Yesterday after installing some new packages I was greeted by this kind reminder 😀
I began stopping services which use a Postgresql database and even forgot about Dendrite.. Nothing so bad as I imagined, tho, just run the suggested commands and everything got up and running in a few minutes.
Debian rocks! 😍
Move files and directories to the current/parent directory in Linux
Current dir
find . -type f -exec mv {} . \;
Parent dir
find . -type f -exec mv {} .. \;
Recursive chmod on files and dirs
To change all the directories to 755 (-rwxr-xr-x):
find /var/www/blog -type d -exec chmod 755 {} \;
To change all the files to 644 (-rw-r--r--):
find /var/www/blog -type f -exec chmod 644 {} \;
Register single domain:
certbot certonly --standalone -d domain.tld --dry-run
Renew single domain:
certbot renew --cert-name domain.tld --dry-run
Revoke certificate:
certbot revoke --cert-path /etc/letsencrypt/archive/${YOUR_DOMAIN}/cert1.pem
Check certificate's expiry date:
cat /etc/letsencrypt/live/domain.tld/cert.pem | openssl x509 -noout -enddate
To reset your git repository to given commit id, do:
git reset --hard <commit-id>
git push origin master --force
Ignoring files that are already tracked
git update-index --assume-unchanged <your file here>
require ["fileinto"];
# rule:[DeltaChat]
if header :contains "Chat-Version" "1.0"
{
fileinto "DeltaChat";
stop;
}
To view postfix mail queue in case of problems and remove a particular message from it, do as follows:
# mailq
-Queue ID- --Size-- ----Arrival Time---- -Sender/Recipient-------
6DCF32201B* 4824 Thu Oct 19 22:54:44 roughnecks@woodpeckersnest.eu
debian@spacenet.it
-- 4 Kbytes in 1 Request.
# postsuper -d 6DCF32201B
postsuper: 6DCF32201B: removed
postsuper: Deleted: 1 message
<interface>)curl ifconfig.me
adduser --shell /usr/sbin/nologin <username>
I always forget which command is the complete one, useradd or adduser
root@pandora:~# cat /etc/wireguard/wg0.conf
[Interface]
# specify generated private key for server
PrivateKey = <sekret>
# IP address for VPN interface
Address = 172.16.100.1/32, fd42:42:42::1/64
MTU = 1420
# UDP port WireGuard server listens
ListenPort = 51820
# possible to set any commands after WireGuard starts/stops
# set routing rules like follows to access to local network via VPN session
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;
[Peer]
# REDMI
# specify public key for client
PublicKey = <sekret>
# clients' VPN IP addresses you allow to connect
# possible to specify subnet ⇒ [172.16.100.0/24]
AllowedIPs = 172.16.100.6/32, fd42:42:42::6/128
PersistentKeepalive = 25
root@pandora:~# cat /etc/wireguard/redmi.conf
[Interface]
#Private IP Address
Address = fd42:42:42::6/128, 172.16.100.6/32
#Client's Private Key
PrivateKey = <sekret>
#Server's listening port
ListenPort = 51820
[Peer]
#Server's Public Key
PublicKey = <sekret>
AllowedIPs = ::0/0, 0.0.0.0/0
#Server's IP:port
Endpoint = woodpeckersnest.space:51820
root@pandora:~# sysctl -p
net.ipv4.ip_forward = 1
net.ipv6.conf.all.forwarding = 1
net.ipv6.conf.eth0.accept_ra = 2
I'm super impressed by Trilium Notes, a wonderful note-taking app and self-hostable service.
Used docker to host it and web to manage my notes. It saves instantly, no button to press, has a lot of useful functions, it's scriptable, does backups automatically and it offers extensions for chrome and firefox.
Two issue though:
Although this is kinda sad, I have used the app for the past 2 days and it works very well, so much that I finally ditched MS One Note (yes I use Windows on my Desktop - shame! shame! shame!)
