fix

.gitignore

@@ -1,3 +1,6 @@
-data/secrets/
-data/certbot/
-data/traefik/
+data/openvpn
+data/secrets
+data/certbot
+data/traefik
+data/caddy
+data.tar.gz

Makefile

@@ -0,0 +1,6 @@
+export:
+	tar cvzf data.tgz data
+	gpg --encrypt --recipient 'marc.partensky@gmail.com' data.tgz
+	rm data.tgz
+clean:
+	rm data.tgz.gpg

README.md

@@ -2,7 +2,6 @@
 
 ## Domains
 - https://marcpartensky.com
-- https://www.marcpartensky.com
 - https://pandoc.marcpartensky.com
 - https://ialab.marcpartensky.com
 - https://notebook.marcpartensky.com
@@ -10,12 +9,26 @@
 - https://cloud.marcpartensky.com
 - https://wordpress.marcpartensky.com
 - https://git.marcpartensky.com
+- https://business.marcpartensky.com
+- https://todolist.marcpartensky.com
+- https://api.todolist.marcpartensky.com
+- https://marc.wp.marcpartensky.com
+- https://alex.wp.marcpartensky.com
+- https://uml.marcpartensky.com
+- https://grafana.marcpartensky.com
+- https://prometheus.marcpartensky.com
+- https://dns.marcpartensky.com
 <!-- - https://dev.marcpartensky.com -->
 <!-- - https://box.marcpartensky.com -->
-<!-- - https://business.marcpartensky.com -->
 <!-- - https://glou.marcpartensky.com -->
 <!-- - https://minecraft.marcpartensky.com -->
 
