119 lines
2.7 KiB
Markdown
119 lines
2.7 KiB
Markdown
|
# Machine virtuelle AUDIO
|
||
|
|
|
||
|
|
## Système
|
||
|
|
|
||
|
|
### Matériel virtuel
|
||
|
|
|
||
|
|
CPU : 1
|
||
|
|
RAM : 957384 KB
|
||
|
|
Stockage de masse : 50 Gio
|
||
|
|
Swap : désactivé
|
||
|
|
|
||
|
|
### Logiciel
|
||
|
|
|
||
|
|
Système d'exploitation : Debian GNU/Linux-libre 11 (Bullseye)
|
||
|
|
Noyau : Linux-libre LTS (`linux-libre-lts` des dépôts https://linux-libre.fsfla.org)
|
||
|
|
Sécurités de la maintenance : `etckeeper`, `mollyguard`, `git`, `tig`, `screen`
|
||
|
|
Mail Transfer Agent : `postfix`
|
||
|
|
|
||
|
|
### Caractéristiques notables
|
||
|
|
|
||
|
|
Domaine : dns.libre-en-communs.org
|
||
|
|
Adresse ipv4 publique : 80.67.176.33
|
||
|
|
Adresse ipv4 interne : 192.168.1.186
|
||
|
|
Adresse ipv6 publique : 2001:910:1021::186
|
||
|
|
|
||
|
|
## Serveur web (installation basique)
|
||
|
|
Installation d'un service nginx pour :
|
||
|
|
- la gestion des certificats SSL ;
|
||
|
|
- l'installation d'une page d'information sur comment se connecter au Mumble ;
|
||
|
|
- la possible installation d'un service client web pour Mumble ;
|
||
|
|
- l'éventuel déploiement de StatoolInfos ;
|
||
|
|
- …
|
||
|
|
|
||
|
|
Installer les paquets :
|
||
|
|
```
|
||
|
|
apt-get install nginx python3-certbot-nginx
|
||
|
|
```
|
||
|
|
|
||
|
|
Ouvrir les ports http (80) et https (443) :
|
||
|
|
```
|
||
|
|
ufw allow 'Nginx HTTP'
|
||
|
|
ufw allow 'Nginx HTTPS'
|
||
|
|
```
|
||
|
|
|
||
|
|
Configurer a minima le site web dans `/etc/nginx/sites-available/audio.a-lec.org` :
|
||
|
|
```
|
||
|
|
server
|
||
|
|
{
|
||
|
|
listen 80;
|
||
|
|
listen [::]:80;
|
||
|
|
|
||
|
|
server_name audio.a-lec.org;
|
||
|
|
|
||
|
|
access_log /var/log/nginx/audio.a-lec.org-access.log;
|
||
|
|
error_log /var/log/nginx/audio.a-lec.org-error.log;
|
||
|
|
}
|
||
|
|
```
|
||
|
|
|
||
|
|
Activer la configuration :
|
||
|
|
```
|
||
|
|
cd /etc/nginx/sites-enabled/
|
||
|
|
ln -s ../sites-available/audio.a-lec.org
|
||
|
|
```
|
||
|
|
|
||
|
|
Vérifier que c'est bon et recharger :
|
||
|
|
```
|
||
|
|
nginx -t && systemctl reload nginx
|
||
|
|
```
|
||
|
|
|
||
|
|
Configurer le certificat SSl :
|
||
|
|
```
|
||
|
|
certbot --nginx
|
||
|
|
```
|
||
|
|
|
||
|
|
Mettre beau le fichier `/etc/nginx/sites-enabled/audio.a-lec.org` :
|
||
|
|
```
|
||
|
|
server
|
||
|
|
{
|
||
|
|
listen 80;
|
||
|
|
listen [::]:80;
|
||
|
|
|
||
|
|
server_name audio.a-lec.org;
|
||
|
|
|
||
|
|
access_log /var/log/nginx/audio.a-lec.org-access.log;
|
||
|
|
error_log /var/log/nginx/audio.a-lec.org-error.log;
|
||
|
|
|
||
|
|
return 302 https://$host$request_uri;
|
||
|
|
}
|
||
|
|
|
||
|
|
server
|
||
|
|
{
|
||
|
|
set_real_ip_from 192.169.1.1;
|
||
|
|
real_ip_header proxy_protocol;
|
||
|
|
listen [::]:443 ssl ipv6only=on;
|
||
|
|
listen 443 ssl;
|
||
|
|
|
||
|
|
server_name audio.a-lec.org;
|
||
|
|
|
||
|
|
access_log /var/log/nginx/audio.a-lec.org-access.log;
|
||
|
|
error_log /var/log/nginx/audio.a-lec.org-error.log;
|
||
|
|
|
||
|
|
ssl_certificate /etc/letsencrypt/live/audio.a-lec.org/fullchain.pem; # managed by Certbot
|
||
|
|
ssl_certificate_key /etc/letsencrypt/live/audio.a-lec.org/privkey.pem; # managed by Certbot
|
||
|
|
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
|
||
|
|
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
|
||
|
|
|
||
|
|
root /var/www/audio.a-lec.org;
|
||
|
|
location = /
|
||
|
|
{
|
||
|
|
index index.xhtml;
|
||
|
|
}
|
||
|
|
}
|
||
|
|
```
|
||
|
|
|
||
|
|
Vérifier que c'est bon et recharger :
|
||
|
|
```
|
||
|
|
nginx -t && systemctl reload nginx
|
||
|
|
```
|