Accédez à votre serveur à distance et en toute sécurité¶

sudo apt install git
git clone https://github.com/dehydrated-io/dehydrated.git

cd dehydrated
vi domains.txt

*.gofoss.duckdns.org > gofoss.duckdns.org

vi config

CHALLENGETYPE="dns-01"
BASEDIR=/etc/dehydrated
HOOK="${BASEDIR}/hook.sh"
CONTACT_EMAIL=gofoss@gofoss.net

vi hook.sh

DOMAIN="gofoss.duckdns.org"                         # indiquez votre domaine ici
TOKEN="ebaa3bd3-177c-4230-8d91-a7a946b5a51e"        # indiquez votre jeton ici
case "$1" in
    "deploy_challenge")
        curl "https://www.duckdns.org/update?domains=$DOMAIN&token=$TOKEN&txt=$4"
        echo
        ;;
    "clean_challenge")
        curl "https://www.duckdns.org/update?domains=$DOMAIN&token=$TOKEN&txt=removed&clear=true"
        echo
        ;;
    "deploy_cert")
        ;;
    "unchanged_cert")
        ;;
    "startup_hook")
        ;;
    "exit_hook")
        ;;
    *)
        echo Unknown hook "${1}"
        exit 0
        ;;
esac

mkdir certs
chmod a+x dehydrated
chmod a+x hook.sh
cd ..
sudo mv dehydrated /etc/dehydrated
sudo chown -R gofossadmin:gofossadmin /etc/dehydrated

sudo ls -al /etc/dehydrated

drwxr-xr-x 2 gofossadmin gofossadmin   4096 Jan 01 00:00 .
drwxr-xr-x 4 gofossadmin gofossadmin   4096 Jan 01 00:00 ..
-rw-r--r-- 1 gofossadmin gofossadmin    200 Jan 01 00:00 certs
-rw-r--r-- 1 gofossadmin gofossadmin    200 Jan 01 00:00 config
-rwxr-xr-x 1 gofossadmin gofossadmin 700000 Jan 01 00:00 dehydrated
-rw-r--r-- 1 gofossadmin gofossadmin    200 Jan 01 00:00 docs
-rw-r--r-- 1 gofossadmin gofossadmin     20 Jan 01 00:00 domains.txt
-rwxr-xr-x 1 gofossadmin gofossadmin    700 Jan 01 00:00 hook.sh

bash /etc/dehydrated/dehydrated --register --accept-terms

# INFO: Using main config file /etc/dehydrated/config
+ Generating account key...
+ Registering account key with ACME server...
+ Done!

bash /etc/dehydrated/dehydrated -c

+ Creating chain cache directory /etc/dehydrated/chains
Processing gofoss.duckdns.org
+ Creating new directory /etc/dehydrated/certs/gofoss.duckdns.org ...
+ Signing domains...
+ Generating private key...
+ Generating signing request...
+ Requesting new certificate order from CA...
+ Received 1 authorizations URLs from the CA
+ Handling authorization for gofoss.duckdns.org
+ 1 pending challenge(s)
+ Deploying challenge tokens...
OK
+ Responding to challenge for gofoss.duckdns.org authorization...
+ Challenge is valid!
+ Cleaning challenge tokens...
OK
+ Requesting certificate...
+ Checking certificate...
+ Done!
+ Creating fullchain.pem...
+ Done!

sudo touch /var/log/dehydrated

sudo vi /etc/cron.weekly/dehydrated

#!/bin/sh

MYLOG=/var/log/dehydrated
echo "Checking cert renewals at `date`" >> $MYLOG
/etc/dehydrated/dehydrated -c >> $MYLOG 2>&1

sudo chmod +x /etc/cron.weekly/dehydrated

sudo bash /etc/cron.weekly/dehydrated
sudo cat /var/log/dehydrated

Checking cert renewals at Sun 01 Jan 2021 01:29:06 PM CEST
# INFO: Using main config file /etc/dehydrated/config
Processing *.gofoss.duckdns.org
 + Checking domain name(s) of existing cert... unchanged.
 + Checking expire date of existing cert...
 + Valid till Mar 12 10:23:18 2021 GMT (Longer than 30 days). Skipping renew!

