|
1 |
| -# Creating new system user for daemons and bots etc |
2 |
| - |
3 |
| -We use /opt/ for base home folder for system users, give it nologin as shell, etc |
4 |
| - |
5 |
| -```bash |
6 |
| -sudo useradd --shell /usr/sbin/nologin \ |
7 |
| - --system --user-group \ |
8 |
| - --create-home \ |
9 |
| - --comment "Service longname" \ |
10 |
| - --home-dir /opt/servicehomedir username |
11 |
| -``` |
12 |
| - |
13 |
| -# Getting shell as system user for admin to do thing as the user |
14 |
| - |
15 |
| -```bash |
16 |
| -sudo -Hu username /bin/bash -l |
17 |
| -``` |
18 |
| - |
19 |
| -Same can be used to run psql on postgres user directly |
20 |
| - |
21 |
| -```bash |
22 |
| -sudo -Hu postgres psql |
23 |
| -``` |
24 |
| - |
25 |
| -# Software installations |
26 |
| - |
27 |
| -We've used apt repositories where possible and rest is "directly on the host" installations, following given documentation per bot or automaton, provides update instructions too |
28 |
| - |
29 |
| -Links to most of them: |
30 |
| - |
31 |
| -* mautrix-bridges: <https://docs.mau.fi/bridges/index.html> |
32 |
| -* mx-puppet-discord: <https://github.com/matrix-discord/mx-puppet-discord> |
33 |
| -* appservice-slack: <https://matrix-appservice-slack.readthedocs.io/en/latest/getting_started/> |
34 |
| -* heisenbridge: <https://github.com/hifi/heisenbridge> |
35 |
| - |
36 |
| -# SSH related |
37 |
| - |
38 |
| -We allow only publickey auth and user needs to belong into `ssh-user` group in order to connect into server with SSH |
39 |
| - |
40 |
| -SSH server related settings resides in `/etc/ssh/sshd_config.d/` "confd" directory, edit settings in files under that dir and **not** directly `/etc/ssh/sshd_config` file. Same goes for possible client settings (ssh_config.d/). |
41 |
| - |
42 |
| -# DNS resolving |
43 |
| - |
44 |
| -We run Bind9/named as resolving DNS-server to provide credible DNSSEC resolving and OCSP-stapling. |
45 |
| - |
46 |
| -If you need to define DNS-server to some service, use `localhost` or it's IP-variations `127.0.0.1` and `::1`. |
| 1 | +# Creating new system user for daemons and bots etc |
| 2 | + |
| 3 | +We use /opt/ for base home folder for system users, give it nologin as shell, etc |
| 4 | + |
| 5 | +```bash |
| 6 | +sudo useradd --shell /usr/sbin/nologin \ |
| 7 | + --system --user-group \ |
| 8 | + --create-home \ |
| 9 | + --comment "Service longname" \ |
| 10 | + --home-dir /opt/servicehomedir username |
| 11 | +``` |
| 12 | + |
| 13 | +# Getting shell as system user for admin to do thing as the user |
| 14 | + |
| 15 | +```bash |
| 16 | +sudo -Hu username /bin/bash -l |
| 17 | +``` |
| 18 | + |
| 19 | +Same can be used to run psql on postgres user directly |
| 20 | + |
| 21 | +```bash |
| 22 | +sudo -Hu postgres psql |
| 23 | +``` |
| 24 | + |
| 25 | +# Software installations |
| 26 | + |
| 27 | +We've used apt repositories where possible and rest is "directly on the host" installations, following given documentation per bot or automaton, provides update instructions too |
| 28 | + |
| 29 | +Links to most of them: |
| 30 | + |
| 31 | +* mautrix-bridges: <https://docs.mau.fi/bridges/index.html> |
| 32 | +* mx-puppet-discord: <https://github.com/matrix-discord/mx-puppet-discord> |
| 33 | +* appservice-slack: <https://matrix-appservice-slack.readthedocs.io/en/latest/getting_started/> |
| 34 | +* heisenbridge: <https://github.com/hifi/heisenbridge> |
| 35 | + |
| 36 | +# SSH related |
| 37 | + |
| 38 | +We allow only publickey auth and user needs to belong into `ssh-user` group in order to connect into server with SSH |
| 39 | + |
| 40 | +SSH server related settings resides in `/etc/ssh/sshd_config.d/` "confd" directory, edit settings in files under that dir and **not** directly `/etc/ssh/sshd_config` file. Same goes for possible client settings (ssh_config.d/). |
| 41 | + |
| 42 | +# DNS resolving |
| 43 | + |
| 44 | +We run Bind9/named as resolving DNS-server to provide credible DNSSEC resolving and OCSP-stapling. |
| 45 | + |
| 46 | +If you need to define DNS-server to some service, use `localhost` or it's IP-variations `127.0.0.1` and `::1`. |
0 commit comments