020.04.05-linux-x64-64bit.tar.gz

cd vpnserver && sudo make
cd ..
sudo mv vpnserver /usr/local && cd /usr/local/vpnserver/
sudo chmod 600 *

amanjuman

Wireguard and iptables restrictions for multiple users

If you don't know what Wireguard is, well, you should. It's fast, easy to setup and highly configurable. We will configure Wireguard for multiple users with various restrictions using iptables.

Assumptions

This should fit most setups (not mine though 😉)

amanjuman

sudo add-apt-repository ppa:ondrej/php -y
sudo add-apt-repository ppa:certbot/certbot -y
sudo apt-get update && sudo apt-get -y upgrade && sudo apt-get autoremove -y

sudo apt-get install nginx python3-certbot-nginx mariadb-server php7.4-common php7.4-cli php7.4-fpm php7.4-opcache php7.4-gd php7.4-mysql php7.4-curl php7.4-intl php7.4-xsl php7.4-mbstring php7.4-zip php7.4-bcmath php7.4-soap unzip git -y

sudo update-alternatives --set php /usr/bin/php7.4

sudo sed -i 's/;cgi.fix_pathinfo=1/cgi.fix_pathinfo=0/g' /etc/php/7.4/fpm/php.ini
sudo sed -i 's/max_execution_time = 30/max_execution_time = 120/g' /etc/php/7.4/fpm/php.ini

amanjuman

# Create two env variable "certdomain" and "email".
# Also note that this config is using the LetsEncrypt staging server, remove the flag when ready!

Resources:
  sslSecurityGroupIngress: 
    Type: AWS::EC2::SecurityGroupIngress
    Properties:
      GroupId: {"Fn::GetAtt" : ["AWSEBSecurityGroup", "GroupId"]}
      IpProtocol: tcp
      ToPort: 443