sudo curl -sSL https://install.pi-hole.net | bash

sudo chown www-data:www-data -R /var/www/html/admin/
sudo usermod -aG pihole www-data
sudo chown -R pihole:pihole /etc/pihole

sudo vi /etc/apache2/sites-available/mypihole.gofoss.duckdns.org.conf

<VirtualHost *:80>

    ServerName              mypihole.gofoss.duckdns.org
    ServerAlias             www.mypihole.gofoss.duckdns.org
    Redirect permanent /    https://mypihole.gofoss.duckdns.org/

</VirtualHost>

<VirtualHost *:443>

    ServerName              mypihole.gofoss.duckdns.org
    ServerAlias             www.mypihole.gofoss.duckdns.org
    ServerSignature         Off

    SSLEngine               On
    SSLProxyEngine          On
    SSLProxyCheckPeerCN     Off
    SSLCertificateFile      /etc/dehydrated/certs/gofoss.duckdns.org/fullchain.pem
    SSLCertificateKeyFile   /etc/dehydrated/certs/gofoss.duckdns.org/privkey.pem
    DocumentRoot            /var/www/html/admin

    <Location />
        Order deny,allow
        Deny from all
        Allow from 127.0.0.1
        Allow from 192.168.1.0/24
        Allow from 10.8.0.1/24
    </Location>

    <Directory /var/www/html/admin/>
        Options +FollowSymlinks
        AllowOverride All
        Require all granted
    </Directory>

    ErrorLog ${APACHE_LOG_DIR}/mypihole.gofoss.duckdns.org-error.log
    CustomLog ${APACHE_LOG_DIR}/mypihole.gofoss.duckdns.org-access.log combined

</VirtualHost>

sudo a2ensite mypihole.gofoss.duckdns.org.conf
sudo systemctl reload apache2

sudo systemctl restart pihole-FTL
sudo systemctl status pihole-FTL

sudo pihole -a -p

wget https://git.io/vpn -O openvpn-install.sh
sudo bash openvpn-install.sh

Welcome to this OpenVPN road warrior installer!

I need to ask you a few questions before starting setup.
You can use the default options and just press enter if you are ok with them.

This server is behind NAT. What is the public IPv4 address or hostname?
Public IPv4 address / hostname [88.888.88.88]: 88.888.88.88

What IPv6 address should the OpenVPN server use?
    1) 1a00:a0a:10a:10a0:a00:00ff:faf0:a011
    2) 1a00:a0a:10a:10a0:a00:00bb:faf0:a022
IPv6 address [1]: 1

Which protocol do you want for OpenVPN connections?
1) UDP (recommended)
2) TCP
Protocol [1]: 1

What port do you want OpenVPN listening to?
Port [1194]: 1194

Which DNS do you want to use with the VPN?
1) Current system resolvers
2) 1.1.1.1
3) Google
4) OpenDNS
5) NTT
6) AdGuard
DNS [1]: 1

Finally, tell me a name for the client certificate.
Client name [client]: ordinateur_vpn

We are ready to set up your OpenVPN server now.

[etc.]

Finished!

The client configuration is available in: /root/ordinateur_vpn.ovpn
New clients can be added by running this script again.

sudo bash openvpn-install.sh

Looks like OpenVPN is already installed.

What do you want to do?
1) Add a new user
2) Revoke an existing user
3) Remove OpenVPN
4) Exit
Select an option: 1

Tell me a name for the client certificate.
Client name: telephone_vpn

[...]

Write out database with 1 new entries
Data Base Updated

Client telephone_vpn added, configuration is available at: /root/telephone_vpn.ovpn

cd
sudo mv /root/ordinateur_vpn.ovpn .
sudo mv /root/telephone_vpn.ovpn .
sudo chmod 755 *.ovpn
sudo chown gofossadmin:gofossadmin *.ovpn

sudo ufw allow 1194/udp

sudo ufw status numbered

ip ad | grep tun0

ip route | grep tun0

sudo apt install traceroute
traceroute 10.8.0.1

sudo vi /etc/openvpn/server/server.conf

#push "dhcp-option DNS XX.XX.XXX.XXX"
#push "dhcp-option DNS XX.XX.XXX.XXX"
push "dhcp-option DNS 10.8.0.1"

sudo systemctl restart openvpn-server@server