ssh-keygen

sudo apt update
sudo apt upgrade
ls /var/run/reboot-required
reboot

# REAPEAT THESE STEPS AFTER REBOOT

# check for logins over ssh
sudo tail -n 10 -f /var/log/auth.log

# check user, if 0 you are root
id

# disable password login

- 

# change password of current user, (root)
passwd

# create new user
adduser <name>

#add user to sudo group
usermod -aG sudo <name>

#check if use group worked
groups <name>

#create ssh key for new user, on extenal device
ssh-keygen

#add public key from laptop into authorized keys directory 
~/.ssh/authorized_keys

# disable password login
## edit following files, find PassworAuthenication setting
/etc/ssh/ssh_config
/etc/ssh/ssh_config.d/
##cloud init?

sudo service ssh restart

# disable root login
#remove '#' comment in sshd_config
PermitRootLogin no

# network and firewall policy
# uncomplicated firewall (ufw)
# 22 for root, 80 http, 443 https?

sudo ufw allow 22    # Allow SSH
sudo ufw allow 80    # Allow HTTP
sudo ufw allow 443   # Allow HTTPS
sudo ufw status verbose
sudo ufw enable


# optional change ssh port to something else than 22 (for more security)
# you can lock down ports to specific ip addresses too

sudo apt install unattended-upgrades
sudo dpkg-reconfigure unattended-upgrades

# check to see if it is running
sudo systemctl status unattended-upgrades

# the caddy docs assume you are using it as a command line, we will be installing caddy as a service
# install the systemd service

sudo service caddy status

# update caddy file with domain name
/etc/caddy/Caddyfile

sudo service caddy restart
sudo service caddy reload

/var/www/
# do not have the website folders editable by the server user group
	change write access only to one user, not any servers

# changing owser of a directory
sudo chown tannerr:tannerr ttannerr.xyz/

# create a system link to perform a multifile pattern
ln -s /etc/caddy/sites-available/http-redirects /etc/caddy/sites-enabled/http-redirects

147.182.240.197

# send files over ssh
# specify files to send space separated, user login for ssh colon filepath
scp [<filename> <filename> <filename> ... ] <user>@<ip-address-or-domanin>:/path/to/directory

# send files using rsync (only transfers files that have changed)
rsync -azP $(pwd)/ <user>@<server-doman>:path/to/folder

# hide files from caddy
# insdie site code block
	file_server {
		hide .git
	}

# handle error
# insdie site code block
	handle_errors {
		respond "{err.status_code} {err.status_text}"
	}

there MUST be a space after the URL or IP before the {} in Caddyfile

# reverse proxy 
# insdie site code block
	reverse_proxy :3000

# servers in ~/hosts directory

# import configs from a folder
import conf.d/*.Caddyfile

## disable the config, add a '.disabled' on the end of the file name

ln -s $(pwd)/README.md $(pwd)/content/README.md

# github can create ssh deploy keys for cloning repos
# create ssh key on server, create key for specific repo not your whole github account

# install node under regular user account not root so if the server is compromised they can have access to everything

#manage long running processes with pm2 (or systemd)
# pm2 works well with node apps

# virtual environment
python3 -m venv env

source env/bin/activate
deactivate

# save the packeages of a project into a file to share on github 
pip freeze > requirements.txt

# install packes from file
pip install -r rquirements.txt

air

7. [docker](dev/dir/docker.md)

## syntax self host 101 notes

openvpn
wiregaurd
https://en.wikipedia.org/wiki/Software_load_testing

process manager or systemd to restart web server if it crashes
- use systemd to write a process manager for webservers to be hosted a vps or homelab

scp can transer files between your vps and laptop

ssh_config
- can be configured to specify username and port so you don't have to say it everytime you ssh
- you can specify a new ssh port in the config file
	- you can set up to not need to specify the user name too

- store ssh keys on yubikey and/or set up ssh keys on another machine? print it off
	- PAM modules?
- you can also set up 2fa?



we set up a new user and added that one to a group with sudo capabilities??
	then we set up the ssh to the new user

Issues with DNS resolution 
	Cloudflare TLS setting to FULL!!!
	
### Networking notes
```bash
dig
netcat

# after installing docker, add tannerr to the docker group
sudo usermod -a -G docker tannerr

cat /etc/crontab
which cron
service cron status
service cron start

crontab -l ##list
crontab -e ##edit

* * * * * echo hello >> /home/tannerr/hello.txt
# * * * * * /usr/bin/python3 /home/tannerr/data/programs/integration/reports/sales_scorecard.py >> /home/tannerr/cron.log 2>&1
#0 8 * * 1 /usr/bin/python3 /home/tannerr/data/programs/integration/reports/sales_scorecard.py >> /home/tannerr/cron.log 2>&1

# * * * * * echo hello >> /home/tannerr/hello.txt
# * * * * * /usr/bin/python3 /home/tannerr/data/integration/reports/sales_scorecard.py >> /home/tannerr/cron.log 2>&1
#0 8 * * 1 /usr/bin/python3 /home/tannerr/data/integration/reports/sales_scorecard.py >> /home/tannerr/cron.log 2>&1
0 6 * * 1 /usr/bin/python3 /home/tannerr/data/integration/reports/item_snapshot.py >> /home/tannerr/cron.log 2>&1
0 7 * * 1 /usr/bin/python3 /home/tannerr/data/integration/reports/contact_snapshot.py >> /home/tannerr/cron.log 2>&1

docker build . -t tannerrrr/data-app-image

docker push tannerrrr/data-app-image:latest

docker pull tannerrrr/data-app-image

docker stop data-app && docker rm data-app && docker ps

docker run -d --name data-app -p 8080:8080 tannerrrr/data-app-image:latest

sudo docker build . -t tannerrrr/data-app-image && sudo docker push tannerrrr/data-app-image:latest

docker pull tannerrrr/data-app-image && docker stop data-app && docker rm data-app && docker ps && docker run -d --name data-app -p 8080:8080 tannerrrr/data-app-image:latest

docker build --no-cache -t data-connect .

docker pull tannerrrr/data-connect:latest

docker run -d --rm --mount type=volume,src=integration-data,target=/integration/data --name data-connect -e NS_ID="[email protected]" -e NS_PW="" tannerrrr/data-connect:latest

mkdir staticSite

chmod +rw staticSite

scp -r /home/tannerr/pockist/* [email protected]:/var/www/pockist/

pockist.com {
        root * /var/www/pockist
        file_server
        header {
                Cache-Control max-age=3600
        }
}

sudo service caddy reload