2024-10-31 20:18:37 +01:00
<!DOCTYPE html> < html lang = "fr" >
< head > < meta charset = "utf-8" >
< meta http-equiv = "X-UA-Compatible" content = "IE=edge" >
< meta name = "viewport" content = "width=device-width, initial-scale=1, user-scalable=no" > < title > vps785909 debian 10 - audio - wireguard - rnmkcy.eu (INACTIF) - YannStatic< / title >
< meta name = "description" content = "OVH vps785909 (1 vCore/2GoRam/20GoSSD) Debian Buster" >
< link rel = "canonical" href = "https://static.rnmkcy.eu/2020/10/11/ovh-vps785909_debian_10_rnmkcy.eu.html" > < link rel = "alternate" type = "application/rss+xml" title = "YannStatic" href = "/feed.xml" >
<!-- - include head/favicon.html - -->
< link rel = "shortcut icon" type = "image/png" href = "/assets/favicon/favicon.png" > < link rel = "stylesheet" href = "/assets/css/main.css" > < link rel = "stylesheet" href = "https://use.fontawesome.com/releases/v5.0.13/css/all.css" > <!-- start custom head snippets --> < link rel = "stylesheet" href = "/assets/css/expand.css" >
<!-- end custom head snippets --> < script > ( f u n c t i o n ( ) {
window.isArray = function(val) {
return Object.prototype.toString.call(val) === '[object Array]';
};
window.isString = function(val) {
return typeof val === 'string';
};
window.hasEvent = function(event) {
return 'on'.concat(event) in window.document;
};
window.isOverallScroller = function(node) {
return node === document.documentElement || node === document.body || node === window;
};
window.isFormElement = function(node) {
var tagName = node.tagName;
return tagName === 'INPUT' || tagName === 'SELECT' || tagName === 'TEXTAREA';
};
window.pageLoad = (function () {
var loaded = false, cbs = [];
window.addEventListener('load', function () {
var i;
loaded = true;
if (cbs.length > 0) {
for (i = 0; i < cbs.length ; i + + ) {
cbs[i]();
}
}
});
return {
then: function(cb) {
cb & & (loaded ? cb() : (cbs.push(cb)));
}
};
})();
})();
(function() {
window.throttle = function(func, wait) {
var args, result, thisArg, timeoutId, lastCalled = 0;
function trailingCall() {
lastCalled = new Date;
timeoutId = null;
result = func.apply(thisArg, args);
}
return function() {
var now = new Date,
remaining = wait - (now - lastCalled);
args = arguments;
thisArg = this;
if (remaining < = 0) {
clearTimeout(timeoutId);
timeoutId = null;
lastCalled = now;
result = func.apply(thisArg, args);
} else if (!timeoutId) {
timeoutId = setTimeout(trailingCall, remaining);
}
return result;
};
};
})();
(function() {
var Set = (function() {
var add = function(item) {
var i, data = this._data;
for (i = 0; i < data.length ; i + + ) {
if (data[i] === item) {
return;
}
}
this.size ++;
data.push(item);
return data;
};
var Set = function(data) {
this.size = 0;
this._data = [];
var i;
if (data.length > 0) {
for (i = 0; i < data.length ; i + + ) {
add.call(this, data[i]);
}
}
};
Set.prototype.add = add;
Set.prototype.get = function(index) { return this._data[index]; };
Set.prototype.has = function(item) {
var i, data = this._data;
for (i = 0; i < data.length ; i + + ) {
if (this.get(i) === item) {
return true;
}
}
return false;
};
Set.prototype.is = function(map) {
if (map._data.length !== this._data.length) { return false; }
var i, j, flag, tData = this._data, mData = map._data;
for (i = 0; i < tData.length ; i + + ) {
for (flag = false, j = 0; j < mData.length ; j + + ) {
if (tData[i] === mData[j]) {
flag = true;
break;
}
}
if (!flag) { return false; }
}
return true;
};
Set.prototype.values = function() {
return this._data;
};
return Set;
})();
window.Lazyload = (function(doc) {
var queue = {js: [], css: []}, sources = {js: {}, css: {}}, context = this;
var createNode = function(name, attrs) {
var node = doc.createElement(name), attr;
for (attr in attrs) {
if (attrs.hasOwnProperty(attr)) {
node.setAttribute(attr, attrs[attr]);
}
}
return node;
};
var end = function(type, url) {
var s, q, qi, cbs, i, j, cur, val, flag;
if (type === 'js' || type ==='css') {
s = sources[type], q = queue[type];
s[url] = true;
for (i = 0; i < q.length ; i + + ) {
cur = q[i];
if (cur.urls.has(url)) {
qi = cur, val = qi.urls.values();
qi & & (cbs = qi.callbacks);
for (flag = true, j = 0; j < val.length ; j + + ) {
cur = val[j];
if (!s[cur]) {
flag = false;
}
}
if (flag & & cbs & & cbs.length > 0) {
for (j = 0; j < cbs.length ; j + + ) {
cbs[j].call(context);
}
qi.load = true;
}
}
}
}
};
var load = function(type, urls, callback) {
var s, q, qi, node, i, cur,
_urls = typeof urls === 'string' ? new Set([urls]) : new Set(urls), val, url;
if (type === 'js' || type ==='css') {
s = sources[type], q = queue[type];
for (i = 0; i < q.length ; i + + ) {
cur = q[i];
if (_urls.is(cur.urls)) {
qi = cur;
break;
}
}
val = _urls.values();
if (qi) {
callback & & (qi.load || qi.callbacks.push(callback));
callback & & (qi.load & & callback());
} else {
q.push({
urls: _urls,
callbacks: callback ? [callback] : [],
load: false
});
for (i = 0; i < val.length ; i + + ) {
node = null, url = val[i];
if (s[url] === undefined) {
(type === 'js' ) & & (node = createNode('script', { src: url }));
(type === 'css') & & (node = createNode('link', { rel: 'stylesheet', href: url }));
if (node) {
node.onload = (function(type, url) {
return function() {
end(type, url);
};
})(type, url);
(doc.head || doc.body).appendChild(node);
s[url] = false;
}
}
}
}
}
};
return {
js: function(url, callback) {
load('js', url, callback);
},
css: function(url, callback) {
load('css', url, callback);
}
};
})(this.document);
})();
< / script > < script >
(function() {
var TEXT_VARIABLES = {
version: '2.2.6',
sources: {
font_awesome: 'https://use.fontawesome.com/releases/v5.0.13/css/all.css',
jquery: '/assets/js/jquery.min.js',
leancloud_js_sdk: '//cdn.jsdelivr.net/npm/leancloud-storage@3.13.2/dist/av-min.js',
chart: 'https://cdn.bootcss.com/Chart.js/2.7.2/Chart.bundle.min.js',
gitalk: {
js: 'https://cdn.bootcss.com/gitalk/1.2.2/gitalk.min.js',
css: 'https://cdn.bootcss.com/gitalk/1.2.2/gitalk.min.css'
},
valine: 'https://unpkg.com/valine/dist/Valine.min.js'
},
site: {
toc: {
selectors: 'h1,h2,h3'
}
},
paths: {
search_js: '/assets/search.js'
}
};
window.TEXT_VARIABLES = TEXT_VARIABLES;
})();
< / script >
< / head >
< body >
< div class = "root" data-is-touch = "false" >
< div class = "layout--page js-page-root" > <!-- --> < div class = "page__main js-page-main page__viewport hide-footer has-aside has-aside cell cell--auto" >
< div class = "page__main-inner" > < div class = "page__header d-print-none" > < header class = "header" > < div class = "main" >
< div class = "header__title" >
< div class = "header__brand" > < svg id = "svg" version = "1.1" xmlns = "http://www.w3.org/2000/svg" xmlns:xlink = "http://www.w3.org/1999/xlink" width = "400" height = "478.9473684210526" viewBox = "0, 0, 400,478.9473684210526" > < g id = "svgg" > < path id = "path0" d = "M308.400 56 . 805 C 306 . 970 56 . 966 , 303 . 280 57 . 385 , 300 . 200 57 . 738 C 290 . 906 58 . 803 , 278 . 299 59 . 676 , 269 . 200 59 . 887 L 260 . 600 60 . 085 259 . 400 61 . 171 C 258 . 010 62 . 428 , 256 . 198 63 . 600 , 255 . 645 63 . 600 C 255 . 070 63 . 600 , 252 . 887 65 . 897 , 252 . 598 66 . 806 C 252 . 460 67 . 243 , 252 . 206 67 . 600 , 252 . 034 67 . 600 C 251 . 397 67 . 600 , 247 . 206 71 . 509 , 247 . 202 72 . 107 C 247 . 201 72 . 275 , 246 . 390 73 . 190 , 245 . 400 74 . 138 C 243 . 961 75 . 517 , 243 . 598 76 . 137 , 243 . 592 77 . 231 C 243 . 579 79 . 293 , 241 . 785 83 . 966 , 240 . 470 85 . 364 C 239 . 176 86 . 740 , 238 . 522 88 . 365 , 237 . 991 91 . 521 C 237 . 631 93 . 665 , 236 . 114 97 . 200 , 235 . 554 97 . 200 C 234 . 938 97 . 200 , 232 . 737 102 . 354 , 232 . 450 104 . 472 C 232 . 158 106 . 625 , 230 . 879 109 . 226 , 229 . 535 110 . 400 C 228 . 933 110 . 926 , 228 . 171 113 . 162 , 226 . 434 119 . 500 C 226 . 178 120 . 435 , 225 . 795 121 . 200 , 225 . 584 121 . 200 C 225 . 373 121 . 200 , 225 . 200 121 . 476 , 225 . 200 121 . 813 C 225 . 200 122 . 149 , 224 . 885 122 . 541 , 224 . 500 122 . 683 C 223 . 606 123 . 013 , 223 . 214 123 . 593 , 223 . 204 124 . 600 C 223 . 183 126 . 555 , 220 . 763 132 . 911 , 219 . 410 134 . 562 C 218 . 443 135 . 742 , 217 . 876 136 . 956 , 217 . 599 138 . 440 C 217 . 041 141 . 424 , 215 . 177 146 . 434 , 214 . 532 146 . 681 C 214 . 240 146 . 794 , 214 . 000 147 . 055 , 214 . 000 147 . 261 C 214 . 000 147 . 467 , 213 . 550 148 . 086 , 213 . 000 148 . 636 C 212 . 450 149 . 186 , 212 . 000 149 . 893 , 212 . 000 150 . 208 C 212 . 000 151 . 386 , 208 . 441 154 . 450 , 207 . 597 153 . 998 C 206 . 319 153 . 315 , 204 . 913 150 . 379 , 204 . 633 147 . 811 C 204 . 365 145 . 357 , 202 . 848 142 . 147 , 201 . 759 141 . 729 C 200 . 967 141 . 425 , 199 . 200 137 . 451 , 199 . 200 135 . 974 C 199 . 200 134 . 629 , 198 . 435 133 . 224 , 196 . 660 131 . 311 C 195 . 363 129 . 913 , 194 . 572 128 . 123 , 193 . 870 125 . 000 C 193 . 623 123 . 900 , 193 . 236 122 . 793 , 193 . 010 122 . 540 C 190 . 863 120 . 133 , 190 . 147 118 . 880 , 188 . 978 115 . 481 C 188 . 100 112 . 928 , 187 . 151 111 . 003 , 186 . 254 109 . 955 C 185 . 358 108 . 908 , 184 . 518 107 . 204 , 183 . 847 105 . 073 C 183 . 280 103 . 273 , 182 . 497 101 . 329 , 182 . 108 100 . 753 C 181 . 719 100 . 177 , 180 . 904 98 . 997 , 180 . 298 98 . 131 C 179 . 693 97 . 265 , 178 . 939 95 . 576 , 178 . 624 94 . 378 C 178 . 041 92 . 159 , 177 . 125 90 . 326 , 175 . 023 87 . 168 C 174 . 375 86 . 196 , 173 . 619 84 . 539 , 173 . 342 83 . 486 C 172 . 800 81 . 429 , 171 . 529 79 . 567 , 170 . 131 78 . 785 C 169 . 654 78 . 517 , 168 . 697 77 . 511 , 168 . 006 76 . 549 C 167 . 316 75 . 587 , 166 . 594 74 . 800 , 166 . 402 74 . 800 C 166 . 210 74 . 800 , 164 . 869 73 . 633 , 163 . 421 72 . 206 C 160 . 103 68 . 936 , 161 . 107 69 . 109 , 146 . 550 69 . 301 C 133 . 437 69 . 474 , 128 . 581 70 . 162 , 126 . 618 72 . 124 C 126 . 248 72 . 495 , 125 . 462 72 . 904 , 124 . 872 73 . 033 C 124 . 282 73 . 163 , 123 . 088 73 . 536 , 122 . 219 73 . 863 C 121 . 349 74 . 191 , 119 . 028 74 . 638 , 117 . 061 74 . 858 C 113 . 514 75 . 254 , 109 . 970 76 . 350 , 108 . 782 77 . 419 C 107 . 652 78 . 436 , 100 . 146 80 . 400 , 97 . 388 80 . 400 C 95 . 775 80 . 400 , 93 . 167 81 . 360 , 91 . 200 82 . 679 C 90 . 430 83 . 195 , 89 . 113 83 . 804 , 88 . 274 84 . 031 C 85 . 875 84 . 681 , 78 . 799 90 . 910 , 74 . 400 96 . 243 L 73 . 400 97 . 456 73 . 455 106 . 028 C 73 . 526 117 . 055 , 74 . 527 121 . 238 , 77 . 820 124 . 263 C 78 . 919 125 . 273 , 80 . 400 127 . 902 , 80 . 400 128 . 842 C 80 . 400 129 . 202 , 81 . 075 130 . 256 , 81 . 900 131 . 186 C 83 . 563 133 . 059 , 85 . 497 136 . 346 , 86 . 039 138 . 216 C 86 . 233 138 . 886 , 87 . 203 140 . 207 , 88 . 196 141 . 153 C 89 . 188 142 . 098 , 90 . 000 143 . 104 , 90 . 000 143 . 388 C 90 . 000 144 . 337 , 92 . 129 148 . 594 , 92 . 869 149 . 123 C 93 . 271 149 . 410 , 93 . 600 149 . 831 , 93 . 600 150 . 059 C 93 . 600 150 . 286 , 93 . 932 150 . 771 , 94 . 337 151 . 136 C 94 . 743 151 . 501 , 95 . 598 153 . 004 , 96 . 237 154 . 475 C 96 . 877 155 . 947 , 97 . 760 157 . 351 , 98 . 200 157 . 596 C 98 . 640 157 . 841 , 99 . 900 159 . 943 , 101 . 000 162 . 267 C 102 . 207 164 . 817 , 103 . 327 166 . 644 , 103 . 825 166 . 876 C 104 . 278 167 . 087 , 105 . 065 168 . 101 , 105 . 573 169 . 130 C 107 . 658 173 . 348 , 108 . 097 174 . 093 , 110 . 006 176 . 647 C 111 . 103 178 . 114 , 112 . 000 179 . 725 , 112 . 000 180 . 227 C 112 . 000 181 . 048 , 113 . 425 183 . 163 , 114 . 678 184 . 200 C 115 . 295 184 . 711 , 117 . 396 188 . 733 , 117 . 720 190 . 022 C 117 . 855 190 . 562 , 118 . 603 191 . 633 , 119 . 381 192 . 402 C 120 . 160 193 . 171 , 121 . 496 195 . 258 , 122 . 351 197 . 039 C 123 . 206 198 . 820 , 124 . 167 200 . 378 , 124 . 487 200 . 501 C 124 . 807 200 . 624 , 125 . 953 202 . 496 , 127 . 034 204 . 662 C 128 . 114 206 . 828 , 129 . 676 209 . 299 , 130 . 505 210 . 153 C 131 . 333 211 . 007 , 132 . 124 212 . 177 , 132 . 262 212 . 753 C 132 . 618 214 . 239 , 134 . 291 217 . 048 , 136 . 288 219 . 5
" href="/">YannStatic< / a > < / div > <!-- <button class="button button - - secondary button - - circle search - button js - search - toggle"><i class="fas fa - search"></i></button> --> <!-- <li><button class="button button - - secondary button - - circle search - button js - search - toggle"><i class="fas fa - search"></i></button></li> -->
<!-- Champ de recherche -->
< div id = "searchbox" class = "search search--dark" style = "visibility: visible" >
< div class = "main" >
< div class = "search__header" > < / div >
< div class = "search-bar" >
< div class = "search-box js-search-box" >
< div class = "search-box__icon-search" > < i class = "fas fa-search" > < / i > < / div >
< input id = "search-input" type = "text" / >
<!-- <div class="search - box__icon - clear js - icon - clear">
< a > < i class = "fas fa-times" > < / i > < / a >
< / div > -->
< / div >
< / div >
< / div >
< / div >
<!-- Script pointing to search - script.js -->
< script > / * !
* Simple-Jekyll-Search
* Copyright 2015-2020, Christian Fei
* Licensed under the MIT License.