+## Reverse proxy
+The `docker-compose.yml` configuration is compatible with the following reverse-proxies:
+- traefik
+- caddy
+- nginx
+
 ## Commands
 ```sh
 certbot certonly -d newdomain.com -n --standalone

config/opendkim/KeyTable

@@ -0,0 +1 @@
+mail._domainkey.marcpartensky.com marcpartensky.com:mail:/etc/opendkim/keys/marcpartensky.com/mail.private

config/opendkim/SigningTable

@@ -0,0 +1 @@
+*@marcpartensky.com mail._domainkey.marcpartensky.com

config/opendkim/TrustedHosts

@@ -0,0 +1,2 @@
+127.0.0.1
+localhost

config/opendkim/keys/marcpartensky.com/mail.private

@@ -0,0 +1,51 @@
+-----BEGIN RSA PRIVATE KEY-----
+MIIJKAIBAAKCAgEAouPk5YPodxb41YBVY4xdeJGRCzUXSrVYUZc2ukE2HqIqWsiv
+U7vPgBFlclBzMMJVdrt/NAt3NnulzWyQg6V+A8wSYkCNpevGlsp2TvkL8Mcuf1LV
+GfNScjycJ8nC8LhRgHZZJ876yM97mEK+J4X4k8X1/IWzwUSmOOAB3EpfuQLMVQL8
+KQh5gyAdvokbnmq+r9VqOyiFbZ03JzyW+RPMTQxMu2kid+KH336/j5Tvza8ITN3v
+qZRVfZJjJzCJHvx4iKpWy2iOFxNThlUTbnZ93xFEA+36s+pU2hT22RGN8qzSQFBt
+IXKEqyNJ4KoJ/X53ukYc4ZSmpRAz/PhxX9eIgurUwKXrSwX5127+eCIanRT4aMYS
+obuue7IGlHixNI4dmZW4H0kMs5MwDItYzNQfmsv7HDjkfsRhBlFpV5LMES1g4L4r
+WQ85kKcQYfl60FyReCKrrBGiFi9H8iEK5gDIgOFJ37qNa3yLolll31YdkhONsFyr
+OyGrEAcCzRHOa9jq9KEa5p8QyRekG75aGEfGlRMntkM1KAhdyjuyixle3I7SYywq
+tqJfjAButWJdvhuPf1jWmqzs97AoJZb2mYzgP/ur9sqHR8EBJ8HN9thRgf4Qsyxp
+PTO9tOU+4GtT9YSVSGjXHQ0SnPDAj8YxjOql5RDalmiP91NmAeGUfCbLwUkCAwEA
+AQKCAgBUDv7kYjnomvY2V0+5W4ow2g3blr46U3MMR9h6LYTcMhthVgcEUvs1v8R2
+RYXsN50a9I8kMHaIqy5Y4BmDljd9hiZGhcGTSiTlU/3Rqzu6OU+JbRmDlsmJIjYD
+Yl8zEisc+/XuUSWh01CYtniitMQenh3e/rBQoDiXSSIsqETVmNgRVsUB99mdDUnM
+Nb0G91cILj3v4W1Zr7Pyj5XpW4omiJ5gaFTdQQ2VDDeWxOkrX5QM9sri3CVx88Uv
+SCC62Nbqz9ySg5Yv2k1UGTs52fQC1UogLQMfLWI0WHU6d5ClFwI5Jkfq5soH9uH9
+CkK1ijoG6n+k+a01qTLq7Nq09uj+s6T0BFb6703ZATVxdTNxc3xaFcYm9ZpuDnCr
+U8P6sVClCa9axjMZk1Kjl7OKSyp8LlRWPacxO4GXqlNmhyMUEldKj8cBmmxzC7fj
+1fMXAve3EodVRM5Z6S+c/PO96TuJrSkddImWhPawd35/rrtBA+7ToPNYzy7aWk/N
+UZ9uFkwPMLaDZeRG590natPOUkB0FZ7F8EEjwMbUhf1iyoPvLPiixofVk1NKTWMr
+8DEN6bSH85v/lQaAQhmFFNRjdeyXts9+a7Kmsxos3AfW8hsmNHFxTuoXZ8AjvVAs
+P7hlPFoJultoUwX/ZpMZtsEwFW3FUSw33Onsdblezp7Lb12icQKCAQEAzVKid6vv
+TWGltBkL1XTtzYSNUTBIZfoOjKxTsrqSKNAR6i2lmN2bPKKTksPdloBoaQ/FHK6R
+/+mebfgmnyulY6zWo8EUewi3LFyL9KhXe0K38/jUUokKWSq1Ob5D8Kjq6MuTCfuS
+M5XnYfIZuIAZLE0244+Q8L03mc2f7uvl3KWaAZOVUsfHu/ETzTm6lgG8Liq5a0Fw
+thCVVupKVeSLjRa/RWFVR9E9jvIjplo+SVAUJWyYwlOfPDVr76gqrF5P+4lOQpAQ
+dzwhi4LHhvdgp9Y/Gw3s5vByA/7Ogh3QI5jS36w2EMCFYZpAe4HBQk1UOYVNBpeD
+58m3venG5pBy4wKCAQEAyxglzQhZSBNkkukoRm7zzmNAx9/M0ROu7uwmJ9t02Q94
+/3fpV2zVYA7rQKZcCgW5Dnhe4GaeyASRXq4x3v7F6iLCUjxbJ8e+YRhsNrp0WmYU
+Xk6+06EQgLBICqDQeMDDeR+KQzaJonuMSrGyUb8krR6RB+/W3LqK/0CQSSaHozzN
+6mxejoFoNhf7rfIP9JJD8QwpBsTJBQNCDvHo1lIA8e3nTngFzLJ56tRVwjaP8EPT
+qJ7RfoVxdTyUTZTq/8EGOqNrzLgB/FehXq3eTz89tdlHOTT+mJ8H23AEtepxpLFx
+5kN/eisi4PjUgCp11IHnmG8qnJr48uDlORdrqL424wKCAQBX/DVK+w7NJi8QAjuj
++Tt+enLke8BKkuFxPtePG4xOmPtUUsNHwo8naLO8jNqEB/q2Kt/Y7qX5+G6/yTsj
+slxpXkOMYM0Z/B4ikHYZHZp/Y5PYpKS3yan5k+edGv+aPYiMwc/80yVPnclNm6WR
+/rLK3TvMQFVoFG2jJw6GH+icqQpZ6phupNXen+xQYZCnf47Yac6TO7PFEU4ttLCu
+JgX3K+xDGvakk/HBM9o7Cyjt2bcIYoUDoTn3Xx0l0faXbsLvk2NJ+tpTfh0R37UJ
+DTEKOzFHsqv2OsthEuwDrirnVjHnT7DLdPSzYpqHUo8yjlitXYYocP1BcpuecnOd
+kgDpAoIBAQCtLi4to8zeFQtR6teZF8t2VlRLG5+/ORWWTnBK1GvTG8qFrW6gSgG5
+I3+fZTxen3qpyCK/H0KONLbxEYEdMgr6GCGzlhv00/KXQQglsuC8pQcBVAyM0W8N
+DUShK3gZP+ZvRmHT5pF+p/N9TgFMi71ukf4B0pZZKgiUmC1w8xX+MD82gqouwlJm
+rhTCwwKv/nlI9qGVUABJ8flGXSm6d7qukbsHwnjPj/E+OUnXjkc3Dd9Sjfr99DRH
