server-configs/README.md

# Base Config

## Notes:

1. The Mail Server requires SSL certificates
2. Occurances of `REPLACEME.TLD` without comments stating otherwise should have the FQDN substituted for it
3. Occurances of `REPLACEME` without comments stating otherwise should have the FQDN without the TLD substituted for it

## Swap File

1. Run `dd if=/dev/zero of=/swapfile bs=1M count=2048` then `chmod 600 /swapfile` followed by `mkswap /swapfile` and `swapon /swapfile`
2. Set the system up to mount the swap file at boot by adding `/swapfile none swap defaults 0 0` to the bottom of `/etc/fstab`

## Web Server

### Package Requirements for Web Server

nginx, php, php-apcu-bc, php-fpm, php-composer, php-gd, php-imap, php-intl, php-mcrypt, php-memcached, php-geoip, geoip-database geoip-database-extra, memcached, mariadb, bower, gulp, npm, certbot

### Folders for Web Server

nginx, php, systemd

### Setup Instructions for Web Server

1. Install the packages in the `Package Requirements` above
2. Copy the folders above that aren't already configured to their equivalent location in `/etc`
3. In `/etc/nginx/sites-available/REPLACEME.TLD.conf` and `/etc/systemd/system/letsencrypt.service`
4. Rename `/etc/nginx/sites-available/REPLACEME.TLD.conf`
5. Add your site files to `/srv/http/REPLACEME.TLD` where public assets are located in `/srv/http/REPLACEME.TLD/public`
6. Create a symlink from `/etc/nginx/sites-available/REPLACEME.tld.conf` to `/etc/nginx/sites-enabled/REPLACEME.tld.conf`
7. Run `openssl dhparam -out /etc/nginx/dhparam.pem 4096` to generate the diffie-hellman parameter
8. Run `systemctl start php-fpm nginx` to start the web services and `systemctl status php-fpm` and `systemctl status nginx` to check for errors
9. If there were no errors in the previous command, run `systemctl enable php-fpm nginx` to enable the web services at boot
10. Ensure the public web directory exists and run `systemctl start letsencrypt` to generate the SSL certificates
11. Run `systemctl start certbot-renewal.timer` and `systemctl enable certbot-renewal.timer` to start and enable the auto-renewal process

### MySQL Config

1. Add `bind-address = 127.0.0.1` to `/etc/mysql/my.cnf`
1. Run `mysql_install_db --user=mysql --basedir=/usr --datadir=/var/lib/mysql`
2. Run `systemctl start mysqld` and `systemctl enable mysqld` to start mysqld and enable it at boot
3. Run `mysql_secure_installation`.
4. Create a new password.
5. Say `yes` to everything (e.g. "Remove anonymous users? Disallow root logging remotely? Remove test database and access to it? Reload privilege tables now?")