*/
(function(){
'use strict'
var _$Templater_7 = {
compile: compile,
setOptions: setOptions
}
const options = {}
options.pattern = /\{(.*?)\}/g
options.template = ''
options.middleware = function () {}
function setOptions (_options) {
options.pattern = _options.pattern || options.pattern
options.template = _options.template || options.template
if (typeof _options.middleware === 'function') {
options.middleware = _options.middleware
}
}
function compile (data) {
return options.template.replace(options.pattern, function (match, prop) {
const value = options.middleware(prop, data[prop], options.template)
if (typeof value !== 'undefined') {
return value
}
return data[prop] || match
})
}
'use strict';
function fuzzysearch (needle, haystack) {
var tlen = haystack.length;
var qlen = needle.length;
if (qlen > tlen) {
return false;
}
if (qlen === tlen) {
return needle === haystack;
}
outer: for (var i = 0, j = 0; i < qlen ; i + + ) {
var nch = needle.charCodeAt(i);
while (j < tlen ) {
if (haystack.charCodeAt(j++) === nch) {
continue outer;
}
}
return false;
}
return true;
}
var _$fuzzysearch_1 = fuzzysearch;
'use strict'
/* removed: const _$fuzzysearch_1 = require('fuzzysearch') */;
var _$FuzzySearchStrategy_5 = new FuzzySearchStrategy()
function FuzzySearchStrategy () {
this.matches = function (string, crit) {
return _$fuzzysearch_1(crit.toLowerCase(), string.toLowerCase())
}
}
'use strict'
var _$LiteralSearchStrategy_6 = new LiteralSearchStrategy()
function LiteralSearchStrategy () {
this.matches = function (str, crit) {
if (!str) return false
str = str.trim().toLowerCase()
crit = crit.trim().toLowerCase()
return crit.split(' ').filter(function (word) {
return str.indexOf(word) >= 0
}).length === crit.split(' ').length
}
}
'use strict'
var _$Repository_4 = {
put: put,
clear: clear,
search: search,
setOptions: __setOptions_4
}
/* removed: const _$FuzzySearchStrategy_5 = require('./SearchStrategies/FuzzySearchStrategy') */;
/* removed: const _$LiteralSearchStrategy_6 = require('./SearchStrategies/LiteralSearchStrategy') */;
function NoSort () {
return 0
}
const data = []
let opt = {}
opt.fuzzy = false
opt.limit = 10
opt.searchStrategy = opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
opt.sort = NoSort
opt.exclude = []
function put (data) {
if (isObject(data)) {
return addObject(data)
}
if (isArray(data)) {
return addArray(data)
}
return undefined
}
function clear () {
data.length = 0
return data
}
function isObject (obj) {
return Boolean(obj) & & Object.prototype.toString.call(obj) === '[object Object]'
}
function isArray (obj) {
return Boolean(obj) & & Object.prototype.toString.call(obj) === '[object Array]'
}
function addObject (_data) {
data.push(_data)
return data
}
function addArray (_data) {
const added = []
clear()
for (let i = 0, len = _data.length; i < len ; i + + ) {
if (isObject(_data[i])) {
added.push(addObject(_data[i]))
}
}
return added
}
function search (crit) {
if (!crit) {
return []
}
return findMatches(data, crit, opt.searchStrategy, opt).sort(opt.sort)
}
function __setOptions_4 (_opt) {
opt = _opt || {}
opt.fuzzy = _opt.fuzzy || false
opt.limit = _opt.limit || 10
opt.searchStrategy = _opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
opt.sort = _opt.sort || NoSort
opt.exclude = _opt.exclude || []
}
function findMatches (data, crit, strategy, opt) {
const matches = []
for (let i = 0; i < data.length & & matches . length < opt . limit ; i + + ) {
const match = findMatchesInObject(data[i], crit, strategy, opt)
if (match) {
matches.push(match)
}
}
return matches
}
function findMatchesInObject (obj, crit, strategy, opt) {
for (const key in obj) {
if (!isExcluded(obj[key], opt.exclude) & & strategy.matches(obj[key], crit)) {
return obj
}
}
}
function isExcluded (term, excludedTerms) {
for (let i = 0, len = excludedTerms.length; i < len ; i + + ) {
const excludedTerm = excludedTerms[i]
if (new RegExp(excludedTerm).test(term)) {
return true
}
}
return false
}
/* globals ActiveXObject:false */
'use strict'
var _$JSONLoader_2 = {
load: load
}
function load (location, callback) {
const xhr = getXHR()
xhr.open('GET', location, true)
xhr.onreadystatechange = createStateChangeListener(xhr, callback)
xhr.send()
}
function createStateChangeListener (xhr, callback) {
return function () {
if (xhr.readyState === 4 & & xhr.status === 200) {
try {
callback(null, JSON.parse(xhr.responseText))
} catch (err) {
callback(err, null)
}
}
}
}
function getXHR () {
return window.XMLHttpRequest ? new window.XMLHttpRequest() : new ActiveXObject('Microsoft.XMLHTTP')
}
'use strict'
var _$OptionsValidator_3 = function OptionsValidator (params) {
if (!validateParams(params)) {
throw new Error('-- OptionsValidator: required options missing')
}
if (!(this instanceof OptionsValidator)) {
return new OptionsValidator(params)
}
const requiredOptions = params.required
this.getRequiredOptions = function () {
return requiredOptions
}
this.validate = function (parameters) {
const errors = []
requiredOptions.forEach(function (requiredOptionName) {
if (typeof parameters[requiredOptionName] === 'undefined') {
errors.push(requiredOptionName)
}
})
return errors
}
function validateParams (params) {
if (!params) {
return false
}
return typeof params.required !== 'undefined' & & params.required instanceof Array
}
}
'use strict'
var _$utils_9 = {
merge: merge,
isJSON: isJSON
}
function merge (defaultParams, mergeParams) {
const mergedOptions = {}
for (const option in defaultParams) {
mergedOptions[option] = defaultParams[option]
if (typeof mergeParams[option] !== 'undefined') {
mergedOptions[option] = mergeParams[option]
}
}
return mergedOptions
}
function isJSON (json) {
try {
if (json instanceof Object & & JSON.parse(JSON.stringify(json))) {
return true
}
return false
} catch (err) {
return false
}
}
var _$src_8 = {};
(function (window) {
'use strict'
let options = {
searchInput: null,
resultsContainer: null,
json: [],
success: Function.prototype,
searchResultTemplate: '< li > < a href = "{url}" title = "{desc}" > {title}< / a > < / li > ',
templateMiddleware: Function.prototype,
sortMiddleware: function () {
return 0
},
noResultsText: 'No results found',
limit: 10,
fuzzy: false,
debounceTime: null,
exclude: []
}
let debounceTimerHandle
const debounce = function (func, delayMillis) {
if (delayMillis) {
clearTimeout(debounceTimerHandle)
debounceTimerHandle = setTimeout(func, delayMillis)
} else {
func.call()
}
}
const requiredOptions = ['searchInput', 'resultsContainer', 'json']
/* removed: const _$Templater_7 = require('./Templater') */;
/* removed: const _$Repository_4 = require('./Repository') */;
/* removed: const _$JSONLoader_2 = require('./JSONLoader') */;
const optionsValidator = _$OptionsValidator_3({
required: requiredOptions
})
/* removed: const _$utils_9 = require('./utils') */;
window.SimpleJekyllSearch = function (_options) {
const errors = optionsValidator.validate(_options)
if (errors.length > 0) {
throwError('You must specify the following required options: ' + requiredOptions)
}
options = _$utils_9.merge(options, _options)
_$Templater_7.setOptions({
template: options.searchResultTemplate,
middleware: options.templateMiddleware
})
_$Repository_4.setOptions({
fuzzy: options.fuzzy,
limit: options.limit,
sort: options.sortMiddleware,
exclude: options.exclude
})
if (_$utils_9.isJSON(options.json)) {
initWithJSON(options.json)
} else {
initWithURL(options.json)
}
const rv = {
search: search
}
typeof options.success === 'function' & & options.success.call(rv)
return rv
}
function initWithJSON (json) {
_$Repository_4.put(json)
registerInput()
}
function initWithURL (url) {
_$JSONLoader_2.load(url, function (err, json) {
if (err) {
throwError('failed to get JSON (' + url + ')')
}
initWithJSON(json)
})
}
function emptyResultsContainer () {
options.resultsContainer.innerHTML = ''
}
function appendToResultsContainer (text) {
options.resultsContainer.innerHTML += text
}
function registerInput () {
options.searchInput.addEventListener('input', function (e) {
if (isWhitelistedKey(e.which)) {
emptyResultsContainer()
debounce(function () { search(e.target.value) }, options.debounceTime)
}
})
}
function search (query) {
if (isValidQuery(query)) {
emptyResultsContainer()
render(_$Repository_4.search(query), query)
}
}
function render (results, query) {
const len = results.length
if (len === 0) {
return appendToResultsContainer(options.noResultsText)
}
for (let i = 0; i < len ; i + + ) {
results[i].query = query
appendToResultsContainer(_$Templater_7.compile(results[i]))
}
}
function isValidQuery (query) {
return query & & query.length > 0
}
function isWhitelistedKey (key) {
return [13, 16, 20, 37, 38, 39, 40, 91].indexOf(key) === -1
}
function throwError (message) {
throw new Error('SimpleJekyllSearch --- ' + message)
}
})(window)
}());
< / script >
<!-- Configuration -->
< script >
SimpleJekyllSearch({
searchInput: document.getElementById('search-input'),
resultsContainer: document.getElementById('results-container'),
json: '/search.json',
//searchResultTemplate: '< li > < a href = "https://static.rnmkcy.eu{url}" > {date} {title}< / a > < / li > '
searchResultTemplate: '< li > < a href = "{url}" > {date} {title}< / a > < / li > '
})
< / script >
<!-- Fin déclaration champ de recherche --> < / div > < nav class = "navigation" >
2024-11-28 11:42:23 +01:00
< ul > < li class = "navigation__item" > < a href = "/archive.html" > Etiquettes< / a > < / li > < li class = "navigation__item" > < a href = "/htmldoc.html" > Documents< / a > < / li > < li class = "navigation__item" > < a href = "/liens_ttrss.html" > Liens< / a > < / li > < li class = "navigation__item" > < a href = "/syntaxe-markdown.html" > Aide< / a > < / li > < / ul >
2024-10-31 20:18:37 +01:00
< / nav > < / div >
< / header >
< / div > < div class = "page__content" > < div class = "main" > < div class = "grid grid--reverse" >
< div class = "col-main cell cell--auto" > <!-- start custom main top snippet --> < div id = "results-container" class = "search-result js-search-result" > < / div > <!-- end custom main top snippet -->
< article itemscope itemtype = "http://schema.org/Article" > < div class = "article__header" > < header > < h1 style = "color:Tomato;" > vps785909 debian 10 - audio - wireguard - rnmkcy.eu (INACTIF)< / h1 > < / header > < / div > < meta itemprop = "headline" content = "vps785909 debian 10 - audio - wireguard - rnmkcy.eu (INACTIF)" > < div class = "article__info clearfix" > < ul class = "left-col menu" > < li >
2024-11-08 14:10:33 +01:00
< a class = "button button--secondary button--pill button--sm" style = "color:#00FFFF" href = "/archive.html?tag=vps" > vps< / a >
2024-10-31 20:18:37 +01:00
< / li > < li >
2024-11-08 14:10:33 +01:00
< a class = "button button--secondary button--pill button--sm" style = "color:#00FFFF" href = "/archive.html?tag=serveur" > serveur< / a >
2024-10-31 20:18:37 +01:00
< / li > < / ul > < ul class = "right-col menu" > < li >
< i class = "far fa-calendar-alt" > < / i > < span title = "Création" style = "color:#FF00FF" > 11 oct. 2020< / span >
< span title = "Modification" style = "color:#00FF7F" > 21 oct. 2020< / span > < / li > < / ul > < / div > < meta itemprop = "datePublished" content = "2020-10-21T00:00:00+02:00" >
< meta itemprop = "keywords" content = "vps,serveur" > < div class = "js-article-content" >
< div class = "layout--article" > <!-- start custom article top snippet -->
< style >
#myBtn {
display: none;
position: fixed;
bottom: 10px;
right: 10px;
z-index: 99;
font-size: 12px;
font-weight: bold;
border: none;
outline: none;
background-color: white;
color: black;
cursor: pointer;
padding: 5px;
border-radius: 4px;
}
#myBtn:hover {
background-color: #555;
}
< / style >
< button onclick = "topFunction()" id = "myBtn" title = "Haut de page" > ⇧ < / button >
< script >
//Get the button
var mybutton = document.getElementById("myBtn");
// When the user scrolls down 20px from the top of the document, show the button
window.onscroll = function() {scrollFunction()};
function scrollFunction() {
if (document.body.scrollTop > 20 || document.documentElement.scrollTop > 20) {
mybutton.style.display = "block";
} else {
mybutton.style.display = "none";
}
}
// When the user clicks on the button, scroll to the top of the document
function topFunction() {
document.body.scrollTop = 0;
document.documentElement.scrollTop = 0;
}
< / script >
<!-- end custom article top snippet -->
< div class = "article__content" itemprop = "articleBody" > < details >
< summary > < b > Afficher/cacher Sommaire< / b > < / summary >
<!-- affichage sommaire -->
< div class = "toc-aside js-toc-root" > < / div >
< / details > < p > < em > OVH vps785909 (1 vCore/2GoRam/20GoSSD) Debian Buster< / em > < / p >
< h1 id = "--serveur-vps785909" > < img src = "/images/logo-ovh-horizontal-blue.png" alt = "OVH" width = "80" / > Serveur vps785909< / h1 >
< h2 id = "-debian-10" > < img src = "/images/debian-buster-logo1.png" alt = "Debian Buster" width = "100" / > Debian 10< / h2 >
< p > PARAMETRES D’ < br / >
L’ < br / >
L’ < / p >
< p > Le nom du VPS est : vps785909.ovh.net< br / >
Connexion SSH en “root” ( jHeW45mA )< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ssh root@54.37.13.57
< / code > < / pre > < / div > < / div >
< h3 id = "installer-noyau-56" > Installer noyau 5.6+< / h3 >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > echo "deb http://deb.debian.org/debian/ unstable main" | sudo tee /etc/apt/sources.list.d/unstable-wireguard.list
printf 'Package: *\nPin: release a=unstable\nPin-Priority: 90\n' | sudo tee /etc/apt/preferences.d/limit-unstable
apt update & & apt upgrade
< / code > < / pre > < / div > < / div >
< p > Rechercher l’ < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > apt search linux-image-5
apt install linux-image-5.8.0-2-cloud-amd64
< / code > < / pre > < / div > < / div >
< h3 id = "-réseau" > < img src = "/images/ipv6-ipv4-logo.png" alt = "ipv6-ipv4" width = "80" / > Réseau< / h3 >
< p > Créer un bash pour désactiver l’ < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > nano initres.sh
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > #!/bin/bash
#
# To disable cloud-init's network configuration capabilities, write a file
# /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg with the following:
# network: {config: disabled}
#
#Création du fichier **/etc/cloud/cloud.cfg.d/99-disable-network-config.cfg** en mode su
echo "network: {config: disabled}" > /etc/cloud/cloud.cfg.d/99-disable-network-config.cfg
#
# Effacerle fichier /etc/network/interfaces
rm /etc/network/interfaces
# Recréer le fichier /etc/network/interfaces
cat > /etc/network/interfaces < < EOF
auto lo
iface lo inet loopback
auto eth0
iface eth0 inet dhcp
iface eth0 inet6 static
address 2001:41d0:401:3200:0:0:0:d48
netmask 128
post-up /sbin/ip -6 route add 2001:41d0:0401:3200:0000:0000:0000:0001 dev eth0
post-up /sbin/ip -6 route add default via 2001:41d0:0401:3200:0000:0000:0000:0001 dev eth0
pre-down /sbin/ip -6 route del default via 2001:41d0:0401:3200:0000:0000:0000:0001 dev eth0
pre-down /sbin/ip -6 route del 2001:41d0:0401:3200:0000:0000:0000:0001 dev eth0
EOF
#
# Configuration OVH à modifier /etc/cloud/cloud.cfg
sed -i 's/preserve_hostname: false/preserve_hostname: true/g' /etc/cloud/cloud.cfg
sed -i 's/manage_etc_hosts: true/manage_etc_hosts: false/g' /etc/cloud/cloud.cfg
#
# Redémarrage de la machine
systemctl reboot
< / code > < / pre > < / div > < / div >
< p > Droits et exécution< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > chmod +x initres.sh & & ./initres.sh
< / code > < / pre > < / div > < / div >
< p > Patienter quelques minutes avant la reconnexion…< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > 54.37.13.57
2001:41d0:401:3200:0:0:0:d48
2001:41d0:0401:3200:0000:0000:0000:0001
< / code > < / pre > < / div > < / div >
< p > Se connecter en root via SSH< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ssh root@54.37.13.57
< / code > < / pre > < / div > < / div >
< p > Vérifier le réseau < code class = "language-plaintext highlighter-rouge" > ip a< / code > et noyau < code class = "language-plaintext highlighter-rouge" > uname -r< / code > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > 1: lo: < LOOPBACK,UP,LOWER_UP> mtu 65536 qdisc noqueue state UNKNOWN group default qlen 1000
link/loopback 00:00:00:00:00:00 brd 00:00:00:00:00:00
inet 127.0.0.1/8 scope host lo
valid_lft forever preferred_lft forever
inet6 ::1/128 scope host
valid_lft forever preferred_lft forever
2: eth0: < BROADCAST,MULTICAST,UP,LOWER_UP> mtu 1500 qdisc pfifo_fast state UP group default qlen 1000
link/ether fa:16:3e:61:4e:9a brd ff:ff:ff:ff:ff:ff
inet 54.37.13.57/32 brd 54.37.13.57 scope global dynamic eth0
valid_lft 86304sec preferred_lft 86304sec
inet6 2001:41d0:401:3200::d48/128 scope global
valid_lft forever preferred_lft forever
inet6 fe80::f816:3eff:fe61:4e9a/64 scope link
valid_lft forever preferred_lft forever
< / code > < / pre > < / div > < / div >
< p > Linux vps785909 5.8.0-2-cloud-amd64 #1 SMP Debian 5.8.10-1 (2020-09-19) x86_64 GNU/Linux< br / >
Fuseau < strong > Europe/Paris< / strong > : < code class = "language-plaintext highlighter-rouge" > dpkg-reconfigure tzdata< / code > < / p >
< h3 id = "-domaine-rnmkcyeu" > < img src = "/images/dns-logo.png" alt = "dns" width = "30" / > Domaine rnmkcy.eu< / h3 >
< p > Zone dns OVH< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > $TTL 3600
@ IN SOA dns20.ovh.net. tech.ovh.net. (2020022809 86400 3600 3600000 300)
IN NS ns20.ovh.net.
IN NS dns20.ovh.net.
