blob: 43fee0e3240bfe57afcb40c651dc536500c4c17c (
plain)
1
2
3
4
5
6
7
8
9
10
11
12
13
14
15
16
17
18
19
20
21
22
23
24
25
26
27
28
29
30
31
32
33
34
35
36
37
38
39
40
41
42
43
44
45
46
47
48
49
50
51
52
53
54
55
56
57
58
59
60
61
62
63
64
65
66
67
68
69
70
71
72
73
74
75
76
77
78
79
80
81
82
83
84
85
86
87
88
89
90
91
92
93
94
95
96
97
98
99
100
101
102
103
104
105
106
107
108
109
110
111
112
113
114
115
116
117
118
119
120
121
122
123
124
125
126
127
128
129
130
131
132
133
134
135
136
137
138
139
140
141
142
143
144
145
146
147
148
149
150
151
152
153
154
155
156
157
158
159
160
161
162
163
164
165
166
167
168
169
170
171
172
173
174
175
176
177
178
179
180
181
182
183
184
185
186
187
188
189
190
191
192
193
194
195
196
197
198
199
200
201
202
203
204
205
206
207
208
209
210
211
212
213
214
215
216
217
218
219
220
221
222
223
224
225
226
227
228
229
230
231
232
233
234
235
236
237
238
239
240
241
242
243
|
# Craig Johnson -- rebuild static http sites on Debian.
## ORGANIZE THIS PILE
### Go old school on the static network configuration.
Systemd/networkd is coming but I want something that works right now.
/etc/network/interfaces aint broken.
So tear out all the new and replace it with the old.
```
systemctl stop systemd-networkd
systemctl disable systemd-networkd
systemctl stop systemd-networkd.socket
systemctl disable systemd-networkd.socket
apt install ifupdown
```
#### Then configure it like it was a decade ago.
```
cat /etc/network/interfaces
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet static
address 198.202.31.221
network 198.202.31.128
netmask 255.255.255.128
broadcast 198.202.31.255
gateway 198.202.31.129
mtu 9000
auto eth0:1
iface eth0:1 inet static
address 198.202.31.230
network 198.202.31.128
netmask 255.255.255.128
broadcast 198.202.31.255
gateway 198.202.31.129
mtu 9000
auto eth0:2
iface eth0:2 inet static
address 198.202.31.231
network 198.202.31.128
netmask 255.255.255.128
broadcast 198.202.31.255
gateway 198.202.31.129
mtu 9000
auto eth0:3
iface eth0:3 inet static
address 198.202.31.232
network 198.202.31.128
netmask 255.255.255.128
broadcast 198.202.31.255
gateway 198.202.31.129
mtu 9000
```
##
### nginx configuration
#### New config for www.3dangst.com (default)
```
server {
#listen 443 ssl 198.202.31.221;
root /var/www/3dangst/site;
index index.html;
server_name www.3dangst.com;
location / {
try_files $uri $uri/ =404;
}
listen 443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/www.3dangst.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/www.3dangst.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
}
server {
if ($host = www.3dangst.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 80 default_server;
server_name www.3dangst.com;
return 404; # managed by Certbot
}
```
#### copy nginx config, /etc/letsencrypt and content (/var/www/*) from the old server
We copied the old servers default to /etc/nginx/sites-avaliable/digithink and then linked it into sites-enabled.
```
cat /etc/nginx/sites-avaliable/digithink
server {
listen 198.202.31.230:80;
server_name www.digithink.com;
if ($host = www.digithink.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = 198.202.31.230) {
return 444;
} # managed by Certbot
return 404; # managed by Certbot
}
server {
listen 198.202.31.230:80;
server_name www.digithink.com;
root /var/www/digithink/site;
index index.html;
listen 198.202.31.230:443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/www.digithink.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/www.digithink.com/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
if ($host = 198.202.31.230) {
return 444;
} # managed by Certbot
error_page 404 /404.html;
location /404.html {
internal;
}
}
upstream bartender {
server 127.0.0.1:5000;
}
server {
server_name bartender.digithink.com;
listen 198.202.31.232:443 ssl;
server_name bartender.digithink.com;
ssl_certificate /etc/letsencrypt/live/bartender.digithink.com/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/bartender.digithink.com/privkey.pem; # managed by Certbot
root /var/www/digithink/whiskey/bartender;
index index.html;
location /whiskey {
include proxy_params;
proxy_pass http://bartender/whiskey;
}
error_page 404 /404.html;
location /404.html {
internal;
}
location /lacuenta {
root /var/www/digithink/whiskey/logs;
}
}
server {
if ($host = bartender.digithink.com) {
return 301 https://$host$request_uri;
} # managed by Certbot
listen 198.202.31.232:80;
server_name bartender.digithink.com;
return 404; # managed by Certbot
}
server {
listen 198.202.31.231:80;
server_name busholini.org w.busholini.org www.busholini.org;
if ($host = www.busholini.org) {
return 301 https://$host$request_uri;
} # managed by Certbot
if ($host = git.suspectdevices.com) {
return 444;
}
if ($host = 198.202.31.231) {
return 444;
}
return 404; # managed by Certbot
}
server {
listen 198.202.31.231:443 ssl; # managed by Certbot
ssl_certificate /etc/letsencrypt/live/www.busholini.org/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/www.busholini.org/privkey.pem; # managed by Certbot
include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
server_name busholini.org w.busholini.org www.busholini.org;
if ($host = git.suspectdevices.com) {
return 444;
}
if ($host = 198.202.31.231) {
return 444;
}
root /var/www/busholini/www;
index index.html;
}
cd /etc/nginx/sites-enabled/
ln -s /etc/nginx/sites-available/digithink .
nginx -t
```
#### Install the parts that the bartender needs
```sh
apt install python3-flask
apt install python3-gunicorn
apt install at
echo www-data |tee /etc/at.allow
```
|