+UBz1+uJYq/Pv1KJ7svyefOrxnTlQQhERG/IL6hCffBxrFh4uMXgug9EoFK6DMn1P
+cV9i2tIXH56o8UJYwB1Anl1YTYxUG78ZAoIBAD748NDDIj5yxjzW7UzNajLs9iB2
+aiywcxPZCKo38Yi7KIaxIy8YeHqJ6chenvTl5S4ElB+sJ0SnYEvBqxceOXiM9l5i
+HrDxIc3gzwY0lN0h2ZEiSKBQgjCtFW6gZ+6KmPonk98S8l8hbFW0vL+nS4EE9vtO
+3cFhz/HPVB1ZY5ofy7/rLRd7GiISof9WcvrnOvE9BKFF0rNKZUjrf2PM3c2rObvj
+5rgLvUiX/Mn9ND/XHTjT/UVptmkmcnjFyRvQwXXA4ns7gxBWYfYB1bqwh6WRfEU6
+x3ykDol24hgohvpEnKMZDUTmLrxgF8hbJTP/57P2Yyy0faxZ/z/MER1qy28=
+-----END RSA PRIVATE KEY-----

config/opendkim/keys/marcpartensky.com/mail.txt

@@ -0,0 +1,4 @@
+mail._domainkey	IN	TXT	( "v=DKIM1; h=sha256; k=rsa; "
+	  "p=MIICIjANBgkqhkiG9w0BAQEFAAOCAg8AMIICCgKCAgEAouPk5YPodxb41YBVY4xdeJGRCzUXSrVYUZc2ukE2HqIqWsivU7vPgBFlclBzMMJVdrt/NAt3NnulzWyQg6V+A8wSYkCNpevGlsp2TvkL8Mcuf1LVGfNScjycJ8nC8LhRgHZZJ876yM97mEK+J4X4k8X1/IWzwUSmOOAB3EpfuQLMVQL8KQh5gyAdvokbnmq+r9VqOyiFbZ03Jz"
+	  "yW+RPMTQxMu2kid+KH336/j5Tvza8ITN3vqZRVfZJjJzCJHvx4iKpWy2iOFxNThlUTbnZ93xFEA+36s+pU2hT22RGN8qzSQFBtIXKEqyNJ4KoJ/X53ukYc4ZSmpRAz/PhxX9eIgurUwKXrSwX5127+eCIanRT4aMYSobuue7IGlHixNI4dmZW4H0kMs5MwDItYzNQfmsv7HDjkfsRhBlFpV5LMES1g4L4rWQ85kKcQYfl60FyReCKrrBGi"
+	  "Fi9H8iEK5gDIgOFJ37qNa3yLolll31YdkhONsFyrOyGrEAcCzRHOa9jq9KEa5p8QyRekG75aGEfGlRMntkM1KAhdyjuyixle3I7SYywqtqJfjAButWJdvhuPf1jWmqzs97AoJZb2mYzgP/ur9sqHR8EBJ8HN9thRgf4QsyxpPTO9tOU+4GtT9YSVSGjXHQ0SnPDAj8YxjOql5RDalmiP91NmAeGUfCbLwUkCAwEAAQ==" )  ; ----- DKIM key mail for marcpartensky.com

config/postfix-accounts.cf

@@ -0,0 +1 @@
+marc@marcpartensky.com|{SHA512-CRYPT}$6$G1SLI/9La3kXrkrt$9MdkaLuUEoa2n8mVVZoCwmy0g6MrvlHDL0i2FVrUakAXi3pgPfo/HNz/mLWRFS6nG1oOeP8IMbTGM.JptPR../

data/conf/clamav/whitelist.ign2

@@ -0,0 +1,5 @@
+# Please restart ClamAV after changing signatures
+Example-Signature.Ignore-1
+PUA.Win.Trojan.EmbeddedPDF-1
+PUA.Pdf.Trojan.EmbeddedJavaScript-1
+PUA.Pdf.Trojan.OpenActionObjectwithJavascript-1

data/nginx/mc.conf

@@ -0,0 +1,16 @@
+server {
+	listen 25565;
+	server_name mc.marcpartensky.com;
+
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+	location / {
+		proxy_pass http://marcpartensky.com:7065;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/pihole.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name ialab.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/ialab.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/ialab.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://ialab;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/poiret.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name poiret.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/poiret.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/poiret.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://poiret:8000;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/vnc.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name vnc.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/vnc.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/vnc.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://vnc:6901;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/wordpress_alex.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name alex.wp.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/alex.wp.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/alex.wp.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://wordpress_alex;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

data/nginx/wordpress_marc.conf

@@ -0,0 +1,30 @@
+server {
