add nginx notes, sparrow update, fulcrum sync, servr.js

2025-12-18 12:34:20 +01:00 · 2024-03-25 10:44:16 +01:00
parent df75eaa016
commit a6a64ea590
7 changed files with 242 additions and 10 deletions
--- a/k8s/nixenv.sh
+++ b/k8s/nixenv.sh
@@ -0,0 +1,53 @@
+#!/bin/bash
+
+# dedicated user
+USERNAME=k3d
+PASSWORD=""
+
+echo "# add the user: ${USERNAME}"
+sudo adduser --system --group --shell /bin/bash --home /home/${USERNAME} ${USERNAME}
+echo "Copy the skeleton files for login"
+sudo -u ${USERNAME} cp -r /etc/skel/. /home/${USERNAME}/
+sudo adduser ${USERNAME} sudo
+
+# set a password
+echo "$USERNAME:$PASSWORD" | sudo chpasswd
+
+
+  # docker
+  if ! docker version 2>/dev/null; then
+    # look for raspiblitz install script
+    if [ -f /home/admin/config.scripts/blitz.docker.sh ]; then
+      /home/admin/config.scripts/blitz.docker.sh on
+    else
+      # https://docs.docker.com/desktop/linux/install/debian/
+      curl -fsSL https://get.docker.com -o get-docker.sh
+      sh get-docker.sh
+    fi
+  fi
+  sudo groupadd docker
+  sudo usermod -aG docker $USERNAME
+
+# need to log back in to get the group change
+
+
+
+# nix
+# manual install step
+curl --proto '=https' --tlsv1.2 -sSf -L https://install.determinate.systems/nix | sh -s -- install
+
+echo "$PATH:/nix/var/nix/profiles/default/bin/nix" >> ~/.bashrc
+
+# direnv
+sudo apt install -y direnv
+echo "eval \"\$(direnv hook bash)\"" >> ~/.bashrc
+source ~/.bashrc
+
+
+sudo su - k3d
+https://github.com/GaloyMoney/charts
+
+direnv allow
+
+cd dev
+make create-cluster
--- a/nginx/custom_website_subdomain.sh
+++ b/nginx/custom_website_subdomain.sh
@@ -51,12 +51,12 @@ server {
    proxy_set_header Upgrade \$http_upgrade;
    proxy_set_header Connection \"upgrade\";

-  # from https://github.com/rootzoll/raspiblitz/blob/v1.7/home.admin/assets/nginx/snippets/ssl-proxy-params.conf
-  proxy_redirect off;
-  proxy_set_header Host \$http_host;
-  proxy_set_header X-Real-IP \$remote_addr;
-  proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
-  proxy_set_header X-Forwarded-Proto https;
+    # from https://github.com/rootzoll/raspiblitz/blob/v1.7/home.admin/assets/nginx/snippets/ssl-proxy-params.conf
+    proxy_redirect off;
+    proxy_set_header Host \$http_host;
+    proxy_set_header X-Real-IP \$remote_addr;
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
  }
 }" | sudo tee /etc/nginx/sites-available/$SUBDOMAIN

--- a/nginx/https_redirect_to_subdomain.sh
+++ b/nginx/https_redirect_to_subdomain.sh
@@ -34,10 +34,9 @@ server {
  listen 443 ssl;
  server_name SUBDOMAIN;
  return 301  $REDIRECT;
-  ssl on;

