Critique my setup, please
- 📧 Messages: 4
- 🗣️ Authors: 3
- 📅 First Message: 2020-09-12 20:01
- 📅 Last Message: 2020-09-13 02:18
1. Nathan Galt (mailinglists (a) ngalt.com)
- 📅 Sent: 2020-09-12 20:01
- 📧 Message 1 of 4
I?m setting up a capsule on a VPS served up with Molly Brown. I?d like to
get some feedback on what I should be doing, in case I?m doing something
egregiously wrong. The capsule isn?t intended to be permanent, at least
not yet, so I?m giving it the domain name of beepbeepbeep.example.
(It was only after I decided I should post this that I remembered that the
best way to get good advice on the Internet is to post bad advice?)
I wasn?t sure how to make/get certs, so I stumbled around and found this:
https://github.com/michael-lazar/jetforce#tls-certificates
And then there?s also
sudo certbot certonly --standalone
as shown on <https://certbot.eff.org/lets-encrypt/ubuntufocal-other>.
I?m waffling back and forth on whether I should stick everything in some
unprivileged user?s home directory (much like I do here) or if I should
put things in ?proper? places like /var/gemini. Opinions welcome. I do not
intend for humans other than me to be inside this server ever.
Without further ado, the commands I used just now:
- - - - - - - - - 8< - - - - - - - - -
#!/bin/bash
apt update
apt upgrade --yes
apt install --yes fish bat
ln -s /usr/bin/batcat /usr/local/bin/bat
mkdir /etc/skel/.ssh
cp ~/.ssh/authorized_keys /etc/skel/.ssh/
addgroup certview
# named after Gus Grissom, who named the Gemini 3 capsule ?Molly Brown?
adduser --shell /usr/bin/fish --disabled-password --gecos -- griss
usermod -aG certview griss
snap install --classic certbot
certbot certonly --standalone \
--non-interactive \
--agree-tos \
--domains "gemini.beepbeepbeep.example" \
--register-unsafely-without-email
chmod 0755 /etc/letsencrypt/{live,archive}
chmod g+r /etc/letsencrypt/archive/gemini.beepbeepbeep.example/privkey1.pem
chgrp certview /etc/letsencrypt/archive/gemini.beepbeepbeep.example/privkey1.pem
cat << 'EOF' > /etc/molly.conf
Hostname = "gemini.beepbeepbeep.example"
DefaultLang = "en-US"
DocBase = "/home/griss/public"
AccessLog = "/home/griss/access.log"
ErrorLog = "/home/griss/error.log"
CertPath = "/etc/letsencrypt/live/gemini.beepbeepbeep.example/fullchain.pem"
KeyPath = "/etc/letsencrypt/live/gemini.beepbeepbeep.example/privkey.pem"
[MimeOverrides]
"atom.xml$" = "application/atom+xml"
EOF
cat << 'EOF' > /etc/systemd/system/molly-brown.service
[Unit]
Description=Molly Brown gemini server
After=network.target
[Service]
Type=simple
Restart=on-failure
User=griss
ExecStart=/home/griss/go/bin/molly-brown
NoNewPrivileges=true
ProtectSystem=strict
ReadWritePaths=/home/griss/access.log /home/griss/error.log
[Install]
WantedBy=multi-user.target
EOF
systemctl enable molly-brown.service
# Much later?
systemctl start molly-brown.service
#######################################
# As griss?
wget https://golang.org/dl/go1.15.2.linux-amd64.tar.gz
tar xf go*
mv go go-dist
mkdir go
./go-dist/bin/go get tildegit.org/solderpunk/molly-brown
# openssl req -newkey rsa:2048 -nodes -keyout gemini.beepbeepbeep.example.key \
# -nodes -x509 -out gemini.beepbeepbeep.example.crt -subj
"/CN=gemini.beepbeepbeep.example"
mkdir public
printf "# It works!\n\nYour Gemini capsule is up and running.\n" > public/index.gmi
Link to individual message.
- 📅 Sent: 2020-09-12 23:54
- 📧 Message 2 of 4
Hello, welcome to Gemini!
I can't speak to your Molly Brown setup, as I don't use it,
but I can offer some advice for certificates. I've actually
written a whole post on how to generate nice Gemini certs
here:
gemini://makeworld.gq/gemlog/2020-07-06-openssl.gmi
The main difference from what you've done is that these certs
are valid for 5 years, so you'll change them less often, and
that they use EC keys, making the cert size (and therefore
request overhead) much smaller.
Cheers!
makeworld
Link to individual message.
3. Jansen Price (jansen.price (a) gmail.com)
- 📅 Sent: 2020-09-13 02:12
- 📧 Message 3 of 4
> ExecStart=/home/griss/go/bin/molly-brown
Do you need to make the execution of molly brown to include -c?
e.g. ExecStart=/home/griss/go/bin/molly-brown -c /etc/molly.conf
-------------- next part --------------
An HTML attachment was scrubbed...
URL: <https://lists.orbitalfox.eu/archives/gemini/attachments/20200912/f7b8
abae/attachment.htm>
Link to individual message.
4. Nathan Galt (mailinglists (a) ngalt.com)
- 📅 Sent: 2020-09-13 02:18
- 📧 Message 4 of 4
> On Sep 12, 2020, at 7:12 PM, Jansen Price <jansen.price at gmail.com> wrote:
>
> > ExecStart=/home/griss/go/bin/molly-brown
>
> Do you need to make the execution of molly brown to include -c?
> e.g. ExecStart=/home/griss/go/bin/molly-brown -c /etc/molly.conf
-c overrides the default of /etc/molly.conf.
Link to individual message.
---
Previous Thread: HTML as an escape hatch
Next Thread: MacOS Gemini Client