IN A 54.37.13.57
IN AAAA 2001:41d0:401:3200:0:0:0:d48
< / code > < / pre > < / div > < / div >
< p > Reverse DNS sur “server” , IP 54.37.13.57 → rnmkcy.eu< / p >
< p > Hostname< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > hostnamectl set-hostname rnmkcy.eu
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > Static hostname: rnmkcy.eu
Icon name: computer-vm
Chassis: vm
Machine ID: 0ef30511d74646618d92e464efb187ce
Boot ID: 324a20f68c0e450cb9a0cfba56ecb180
Virtualization: kvm
Operating System: Debian GNU/Linux 10 (buster)
Kernel: Linux 5.8.0-2-cloud-amd64
Architecture: x86-64
< / code > < / pre > < / div > < / div >
< h3 id = "création-utilisateur" > Création utilisateur< / h3 >
< p > Utilisateur < strong > vpsrnm< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > useradd -m -d /home/vpsrnm/ -s /bin/bash vpsrnm
< / code > < / pre > < / div > < / div >
< p > Mot de passe < strong > vpsrnm< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > passwd vpsrnm
< / code > < / pre > < / div > < / div >
< p > Visudo pour les accès root via utilisateur < strong > vpsrnm< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > echo "vpsrnm ALL=(ALL) NOPASSWD: ALL" > > /etc/sudoers
< / code > < / pre > < / div > < / div >
< p > Changer le mot de passe root< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > passwd root
< / code > < / pre > < / div > < / div >
< h3 id = "-openssh-clé-et-script" > < img src = "/images/openssh-logo.png" alt = "OpenSSH" / > OpenSSH, clé et script< / h3 >
< p > < strong > connexion avec clé< / strong > < br / >
< u > sur l'ordinateur de bureau< / u >
Générer une paire de clé curve25519-sha256 (ECDH avec Curve25519 et SHA2) nommé < strong > kvm-cinay< / strong > pour une liaison SSH avec le serveur KVM.< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ssh-keygen -t ed25519 -o -a 100 -f ~/.ssh/kvm-vps785909
< / code > < / pre > < / div > < / div >
< p > Envoyer la clé publique sur le serveur KVM< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > scp ~/.ssh/kvm-vps785909.pub vpsrnm@54.37.13.57:/home/vpsrnm/
< / code > < / pre > < / div > < / div >
< p > < u > sur le serveur KVM< / u >
On se connecte< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ssh vpsrnm@54.37.13.57
< / code > < / pre > < / div > < / div >
< p > Copier le contenu de la clé publique dans /home/$USER/.ssh/authorized_keys< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > cd ~
< / code > < / pre > < / div > < / div >
< p > Sur le KVM ,créer un dossier .ssh< / p >
< div class = "language-bash highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > < span class = "nb" > mkdir< / span > .ssh
< span class = "nb" > cat< / span > < span class = "nv" > $HOME< / span > /kvm-vps785909.pub < span class = "o" > > > < / span > < span class = "nv" > $HOME< / span > /.ssh/authorized_keys
< span class = "nb" > chmod < / span > 600 < span class = "nv" > $HOME< / span > /.ssh/authorized_keys < span class = "c" > # donner les droits< / span >
< span class = "nb" > rm< / span > < span class = "nv" > $HOME< / span > /kvm-vps785909.pub < span class = "c" > # effacer le fichier de la clé < / span >
< / code > < / pre > < / div > < / div >
< p > Modifier la configuration serveur SSH< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo nano /etc/ssh/sshd_config # attention aux 2 dernières lignes
< / code > < / pre > < / div > < / div >
< p > Modifier< / p >
< div class = "language-conf highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > < span class = "n" > Port< / span > < span class = "m" > 55034< / span >
< span class = "n" > PasswordAuthentication< / span > < span class = "n" > no< / span > < span class = "c" > # avant dernière ligne
< / span > < span class = "n" > PermitRootLogin< / span > < span class = "n" > no< / span > < span class = "c" > # dernière ligne
< / span > < / code > < / pre > < / div > < / div >
< p > < u > session SSH ne se termine pas correctement lors d'un "reboot" à distance< / u > < br / >
Si vous tentez de < strong > redémarrer/éteindre< / strong > une machine distance par < strong > ssh< / strong > , vous pourriez constater que votre session ne se termine pas correctement, vous laissant avec un terminal inactif jusqu’ ’ ’ ’ ’ ’ < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo apt install libpam-systemd # installé par défaut sur debian buster
< / code > < / pre > < / div > < / div >
< p > cela terminera la session ssh avant que le réseau ne tombe.< br / >
Veuillez noter qu’ < / p >
< p > Relancer openSSH< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl restart sshd
< / code > < / pre > < / div > < / div >
< p > Accès depuis le poste distant avec la clé privée< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ssh -p 55034 -i ~/.ssh/kvm-vps785909 vpsrnm@54.37.13.57
< / code > < / pre > < / div > < / div >
< h3 id = "outils-scripts-motd-et-ssh_rc_bash" > Outils, scripts motd et ssh_rc_bash< / h3 >
< p > Installer utilitaires< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo apt install rsync curl tmux jq figlet git dnsutils tree -y
< / code > < / pre > < / div > < / div >
< p > Motd< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo rm /etc/motd & & sudo nano /etc/motd
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ____ ___ ___ ___ __ ___
__ __ _ __ ___|__ |( _ )| __|/ _ \ / \ / _ \
\ V /| '_ \(_-< / / / _ \|__ \\_, /| () |\_, /
\_/ | .__//__/ /_/ _\___/|___/ /_/ \__/ /_/
_ _ |_|__ _ __ | |__ __ _ _ ___ _ _
| '_|| ' \ | ' \ | / // _|| || | _ / -_)| || |
|_| |_|_|_||_|_|_||_\_\\__| \_, |(_)\___| \_,_|
|__/
< / code > < / pre > < / div > < / div >
< p > Script < strong > ssh_rc_bash< / strong > < / p >
< blockquote >
< p > < strong > ATTENTION!!! Les scripts sur connexion peuvent poser des problèmes pour des appels externes autres que ssh< / strong > < / p >
< / blockquote >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > wget https://static.xoyaz.xyz/files/ssh_rc_bash
chmod +x ssh_rc_bash # rendre le bash exécutable
./ssh_rc_bash # exécution
< / code > < / pre > < / div > < / div >
< p > < img src = "/images/vps785909.png" alt = "" / > < / p >
< h3 id = "certificats-" > Certificats < img src = "/images/LetsEncrypt.png" alt = "LetsEncrypt.png" width = "100" / > < / h3 >
< p > Installer acme: < a href = "https://blog.cinay.xyz/2017/08/Acme-Certficats-Serveurs.html" > Serveur , installer et renouveler les certificats SSL Let’ < / a > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > cd ~
sudo apt install socat -y # prérequis
git clone https://github.com/Neilpang/acme.sh.git
cd acme.sh
./acme.sh --install # se déconnecter pour prise en compte
# export des clé API OVH
< / code > < / pre > < / div > < / div >
< p > Générer les certificats pour le domaine rnmkcy.eu< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > acme.sh --dns dns_ovh --ocsp --issue --keylength ec-384 -d 'rnmkcy.eu' -d 'wg.rnmkcy.eu' -d 'zic.rnmkcy.eu'
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > [dimanche 11 octobre 2020, 11:56:26 (UTC+0200)] Your cert is in /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/rnmkcy.eu.cer
[dimanche 11 octobre 2020, 11:56:26 (UTC+0200)] Your cert key is in /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/rnmkcy.eu.key
[dimanche 11 octobre 2020, 11:56:26 (UTC+0200)] The intermediate CA cert is in /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/ca.cer
[dimanche 11 octobre 2020, 11:56:26 (UTC+0200)] And the full chain certs is there: /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/fullchain.cer
< / code > < / pre > < / div > < / div >
< p > Les liens avec < strong > /etc/ssl/private< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo ln -s /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/fullchain.cer /etc/ssl/private/rnmkcy.eu-fullchain.pem # full chain certs
sudo ln -s /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/rnmkcy.eu.key /etc/ssl/private/rnmkcy.eu-key.pem # cert key
sudo ln -s /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/rnmkcy.eu.cer /etc/ssl/private/rnmkcy.eu-chain.pem # cert domain
sudo ln -s /home/vpsrnm//.acme.sh/rnmkcy.eu_ecc/ca.cer /etc/ssl/private/rnmkcy.eu-ca.pem # intermediate CA cert
< / code > < / pre > < / div > < / div >
< h3 id = "-parefeu" > < img src = "/images/ufw-logo1.png" alt = "ufw" width = "50" / > Parefeu< / h3 >
< p > < em > UFW, ou pare - feu simple , est une interface pour gérer les règles de pare-feu dans Arch Linux, Debian ou Ubuntu. UFW est utilisé via la ligne de commande (bien qu’ ’ < / em > < / p >
< p > Installation < strong > Debian / Ubuntu< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo apt-get install ufw
< / code > < / pre > < / div > < / div >
< p > < em > Par défaut, les jeux de règles d’ ’ ’ ’ < / em > < / p >
< p > Les règles< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo ufw allow 55034/tcp # port SSH , 55034
sudo ufw allow http # port 80
sudo ufw allow https # port 53
sudo ufw allow DNS # port 53
sudo ufw allow 51820/udp # wireguard
< / code > < / pre > < / div > < / div >
< p > Activer le parefeu< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo ufw enable
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > Command may disrupt existing ssh connections. Proceed with operation (y|n)? y
Firewall is active and enabled on system startup
< / code > < / pre > < / div > < / div >
< p > Status< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo ufw status verbose
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > Status: active
Logging: on (low)
Default: deny (incoming), allow (outgoing), disabled (routed)
New profiles: skip
To Action From
-- ------ ----
55034/tcp ALLOW IN Anywhere
80/tcp ALLOW IN Anywhere
443/tcp ALLOW IN Anywhere
53 (DNS) ALLOW IN Anywhere
51820/udp ALLOW IN Anywhere
55034/tcp (v6) ALLOW IN Anywhere (v6)
80/tcp (v6) ALLOW IN Anywhere (v6)
443/tcp (v6) ALLOW IN Anywhere (v6)
53 (DNS (v6)) ALLOW IN Anywhere (v6)
51820/udp (v6) ALLOW IN Anywhere (v6)
< / code > < / pre > < / div > < / div >
< h3 id = "-nginx--php--mariadb" > < img src = "/images/nginx-php7-mariadb1.png" alt = "" width = "70" / > Nginx + PHP + MariaDb< / h3 >
< p > < a href = "https://www.geek17.com/fr/content/debian-10-buster-installer-et-configurer-la-derniere-version-de-nginx-et-php-73-fpm-105" > Debian 10 Buster : installer et configurer la dernière version de Nginx et PHP 7.3 FPM< / a > < / p >
< p > Debian Buster compilation < strong > Nginx< / strong > 1.18 + TLSv1.3< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s
curl -o compil.sh https://static.xoyaz.xyz/files/debian10-compilation-nginx-tls1.3.sh
chmod +x compil.sh
./compil.sh # Patienter quelques minutes (5 à 10 suivant CPU)
< / code > < / pre > < / div > < / div >
< p > A la fin de la compilation< / p >
< p > < img src = "/images/nginx-logo.png" alt = "" width = "60" / > nginx/1.18.0< br / >
< img src = "/images/openssl-logo.png" alt = "" / > 1.1.1d 10 Sep 2019< / p >
< p > Debian Buster < strong > PHP 7.3< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > curl -o compilphp.sh https://static.xoyaz.xyz/files/debian10-php7.3.sh
chmod +x compilphp.sh
./compilphp.sh
< / code > < / pre > < / div > < / div >
< p > < strong > ssl headers< / strong > < br / >
Configuration nginx , ssl (tls1.2 tls1.3) , Diffie Hellman ,Headers et OCSP< br / >
Diffie-Hellman , générer le fichier dh2048.pem (en mode su):< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > openssl dhparam -out /etc/ssl/private/dh2048.pem -outform PEM -2 2048
< / code > < / pre > < / div > < / div >
< p > Si < strong > DNS ubound< / strong > n’ < code class = "language-plaintext highlighter-rouge" > cat /etc/resolv.conf< / code > : nameserver 213.186.33.99< / p >
< p > Regroupement dans un fichier < strong > /etc/nginx/ssl_dh_headers_ocsp< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > nano /etc/nginx/ssl_dh_headers_ocsp
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # /etc/nginx/ssl_dh_headers_ocsp
ssl_certificate /etc/ssl/private/rnmkcy.eu-fullchain.pem;
ssl_certificate_key /etc/ssl/private/rnmkcy.eu-key.pem;
ssl_session_timeout 1d;
ssl_session_cache shared:MozSSL:10m; # about 40000 sessions
ssl_session_tickets off;
ssl_dhparam /etc/ssl/private/dh2048.pem;
# intermediate configuration
ssl_protocols TLSv1.2 TLSv1.3;
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
ssl_prefer_server_ciphers off;
# Add headers to serve security related headers
add_header X-Content-Type-Options nosniff;
add_header X-XSS-Protection "1; mode=block";
add_header X-Robots-Tag none;
add_header X-Download-Options noopen;
add_header X-Permitted-Cross-Domain-Policies none;
add_header X-Frame-Options "SAMEORIGIN";
add_header Strict-Transport-Security 'max-age=31536000; includeSubDomains;';
add_header Referrer-Policy "no-referrer" always;
# OCSP settings
ssl_stapling on;
ssl_stapling_verify on;
ssl_trusted_certificate /etc/ssl/private/rnmkcy.eu-fullchain.pem;
resolver 213.186.33.99; # 127.0.0.1 si DNS Unbound installé
< / code > < / pre > < / div > < / div >
< p > Configuration de base < strong > /etc/nginx/conf.d/rnmkcy.eu.conf< / strong > < br / >
On va renommer le default.conf< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > mv /etc/nginx/conf.d/default.conf /etc/nginx/conf.d/rnmkcy.eu.conf
nano /etc/nginx/conf.d/rnmkcy.eu.conf
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # /etc/nginx/conf.d/rnmkcy.eu.conf
##
# Virtual Host rnmkcy.eu
##
server {
listen 80;
listen [::]:80;
## redirect http to https ##
server_name rnmkcy.eu;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name rnmkcy.eu;
#### Locations
# On cache les fichiers statiques
location ~* \.(html|css|js|png|jpg|jpeg|gif|ico|svg|eot|woff|ttf)$ { expires max; }
location = /favicon.ico {
log_not_found off;
}
# On interdit les dotfiles
location ~ /\. { deny all; }
include ssl_dh_headers_ocsp;
root /var/www/default-www/ ;
index index.html index.php;
location ~ \.php$ {
fastcgi_split_path_info ^(.+\.php)(/.+)$;
fastcgi_pass unix:/run/php/php7.4-fpm.sock; # PHP7.4
fastcgi_index index.php;
include fastcgi_params;
fastcgi_param SCRIPT_FILENAME $request_filename;
}
include /etc/nginx/conf.d/rnmkcy.eu.d/*.conf;
access_log /var/log/nginx/rnmkcy.eu-access.log;
error_log /var/log/nginx/rnmkcy.eu-error.log;
}
< / code > < / pre > < / div > < / div >
< p > Vérifications et rechargement nginx< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > nginx -t
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > nginx: the configuration file /etc/nginx/nginx.conf syntax is ok
nginx: configuration file /etc/nginx/nginx.conf test is successful
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > systemctl reload nginx
< / code > < / pre > < / div > < / div >
< p > Au premier accès sur le lien on obtient une erreur< / p >
< p > < img src = "/images/vps803434-1.png" alt = "ocsp" width = "400" / > < br / >
Ce problème est lié à la mise en cache ocsp qui ne se fait qu’ < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo nano /usr/local/bin/ocsp_cache
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > #! /bin/sh
# ocsp_cache
# $1 domaine passé en paramètre
echo "Premier passage"
for fichier in /etc/nginx/conf.d/*$1.conf
do
echo $(basename $fichier .${fichier##*.})
openssl s_client -connect $(basename $fichier .${fichier##*.}):443 -status < /dev/null |grep -i ocsp
done
# pause de 1 seconde
sleep 1
echo "Second passage"
for fichier in /etc/nginx/conf.d/*$1.conf
do
echo $(basename $fichier .${fichier##*.})
openssl s_client -connect $(basename $fichier .${fichier##*.}):443 -status < /dev/null |grep -i ocsp
done
echo "Fin mise en cache nginx OCSP..."
