VPS setup instructions

00-setup.md

SSH

• authorized_keys
• config
• lyra and lyra.pub

byobu and fish and GHC

sudo apt update
sudo apt install software-properties-common
sudo add-apt-repository ppa:fish-shell/release-2
sudo add-apt-repository ppa:hvr/ghc
sudo apt update
sudo apt install byobu fish ghc-8.0.2 ghc-8.0.2-dyn ghc-8.0.2-prof cabal-install-1.24 alex-3.1.7 happy-1.19.5

Ruby

Install these:

• https://github.com/rbenv/rbenv
• https://github.com/rbenv/ruby-build

Then

sudo apt-get build-dep 'ruby2.*'
rbenv install 2.4.0
gem install bundler

Rust

Follow instructions on https://rustup.rs/

rustup install nightly

Vim

sudo apt install vim-nox
cd
git clone --recursive g:lfairy/vimfiles.git .vim
ln -s .vim/vimrc .vimrc

LilyPond

sudo apt install lilypond

Dehydrated

Install:

• https://github.com/lukas2511/dehydrated
• https://github.com/kappataumu/letsencrypt-cloudflare-hook

Then use the update-certificates.sh script below.

Services

• sudo mkdir /srv

• www.lambda.xyz

  • redirect to lambda.xyz (see www-redirect config below)

• files.lambda.xyz

  • /srv/files -> /home/chris/public

• octavia.lambda.xyz

  • /srv/octavia

• pinkie.link

  • /srv/pinkie

• brigitte.lambda.xyz

  • /srv/hircine
  • Port 8244

• karkinos.lambda.xyz

  • /srv/karkinos
  • Port 8344

• nanojoshu

  • /srv/nanojoshu
  • Moe desu!

Arroyo

cd /srv
git clone g:lfairy/arroyo.git
cd arroyo
sudo cp arroyo.service /etc/systemd/system
sudo systemctl enable arroyo
sudo systemctl start arroyo

./add-secret music

auto-update.sh

#!/bin/sh

set -e

sudo apt-get update
sudo apt-get upgrade --assume-yes
sudo apt-get autoclean

brigitte

server {
    listen [::]:80;
    server_name brigitte.lambda.xyz;
  
    location / {
        proxy_buffering off;
        proxy_pass http://localhost:8244;
    }
} 

config

Host github.com
    IdentityFile /home/chris/.ssh/id_rsa_lyra
 
Host g
    HostName github.com
    User git
    IdentityFile /home/chris/.ssh/id_rsa_lyra

default

server {
    listen [::]:80 default_server ipv6only=off;
    server_name octavia.lambda.xyz;
    
    root /srv/octavia;
    index index.html index.htm;
    autoindex on;
    
    location ~ /\. {
        deny all;
    }
}

files

server { 
    listen [::]:8443 ssl ipv6only=off; 
    server_name files.lambda.xyz; 
 
    ssl_certificate /etc/dehydrated/lambda.xyz/fullchain.pem; 
    ssl_certificate_key /etc/dehydrated/lambda.xyz/privkey.pem; 
    ssl_protocols TLSv1.1 TLSv1.2; 
    ssl_ciphers ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK; 
    ssl_session_cache shared:SSL:10m; 
    ssl_dhparam /etc/ssl/certs/dhparam.pem; 
    ssl_prefer_server_ciphers on; 
    add_header Strict-Transport-Security "max-age=15552000"; 
 
    root /srv/files; 
    index index.html index.htm; 
    autoindex on; 
 
    # Deny access to dotfiles 
    location ~ /\. { 
        deny all; 
    } 
} 
 
server { 
    listen [::]:80; 
    server_name files.lambda.xyz; 
    return 301 https://$server_name$request_uri; 
} 

karkinos

server {
    listen [::]:80;
    server_name karkinos.lambda.xyz;

    location / {
        proxy_buffering off;
        proxy_pass http://localhost:8344;
        proxy_set_header Host $http_host;
    }
}

pinkie

server {
    listen [::]:80;
    server_name pinkie.link;

    root /srv/pinkie;
    index index.html index.htm;
    autoindex on;

    # Deny access to dotfiles
    location ~ /\. {
        deny all;
    }
}

update-certificates.sh

#!/bin/sh

set -e
cd "$(readlink -f "$(dirname "$0")")"

./dehydrated --cron --challenge dns-01 --hook hooks/cloudflare/hook.py

echo ' + Installing certificates'
cd certs
for root in *
do
    sudo sh -c "mkdir -p /etc/dehydrated/$root && cp $root/* /etc/dehydrated/$root"
done

sudo service nginx restart

www-redirect

server {
    listen [::]:80 ipv6only=off;
    server_name www.lambda.xyz;
    return 301 $scheme://lambda.xyz$request_uri;
}