-  ssl_certificate /etc/letsencrypt/live/tips.diynodes.com/fullchain.pem;
-  ssl_certificate_key /etc/letsencrypt/live/tips.diynodes.com/privkey.pem;
+  ssl_certificate /etc/letsencrypt/live/$SUBDOMAIN/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/$SUBDOMAIN/privkey.pem;
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_session_tickets off;
@@ -46,7 +45,7 @@ server {
  ssl_prefer_server_ciphers on;
  ssl_stapling on;
  ssl_stapling_verify on;
-  ssl_trusted_certificate /etc/letsencrypt/live/tips.diynodes.com/chain.pem;
+  ssl_trusted_certificate /etc/letsencrypt/live/$SUBDOMAIN/chain.pem;

  location / {
    proxy_set_header Host \$host;
--- a/nginx/nostr-relay.sh
+++ b/nginx/nostr-relay.sh
@@ -0,0 +1,88 @@
+#!/bin/bash
+
+echo "
+Input your email:
+"
+read EMAIL
+
+echo "
+Input a subdomain set up with an A record pointing to this server:
+eg.: mempool.example.com
+"
+read SUBDOMAIN
+
+echo "
+Input the URL where the server is running:
+eg.: http://192.168.1.42:5000
+"
+read SERVER
+
+echo "
+Input the address of the relay after the IPaddress or domain:
+eg.: /nostrrelay/nNZ59JFH
+"
+read RELAY
+
+sudo certbot certonly -a standalone -m $EMAIL --agree-tos \
+-d $SUBDOMAIN --expand -n --pre-hook "service nginx stop" \
+--post-hook "service nginx start" || exit 1
+
+# copy in place on a remote machine if needed
+#sudo cat /etc/letsencrypt/live/$SUBDOMAIN/fullchain.pem
+#sudo cat /etc/letsencrypt/live/$SUBDOMAIN/privkey.pem
+
+# add to /etc/nginx/sites-available/
+echo "\
+server {
+  listen 80;
+  listen 443 ssl;
+  server_name $SUBDOMAIN;
+
+  ssl_certificate /etc/letsencrypt/live/$SUBDOMAIN/fullchain.pem;
+  ssl_certificate_key /etc/letsencrypt/live/$SUBDOMAIN/privkey.pem;
+  ssl_session_timeout 1d;
+  ssl_session_cache shared:SSL:50m;
+  ssl_session_tickets off;
+  ssl_protocols TLSv1.2 TLSv1.3;
+  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!3DES:!MD5:!PSK';
+  ssl_prefer_server_ciphers on;
+  ssl_stapling on;
+  ssl_stapling_verify on;
+  ssl_trusted_certificate /etc/letsencrypt/live/$SUBDOMAIN/chain.pem;
+
+  location / {
+    proxy_pass      https://${SUBDOMAIN}${RELAY};
+    # to allow wss:// connections
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade \$http_upgrade;
+    proxy_set_header Connection \"upgrade\";
+
+    # from https://github.com/rootzoll/raspiblitz/blob/v1.7/home.admin/assets/nginx/snippets/ssl-proxy-params.conf
+    proxy_SERVER off;
+    proxy_set_header Host \$http_host;
+    proxy_set_header X-Real-IP \$remote_addr;
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto https;
+  }
+
+  location $RELAY {
+    proxy_pass      $SERVER;
+    proxy_http_version 1.1;
+    proxy_set_header Upgrade \$http_upgrade;
+    proxy_set_header Connection \"upgrade\";
+    proxy_set_header Host \$host;
+    proxy_set_header X-Real-IP \$remote_addr;
+    proxy_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
+    proxy_set_header X-Forwarded-Proto \$scheme;
+  }
+}" | sudo tee /etc/nginx/sites-available/$SUBDOMAIN
+
+# edit with
+# sudo nano /etc/nginx/sites-available/$SUBDOMAIN
+
+# add to /etc/nginx/sites-enabled/
+sudo ln -s /etc/nginx/sites-available/$SUBDOMAIN /etc/nginx/sites-enabled/
+
+sudo nginx -t || exit 1
+
+sudo systemctl restart nginx
