mj-saunders
/
epicyon
forked from indymedia/epicyon
1
0
Fork 0
Code Issues Pull Requests Releases Wiki Activity

Describe complete configuration

master
Bob Mottram 2019-08-29 12:52:42 +01:00
parent f213517de6
commit 81a86bb1b9
1 changed files with 94 additions and 5 deletions
Show Stats Download Patch File Download Diff File Expand all files Collapse all files

99
README.md
View File

@ -12,23 +12,23 @@ Includes emojis designed by [OpenMoji](https://openmoji.org) – the open-source
[Customizations](README_customizations.md) [Customizations](README_customizations.md)
## Install ## Package Dependencies
On Arch/Parabola: On Arch/Parabola:
``` bash ``` bash
sudo pacman -S tor python-pip python-pysocks python-pycryptodome python-beautifulsoup4 imagemagick python-pillow python-numpy python-dateutil sudo pacman -S tor python-pip python-pysocks python-pycryptodome python-beautifulsoup4 imagemagick python-pillow python-numpy python-dateutil certbot
sudo pip install commentjson sudo pip install commentjson
``` ```
Or on Debian: Or on Debian:
``` bash ``` bash
sudo apt-get -y install tor python3-pip python3-socks imagemagick python3-numpy python3-setuptools python3-crypto python3-dateutil python3-pil.imagetk sudo apt-get -y install tor python3-pip python3-socks imagemagick python3-numpy python3-setuptools python3-crypto python3-dateutil python3-pil.imagetk certbot
sudo pip3 install commentjson beautifulsoup4 pycryptodome sudo pip3 install commentjson beautifulsoup4 pycryptodome
``` ```
## Running the Server ## Installation
In the most common case you'll be using systemd to set up a daemon to run the server. In the most common case you'll be using systemd to set up a daemon to run the server.
@ -83,9 +83,98 @@ If it's not running then you can also look at the log:
journalctl -u epicyon journalctl -u epicyon
``` ```
You'll also need to set up a web server configuration. An Nginx example is as follows: You'll also need to set up a web server configuration. For Nginx edit */etc/nginx/sites-available/YOUR_DOMAIN* as follows:
``` nginx
server {
listen 80;
listen [::]:80;
server_name YOUR_DOMAIN;
root /var/www/YOUR_DOMAIN/htdocs;
access_log /dev/null;
error_log /dev/null;
client_max_body_size 20m;
client_body_buffer_size 128k;
limit_conn conn_limit_per_ip 10;
limit_req zone=req_limit_per_ip burst=10 nodelay;
index index.html;
rewrite ^ https://$server_name$request_uri? permanent;
}
server {
listen 443 ssl;
server_name YOUR_DOMAIN;
ssl_stapling off;
ssl_stapling_verify off;
ssl on;
ssl_certificate /etc/letsencrypt/live/YOUR_DOMAIN/fullchain.pem;
ssl_certificate_key /etc/letsencrypt/live/YOUR_DOMAIN/privkey.pem;
#ssl_dhparam /etc/ssl/certs/YOUR_DOMAIN.dhparam;
ssl_session_cache builtin:1000 shared:SSL:10m;
ssl_session_timeout 60m;
ssl_prefer_server_ciphers on;
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers 'ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA:ECDHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES256-SHA:ECDHE-ECDSA-DES-CBC3-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:DES-CBC3-SHA:!DSS';
add_header X-Frame-Options DENY;
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";
add_header Strict-Transport-Security max-age=15768000;
access_log /dev/null;
error_log /dev/null;
root /var/www/YOUR_DOMAIN/htdocs;
index index.html;
location / {
proxy_http_version 1.1;
client_max_body_size 11M;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $http_host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forward-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forward-Proto http;
proxy_set_header X-Nginx-Proxy true;
proxy_temp_file_write_size 64k;
proxy_connect_timeout 10080s;
proxy_send_timeout 10080;
proxy_read_timeout 10080;
proxy_buffer_size 64k;
proxy_buffers 16 32k;
proxy_busy_buffers_size 64k;
proxy_redirect off;
proxy_request_buffering off;
proxy_buffering off;
proxy_pass http://localhost:7156;
}
}
```
Changing your domain name as appropriate. Active the configuration with:
``` bash ``` bash
ln -s /etc/nginx/sites-available/YOUR_DOMAIN /etc/nginx/sites-enabled/
```
Generate a LetsEncrypt certificate.
``` bash
certbot certonly -n --server https://acme-v01.api.letsencrypt.org/directory --standalone -d YOUR_DOMAIN --renew-by-default --agree-tos --email YOUR_EMAIL
```
And restart the web server:
``` bash
systemctl restart nginx
``` ```
## Object Capabilities Security ## Object Capabilities Security