Found this post quite useful to set up Hurricane Electric's IPv6 on a Windows machine and serve the connection over LAN (Windows machine must stay on, obviously)
Legend of variables:
$ipv4a = tunnel server's IPv4 IP
$ipv4b = user's IPv4 IP
$ipv6a = tunnel server's side of point-to-point /64 allocation
$ipv6b = user's side of point-to-point /64 allocation
$ipv6c = first address of user's routed /64 allocation
$ipv6d = user's routed /64 allocation
$adapter = name of local area network connection (where your IPv4 address is configured now)
netsh int teredo set state disabled
netsh int ipv6 add v6v4tunnel IP6Tunnel $ipv4b $ipv4a
netsh int ipv6 add address IP6Tunnel $ipv6b
netsh int ipv6 set interface IP6Tunnel forwarding=enabled
netsh int ipv6 set interface "$adapter" forwarding=enabled advertise=enabled
netsh int ipv6 add address "$adapter" $ipv6c
netsh int ipv6 set route $ipv6d "$adapter" publish=yes
netsh int ipv6 add route ::/0 IP6Tunnel $ipv6c publish=yes
server {
listen [::]:443 ssl http2;
server_name woodpeckersnest.eu;
ssl_certificate /etc/letsencrypt/live/woodpeckersnest.eu/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/woodpeckersnest.eu/privkey.pem;
root /var/www/mail/;
location / {
try_files /.well-known/autoconfig/mail/config-v1.1.xml =404;
}
access_log /var/log/nginx/autoconfig.log;
error_log /var/log/nginx/autoconfig_error.log;
}
<?xml version="1.0"?>
<clientConfig version="1.1">
<emailProvider id="woodpeckersnest.eu">
<domain>woodpeckersnest.eu</domain>
<displayName>Woodpeckers Mail</displayName>
<displayShortName>woodpeckers</displayShortName>
<!-- type=
"imap": IMAP
"pop3": POP3
-->
<incomingServer type="imap">
<hostname>woodpeckersnest.eu</hostname>
<port>993</port>
<!-- "plain": no encryption
"SSL": SSL 3 or TLS 1 on SSL-specific port
"STARTTLS": on normal plain port and mandatory upgrade to TLS via STARTTLS
-->
<socketType>SSL</socketType>
<username>%EMAILLOCALPART%</username>
<!-- Authentication methods:
"password-cleartext",
Send password in the clear
(dangerous, if SSL isn't used either).
AUTH PLAIN, LOGIN or protocol-native login.
"password-encrypted",
A secure encrypted password mechanism.
Can be CRAM-MD5 or DIGEST-MD5. Not NTLM.
"NTLM":
Use NTLM (or NTLMv2 or successors),
the Windows login mechanism.
"GSSAPI":
Use Kerberos / GSSAPI,
a single-signon mechanism used for big sites.
"client-IP-address":
The server recognizes this user based on the IP address.
No authentication needed, the server will require no username nor password.
"TLS-client-cert":
On the SSL/TLS layer, the server requests a client certificate and the client sends one (possibly after letting the user select/confirm one), if available. (Not yet supported by Thunderbird)
"OAuth2":
OAuth2. Works only on specific hardcoded servers, please see below. Should be added only as second alternative.
"none":
No authentication
-->
<authentication>password-cleartext</authentication>
</incomingServer>
<outgoingServer type="smtp">
<hostname>woodpeckersnest.eu</hostname>
<port>587</port>
<socketType>STARTTLS</socketType> <!-- see <incomingServer> -->
<username>%EMAILLOCALPART%</username> <!-- if smtp-auth -->
<!-- smtp-auth (RFC 2554, 4954) or other auth mechanism.
For values, see incoming.
Additional options here:
"SMTP-after-POP":
authenticate to incoming mail server first
before contacting the smtp server.
Compatibility note: Thunderbird 3.0 accepts only "plain",
"secure", "none", and "smtp-after-pop".
It will ignore the whole XML file, if other values are given.
-->
<authentication>password-cleartext</authentication>
<!-- If the server makes some additional requirements beyond
<authentication>.
"client-IP-address": The server is only reachable or works,
if the user is in a certain IP network, e.g.
the dialed into the ISP's network (DSL, cable, modem) or
connected to a company network.
Note: <authentication>client-IP-address</>
means that you may use the server without any auth.