< / code > < / pre > < / div > < / div >
< p > Le rendre exécutable< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo chmod +x /usr/local/bin/ocsp_cache
< / code > < / pre > < / div > < / div >
< p > Exécution en mode sans affichage< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ocsp_cache > /dev/null 2> & 1
< / code > < / pre > < / div > < / div >
< p > Lien https://rnmkcy.eu< / p >
< h2 id = "go-node-docker" > Go Node Docker< / h2 >
< h3 id = "-go" > < img src = "/images/golang-color-icon2.png" alt = "golang" width = "40" / > Go< / h3 >
< p > Go installation (Debian) , installer la dernière version de Go → < a href = "https://golang.org/dl/" > https://golang.org/dl/< / a > < / p >
< div class = "language-bash highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > < span class = "nb" > cd< / span > ~
wget https://golang.org/dl/go1.15.2.linux-amd64.tar.gz
< span class = "nb" > sudo tar< / span > < span class = "nt" > -C< / span > /usr/local < span class = "nt" > -xzf< / span > go1.15.2.linux-amd64.tar.gz
< span class = "nb" > echo< / span > < span class = "s2" > "export PATH=< / span > < span class = "nv" > $PATH< / span > < span class = "s2" > :/usr/local/go/bin"< / span > < span class = "o" > > > < / span > ~/.bashrc
< span class = "nb" > source< / span > ~/.bashrc
< / code > < / pre > < / div > < / div >
< p > Version< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > go version
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > go version go1.15.2 linux/amd64
< / code > < / pre > < / div > < / div >
< h3 id = "-nodejs" > < img src = "/images/Node_logo.png" alt = "nodejs" width = "40" / > Nodejs< / h3 >
< p > Installer la version LTS de nodejs pour le frontend → < a href = "https://github.com/nodesource/distributions#debinstall" > https://github.com/nodesource/distributions#debinstall< / a > < / p >
< p > Version < strong > Node.js v14.x< / strong > au 11 octobre 2020< / p >
< div class = "language-bash highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > < span class = "c" > # Using Debian, as root< / span >
< span class = "nb" > sudo< / span > < span class = "nt" > -s< / span >
curl < span class = "nt" > -sL< / span > https://deb.nodesource.com/setup_14.x | bash -
apt-get < span class = "nb" > install< / span > < span class = "nt" > -y< / span > nodejs
< / code > < / pre > < / div > < / div >
< p > Version < strong > Node.js LTS (v12.x)< / strong > au 11 octobre 2020< / p >
< div class = "language-bash highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > < span class = "c" > # Using Debian, as root< / span >
< span class = "nb" > sudo< / span > < span class = "nt" > -s< / span >
curl < span class = "nt" > -sL< / span > https://deb.nodesource.com/setup_lts.x | bash -
apt-get < span class = "nb" > install< / span > < span class = "nt" > -y< / span > nodejs
< / code > < / pre > < / div > < / div >
< p > Versions< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > node --version
v14.13.1
npm --version
6.14.8
< / code > < / pre > < / div > < / div >
< h3 id = "-docker-facultatif" > < img src = "/images/docker-logo.png" alt = "docker" width = "60" / > Docker (Facultatif)< / h3 >
< p > < a href = "/2020/03/10/Docker-Debian-Buster.html" > Installer docker sur debian 10< / a > < / p >
< p > Docker compose , version sur < a href = "https://github.com/docker/compose/releases" > https://github.com/docker/compose/releases< / a > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo curl -L https://github.com/docker/compose/releases/download/1.26.0-rc4/docker-compose-`uname -s`-`uname -m` -o /usr/local/bin/docker-compose
sudo chmod +x /usr/local/bin/docker-compose
docker-compose --version
< / code > < / pre > < / div > < / div >
< p > < em > docker-compose version 1.26.0-rc4, build d279b7a8< / em > < / p >
< h2 id = "-sshfs-fstab" > < img src = "/images/sshfs-logo.png" alt = "sshfs" width = "50" / > SSHFS fstab< / h2 >
< p > Le dossier “musique” est distant (serveur xoyaz.xyz)< br / >
Il faut créer une liaison réseau sécurisée entre < strong > rnmkcy.eu ← → xoyaz.xyz< / strong > < br / >
On va utiliser SSHFS (< em > Secure shell file system (ou SSHFS) permet le partage d’ < / em > )< / p >
< p > Installation< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo apt install sshfs
< / code > < / pre > < / div > < / div >
< p > Autorisations< / p >
< ul >
< li > Autorisations “utilisateur”
< ul >
< li > Exécuter < code class = "language-plaintext highlighter-rouge" > sshfs< / code > (ou toute autre commande de montage FUSE) avec l’ < code class = "language-plaintext highlighter-rouge" > -o allow_other< / code > < / li >
< / ul >
< / li >
< li > Autoriser l’ < strong > fuse< / strong >
< ul >
< li > Ajouter < code class = "language-plaintext highlighter-rouge" > user_allow_other< / code > au fichier < strong > /etc/fuse.conf< / strong > < / li >
< li > Exécuter < code class = "language-plaintext highlighter-rouge" > sshfs< / code > (ou toute autre commande de montage FUSE) avec l’ < code class = "language-plaintext highlighter-rouge" > -o allow_root< / code > < / li >
< / ul >
< / li >
< / ul >
< p > Clé privée < strong > OVZ-STORAGE-128< / strong > pour accéder au serveur xoyaz.xyz< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > chmod 600 /home/vpsrnm/.ssh/OVZ-STORAGE-128
< / code > < / pre > < / div > < / div >
< p > < strong > Exécution manuelle< / strong > pour authentifier la clé avec utilisateur “debian”< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s
mkdir -p /opt/sshfs
sshfs -o allow_other usernl@xoyaz.xyz:/home/usernl/backup /opt/sshfs -C -p 55036 -oIdentityFile=/home/vpsrnm/.ssh/OVZ-STORAGE-128
< / code > < / pre > < / div > < / div >
< div class = "language-bash highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > The authenticity of host < span class = "s1" > '[xoyaz.xyz]:55036 ([2a04:52c0:101:82::73db]:55036)'< / span > can< span class = "s1" > 't be established.
ECDSA key fingerprint is SHA256:NuFqR5id10fVzRLsSTqJ4vBpFnNYi+APGsvPYth6PHw.
Are you sure you want to continue connecting (yes/no)? yes
< / span > < / code > < / pre > < / div > < / div >
< blockquote >
< p > NOTE: Il faut mettre l’ < / p >
< / blockquote >
< p > Après vérification , < code class = "language-plaintext highlighter-rouge" > ls /opt/sshfs< / code > , déconnexion < code class = "language-plaintext highlighter-rouge" > fusermount -u /opt/sshfs< / code > < / p >
< p > < strong > Montage fstab< / strong > < / p >
< p > ajouter la ligne suivante au fichier < strong > /etc/fstab< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > usernl@xoyaz.xyz:/home/usernl/backup /opt/sshfs fuse.sshfs _netdev,identityfile=/home/vpsrnm/.ssh/OVZ-STORAGE-128,allow_other,port=55036 0 0
< / code > < / pre > < / div > < / div >
< p > Montage pour authentifier la clé avec utilisateur “root”< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo mount -a
< / code > < / pre > < / div > < / div >
< p > Vérification< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ls /opt/sshfs
< / code > < / pre > < / div > < / div >
< div class = "language-bash highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > CalibreTechnique musique yunohost.backup.cinay.xyz
< / code > < / pre > < / div > < / div >
< h2 id = "serveur-audio" > Serveur Audio< / h2 >
< h3 id = "-gonic" > < img src = "/images/gonic002.png" alt = "gonic" width = "100" / > Gonic< / h3 >
< p > < em > < a href = "https://github.com/sentriz/gonic" > Gonic< / a > écrit en go est une alternative à Subsonic.org, accessible par un proxy nginx< br / >
La seule application qui accepte de fonctionner avec répertoires montés par FUSE.< / em > < / p >
< h4 id = "caractéristiques" > Caractéristiques< / h4 >
< ul >
< li > la navigation par dossier (en gardant votre arborescence complète intacte)< / li >
< li > la navigation par balises (à l’ < a href = "https://taglib.org/" > taglib< / a > - supporte mp3, opus, flac, ape, m4a, wav, etc.)< / li >
< li > transcodage et mise en cache audio à la volée (nécessite < a href = "https://ffmpeg.org/" > ffmpeg< / a > ) (merci spijet)< / li >
< li > balayage assez rapide (avec ma bibliothèque de ~27k pistes, le balayage initial prend environ 10m, et environ 5s après de manière incrémentielle)< / li >
< li > plusieurs utilisateurs, chacun ayant ses propres préférences de transcodage, ses listes de lecture, ses meilleures pistes, ses meilleurs artistes, etc.< / li >
< li > < a href = "https://www.last.fm/" > last.fm< / a > scrobbling< / li >
< li > similarités entre les artistes et biographies de la dernière api.fm< / li >
< li > une interface web pour la configuration (configurer last.fm, gérer les utilisateurs, lancer des analyses, etc.)< / li >
< li > un support pour le tag album-artist, pour ne pas encombrer votre liste d’ ’ < / li >
< li > écrit en go, donc léger et adapté à un pi framboise, etc.< / li >
< li > plus récent sel et token auth< / li >
< li > testé sur < a href = "https://f-droid.org/en/packages/github.daneren2005.dsub/" > dsub< / a > , < a href = "http://jamstash.com/" > jamstash< / a > , < a href = "https://gitlab.com/sumner/sublime-music/" > musique sublime< / a > et< a href = "https://apps.apple.com/us/app/soundwaves/id736139596" > ondes sonores< / a > < / li >
< / ul >
< h4 id = "installation-gonic" > Installation gonic< / h4 >
< p > dans le répertoire utilisateur < strong > $HOME< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # les dépendances
sudo apt install build-essential git sqlite libtag1-dev ffmpeg libasound2-dev pkg-config # for debian like
cd $HOME/
# cloner
git clone https://gitea.cinay.eu/yann/golang-subsonic.git
cd golang-subsonic/
< / code > < / pre > < / div > < / div >
< p > Construire l’ < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ./_do_build_server
sudo mv gonic /usr/local/bin/
< / code > < / pre > < / div > < / div >
< p > Créer le dossier pour la base< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo mkdir -p /opt/gonic
< / code > < / pre > < / div > < / div >
< h4 id = "créer-le-service-gonic" > Créer le service gonic< / h4 >
< p > Que fait le service ?< / p >
< ul >
< li > Le dossier fuse est monté au démarrage par fstab< / li >
< li > lancer le serveur “gonic” en écoute local sur le port 4747 avec les options < code class = "language-plaintext highlighter-rouge" > -music-path< / code > , < code class = "language-plaintext highlighter-rouge" > -db-path< / code > et < code class = "language-plaintext highlighter-rouge" > -proxy-prefix< / code > < / li >
< li > A l’ < / li >
< / ul >
< p > Tester le serveur< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s
/usr/local/bin/gonic -music-path /opt/sshfs/musique -db-path /opt/gonic/gonic.db -proxy-prefix /
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > 2020/10/11 15:26:37 starting gonic v0.11.0
2020/10/11 15:26:37 provided config
2020/10/11 15:26:37 cache-path /tmp/gonic_cache
2020/10/11 15:26:37 config-path
2020/10/11 15:26:37 db-path /opt/gonic/gonic.db
2020/10/11 15:26:37 jukebox-enabled false
2020/10/11 15:26:37 listen-addr 0.0.0.0:4747
2020/10/11 15:26:37 music-path /opt/sshfs/musique
2020/10/11 15:26:37 proxy-prefix /
2020/10/11 15:26:37 scan-interval 0
2020/10/11 15:26:37 version false
2020/10/11 15:26:37 migration (1/7) '202002192100' finished
2020/10/11 15:26:37 migration (2/7) '202002192019' finished
2020/10/11 15:26:37 migration (3/7) '202002192222' finished
2020/10/11 15:26:37 migration (4/7) '202003111222' finished
2020/10/11 15:26:37 migration (5/7) '202003121330' finished
2020/10/11 15:26:37 migration (6/7) '202003241509' finished
2020/10/11 15:26:37 migration (7/7) '202004302006' finished
2020/10/11 15:26:37 starting job 'session clean'
2020/10/11 15:26:37 starting job 'http'
< / code > < / pre > < / div > < / div >
< p > Arrêt par Ctrl+C< / p >
< p > Chaque service généré par systemd est configuré par un fichier .service qui se trouve dans le répertoire < strong > /etc/systemd/system< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo nano /etc/systemd/system/gonic.service
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > [Unit]
Description=Gonic audio server
After=network.target
[Service]
Type=simple
Restart=on-failure
RestartSec=10
ExecStart=/usr/local/bin/gonic -music-path /opt/sshfs/musique -db-path /opt/gonic/gonic.db -proxy-prefix /
[Install]
WantedBy=multi-user.target
< / code > < / pre > < / div > < / div >
< p > Recharger < code class = "language-plaintext highlighter-rouge" > systemd< / code > puis démarrer le service:< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl daemon-reload
sudo systemctl start gonic.service
< / code > < / pre > < / div > < / div >
< p > Visualiser le journal< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo journalctl -t gonic
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > -- Logs begin at Sun 2020-10-11 14:19:55 CEST, end at Sun 2020-10-11 15:27:54 CEST. --
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 starting gonic v0.11.0
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 provided config
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 cache-path /tmp/gonic_cache
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 config-path
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 db-path /opt/gonic/gonic.db
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 jukebox-enabled false
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 listen-addr 0.0.0.0:4747
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 music-path /opt/sshfs/musique
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 proxy-prefix /
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 scan-interval 0
oct. 11 15:27:41 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:41 version false
oct. 11 15:27:42 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:42 starting job 'session clean'
oct. 11 15:27:42 rnmkcy.eu gonic[6432]: 2020/10/11 15:27:42 starting job 'http'
< / code > < / pre > < / div > < / div >
< p > Si tout est en ordre , on active le service< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl enable gonic.service
< / code > < / pre > < / div > < / div >
< h4 id = "dns-ovh---cname-zic" > dns OVH - CNAME zic< / h4 >
< p > Il faut ajouter le CNAME zic au domaine rnmkcy.eu< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > zic IN CNAME rnmkcy.eu.
< / code > < / pre > < / div > < / div >
< h4 id = "proxy-nginx-zicrnmkcyeu" > Proxy nginx zic.rnmkcy.eu< / h4 >
< p > < em > Gonic est un serveur local http sur le port 4747 et pour un accès externe il nous faut un proxy< / em > < / p >
< p > < strong > Proxy nginx< / strong > - configuration < strong > /etc/nginx/conf.d/zic.rnmkcy.eu.conf< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # /etc/nginx/conf.d/zic.rnmkcy.eu.conf
##
# Virtual Host zic.rnmkcy.eu
##
server {
listen 80;
listen [::]:80;
## redirect http to https ##
server_name zic.rnmkcy.eu;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name zic.rnmkcy.eu;
include ssl_dh_headers_ocsp;
access_log /var/log/nginx/zic.rnmkcy.eu.log;
proxy_request_buffering off;
proxy_buffering off;
proxy_buffer_size 4k;
# Proxy audio gonic server
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:4747;
proxy_read_timeout 120;
}
}
< / code > < / pre > < / div > < / div >
< p > On vérifie et on relance le serveur nginx< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo nginx -t
sudo systemctl reload nginx
< / code > < / pre > < / div > < / div >
< p > Accès < a href = "https://zic.rnmkcy.eu" > https://zic.rnmkcy.eu< / a > < / p >
< p > < img src = "/images/gonic003.png" alt = "gonic" width = "400" / > < / p >
< h3 id = "navidrome" > Navidrome< / h3 >
< p > < a href = "https://www.navidrome.org/docs/installation/pre-built-binaries/" > Navidrome< / a > < / p >
< p > Créer les répertoires< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo install -d -o debian -g debian /opt/navidrome
sudo install -d -o debian -g debian /var/lib/navidrome
< / code > < / pre > < / div > < / div >
< p > La < a href = "https://github.com/deluan/navidrome/releases" > dernière version< / a > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > wget https://github.com/deluan/navidrome/releases/download/v0.35.1/navidrome_0.35.1_Linux_x86_64.tar.gz -O Navidrome.tar.gz
sudo tar -xvzf Navidrome.tar.gz -C /opt/navidrome/
sudo chown -R debian:debian /opt/navidrome
< / code > < / pre > < / div > < / div >
< p > Créer le fichier de configuration < code class = "language-plaintext highlighter-rouge" > /var/lib/navidrome/navidrome.toml< / code > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > MusicFolder = "/opt/sshfs/musique"
< / code > < / pre > < / div > < / div >
< p > Créer un service < code class = "language-plaintext highlighter-rouge" > /etc/systemd/system/navidrome.service< / code > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > [Unit]
Description=Navidrome Music Server and Streamer compatible with Subsonic/Airsonic
After=remote-fs.target network.target
AssertPathExists=/var/lib/navidrome
[Install]
WantedBy=multi-user.target
[Service]
User=debian
Group=debian
Type=simple
ExecStart=/opt/navidrome/navidrome --configfile "/var/lib/navidrome/navidrome.toml"
WorkingDirectory=/var/lib/navidrome
TimeoutStopSec=20
KillMode=process
Restart=on-failure
# See https://www.freedesktop.org/software/systemd/man/systemd.exec.html
DevicePolicy=closed
NoNewPrivileges=yes
PrivateTmp=yes
PrivateUsers=yes
ProtectControlGroups=yes
ProtectKernelModules=yes
ProtectKernelTunables=yes
RestrictAddressFamilies=AF_UNIX AF_INET AF_INET6
RestrictNamespaces=yes
RestrictRealtime=yes
SystemCallFilter=~@clock @debug @module @mount @obsolete @reboot @setuid @swap
ReadWritePaths=/var/lib/navidrome
# You can uncomment the following line if you're not using the jukebox This
# will prevent navidrome from accessing any real (physical) devices
#PrivateDevices=yes
# You can change the following line to `strict` instead of `full` if you don't
# want navidrome to be able to write anything on your filesystem outside of
# /var/lib/navidrome.
ProtectSystem=full
# You can comment the following line if you don't have any media in /home/*.
# This will prevent navidrome from ever reading/writing anything there.
#ProtectHome=true
< / code > < / pre > < / div > < / div >
< p > Démarrer le service< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl daemon-reload
sudo systemctl start navidrome.service
< / code > < / pre > < / div > < / div >
< p > Le status< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl status navidrome.service
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ● navidrome.service - Navidrome Music Server and Streamer compatible with Subsonic/Airsonic
Loaded: loaded (/etc/systemd/system/navidrome.service; disabled; vendor preset: enabled)
Active: active (running) since Sun 2020-10-11 16:19:57 CEST; 1s ago
Main PID: 6676 (navidrome)
Tasks: 5 (limit: 2312)
Memory: 9.1M
CGroup: /system.slice/navidrome.service
└─6676 /opt/navidrome/navidrome --configfile /var/lib/navidrome/navidrome.toml
oct. 11 16:19:57 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:57+02:00" level=info msg="Configuring Media Folder" name="Music Library" path=/opt/sshfs/musique
oct. 11 16:19:57 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:57+02:00" level=info msg="Creating Image cache" maxSize="100 MB" path=cache/images
oct. 11 16:19:57 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:57+02:00" level=info msg="Creating Transcoding cache" maxSize="100 MB" path=cache/transcoding
oct. 11 16:19:57 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:57+02:00" level=warning msg="Running initial setup"
oct. 11 16:19:57 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:57+02:00" level=warning msg="Creating JWT secret, used for encrypting UI sessions"
oct. 11 16:19:58 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:58+02:00" level=info msg="Starting scanner" interval=1m0s
oct. 11 16:19:58 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:58+02:00" level=info msg="Mounting routes" path=/rest
oct. 11 16:19:58 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:58+02:00" level=info msg="Mounting routes" path=/app
oct. 11 16:19:58 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:58+02:00" level=info msg="Login rate limit set" requestLimit=5 windowLength=20s
oct. 11 16:19:58 rnmkcy.eu navidrome[6676]: time="2020-10-11T16:19:58+02:00" level=info msg="Navidrome server is accepting requests" address="0.0.0.0:4533"
< / code > < / pre > < / div > < / div >
< h4 id = "dns-ovh---cname-navi" > dns OVH - CNAME navi< / h4 >
< p > Il faut ajouter le CNAME navi au domaine rnmkcy.eu< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > navi IN CNAME rnmkcy.eu.