+	listen 443 ssl http2;
+	server_name marc.wp.marcpartensky.com;
+
+	# ssl keys + letsencrypt
+	ssl_certificate /etc/letsencrypt/live/marc.wp.marcpartensky.com/fullchain.pem;
+	ssl_certificate_key /etc/letsencrypt/live/marc.wp.marcpartensky.com/privkey.pem;
+
+	include /etc/letsencrypt/options-ssl-nginx.conf;
+	ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
+
+	# logs
+	access_log /var/log/nginx/reverse-access.log;
+	error_log /var/log/nginx/reverse-error.log;
+
+
+	location /.well-known/acme-challenge/ {
+		allow all;
+		root /var/www/certbot;
+	}
+
+	location / {
+		proxy_pass http://wordpress_marc;
+		# proxy_redirect off;
+		proxy_set_header Host $host;
+		proxy_set_header X-Real-IP $remote_addr;
+		proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+		proxy_set_header X-Forwarded-Proto https;
+	}
+}

init-letsencrypt.sh

@@ -1,80 +0,0 @@
-#!/bin/bash
-
-if ! [ -x "$(command -v docker-compose)" ]; then
-  echo 'Error: docker-compose is not installed.' >&2
-  exit 1
-fi
-
-domains=(marcpartensky.com www.marcpartensky.com)
-rsa_key_size=4096
-data_path="./data/certbot"
-email="" # Adding a valid address is strongly recommended
-staging=0 # Set to 1 if you're testing your setup to avoid hitting request limits
-
-if [ -d "$data_path" ]; then
-  read -p "Existing data found for $domains. Continue and replace existing certificate? (y/N) " decision
-  if [ "$decision" != "Y" ] && [ "$decision" != "y" ]; then
-    exit
-  fi
-fi
-
-
-if [ ! -e "$data_path/conf/options-ssl-nginx.conf" ] || [ ! -e "$data_path/conf/ssl-dhparams.pem" ]; then
-  echo "### Downloading recommended TLS parameters ..."
-  mkdir -p "$data_path/conf"
-  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot-nginx/certbot_nginx/_internal/tls_configs/options-ssl-nginx.conf > "$data_path/conf/options-ssl-nginx.conf"
-  curl -s https://raw.githubusercontent.com/certbot/certbot/master/certbot/certbot/ssl-dhparams.pem > "$data_path/conf/ssl-dhparams.pem"
-  echo
-fi
-
-echo "### Creating dummy certificate for $domains ..."
-path="/etc/letsencrypt/live/$domains"
-mkdir -p "$data_path/conf/live/$domains"
-docker-compose run --rm --entrypoint "\
-  openssl req -x509 -nodes -newkey rsa:$rsa_key_size -days 1\
-    -keyout '$path/privkey.pem' \
-    -out '$path/fullchain.pem' \
-    -subj '/CN=localhost'" certbot
-echo
-
-
-echo "### Starting nginx ..."
-docker-compose up --force-recreate -d nginx
-echo
-
-echo "### Deleting dummy certificate for $domains ..."
-docker-compose run --rm --entrypoint "\
-  rm -Rf /etc/letsencrypt/live/$domains && \
-  rm -Rf /etc/letsencrypt/archive/$domains && \
-  rm -Rf /etc/letsencrypt/renewal/$domains.conf" certbot
-echo
-
-
-echo "### Requesting Let's Encrypt certificate for $domains ..."
-#Join $domains to -d args
-domain_args=""
-for domain in "${domains[@]}"; do
-  domain_args="$domain_args -d $domain"
-done
-
-# Select appropriate email arg
-case "$email" in
-  "") email_arg="--register-unsafely-without-email" ;;
-  *) email_arg="--email $email" ;;
-esac
-
-# Enable staging mode if needed
-if [ $staging != "0" ]; then staging_arg="--staging"; fi
-
-docker-compose run --rm --entrypoint "\
-  certbot certonly --webroot -w /var/www/certbot \
-    $staging_arg \
-    $email_arg \
-    $domain_args \
-    --rsa-key-size $rsa_key_size \
-    --agree-tos \
-    --force-renewal" certbot
-echo
-
-echo "### Reloading nginx ..."
-docker-compose exec nginx nginx -s reload