<authentication>password-cleartext</> *and*
<restriction>client-IP-address</> means that you need to
be in the correct IP network *and* (should) authenticate.
Servers which do that are highly discouraged and
should be avoided, see {{bug|556267}}.
Not yet implemented. Spec (element name?) up to change.
-->
<!-- remove the following and leave to client/user? -->
<addThisServer>true</addThisServer>
<useGlobalPreferredServer>true</useGlobalPreferredServer>
</outgoingServer>
</emailProvider>
<!-- This allows to access the webmail service of the provider.
The URLs are loaded into a standard webbrowser for the user.
Specifying this is optional. -->
<webMail>
<!-- Webpage where the user has to log in manually by entering username
and password himself.
HTTPS required. -->
<loginPage url="https://webmail.woodpeckersnest.space/" />
<!-- Same as loginAutomaticDOM, but the website makes checks that
the user comes from the login page. So, open the login page
in the browser, get the page's DOM, fill out name and password
fields for the user, and trigger the login button.
The login button might not be an HTML button, just a div, so
to trigger it, send a click event to it.
HTTPS is required for the URL. -->
<loginPageInfo url="https://webmail.woodpeckersnest.space">
<!-- What to fill into the usernameField.
Format is the same as for <username> within <incomingServer>,
including placeholders. See below for valid placeholders. -->
<username>%EMAILLOCALPART%</username>
</loginPageInfo>
</webMail>
<clientConfigUpdate url="https://woodpeckersnest.eu/.well-known/autoconfig/mail/config-v1.1.xml" />
</clientConfig>
Interesting project, features' rich and almost complete. Thanks goes to its main developer Schimon AKA "sch".
Here is the support room
Launch the shell:
# prosodyctl shell
Delete pubsub node (the ">" sign at the beginning is important):
>prosody.hosts["pubsub.example.tld"].modules.pubsub.service:delete("blog", true)
Delete ALL pubsub nodes
>local service = prosody.hosts["pubsub.example.tld"].modules.pubsub.service; for node in pairs(select(2, assert(service:get_nodes(true)))) do service:delete(node, true); end
Check subscription by user:
>prosody.hosts["pubsub.example.tld"].modules.pubsub.service.subscriptions["user@example.tld"]
Change affiliation on pubsub nodes (make user owner):
>prosody.hosts["pubsub.example.tld"].modules.pubsub.service:set_affiliation("blog",true,"user@example.tld","owner")
Unsubscribe from node
>prosody.hosts["pubsub.example.tld"].modules.pubsub.service:remove_subscription("blog",true,"user@example.tld")
Subscribe to node
>prosody.hosts["pubsub.example.tld"].modules.pubsub.service:add_subscription("blog",true,"user@example.tld")
Asking for help:
# prosodyctl shell help
List registered users:
# prosodyctl shell user list example.tld
List existing MUCs:
# prosodyctl shell muc list [component name]
Activate a component:
# prosodyctl shell host activate some.component.example.tld
Generate Invites: create a new invite using an ad-hoc command in an XMPP client connected to your admin account, or use the command line:
# prosodyctl mod_invites generate example.tld
Reset forgot passsword: "doesn't seem to work - see below"
# prosodyctl mod_invites generate example.tld --reset <USERNAME>
Automatic Certificates Import: prosodyctl has the ability to import and activate certificates in one command:
# prosodyctl --root cert import HOSTNAME /path/to/certificates
Certificates and their keys are copied to /etc/prosody/certs (can be changed with the certificates option) and then it signals Prosody to reload itself. –root lets prosodyctl write to paths that may not be writable by the prosody user, as is common with /etc/prosody. Multiple hostnames and paths can be given, as long as the hostnames are given before the paths.
This command can be put in cron or passed as a callback to automated certificate renewal programs such as certbot or other Let's Encrypt clients.
Import All:
# prosodyctl --root cert import /etc/letsencrypt/live
# prosodyctl install --server=https://modules.prosody.im/rocks/ mod_password_reset
Reload prosody configuration then use ad-hoc commands to generate a reset link for given JID
Not really that hard of a certification, but still.. Here we are 😀