< / code > < / pre > < / div > < / div >
< h4 id = "proxy-nginx-navirnmkcyeu" > Proxy nginx navi.rnmkcy.eu< / h4 >
< p > < em > Navidrome est un serveur local http sur le port 4533 et pour un accès externe il nous faut un proxy< / em > < / p >
< p > < strong > Proxy nginx< / strong > - configuration < strong > /etc/nginx/conf.d/navi.rnmkcy.eu.conf< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # /etc/nginx/conf.d/navi.rnmkcy.eu.conf
##
# Virtual Host navi.rnmkcy.eu
##
server {
listen 80;
listen [::]:80;
## redirect http to https ##
server_name navi.rnmkcy.eu;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name navi.rnmkcy.eu;
include ssl_dh_headers_ocsp;
access_log /var/log/nginx/navi.rnmkcy.eu.log;
proxy_request_buffering off;
proxy_buffering off;
proxy_buffer_size 4k;
# Proxy audio gonic server
location / {
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_pass http://localhost:4533;
proxy_read_timeout 120;
}
}
< / code > < / pre > < / div > < / div >
< p > On vérifie et on relance le serveur nginx< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo nginx -t
sudo systemctl reload nginx
< / code > < / pre > < / div > < / div >
< p > Accès < a href = "https://navi.rnmkcy.eu" > https://navi.rnmkcy.eu< / a > < / p >
< p > < img src = "/images/navidrome01.png" alt = "navidrome" width = "400" / > < / p >
< h2 id = "wireguard" > Wireguard< / h2 >
< p > < em > WireGuard est un serveur VPN à code source ouvert, gratuit, moderne et rapide, doté d’ ’ ’ < / em > < / p >
< h3 id = "installer-wireguard" > Installer wireguard< / h3 >
< p > Wireguard est dans le noyau 5.6+< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > apt install wireguard
< / code > < / pre > < / div > < / div >
< p > < strong > Générer une paire de clés< / strong > < / p >
< p > On se positionne dans le dossier < strong > /etc/wireguard/< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > cd /etc/wireguard
< / code > < / pre > < / div > < / div >
< p > WireGuard repose sur une authentification par clé publique/privée (cryptographie asymétrique), vous devez donc créer ces clés avec les sous-commandes wg genkey et wg pubkey< br / >
La création de la clé privée se fait avec wg genkey et la clé publique est générée en la canalisant dans wg pubkey< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > umask 077; wg genkey | tee vps785909-private.key | wg pubkey > vps785909-public.key
< / code > < / pre > < / div > < / div >
< p > **Autoriser le serveur Wireguard à relayer les paquets **< / p >
< p > Autoriser le serveur Wireguard à relayer les paquets venant de ces clients vers l’ < strong > /etc/sysctl.conf< / strong > )< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sed -i 's/^#net.ipv4.ip_forward=1/net.ipv4.ip_forward=1/' /etc/sysctl.conf
sed -i 's/^#net.ipv6.conf.all.forwarding=1/net.ipv6.conf.all.forwarding=1/' /etc/sysctl.conf
sysctl -p # prise en compte immédiate
< / code > < / pre > < / div > < / div >
< p > < strong > Fichier de configuration /etc/wireguard/wg0.conf< / strong > < / p >
< p > Récupérer le nom de la carte réseau < code class = "language-plaintext highlighter-rouge" > ip a< / code > , dans notre cas < strong > eth0< / strong > < / p >
< p > La première étape consiste à choisir une plage IPV4 privée qui sera utilisée par le serveur : < strong > 10.19.55.0/8< / strong > < / p >
< p > Pour une adresse IPV6 < a href = "https://www.ultratools.com/tools/rangeGenerator" > Local IPv6 Address Generator< / a > : fd51:6547:3aa2:3ab6::/64< / p >
< table >
< thead >
< tr >
< th > Prefix/L< / th >
< th > fd< / th >
< / tr >
< / thead >
< tbody >
< tr >
< td > Global ID< / td >
< td > 5165473aa2< / td >
< / tr >
< tr >
< td > Subnet ID< / td >
< td > 3ab6< / td >
< / tr >
< tr >
< td > Combine/CID< / td >
< td > fd51:6547:3aa2:3ab6::/64< / td >
< / tr >
< tr >
< td > IPv6 addresses< / td >
< td > fd51:6547:3aa2:3ab6::/64:XXXX:XXXX:XXXX:XXXX< / td >
< / tr >
< tr >
< td > Start Range< / td >
< td > fd51:6547:3aa2:3ab6:0:0:0:0< / td >
< / tr >
< tr >
< td > End Range< / td >
< td > fd51:6547:3aa2:3ab6:ffff:ffff:ffff:ffff< / td >
< / tr >
< tr >
< td > No. of hosts< / td >
< td > 18446744073709551616< / td >
< / tr >
< / tbody >
< / table >
< p > Nous utiliserons 10.19.55.0/24 qui se trouve dans la plage 10.19.55.0/8 . Le serveur aura l’ < / p >
< p > Créer le fichier < strong > /etc/wireguard/wg0.conf< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > nano /etc/wireguard/wg0.conf
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > [Interface]
Address = 10.19.55.1/24
Address = fd51:6547:3aa2:3ab6::1/64
ListenPort = 51820
PostUp = iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
PrivateKey = 5Zsr0jQXiuCpHFkye325Zsr0jMUKinVEOPmk=
DNS = 10.19.55.1
DNS = fd51:6547:3aa2:3ab6::1
SaveConfig = true
< / code > < / pre > < / div > < / div >
< p > < strong > Address< / strong > , fixer l’ ’ < strong > /24< / strong > < br / >
< strong > PostUp< / strong > , pour la mise en place des règles iptables de translation d’ ’ < br / >
< strong > PostDown< / strong > , pour la suppression des règles iptables de translation d’ ’ < br / >
< strong > PrivateKey< / strong > , clé privée du serveur< / p >
< p > Modification des droits (lecture uniquement par “root”)< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > chmod 600 /etc/wireguard/wg0.conf
< / code > < / pre > < / div > < / div >
< h3 id = "dns-unbound" > DNS Unbound< / h3 >
< p > < img src = "/images/unbound-250.png" alt = "" width = "100" / > < / p >
< p > Un problème majeur avec beaucoup de configurations VPN est que le DNS n’ ’ < a href = "http://dnsleak.com/" > http://dnsleak.com/< / a > < / p >
< p > Nous allons sécuriser le trafic DNS avec la solution < strong > unbound< / strong > qui offre les caractéristiques suivantes< / p >
< ul >
< li > Léger et rapide< / li >
< li > Facile à installer et à configurer< / li >
< li > Orienté sécurité< / li >
< li > Prise en charge DNSSEC< / li >
< / ul >
< p > Nous allons le configurer de manière à contrer les fuites DNS, les attaques plus sophistiquées comme la fausse configuration de proxy, les routeurs escrocs et toutes sortes d’ < / p >
< p > Nous installons unbound sur le serveur < br / >
Passage en mode super utilisateur< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s # ou su
< / code > < / pre > < / div > < / div >
< blockquote >
< p > ATTENTION : Le programme < strong > resolvconf< / strong > est en général seulement nécessaire quand un système a plusieurs programmes qui ont besoin de modifier de façon dynamique les informations sur les serveurs de noms de domaine. Sur un système simple où les serveurs de noms de domaine ne changent pas souvent ou bien ne sont modifiés que par un programme, le < u > fichier de configuration **resolv.conf** est suffisant< / u > .< br / >
Il faut installer < strong > resolvconf< / strong > , sinon on a une erreur < strong > unbound-resolvconf< / strong > < br / >
Une fois le paquet « < strong > resolvconf< / strong > » installé, < u > il ne faut plus modifier le fichier< / u > « < strong > /etc/resolv.conf< / strong > », car le contenu de celui-ci sera automatiquement géré et remplacé par « < strong > resolvconf< / strong > ».< / p >
< / blockquote >
< p > Installation des outils dns, des paquets Unbound et resolv :< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > apt install unbound unbound-host resolvconf -y
< / code > < / pre > < / div > < / div >
< p > Téléchargement de la liste des serveurs DNS racines< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > curl -o /var/lib/unbound/root.hints https://www.internic.net/domain/named.cache
chown unbound:unbound /var/lib/unbound/root.hints
< / code > < / pre > < / div > < / div >
< p > Ajout d’ < strong > dns-vps785909.conf< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > /etc/unbound/unbound.conf.d/dns-vps785909.conf
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > server:
num-threads: 4
# enable logs
verbosity: 0 # no verbosity, only errors
# liste des serveurs DNS racine
root-hints: "/var/lib/unbound/root.hints"
# Répondre aux requêtes DNS sur toutes les interfaces
interface: 0.0.0.0 # 0.0.0.0 unbound sur plusieurs interfaces
interface: ::0
max-udp-size: 3072
# IPs authorised to access the DNS Server
access-control: 0.0.0.0/0 refuse
access-control: 127.0.0.0/8 allow
access-control: 10.19.55.0/16 allow
access-control: ::0/0 refuse
access-control: ::1 allow
access-control: ::ffff:127.0.0.1 allow
access-control: fe80::/10 allow
access-control: fd51:6547:3aa2:3ab6::/48 allow
local-zone: "19.10.in-addr.arpa." transparent
#hide DNS Server info
hide-identity: yes
hide-version: yes
# limit DNS fraud and use DNSSEC
harden-glue: yes
harden-dnssec-stripped: yes
harden-referral-path: yes
# add an unwanted reply threshold to clean the cache and avoid, when possible, DNS poisoning
unwanted-reply-threshold: 10000000
# have the validator print validation failures to the log
val-log-level: 1
# minimum lifetime of cache entries in seconds
cache-min-ttl: 1800
# maximum lifetime of cached entries in seconds
cache-max-ttl: 14400
prefetch: yes
prefetch-key: yes
#include: /etc/unbound/unbound.conf.d/adslist.txt
< / code > < / pre > < / div > < / div >
< p > Droits< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > chown -R unbound:unbound /var/lib/unbound
< / code > < / pre > < / div > < / div >
< p > Pour vérifier si le fichier de configuration est valide< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > unbound-checkconf /etc/unbound/unbound.conf.d/dns-vps785909.conf
< / code > < / pre > < / div > < / div >
< p > < em > unbound-checkconf: no errors in /etc/unbound/unbound.conf.d/dns-vps785909.conf< / em > < br / >
Désactiver systemd-resolved (si utilisé)< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > systemctl stop systemd-resolved
systemctl disable systemd-resolved
< / code > < / pre > < / div > < / div >
< p > Activer Unbound (ILS SONT ACTIFS DES LEUR INSTALLATION)< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > systemctl enable unbound-resolvconf
systemctl enable unbound
< / code > < / pre > < / div > < / div >
< p > Redémarrer le serveur< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > systemctl reboot
< / code > < / pre > < / div > < / div >
< p > Après redémarrage et connexion au serveur< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > systemctl status unbound unbound-resolvconf resolvconf
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ● unbound.service - Unbound DNS server
Loaded: loaded (/lib/systemd/system/unbound.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2020-05-10 12:10:30 CEST; 18s ago
Docs: man:unbound(8)
Process: 562 ExecStartPre=/usr/lib/unbound/package-helper chroot_setup (code=exited, status=0/SUCCESS)
Process: 601 ExecStartPre=/usr/lib/unbound/package-helper root_trust_anchor_update (code=exited, status=0/SUCC
Main PID: 609 (unbound)
Tasks: 4 (limit: 2313)
Memory: 27.2M
CGroup: /system.slice/unbound.service
└─609 /usr/sbin/unbound -d
● unbound-resolvconf.service - Unbound DNS server via resolvconf
Loaded: loaded (/lib/systemd/system/unbound-resolvconf.service; enabled; vendor preset: enabled)
Active: active (exited) since Sun 2020-05-10 12:10:30 CEST; 18s ago
Process: 613 ExecStart=/usr/lib/unbound/package-helper resolvconf_start (code=exited, status=0/SUCCESS)
Main PID: 613 (code=exited, status=0/SUCCESS)
● resolvconf.service - Nameserver information manager
Loaded: loaded (/lib/systemd/system/resolvconf.service; enabled; vendor preset: enabled)
Active: active (exited) since Sun 2020-05-10 12:10:25 CEST; 23s ago
Docs: man:resolvconf(8)
Process: 197 ExecStartPre=/bin/mkdir -p /run/resolvconf/interface (code=exited, status=0/SUCCESS)
Process: 203 ExecStartPre=/bin/touch /run/resolvconf/postponed-update (code=exited, status=0/SUCCESS)
Process: 205 ExecStart=/sbin/resolvconf --enable-updates (code=exited, status=0/SUCCESS)
Main PID: 205 (code=exited, status=0/SUCCESS)
< / code > < / pre > < / div > < / div >
< h4 id = "vérifications" > Vérifications< / h4 >
< p > Les commandes suivantes ne fonctionneront que si le paquet “dnsutils” est installé sur votre système Debian!< / p >
< p > On teste en utilisant les serveurs DNS locaux< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > dig @127.0.0.1 afnic.fr +short +dnssec
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > 192.134.5.37
A 13 2 600 20200608204052 20200509084949 30435 afnic.fr. eVchVAseJD5n8W7U8okAz546Ix33hOCqRF7wLrhUV+sOTkwyXo7EwAut k/rN8wsPVpTnTpFyQLKdBTuOpx2UxA==
< / code > < / pre > < / div > < / div >
< h4 id = "mise-à-jour-des-serveurs-dns-racines" > Mise à jour des serveurs DNS racines< / h4 >
< p > Télécharger le script< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > curl -o /etc/unbound/dnsunbound-update-root-dns.sh https://yann.cinay.eu/files/dnsunbound-update-root-dns.sh
< / code > < / pre > < / div > < / div >
< p > Droits en exécution pour le bash < strong > dnsunbound-update-root-dns.sh< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > chmod +x /etc/unbound/dnsunbound-update-root-dns.sh
< / code > < / pre > < / div > < / div >
< p > Planification journalière< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > crontab -e
< / code > < / pre > < / div > < / div >
< p > Ajouter en fin de fichier< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # Mise à jour automatique des serveurs DNS de la racine
10 02 * * * /etc/unbound/dnsunbound-update-root-dns.sh > /dev/null
< / code > < / pre > < / div > < / div >
< h3 id = "wireguard-ui" > Wireguard UI< / h3 >
< h4 id = "gestion-web-wireguard" > Gestion web wireguard< / h4 >
< p > Création dossier application wev< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo mkdir -p /opt/appwg
< / code > < / pre > < / div > < / div >
< p > Copier le git wg-gen-web< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > cd ~
git clone https://gitea.cinay.eu/yann/wg-gen-web.git
< / code > < / pre > < / div > < / div >
< p > Construction du site< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > cd /home/vpsrnm/wg-gen-web/cmd/wg-gen-web/
go build -o deb-wg-gen-web
cd ../../ui
npm install
npm run build
sudo cp /home/vpsrnm/wg-gen-web/cmd/wg-gen-web/deb-wg-gen-web /opt/appwg
sudo mkdir -p /opt/appwg/ui
sudo cp -r /home/vpsrnm/wg-gen-web/ui/dist /opt/appwg/ui/
< / code > < / pre > < / div > < / div >
< h4 id = "proxy-nginx---wgrnmkcyeu" > Proxy nginx - wg.rnmkcy.eu< / h4 >
< p > configuration < strong > /etc/nginx/conf.d/wg.rnmkcy.eu.conf< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # /etc/nginx/conf.d/wg.rnmkcy.eu.conf
##
# Virtual Host wg.rnmkcy.eu (wireguard UI)
##
server {
listen 80;
listen [::]:80;
## redirect http to https ##
server_name wg.rnmkcy.eu;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name wg.rnmkcy.eu;
include ssl_dh_headers_ocsp;
# Proxy deb-wg-gen-web
location / {
proxy_pass http://localhost:8080;
}
}
< / code > < / pre > < / div > < / div >
< p > On vérifie et on relance le serveur nginx< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo nginx -t
sudo systemctl reload nginx
ocsp_cache
< / code > < / pre > < / div > < / div >
< h4 id = "configuration-env" > Configuration .env< / h4 >
< p > Créer le fichier de configuration < strong > .env< / strong > (pas de oath et messagerie) à partir du modèle< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # IP address to listen to
SERVER=0.0.0.0
# port to bind
PORT=8080
# Gin framework release mode
GIN_MODE=release
# where to write all generated config files
WG_CONF_DIR=./wireguard
# WireGuard main config file name, generally < interface name> .conf
WG_INTERFACE_NAME=wg0.conf
# SMTP settings to send email to clients
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USERNAME=account@gmail.com
SMTP_PASSWORD=*************
SMTP_FROM=Wg Gen Web < account@gmail.com>
# example with gitlab, which is RFC implementation and no need any custom stuff
OAUTH2_PROVIDER_NAME=oauth2oidc
OAUTH2_PROVIDER=https://gitlab.com
OAUTH2_CLIENT_ID=
OAUTH2_CLIENT_SECRET=
OAUTH2_REDIRECT_URL=https://wg-gen-web-demo.127-0-0-1.fr
# example with google
OAUTH2_PROVIDER_NAME=google
OAUTH2_PROVIDER=
OAUTH2_CLIENT_ID=
OAUTH2_CLIENT_SECRET=
OAUTH2_REDIRECT_URL=
# example with github
OAUTH2_PROVIDER_NAME=github
OAUTH2_PROVIDER=https://github.com
OAUTH2_CLIENT_ID=
OAUTH2_CLIENT_SECRET=
OAUTH2_REDIRECT_URL=https://wg-gen-web-demo.127-0-0-1.fr
# set provider name to fake to disable auth, also the default
OAUTH2_PROVIDER_NAME=fake
< / code > < / pre > < / div > < / div >
< p > Dans le cas ou l’ ’ < strong > /opt/appwg/.env< / strong > se résume à remplir la zone correspondante SMTP de la messagerie et désactiver l’ < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > /opt/appwg/.env
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # IP address to listen to
SERVER=0.0.0.0
# port to bind
PORT=8080
# Gin framework release mode
GIN_MODE=release
# where to write all generated config files
WG_CONF_DIR=./wireguard
# WireGuard main config file name, generally < interface name> .conf
WG_INTERFACE_NAME=wg0.conf
# SMTP settings to send email to clients
SMTP_HOST=smtp.gmail.com
SMTP_PORT=587
SMTP_USERNAME=account@gmail.com
SMTP_PASSWORD=*************
SMTP_FROM=Wg Gen Web < account@gmail.com>
# set provider name to fake to disable auth, also the default
OAUTH2_PROVIDER_NAME=fake
< / code > < / pre > < / div > < / div >
< h4 id = "créer-le-service-wgwebservice" > Créer le service wgweb.service< / h4 >
< p > Tester manuellement le fonctionnement< br / >
Ouvrir un terminal< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s
cd /opt/appwg/
./deb-wg-gen-web # arrêt par Ctrl C
< / code > < / pre > < / div > < / div >
< p > Ouvrir le lien https://wg.rnmkcy.eu < br / >
Les échanges sont affichés dans la fenêtre du terminal< / p >
< p > < img src = "/images/wg-web-01.png" alt = "" width = "700" / > < / p >
< p > Créer un service systemd < strong > wgweb< / strong > qui lance le serveur avec journalisation< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo nano /etc/systemd/system/wgweb.service
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > [Unit]
Description=Gestion web wg
After=network.target
[Service]
Type=simple
Restart=on-failure
RestartSec=10
WorkingDirectory=/opt/appwg
ExecStart=/opt/appwg/deb-wg-gen-web
[Install]
WantedBy=multi-user.target
< / code > < / pre > < / div > < / div >
< p > Recharger < code class = "language-plaintext highlighter-rouge" > systemd< / code > puis démarrer le service:< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl daemon-reload
sudo systemctl start wgweb.service
sudo systemctl status wgweb.service
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ● wgweb.service - Gestion web wg
Loaded: loaded (/etc/systemd/system/wgweb.service; enabled; vendor preset: enabled)
Active: active (running) since Sun 2020-05-10 19:36:04 CEST; 8s ago
Main PID: 30363 (deb-wg-gen-web)
Tasks: 5 (limit: 2313)
Memory: 8.7M
CGroup: /system.slice/wgweb.service
└─30363 /opt/appwg/deb-wg-gen-web
mai 10 18:01:13 rnmkcy.eu systemd[1]: Started Gestion web wg.