--- a/proxy/server.js
+++ b/proxy/server.js
@@ -0,0 +1,34 @@
+/*
+# Install dependencies:
+npm install express http-proxy-middleware
+# Start with the command:
+node server.js
+*/
+
+const express = require('express');
+const { createProxyMiddleware } = require('http-proxy-middleware');
+
+const app = express();
+
+app.use('/api', createProxyMiddleware({
+  target: 'https://api.staging.galoy.io/graphql', // The target API endpoint
+  changeOrigin: true,
+  pathRewrite: {
+    '^/api': '', // Rewrite the API path, if needed
+  },
+  onProxyRes: function (proxyRes, req, res) {
+    // Add CORS headers to the response from the proxied server
+    res.header('Access-Control-Allow-Origin', '*');
+    res.header('Access-Control-Allow-Methods', 'GET, POST, PUT, DELETE, OPTIONS');
+    res.header('Access-Control-Allow-Headers', 'Origin, X-Requested-With, Content-Type, Accept, Authorization');
+    if (req.method === 'OPTIONS') {
+      // Preflight request, end it after setting headers
+      res.sendStatus(200);
+    }
+  },
+}));
+
+const PORT = 3000; // The port your proxy server will listen on
+app.listen(PORT, () => {
+  console.log(`Proxy server is running on http://localhost:${PORT}`);
+});
--- a/sparrowwallet/sparrow.update.sh
+++ b/sparrowwallet/sparrow.update.sh
@@ -0,0 +1,17 @@
+#!/bin/bash
+
+VERSION='1.8.4'
+
+cd Downloads
+
+wget -O sparrow_${VERSION}-1_amd64.deb https://github.com/sparrowwallet/sparrow/releases/download/${VERSION}/sparrow_${VERSION}-1_amd64.deb || exit 1
+wget -O sparrow-${VERSION}-manifest.txt https://github.com/sparrowwallet/sparrow/releases/download/${VERSION}/sparrow-${VERSION}-manifest.txt || exit 1
+wget -O sparrow-${VERSION}-manifest.txt.asc https://github.com/sparrowwallet/sparrow/releases/download/${VERSION}/sparrow-${VERSION}-manifest.txt.asc || exit 1
+
+
+gpg --verify sparrow-${VERSION}-manifest.txt.asc sparrow-${VERSION}-manifest.txt || exit 1
+sha256sum -c sparrow-${VERSION}-manifest.txt --ignore-missing || exit 1
+
+sudo dpkg -i sparrow_${VERSION}-1_amd64.deb || exit 1
+
+exit 0
--- a/zfs/sync-fulcrum-db.md
+++ b/zfs/sync-fulcrum-db.md
@@ -0,0 +1,41 @@
+# Snapshot and mount a datadisk
+
+## Create the snapshot, clone and mount
+```
+# create snapshot of /mnt/hdd - datadisk/hdd@hdd-snapshot
+sudo zfs snap datadisk/hdd@hdd-snapshot
+# display snapshots
+zfs list -t snap
+# clone snapshot (datadisk/hdd/hdd-snapshot-clone)
+sudo zfs clone datadisk/hdd@hdd-snapshot datadisk/hdd/hdd-snapshot-clone
+# see if mounted
+zfs list
+```
+
+
+## Copy over the network
+### on the remote computer
+```
+sudo mkdir -p /mnt/hdd/fulcrum_db
+sudo chown admin:admin /mnt/hdd/fulcrum_db
+```
+### on the source computer
+```
+sudo scp -r /mnt/hdd/hdd-snapshot-clone/app-storage/fulcrum/db admin@$REMOTE_IP:/mnt/hdd/fulcrum_db/
+```
+### on the remote computer once finished
+sudo mv /mnt/hdd/app-storage/fulcrum/db /mnt/hdd/app-storage/fulcrum/db-corrupt
+sudo mv /mnt/hdd/fulcrum_db/db /mnt/hdd/app-storage/fulcrum/
+sudo chown -R fulcrum:fulcrum /mnt/hdd/app-storage/fulcrum/db
+sudo rm -rf /mnt/hdd/fulcrum_db
+
+## OFF
+```
+zfs list
+# destroy the clone filesystem
+sudo zfs destroy datadisk/hdd/hdd-snapshot-clone
+# destroy the snapshot
+sudo zfs destroy datadisk/hdd@hdd-snapshot
+zfs list
+```
+