mai 10 18:01:15 rnmkcy.eu deb-wg-gen-web[30004]: time="2020-05-10T18:01:15+02:00" level=info msg="Lancement de la version Web de Wg Gen : yann"
mai 10 18:01:15 rnmkcy.eu deb-wg-gen-web[30004]: time="2020-05-10T18:01:15+02:00" level=warning msg="Oauth n'est pas utilisé, aucune authentification réelle ne sera effectuée"
< / code > < / pre > < / div > < / div >
< p > Vérifier sur le lien https://wg.rnmkcy.eu< br / >
Activer le service si tout fonctionne< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl enable wgweb.service
< / code > < / pre > < / div > < / div >
< p > Pour suivre dans le journal< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo journalctl -f -t deb-wg-gen-web
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > -- Logs begin at Sun 2020-05-10 12:10:25 CEST. --
mai 10 20:02:09 rnmkcy.eu deb-wg-gen-web[30457]: [GIN] 2020/05/10 - 20:02:09 | 200 | 27.49257ms | 127.0.0.1 | PATCH "/api/v1.0/server"
mai 10 20:03:22 rnmkcy.eu deb-wg-gen-web[30457]: [GIN] 2020/05/10 - 20:03:22 | 200 | 243.07µs | ::1 | GET "/api/v1.0/client"
mai 10 20:03:22 rnmkcy.eu deb-wg-gen-web[30457]: [GIN] 2020/05/10 - 20:03:22 | 200 | 253.995µs | 127.0.0.1 | GET "/api/v1.0/server"
mai 10 20:03:22 rnmkcy.eu deb-wg-gen-web[30457]: [GIN] 2020/05/10 - 20:03:22 | 200 | 860.702µs | ::1 | GET "/api/v1.0/server/config"
mai 10 20:05:19 rnmkcy.eu deb-wg-gen-web[30457]: [GIN] 2020/05/10 - 20:05:19 | 200 | 197.038µs | 127.0.0.1 | GET "/api/v1.0/server"
mai 10 20:05:19 rnmkcy.eu deb-wg-gen-web[30457]: [GIN] 2020/05/10 - 20:05:19 | 200 | 2.758656ms | ::1 | GET "/api/v1.0/server/config"
mai 10 20:06:17 rnmkcy.eu deb-wg-gen-web[30457]: [GIN] 2020/05/10 - 20:06:17 | 200 | 1.287984ms | 127.0.0.1 | PATCH "/api/v1.0/server"
< / code > < / pre > < / div > < / div >
< h4 id = "paramètres-wireguard-du-serveur-wg0conf-et-serverjson" > Paramètres wireguard du serveur (wg0.conf et server.json)< / h4 >
< p > Arrêt du service< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl stop wgweb.service
< / code > < / pre > < / div > < / div >
< p > Modifier les fichiers existants pour être identique au paramétrage de wireguard < strong > wg0.conf< / strong > situé sous < strong > /etc/wireguard< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > /opt/appwg/wireguard/server.json
< / code > < / pre > < / div > < / div >
< div class = "language-json highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > < span class = "p" > {< / span > < span class = "w" >
< / span > < span class = "nl" > "address"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "p" > [< / span > < span class = "w" >
< / span > < span class = "s2" > "fd9f:6666::10:6:6:1/64"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "s2" > "10.6.6.1/24"< / span > < span class = "w" >
< / span > < span class = "p" > ],< / span > < span class = "w" >
< / span > < span class = "nl" > "listenPort"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "mi" > 51820< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "mtu"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "mi" > 0< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "privateKey"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "UEQCgh/6a2RQbF9+qqylVjqLCK/mRwqRPc/4vjRsYXg="< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "publicKey"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "0s1wsNpuU1RlKgj6AmoN0aKUeb+aESByhO3yTSnfTyE="< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "endpoint"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "wireguard.example.com:123"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "persistentKeepalive"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "mi" > 16< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "dns"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "p" > [< / span > < span class = "w" >
< / span > < span class = "s2" > "fd9f::10:0:0:2"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "s2" > "10.0.0.2"< / span > < span class = "w" >
< / span > < span class = "p" > ],< / span > < span class = "w" >
< / span > < span class = "nl" > "allowedips"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "p" > [< / span > < span class = "w" >
< / span > < span class = "s2" > "0.0.0.0/0"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "s2" > "::/0"< / span > < span class = "w" >
< / span > < span class = "p" > ],< / span > < span class = "w" >
< / span > < span class = "nl" > "preUp"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "echo WireGuard PreUp"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "postUp"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "echo WireGuard PostUp"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "preDown"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "echo WireGuard PreDown"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "postDown"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "echo WireGuard PostDown"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "updatedBy"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > ""< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "created"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "2020-05-10T17:31:50.589913433Z"< / span > < span class = "p" > ,< / span > < span class = "w" >
< / span > < span class = "nl" > "updated"< / span > < span class = "p" > :< / span > < span class = "w" > < / span > < span class = "s2" > "2020-05-10T17:31:50.589913433Z"< / span > < span class = "w" >
< / span > < / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > cat /opt/appwg/wireguard/wg0.conf
< / code > < / pre > < / div > < / div >
< div class = "language-ini highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > < span class = "c" > # Updated: 2020-05-10 17:31:50.589913433 +0000 UTC / Created: 2020-05-10 17:31:50.589913433 +0000 UTC
< / span > < span class = "nn" > [Interface]< / span >
< span class = "py" > Address< / span > < span class = "p" > =< / span > < span class = "s" > fd9f:6666::10:6:6:1/64< / span >
< span class = "py" > Address< / span > < span class = "p" > =< / span > < span class = "s" > 10.6.6.1/24< / span >
< span class = "py" > ListenPort< / span > < span class = "p" > =< / span > < span class = "s" > 51820< / span >
< span class = "py" > PrivateKey< / span > < span class = "p" > =< / span > < span class = "s" > UEQCgh/6a2RQbF9+qqylVjqLCK/mRwqRPc/4vjRsYXg=< / span >
< span class = "py" > PreUp< / span > < span class = "p" > =< / span > < span class = "s" > echo WireGuard PreUp< / span >
< span class = "py" > PostUp< / span > < span class = "p" > =< / span > < span class = "s" > echo WireGuard PostUp< / span >
< span class = "py" > PreDown< / span > < span class = "p" > =< / span > < span class = "s" > echo WireGuard PreDown< / span >
< / code > < / pre > < / div > < / div >
< p > Après modifications, les < u > 2 fichiers sont déplacés vers le dossier **/et/wireguard**< / u > < br / >
On modifie dans < strong > /opt/appwg/.env< / strong > ,le paramètre WG_CONF_DIR=./wireguard → < code class = "language-plaintext highlighter-rouge" > WG_CONF_DIR=/etc/wireguard< / code > < br / >
On relance le service< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl start wgweb
< / code > < / pre > < / div > < / div >
< h4 id = "activation-service-wireguard-wg-quickwg0service" > Activation service wireguard wg-quick@wg0.service< / h4 >
< p > Le gestionnaire web est à jour , on peut lancer le serveur wireguard< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl start wg-quick@wg0.service
< / code > < / pre > < / div > < / div >
< p > Vérifier< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > systemctl status wg-quick@wg0.service
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ● wg-quick@wg0.service - WireGuard via wg-quick(8) for wg0
Loaded: loaded (/lib/systemd/system/wg-quick@.service; disabled; vendor preset: enabled)
Active: active (exited) since Sun 2020-05-10 20:10:08 CEST; 10s ago
Docs: man:wg-quick(8)
man:wg(8)
https://www.wireguard.com/
https://www.wireguard.com/quickstart/
https://git.zx2c4.com/wireguard-tools/about/src/man/wg-quick.8
https://git.zx2c4.com/wireguard-tools/about/src/man/wg.8
Process: 30521 ExecStart=/usr/bin/wg-quick up wg0 (code=exited, status=0/SUCCESS)
Main PID: 30521 (code=exited, status=0/SUCCESS)
mai 10 20:10:07 rnmkcy.eu systemd[1]: Starting WireGuard via wg-quick(8) for wg0...
mai 10 20:10:07 rnmkcy.eu wg-quick[30521]: [#]
mai 10 20:10:07 rnmkcy.eu wg-quick[30521]: [#] ip link add wg0 type wireguard
mai 10 20:10:07 rnmkcy.eu wg-quick[30521]: [#] wg setconf wg0 /dev/fd/63
mai 10 20:10:07 rnmkcy.eu wg-quick[30521]: [#] ip -6 address add fd51:6547:3aa2:3ab6::1/64 dev wg0
mai 10 20:10:07 rnmkcy.eu wg-quick[30521]: [#] ip -4 address add 10.19.55.1/24 dev wg0
mai 10 20:10:07 rnmkcy.eu wg-quick[30521]: [#] ip link set mtu 1420 up dev wg0
mai 10 20:10:07 rnmkcy.eu wg-quick[30521]: [#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUT
mai 10 20:10:08 rnmkcy.eu systemd[1]: Started WireGuard via wg-quick(8) for wg0.
< / code > < / pre > < / div > < / div >
< h4 id = "appliquer-automatiquement-les-modifications-apportées-à-wireguard" > Appliquer automatiquement les modifications apportées à WireGuard< / h4 >
< p > Utilisation de < strong > systemd.path< / strong > monitor pour les changements dans le répertoire, voir < a href = "https://www.freedesktop.org/software/systemd/man/systemd.path.html" > systemd doc< / a > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > /etc/systemd/system/wg-gen-web.path
< / code > < / pre > < / div > < / div >
< pre > < code class = "language-init" > [Unit]
Description=Surveiller /etc/wireguard pour les changements
[Path]
PathModified=/etc/wireguard
[Install]
WantedBy=multi-user.target
< / code > < / pre >
< p > Ce < strong > wg-gen-web.path< / strong > activera le fichier de l’ < strong > wg-gen-web.service< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > /etc/systemd/system/wg-gen-web.service
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > [Unit]
Description=Relancer WireGuard si changements
After=network.target
[Service]
Type=oneshot
ExecStart=/usr/bin/systemctl restart wg-quick@wg0.service
[Install]
WantedBy=multi-user.target
< / code > < / pre > < / div > < / div >
< p > Ce qui permettra de relancer le service WireGuard< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl start wg-gen-web.path
sudo systemctl status wg-gen-web.path
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ● wg-gen-web.path - Surveiller /etc/wireguard pour les changements
Loaded: loaded (/etc/systemd/system/wg-gen-web.path; disabled; vendor preset: enabled)
Active: active (waiting) since Sun 2020-05-10 21:04:50 CEST; 13s ago
mai 10 21:04:50 rnmkcy.eu systemd[1]: Started Surveiller /etc/wireguard pour les changements.
< / code > < / pre > < / div > < / div >
< p > Activation< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo systemctl enable wg-gen-web.path
< / code > < / pre > < / div > < / div >
< p > Pour suivre dans le journal< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo journalctl -f -t wg-quick
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > -- Logs begin at Sun 2020-05-10 12:10:25 CEST. --
mai 10 20:25:41 rnmkcy.eu wg-quick[31291]: [#]
mai 10 20:25:41 rnmkcy.eu wg-quick[31291]: [#] ip link delete dev wg0
mai 10 20:25:42 rnmkcy.eu wg-quick[31291]: [#] iptables -D FORWARD -i wg0 -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE; ip6tables -D FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -D POSTROUTING -o eth0 -j MASQUERADE
mai 10 20:25:43 rnmkcy.eu wg-quick[31326]: [#]
mai 10 20:25:43 rnmkcy.eu wg-quick[31326]: [#] ip link add wg0 type wireguard
mai 10 20:25:43 rnmkcy.eu wg-quick[31326]: [#] wg setconf wg0 /dev/fd/63
mai 10 20:25:44 rnmkcy.eu wg-quick[31326]: [#] ip -6 address add fd51:6547:3aa2:3ab6::1/64 dev wg0
mai 10 20:25:44 rnmkcy.eu wg-quick[31326]: [#] ip -4 address add 10.19.55.1/24 dev wg0
mai 10 20:25:44 rnmkcy.eu wg-quick[31326]: [#] ip link set mtu 1420 up dev wg0
mai 10 20:25:44 rnmkcy.eu wg-quick[31326]: [#] iptables -A FORWARD -i wg0 -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE; ip6tables -A FORWARD -i wg0 -j ACCEPT; ip6tables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
< / code > < / pre > < / div > < / div >
< h3 id = "authentification-2fa-facultatif" > Authentification 2FA (facultatif)< / h3 >
< p > Authentification à 2 facteurs pour créer un accès protégé au générateur web wireguard< br / >
On passe en mode su < br / >
Le dossier web par défaut : < strong > /var/www/default-www/< / strong > < / p >
< h4 id = "installation-création-de-la-base-utilisateurs-et-ajout-utlisateur" > Installation, création de la base utilisateurs et ajout utlisateur< / h4 >
< p > Cloner le dépot “twofactorauth” dans /var/www/default-www/ et établir les droits< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > git clone https://gitea.cinay.eu/yann/twofactorauth.git /var/www/default-www/twofactorauth
chown www-data.www-data -R /var/www/default-www/twofactorauth
< / code > < / pre > < / div > < / div >
< p > Vérifier si sqlit3 est installé en fonction de la version php utilisée< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > php --version # PHP 7.4.5 dans le cas présent
dpkg -l | grep php7.4 |grep sql # sqlite3 ?
apt install php7.4-sqlite3 # installer sqlite3 si pas présent
< / code > < / pre > < / div > < / div >
< p > Moddifier à votre convenance le fichier < strong > config.php< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > define('QRCODE_TITLE','rnmkcy.eu');
define('AUTH_SUCCEED_REDIRECT_URL','https://rnmkcy.eu/');
define('SESSION_NAME','2farnm');
< / code > < / pre > < / div > < / div >
< p > Installer l’ < / p >
< p > < img src = "/images/2farnm01.png" alt = "" width = "400" / > < / p >
< p > < img src = "/images/2farnm02.png" alt = "" width = "400" / > < br / >
Scanner le code QR sur application android andOTP , puis fermer< / p >
< p > < img src = "/images/2farnm03.png" alt = "" width = "400" / > < br / >
Cliquer sur le lien< / p >
< p > < img src = "/images/2farnm04.png" alt = "" width = "400" / > < br / >
Ajouter un utilisateur< / p >
< p > < img src = "/images/2farnm05.png" alt = "" width = "400" / > < / p >
< p > < img src = "/images/2farnm06.png" alt = "" width = "400" / > < / p >
< p > < img src = "/images/2farnm07.png" alt = "" width = "400" / > < br / >
Liste des utilisateurs, fermer la page< / p >
< h4 id = "paramétrage-nginx-auth_request" > Paramétrage nginx auth_request< / h4 >
< p > Modifier la configuration existante < strong > /etc/nginx/conf.d/rnmkcy.eu.conf< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > map $request_uri $loggable {
/submit/api/submit 1;
default 0;
}
log_format phpcookie '$remote_addr - $remote_user [$time_local] '
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent" - "$http_cookie"';
# /etc/nginx/conf.d/rnmkcy.eu.conf
##
# Virtual Host rnmkcy.eu
##
server {
listen 80;
listen [::]:80;
## redirect http to https ##
server_name rnmkcy.eu;
return 301 https://$server_name$request_uri;
}
server {
listen 443 ssl http2;
listen [::]:443 ssl http2;
server_name rnmkcy.eu;
include ssl_dh_headers_ocsp;
root /var/www/default-www/ ;
index index.php;
error_page 401 = @error401;
location @error401 {
return 302 $scheme://$host/twofactorauth/login/login.php?from=$uri;
}
location = /twofactorauth/nginx/auth.php {
include /etc/nginx/fastcgi.conf;
fastcgi_param CONTENT_LENGTH "";
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
}
location /twofactorauth/ {
index index.php;
}
location /twofactorauth/db/ {
deny all;
}
location = /twofactorauth/login/login.php {
allow all;
auth_request off;
include /etc/nginx/fastcgi.conf;
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
}
location ~ \.php {
include /etc/nginx/fastcgi.conf;
fastcgi_pass unix:/run/php/php7.4-fpm.sock;
}
location /static/ {
alias /var/www/html/static/;
}
location / {
#access_log /var/log/nginx/yann.log phpcookie if=$loggable;
proxy_pass https://rnmkcy.eu;
auth_request /twofactorauth/nginx/auth.php;
proxy_buffering off;
}
}
< / code > < / pre > < / div > < / div >
< p > Vérifier et relancer nginx< / p >
< p > Aller sur le site https://rnmkcy.eu , vous serez invité à saisir un utilisateur , un mot de passe at le jeton correspondant< / p >
< h2 id = "sauvegarde-borgbackup" > Sauvegarde BorgBackup< / h2 >
< p > < img src = "/images/borg-logo.png" alt = "" / > < / p >
< p > < strong > Préparation de la machine à sauvegarder< / strong > < br / >
On se connecte sur la machine et on passe en mode su< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s
apt update
< / code > < / pre > < / div > < / div >
< p > Installer borgbackup< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > apt install borgbackup
< / code > < / pre > < / div > < / div >
< p > < strong > < u > Créer un jeu de clé sur machine à sauvegarder (rnmkcy.eu)< / u > < / strong > < br / >
Créer un utilisateur borg (sans home) dédié aux sauvegardes par BorgBackup :< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > useradd -M borg
< / code > < / pre > < / div > < / div >
< p > Générer un jeu de clé sur < strong > /root/.ssh< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > mkdir -p /root/.ssh
ssh-keygen -t ed25519 -o -a 100 -f /root/.ssh/rnmkcy_eu_ed25519
< / code > < / pre > < / div > < / div >
< p > Le jeu de clé< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ls /root/.ssh
rnmkcy_eu_ed25519 rnmkcy_eu_ed25519.pub
< / code > < / pre > < / div > < / div >
< p > Autoriser utilisateur < strong > borg< / strong > à exécuter < em > /usr/bin/borg< / em > uniquement< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > echo "borg ALL=NOPASSWD: /usr/bin/borg" > > /etc/sudoers
< / code > < / pre > < / div > < / div >
< p > < strong > Ajout clé publique au serveur backup xoyaz.xyz< / strong > < / p >
< blockquote >
< p > Pour une connexion via ssh vous devez ajouter la clé publique < em > rnmkcy_eu_ed25519.pub< / em > du < strong > serveur client rnmkcy.eu< / strong > au fichier < em > ~/.ssh/authorized_keys< / em > du < strong > serveur backup xoyaz.xyz< / strong > < / p >
< / blockquote >
< p > Se connecter au < strong > serveur backup xoyaz.xyz< / strong > depuis un terminal autorisé< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > ssh usernl@5.2.79.107 -p 55036 -i /home/yannick/.ssh/OVZ-STORAGE-128 # connexion SSH serveur backup depuis PC1
sudo -s # passer en super utilisateur
cat > > /srv/data/borg-backups/.ssh/authorized_keys
< / code > < / pre > < / div > < / div >
< p > Copier/coller le contenu du fichier du fichier de clef publique (fichier < strong > /root/.ssh/rnmkcy_eu_ed25519.pub< / strong > de la machine à sauvegarder < strong > rnmkcy.eu< / strong > ) dans ce terminal, et presser < strong > [Ctrl]+[D]< / strong > pour valider.< / p >
< p > Test depuis le serveur client < strong > rnmkcy.eu< / strong > (c’ < br / >
< em > Si parefeu avec les sorties bloquées sur < strong > rnmkcy.eu< / strong > , il faut ouvrir en sortie le port TCP 55036.< / em > < / p >
< p > < strong > AU PREMIER passage une question est posée , saisir oui ou yes< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s
ssh -p 55036 -i /root/.ssh/rnmkcy_eu_ed25519 borg@xoyaz.xyz
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > The authenticity of host '[xoyaz.xyz]:55036 ([2a04:52c0:101:7ae::7a5e]:55036)' can't be established.
ECDSA key fingerprint is SHA256:PDXQBhTh4oj0cSzgnjCun+J60JDUEk7VeLH2YHZbwMc.
Are you sure you want to continue connecting (yes/no)? yes
hosts.
Linux backup 2.6.32-042stab140.1 #1 SMP Thu Aug 15 13:32:22 MSK 2019 x86_64
_ _
| |__ __ _ __ | |__ _ _ _ __
| '_ \/ _` |/ _|| / /| || || '_ \
|_.__/\__,_|\__||_\_\ \_,_|| .__/
__ __ ___ _ _ __ _ ___ |_|_ __ _ _ ___
\ \ // _ \| || |/ _` ||_ / _ \ \ /| || ||_ /
/_\_\\___/ \_, |\__,_|/__|(_)/_\_\ \_, |/__|
|__/ |__/
Last login: Sun Apr 12 19:33:05 2020 from 2001:41d0:404:200::1cf
$
< / code > < / pre > < / div > < / div >
< p > saisir < code class = "language-plaintext highlighter-rouge" > exit< / code > pour sortir< / p >
< blockquote >
< p > NOTE : < strong > /srv/data/borg-backups< / strong > est le home de l’ < em > borg< / em > sur le serveur backup < em > xoyaz.xyz< / em > < / p >
< / blockquote >
< p > < strong > Création dépôt et lancement des sauvegardes depuis la machine à sauvegarder< / strong > < / p >
< p > < strong > < u > machine cliente rnmkcy.eu< / u > < / strong > < br / >
On se connecte sur la machine et on passe en mode su< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > sudo -s
< / code > < / pre > < / div > < / div >
< p > < strong > Création du dépôt distant sur le serveur backup xoyaz.xyz (A FAIRE UNE SEULE FOIS)< / strong > < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > export BORG_RSH='ssh -i /root/.ssh/rnmkcy_eu_ed25519' # ce n'est pas la clé par défaut id_rsa
borg init --encryption=repokey-blake2 ssh://borg@xoyaz.xyz:55036/srv/data/borg-backups/rnmkcy.eu
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > Enter new passphrase:
Enter same passphrase again:
Do you want your passphrase to be displayed for verification? [yN]:
By default repositories initialized with this version will produce security
errors if written to with an older version (up to and including Borg 1.0.8).
If you want to use these older versions, you can disable the check by running:
borg upgrade --disable-tam ssh://borg@xoyaz.xyz:55036/srv/data/borg-backups/rnmkcy.eu
See https://borgbackup.readthedocs.io/en/stable/changes.html#pre-1-0-9-manifest-spoofing-vulnerability for details about the security implications.
IMPORTANT: you will need both KEY AND PASSPHRASE to access this repo!
Use "borg key export" to export the key, optionally in printable format.
Write down the passphrase. Store both at safe place(s).
< / code > < / pre > < / div > < / div >
< p > Sauvegarder la “passphrase” dans un fichier pour une procédure automatique< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > mkdir -p /root/.borg
nano /root/.borg/passphrase
< / code > < / pre > < / div > < / div >
< p > < strong > Générer une sauvegarde d’ < / strong > pour test (facultatif)< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > borg create ssh://borg@xoyize.xyz:55029/srv/ssd-two/borg-backups/rnmkcy.eu::2019-01-11 /home/yanfi
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > Enter passphrase for key ssh://borg@xoyize.xyz:55029/srv/ssd-two/borg-backups/rnmkcy.eu:
< / code > < / pre > < / div > < / div >
< p > < strong > Automatiser la procédure de sauvegarde pour le client rnmkcy.eu< / strong > < br / >
script de sauvegarde (notez l’ < / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > nano /root/.borg/borg-backup
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > #!/bin/sh
#
# Script de sauvegarde.
#
# Envoie les sauvegardes sur un serveur distant, via le programme Borg.
# Les sauvegardes sont chiffrées
#
set -e
BACKUP_DATE=`date +%Y-%m-%d-%Hh%M`
LOG_PATH=/var/log/borg-backup.log
export BORG_PASSPHRASE="`cat ~root/.borg/passphrase`"
export BORG_RSH='ssh -i /root/.ssh/rnmkcy_eu_ed25519'
BORG_REPOSITORY=ssh://borg@xoyaz.xyz:55036/srv/data/borg-backups/rnmkcy.eu
BORG_ARCHIVE=${BORG_REPOSITORY}::${BACKUP_DATE}
borg create \
-v --progress --stats --compression lzma,9 \
--exclude-from /root/.borg/exclusions --exclude-caches \
$BORG_ARCHIVE \
/bin /boot /etc /home /lib /lib64 /opt /root /sbin /srv /usr /var \
> > ${LOG_PATH} 2> & 1
# Nettoyage des anciens backups
# On conserve
# - une archive par jour les 7 derniers jours,
# - une archive par semaine pour les 4 dernières semaines,
# - une archive par mois pour les 6 derniers mois.
borg prune \
-v --list --stats --keep-daily=7 --keep-weekly=4 --keep-monthly=6 \
$BORG_REPOSITORY \
> > ${LOG_PATH} 2> & 1
< / code > < / pre > < / div > < / div >
< p > Le rendre exécutable< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > chmod +x /root/.borg/borg-backup
< / code > < / pre > < / div > < / div >
< p > Fichier < strong > /root/.borg/exclusions< / strong > pour ne pas sauvegarder, entre autre,le point de montage ssfs “music” (si existant)< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > /dev
/proc
/sys
/tmp
/run
/mnt
/media
/home/vpsrnm/music
lost+found
< / code > < / pre > < / div > < / div >
< p > Programmer la tâche à 2h50 du matin< / p >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > crontab -e
< / code > < / pre > < / div > < / div >
< div class = "language-plaintext highlighter-rouge" > < div class = "highlight" > < pre class = "highlight" > < code > # Sauvegarde sur distant avec BorgBackup
50 02 * * * /root/.borg/borg-backup > /dev/null
< / code > < / pre > < / div > < / div >
< h2 id = "ssl-labs" > SSL Labs< / h2 >
< p > < a href = "https://www.ssllabs.com/ssltest/analyze.html?d=rnmkcy.eu" > https://www.ssllabs.com/ssltest/analyze.html?d=rnmkcy.eu< / a > < / p >
< p > < img src = "/images/ssllabs-cinay.eu.png" alt = "" width = "400" / > < / p >
< / div >
< div class = "d-print-none" > < footer class = "article__footer" > < meta itemprop = "dateModified" content = "2020-10-11T00:00:00+02:00" > <!-- start custom article footer snippet -->
<!-- end custom article footer snippet -->
<!--
< div align = "right" > < a type = "application/rss+xml" href = "/feed.xml" title = "S'abonner" > < i class = "fa fa-rss fa-2x" > < / i > < / a >
  < / div >
-->
< / footer >
< div class = "article__section-navigator clearfix" > < div class = "previous" > < span > PRÉCÉDENT< / span > < a href = "/2020/10/04/Mullvad-linux-Desktop-et-Android.html" > Mullvad linux Desktop et Android< / a > < / div > < div class = "next" > < span > SUIVANT< / span > < a href = "/2020/10/21/Nginx-reverse-proxy+SSL-certbot.html" > Nginx reverse proxy + SSL (certbot)< / a > < / div > < / div > < / div >
< / div >
< script > ( f u n c t i o n ( ) {
var SOURCES = window.TEXT_VARIABLES.sources;
window.Lazyload.js(SOURCES.jquery, function() {
$(function() {
var $this ,$scroll;
var $articleContent = $('.js-article-content');
var hasSidebar = $('.js-page-root').hasClass('layout--page--sidebar');
var scroll = hasSidebar ? '.js-page-main' : 'html, body';
$scroll = $(scroll);
$articleContent.find('.highlight').each(function() {
$this = $(this);
$this.attr('data-lang', $this.find('code').attr('data-lang'));
});
$articleContent.find('h1[id], h2[id], h3[id], h4[id], h5[id], h6[id]').each(function() {
$this = $(this);
$this.append($('< a class = "anchor d-print-none" aria-hidden = "true" > < / a > ').html('< i class = "fas fa-anchor" > < / i > '));
});
$articleContent.on('click', '.anchor', function() {
$scroll.scrollToAnchor('#' + $(this).parent().attr('id'), 400);
});
});
});
})();
< / script >
< / div > < section class = "page__comments d-print-none" > < / section > < / article > <!-- start custom main bottom snippet -->
<!-- end custom main bottom snippet -->
< / div >
< / div > < / div > < / div > < / div >
< / div > < script > ( f u n c t i o n ( ) {
var SOURCES = window.TEXT_VARIABLES.sources;
window.Lazyload.js(SOURCES.jquery, function() {
var $body = $('body'), $window = $(window);
var $pageRoot = $('.js-page-root'), $pageMain = $('.js-page-main');
var activeCount = 0;
function modal(options) {
var $root = this, visible, onChange, hideWhenWindowScroll = false;
var scrollTop;
function setOptions(options) {
var _options = options || {};
visible = _options.initialVisible === undefined ? false : show;
onChange = _options.onChange;
hideWhenWindowScroll = _options.hideWhenWindowScroll;
}
function init() {
setState(visible);
}
function setState(isShow) {
if (isShow === visible) {
return;
}
visible = isShow;
if (visible) {
activeCount++;
scrollTop = $(window).scrollTop() || $pageMain.scrollTop();
$root.addClass('modal--show');
$pageMain.scrollTop(scrollTop);
activeCount === 1 & & ($pageRoot.addClass('show-modal'), $body.addClass('of-hidden'));
hideWhenWindowScroll & & window.hasEvent('touchstart') & & $window.on('scroll', hide);
$window.on('keyup', handleKeyup);
} else {
activeCount > 0 & & activeCount--;
$root.removeClass('modal--show');
$window.scrollTop(scrollTop);
activeCount === 0 & & ($pageRoot.removeClass('show-modal'), $body.removeClass('of-hidden'));
hideWhenWindowScroll & & window.hasEvent('touchstart') & & $window.off('scroll', hide);
$window.off('keyup', handleKeyup);
}
onChange & & onChange(visible);
}
function show() {
setState(true);
}
function hide() {
setState(false);
}
function handleKeyup(e) {
// Char Code: 27 ESC
if (e.which === 27) {
hide();
}
}
setOptions(options);
init();
return {
show: show,
hide: hide,
$el: $root
};
}
$.fn.modal = modal;
});
})();
< / script > < div class = "modal modal--overflow page__search-modal d-print-none js-page-search-modal" > < script >
(function () {
var SOURCES = window.TEXT_VARIABLES.sources;
window.Lazyload.js(SOURCES.jquery, function() {
// search panel
var search = (window.search || (window.search = {}));
var useDefaultSearchBox = window.useDefaultSearchBox === undefined ?
true : window.useDefaultSearchBox ;
var $searchModal = $('.js-page-search-modal');
var $searchToggle = $('.js-search-toggle');
var searchModal = $searchModal.modal({ onChange: handleModalChange, hideWhenWindowScroll: true });
var modalVisible = false;
search.searchModal = searchModal;
var $searchBox = null;
var $searchInput = null;
var $searchClear = null;
function getModalVisible() {
return modalVisible;
}
search.getModalVisible = getModalVisible;
function handleModalChange(visible) {
modalVisible = visible;
if (visible) {
search.onShow & & search.onShow();
useDefaultSearchBox & & $searchInput[0] & & $searchInput[0].focus();
} else {
search.onShow & & search.onHide();
useDefaultSearchBox & & $searchInput[0] & & $searchInput[0].blur();
setTimeout(function() {
useDefaultSearchBox & & ($searchInput.val(''), $searchBox.removeClass('not-empty'));
search.clear & & search.clear();
window.pageAsideAffix & & window.pageAsideAffix.refresh();
}, 400);
}
}
$searchToggle.on('click', function() {
modalVisible ? searchModal.hide() : searchModal.show();
});
// Char Code: 83 S, 191 /
$(window).on('keyup', function(e) {
if (!modalVisible & & !window.isFormElement(e.target || e.srcElement) & & (e.which === 83 || e.which === 191)) {
modalVisible || searchModal.show();
}
});
if (useDefaultSearchBox) {
$searchBox = $('.js-search-box');
$searchInput = $searchBox.children('input');
$searchClear = $searchBox.children('.js-icon-clear');
search.getSearchInput = function() {
return $searchInput.get(0);
};
search.getVal = function() {
return $searchInput.val();
};
search.setVal = function(val) {
$searchInput.val(val);
};
$searchInput.on('focus', function() {
$(this).addClass('focus');
});
$searchInput.on('blur', function() {
$(this).removeClass('focus');
});
$searchInput.on('input', window.throttle(function() {
var val = $(this).val();
if (val === '' || typeof val !== 'string') {
search.clear & & search.clear();
} else {
$searchBox.addClass('not-empty');
search.onInputNotEmpty & & search.onInputNotEmpty(val);
}
}, 400));
$searchClear.on('click', function() {
$searchInput.val(''); $searchBox.removeClass('not-empty');
search.clear & & search.clear();
});
}
});
})();
< / script > < div class = "search search--dark" >
< div class = "main" >
< div class = "search__header" > Recherche< / div >
< div class = "search-bar" >
< div class = "search-box js-search-box" >
< div class = "search-box__icon-search" > < i class = "fas fa-search" > < / i > < / div >
< input id = "search-input" type = "text" / >
< div class = "search-box__icon-clear js-icon-clear" >
< a > < i class = "fas fa-times" > < / i > < / a >
< / div >
< / div >
< button class = "button button--theme-dark button--pill search__cancel js-search-toggle" >
Annuler< / button >
< / div >
< div id = "results-container" class = "search-result js-search-result" > < / div >
< / div >
< / div >
<!-- Script pointing to search - script.js -->
< script > / * !
* Simple-Jekyll-Search
* Copyright 2015-2020, Christian Fei
* Licensed under the MIT License.
*/
(function(){
'use strict'
var _$Templater_7 = {
compile: compile,
setOptions: setOptions
}
const options = {}
options.pattern = /\{(.*?)\}/g
options.template = ''
options.middleware = function () {}
function setOptions (_options) {
options.pattern = _options.pattern || options.pattern
options.template = _options.template || options.template
if (typeof _options.middleware === 'function') {
options.middleware = _options.middleware
}
}
function compile (data) {
return options.template.replace(options.pattern, function (match, prop) {
const value = options.middleware(prop, data[prop], options.template)
if (typeof value !== 'undefined') {
return value
}
return data[prop] || match
})
}
'use strict';
function fuzzysearch (needle, haystack) {
var tlen = haystack.length;
var qlen = needle.length;
if (qlen > tlen) {
return false;
}
if (qlen === tlen) {
return needle === haystack;
}
outer: for (var i = 0, j = 0; i < qlen ; i + + ) {
var nch = needle.charCodeAt(i);
while (j < tlen ) {
if (haystack.charCodeAt(j++) === nch) {
continue outer;
}
}
return false;
}
return true;
}
var _$fuzzysearch_1 = fuzzysearch;
'use strict'
/* removed: const _$fuzzysearch_1 = require('fuzzysearch') */;
var _$FuzzySearchStrategy_5 = new FuzzySearchStrategy()
function FuzzySearchStrategy () {
this.matches = function (string, crit) {
return _$fuzzysearch_1(crit.toLowerCase(), string.toLowerCase())
}
}
'use strict'
var _$LiteralSearchStrategy_6 = new LiteralSearchStrategy()
function LiteralSearchStrategy () {
this.matches = function (str, crit) {
if (!str) return false
str = str.trim().toLowerCase()
crit = crit.trim().toLowerCase()
return crit.split(' ').filter(function (word) {
return str.indexOf(word) >= 0
}).length === crit.split(' ').length
}
}
'use strict'
var _$Repository_4 = {
put: put,
clear: clear,
search: search,
setOptions: __setOptions_4
}
/* removed: const _$FuzzySearchStrategy_5 = require('./SearchStrategies/FuzzySearchStrategy') */;
/* removed: const _$LiteralSearchStrategy_6 = require('./SearchStrategies/LiteralSearchStrategy') */;
function NoSort () {
return 0
}
const data = []
let opt = {}
opt.fuzzy = false
opt.limit = 10
opt.searchStrategy = opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
opt.sort = NoSort
opt.exclude = []
function put (data) {
if (isObject(data)) {
return addObject(data)
}
if (isArray(data)) {
return addArray(data)
}
return undefined
}
function clear () {
data.length = 0
return data
}
function isObject (obj) {
return Boolean(obj) & & Object.prototype.toString.call(obj) === '[object Object]'
}
function isArray (obj) {
return Boolean(obj) & & Object.prototype.toString.call(obj) === '[object Array]'
}
function addObject (_data) {
data.push(_data)
return data
}
function addArray (_data) {
const added = []
clear()
for (let i = 0, len = _data.length; i < len ; i + + ) {
if (isObject(_data[i])) {
added.push(addObject(_data[i]))
}
}
return added
}
function search (crit) {
if (!crit) {
return []
}
return findMatches(data, crit, opt.searchStrategy, opt).sort(opt.sort)
}
function __setOptions_4 (_opt) {
opt = _opt || {}
opt.fuzzy = _opt.fuzzy || false
opt.limit = _opt.limit || 10
opt.searchStrategy = _opt.fuzzy ? _$FuzzySearchStrategy_5 : _$LiteralSearchStrategy_6
opt.sort = _opt.sort || NoSort
opt.exclude = _opt.exclude || []
}
function findMatches (data, crit, strategy, opt) {
const matches = []
for (let i = 0; i < data.length & & matches . length < opt . limit ; i + + ) {
const match = findMatchesInObject(data[i], crit, strategy, opt)
if (match) {
matches.push(match)
}
}
return matches
}
function findMatchesInObject (obj, crit, strategy, opt) {
for (const key in obj) {
if (!isExcluded(obj[key], opt.exclude) & & strategy.matches(obj[key], crit)) {
return obj
}
}
}
function isExcluded (term, excludedTerms) {
for (let i = 0, len = excludedTerms.length; i < len ; i + + ) {
const excludedTerm = excludedTerms[i]
if (new RegExp(excludedTerm).test(term)) {
return true
}
}
return false
}
/* globals ActiveXObject:false */
'use strict'
var _$JSONLoader_2 = {
load: load
}
function load (location, callback) {
const xhr = getXHR()
xhr.open('GET', location, true)
xhr.onreadystatechange = createStateChangeListener(xhr, callback)
xhr.send()
}
function createStateChangeListener (xhr, callback) {
return function () {
if (xhr.readyState === 4 & & xhr.status === 200) {
try {
callback(null, JSON.parse(xhr.responseText))
} catch (err) {
callback(err, null)
}
}
}
}
function getXHR () {
return window.XMLHttpRequest ? new window.XMLHttpRequest() : new ActiveXObject('Microsoft.XMLHTTP')
}
'use strict'
var _$OptionsValidator_3 = function OptionsValidator (params) {
if (!validateParams(params)) {
throw new Error('-- OptionsValidator: required options missing')
}
if (!(this instanceof OptionsValidator)) {
return new OptionsValidator(params)
}
const requiredOptions = params.required
this.getRequiredOptions = function () {
return requiredOptions
}
this.validate = function (parameters) {
const errors = []
requiredOptions.forEach(function (requiredOptionName) {
if (typeof parameters[requiredOptionName] === 'undefined') {
errors.push(requiredOptionName)
}
})
return errors
}
function validateParams (params) {
if (!params) {
return false
}
return typeof params.required !== 'undefined' & & params.required instanceof Array
}
}
'use strict'
var _$utils_9 = {
merge: merge,
isJSON: isJSON
}
function merge (defaultParams, mergeParams) {
const mergedOptions = {}
for (const option in defaultParams) {
mergedOptions[option] = defaultParams[option]
if (typeof mergeParams[option] !== 'undefined') {
mergedOptions[option] = mergeParams[option]
}
}
return mergedOptions
}
function isJSON (json) {
try {
if (json instanceof Object & & JSON.parse(JSON.stringify(json))) {
return true
}
return false
} catch (err) {
return false
}
}
var _$src_8 = {};
(function (window) {
'use strict'
let options = {
searchInput: null,
resultsContainer: null,
json: [],
success: Function.prototype,
searchResultTemplate: '< li > < a href = "{url}" title = "{desc}" > {title}< / a > < / li > ',
templateMiddleware: Function.prototype,
sortMiddleware: function () {
return 0
},
noResultsText: 'No results found',
limit: 10,
fuzzy: false,
debounceTime: null,
exclude: []
}
let debounceTimerHandle
const debounce = function (func, delayMillis) {
if (delayMillis) {
clearTimeout(debounceTimerHandle)
debounceTimerHandle = setTimeout(func, delayMillis)
} else {
func.call()
}
}
const requiredOptions = ['searchInput', 'resultsContainer', 'json']
/* removed: const _$Templater_7 = require('./Templater') */;
/* removed: const _$Repository_4 = require('./Repository') */;
/* removed: const _$JSONLoader_2 = require('./JSONLoader') */;
const optionsValidator = _$OptionsValidator_3({
required: requiredOptions
})
/* removed: const _$utils_9 = require('./utils') */;
window.SimpleJekyllSearch = function (_options) {
const errors = optionsValidator.validate(_options)
if (errors.length > 0) {
throwError('You must specify the following required options: ' + requiredOptions)
}
options = _$utils_9.merge(options, _options)
_$Templater_7.setOptions({
template: options.searchResultTemplate,
middleware: options.templateMiddleware
})
_$Repository_4.setOptions({
fuzzy: options.fuzzy,
limit: options.limit,
sort: options.sortMiddleware,
exclude: options.exclude
})
if (_$utils_9.isJSON(options.json)) {
initWithJSON(options.json)
} else {
initWithURL(options.json)
}
const rv = {
search: search
}
typeof options.success === 'function' & & options.success.call(rv)
return rv
}
function initWithJSON (json) {
_$Repository_4.put(json)
registerInput()
}
function initWithURL (url) {
_$JSONLoader_2.load(url, function (err, json) {
if (err) {
throwError('failed to get JSON (' + url + ')')
}
initWithJSON(json)
})
}
function emptyResultsContainer () {
options.resultsContainer.innerHTML = ''
}
function appendToResultsContainer (text) {
options.resultsContainer.innerHTML += text
}
function registerInput () {
options.searchInput.addEventListener('input', function (e) {
if (isWhitelistedKey(e.which)) {
emptyResultsContainer()
debounce(function () { search(e.target.value) }, options.debounceTime)
}
})
}
function search (query) {
if (isValidQuery(query)) {
emptyResultsContainer()
render(_$Repository_4.search(query), query)
}
}
function render (results, query) {
const len = results.length
if (len === 0) {
return appendToResultsContainer(options.noResultsText)
}
for (let i = 0; i < len ; i + + ) {
results[i].query = query
appendToResultsContainer(_$Templater_7.compile(results[i]))
}
}
function isValidQuery (query) {
return query & & query.length > 0
}
function isWhitelistedKey (key) {
return [13, 16, 20, 37, 38, 39, 40, 91].indexOf(key) === -1
}
function throwError (message) {
throw new Error('SimpleJekyllSearch --- ' + message)
}
})(window)
}());
< / script >
<!-- Configuration -->
< script >
SimpleJekyllSearch({
searchInput: document.getElementById('search-input'),
resultsContainer: document.getElementById('results-container'),
noResultsText: '< p > Aucun résultat!< / p > ',
json: '/search.json',
searchResultTemplate: '< li > < a href = "{url}" > {date} {title}< / a > (Création {create})< / li > '
})
< / script >
< / div > < / div >
< script > ( f u n c t i o n ( ) {
var SOURCES = window.TEXT_VARIABLES.sources;
window.Lazyload.js(SOURCES.jquery, function() {
function scrollToAnchor(anchor, duration, callback) {
var $root = this;
$root.animate({ scrollTop: $(anchor).position().top }, duration, function() {
window.history.replaceState(null, '', window.location.href.split('#')[0] + anchor);
callback & & callback();
});
}
$.fn.scrollToAnchor = scrollToAnchor;
});
})();
(function() {
var SOURCES = window.TEXT_VARIABLES.sources;
window.Lazyload.js(SOURCES.jquery, function() {
function affix(options) {
var $root = this, $window = $(window), $scrollTarget, $scroll,
offsetBottom = 0, scrollTarget = window, scroll = window.document, disabled = false, isOverallScroller = true,
rootTop, rootLeft, rootHeight, scrollBottom, rootBottomTop,
hasInit = false, curState;
function setOptions(options) {
var _options = options || {};
_options.offsetBottom & & (offsetBottom = _options.offsetBottom);
_options.scrollTarget & & (scrollTarget = _options.scrollTarget);
_options.scroll & & (scroll = _options.scroll);
_options.disabled !== undefined & & (disabled = _options.disabled);
$scrollTarget = $(scrollTarget);
isOverallScroller = window.isOverallScroller($scrollTarget[0]);
$scroll = $(scroll);
}
function preCalc() {
top();
rootHeight = $root.outerHeight();
rootTop = $root.offset().top + (isOverallScroller ? 0 : $scrollTarget.scrollTop());
rootLeft = $root.offset().left;
}
function calc(needPreCalc) {
needPreCalc & & preCalc();
scrollBottom = $scroll.outerHeight() - offsetBottom - rootHeight;
rootBottomTop = scrollBottom - rootTop;
}
function top() {
if (curState !== 'top') {
$root.removeClass('fixed').css({
left: 0,
top: 0
});
curState = 'top';
}
}
function fixed() {
if (curState !== 'fixed') {
$root.addClass('fixed').css({
left: rootLeft + 'px',
top: 0
});
curState = 'fixed';
}
}
function bottom() {
if (curState !== 'bottom') {
$root.removeClass('fixed').css({
left: 0,
top: rootBottomTop + 'px'
});
curState = 'bottom';
}
}
function setState() {
var scrollTop = $scrollTarget.scrollTop();
if (scrollTop >= rootTop & & scrollTop < = scrollBottom) {
fixed();
} else if (scrollTop < rootTop ) {
top();
} else {
bottom();
}
}
function init() {
if(!hasInit) {
var interval, timeout;
calc(true); setState();
// run calc every 100 millisecond
interval = setInterval(function() {
calc();
}, 100);
timeout = setTimeout(function() {
clearInterval(interval);
}, 45000);
window.pageLoad.then(function() {
setTimeout(function() {
clearInterval(interval);
clearTimeout(timeout);
}, 3000);
});
$scrollTarget.on('scroll', function() {
disabled || setState();
});
$window.on('resize', function() {
disabled || (calc(true), setState());
});
hasInit = true;
}
}
setOptions(options);
if (!disabled) {
init();
}
$window.on('resize', window.throttle(function() {
init();
}, 200));
return {
setOptions: setOptions,
refresh: function() {
calc(true, { animation: false }); setState();
}
};
}
$.fn.affix = affix;
});
})();
(function() {
var SOURCES = window.TEXT_VARIABLES.sources;
window.Lazyload.js(SOURCES.jquery, function() {
function toc(options) {
var $root = this, $window = $(window), $scrollTarget, $scroller, $tocUl = $('< ul class = "toc toc--ellipsis" > < / ul > '), $tocLi, $headings, $activeLast, $activeCur,
selectors = 'h1,h2,h3', container = 'body', scrollTarget = window, scroller = 'html, body', disabled = false,
headingsPos, scrolling = false, hasRendered = false, hasInit = false;
function setOptions(options) {
var _options = options || {};
_options.selectors & & (selectors = _options.selectors);
_options.container & & (container = _options.container);
_options.scrollTarget & & (scrollTarget = _options.scrollTarget);
_options.scroller & & (scroller = _options.scroller);
_options.disabled !== undefined & & (disabled = _options.disabled);
$headings = $(container).find(selectors).filter('[id]');
$scrollTarget = $(scrollTarget);
$scroller = $(scroller);
}
function calc() {
headingsPos = [];
$headings.each(function() {
headingsPos.push(Math.floor($(this).position().top));
});
}
function setState(element, disabled) {
var scrollTop = $scrollTarget.scrollTop(), i;
if (disabled || !headingsPos || headingsPos.length < 1 ) { return ; }
if (element) {
$activeCur = element;
} else {
for (i = 0; i < headingsPos.length ; i + + ) {
if (scrollTop >= headingsPos[i]) {
$activeCur = $tocLi.eq(i);
} else {
$activeCur || ($activeCur = $tocLi.eq(i));
break;
}
}
}
$activeLast & & $activeLast.removeClass('active');
($activeLast = $activeCur).addClass('active');
}
function render() {
if(!hasRendered) {
$root.append($tocUl);
$headings.each(function() {
var $this = $(this);
$tocUl.append($('< li > < / li > ').addClass('toc-' + $this.prop('tagName').toLowerCase())
.append($('< a > < / a > ').text($this.text()).attr('href', '#' + $this.prop('id'))));
});
$tocLi = $tocUl.children('li');
$tocUl.on('click', 'a', function(e) {
e.preventDefault();
var $this = $(this);
scrolling = true;
setState($this.parent());
$scroller.scrollToAnchor($this.attr('href'), 400, function() {
scrolling = false;
});
});
}
hasRendered = true;
}
function init() {
var interval, timeout;
if(!hasInit) {
render(); calc(); setState(null, scrolling);
// run calc every 100 millisecond
interval = setInterval(function() {
calc();
}, 100);
timeout = setTimeout(function() {
clearInterval(interval);
}, 45000);
window.pageLoad.then(function() {
setTimeout(function() {
clearInterval(interval);
clearTimeout(timeout);
}, 3000);
});
$scrollTarget.on('scroll', function() {
disabled || setState(null, scrolling);
});
$window.on('resize', window.throttle(function() {
if (!disabled) {
render(); calc(); setState(null, scrolling);
}
}, 100));
}
hasInit = true;
}
setOptions(options);
if (!disabled) {
init();
}
$window.on('resize', window.throttle(function() {
init();
}, 200));
return {
setOptions: setOptions
};
}
$.fn.toc = toc;
});
})();
/*(function () {
})();*/
< / script > < script >
/* toc must before affix, since affix need to konw toc' height. */(function() {
var SOURCES = window.TEXT_VARIABLES.sources;
var TOC_SELECTOR = window.TEXT_VARIABLES.site.toc.selectors;
window.Lazyload.js(SOURCES.jquery, function() {
var $window = $(window);
var $articleContent = $('.js-article-content');
var $tocRoot = $('.js-toc-root'), $col2 = $('.js-col-aside');
var toc;
var tocDisabled = false;
var hasSidebar = $('.js-page-root').hasClass('layout--page--sidebar');
var hasToc = $articleContent.find(TOC_SELECTOR).length > 0;
function disabled() {
return $col2.css('display') === 'none' || !hasToc;
}
tocDisabled = disabled();
toc = $tocRoot.toc({
selectors: TOC_SELECTOR,
container: $articleContent,
scrollTarget: hasSidebar ? '.js-page-main' : null,
scroller: hasSidebar ? '.js-page-main' : null,
disabled: tocDisabled
});
$window.on('resize', window.throttle(function() {
tocDisabled = disabled();
toc & & toc.setOptions({
disabled: tocDisabled
});
}, 100));
});
})();
(function() {
var SOURCES = window.TEXT_VARIABLES.sources;
window.Lazyload.js(SOURCES.jquery, function() {
var $window = $(window), $pageFooter = $('.js-page-footer');
var $pageAside = $('.js-page-aside');
var affix;
var tocDisabled = false;
var hasSidebar = $('.js-page-root').hasClass('layout--page--sidebar');
affix = $pageAside.affix({
offsetBottom: $pageFooter.outerHeight(),
scrollTarget: hasSidebar ? '.js-page-main' : null,
scroller: hasSidebar ? '.js-page-main' : null,
scroll: hasSidebar ? $('.js-page-main').children() : null,
disabled: tocDisabled
});
$window.on('resize', window.throttle(function() {
affix & & affix.setOptions({
disabled: tocDisabled
});
}, 100));
window.pageAsideAffix = affix;
});
})();
< / script > <!-- -->
< / div >
< script > ( f u n c t i o n ( ) {
var $root = document.getElementsByClassName('root')[0];
if (window.hasEvent('touchstart')) {
$root.dataset.isTouch = true;
document.addEventListener('touchstart', function(){}, false);
}
})();
< / script >
< / body >
< / html >