## Mail Server

### Package Requirements for Mail Server

dovecot, postfix, procmail, opendkim

### Folders for Mail Server

dovecot, pam.d, postfix, procmailrc, skel, systemd, opendkim

### Setup Instructions for Mail Server

1. Install the packages in the `Package Requirements` above
2. Copy the folders above that aren't already configured to their equivalent location in `/etc`
3. Add an A DNS record for the FQDN and a hostname for the server
4. Set the hostname of the server with `hostnamectl set-hostname SOMETHING.REPLACEME.TLD` where `SOMETHING.REPLACEME.TLD` is the server hostname
5. Add the hostname of the server to the end of the line starting with `127.0.0.1` in `/etc/hosts`
6. In `/etc/dovecot/dovecot.conf` and `/etc/opendkim/opendkim.conf` replace occurances of `REPLACEME.TLD` and occurances of `REPLACEME` with the first part of the hostname
7. In `/etc/postfix/main.cf` replace occurances of `REPLACEME.TLD` with the hostname (not the  name)
8. Run `opendkim-genkey -r -s REPLACEME -d REPLACEME.TLD` where `REPLACEME` is the first part of the hostname
9. In `/etc/postfix/aliases`, replace the instance of `REPLACEME` with the user that should receive domain-level emails
10. Run `newaliases` to update the aliases database with the contents of `/etc/postfix/aliases`
11. Run `systemctl start postfix dovecot opendkim` to start the mail services and `systemctl status postfix dovecot opendkim` to check for errors
12. If there were no errors in the previous command, run `systemctl enable postfix dovecot opendkim` to enable the mail services at boot
13. Create an MX DNS record for `REPLACEME.TLD` containing the hostname (`REPLACEME.TLD` can usually be left out of the input field)
14. Create a TXT DNS record for the host `REPLACEME._domainkey.REPLACEME.TLD` containing `v=DKIM1; k=rsa; s=email; p=PASSWORD`, replacing the occurance of `REPLACEME` with the first part of the hostname and `PASSWORD` with the string following `p=` in `/etc/opendkim/REPLACEME.txt` (`REPLACEME.TLD` can usually be left out of the input field)
15. Create a TXT DNS record for the host `REPLACEME.TLD` containing `v=spf1 mx -all` (`REPLACEME.TLD` can usually be left out of the input field)
16. Create a TXT DNS record for the host `_dmarc.REPLACEME.TLD` containing `v=DMARC1; p=none` (`REPLACEME.TLD` can usually be left out of the input field)
17. Set the reverse DNS record for the VPS to the hostname

### Add Accounts

1. Create an account by running `useradd -m -d /home/REPLACEME -s /bin/bash REPLACEME` (replacing `REPLACEME` with the username associated with the mail account)
2. Set the password by running `passwd REPLACEME` (replacing `REPLACEME` with the username associated with the mail account)
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00			`# Base Config`

Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			`## Notes:`

			`1. The Mail Server requires SSL certificates`
			2. Occurances of `REPLACEME.TLD` without comments stating otherwise should have the FQDN substituted for it
			3. Occurances of `REPLACEME` without comments stating otherwise should have the FQDN without the TLD substituted for it
Add instructions for setting up a swap file 2016-02-23 22:26:25 -05:00
			`## Swap File`

			1. Run `dd if=/dev/zero of=/swapfile bs=1M count=2048` then `chmod 600 /swapfile` followed by `mkswap /swapfile` and `swapon /swapfile`
			2. Set the system up to mount the swap file at boot by adding `/swapfile none swap defaults 0 0` to the bottom of `/etc/fstab`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
			`## Web Server`

Be more specific in setup instruction headings 2016-05-02 22:39:40 -04:00			`### Package Requirements for Web Server`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
Add GeoIP (PECL) support to PHP 2017-01-13 19:39:32 -05:00			`nginx, php, php-apcu-bc, php-fpm, php-composer, php-gd, php-imap, php-intl, php-mcrypt, php-memcached, php-geoip, geoip-database geoip-database-extra, memcached, mariadb, bower, gulp, npm, certbot`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
Remove FIXME and specify what folders are for 2016-05-02 22:23:02 -04:00			`### Folders for Web Server`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
			`nginx, php, systemd`

Be more specific in setup instruction headings 2016-05-02 22:39:40 -04:00			`### Setup Instructions for Web Server`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
			1. Install the packages in the `Package Requirements` above
			2. Copy the folders above that aren't already configured to their equivalent location in `/etc`
Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			3. In `/etc/nginx/sites-available/REPLACEME.TLD.conf` and `/etc/systemd/system/letsencrypt.service`
			4. Rename `/etc/nginx/sites-available/REPLACEME.TLD.conf`
			5. Add your site files to `/srv/http/REPLACEME.TLD` where public assets are located in `/srv/http/REPLACEME.TLD/public`
			6. Create a symlink from `/etc/nginx/sites-available/REPLACEME.tld.conf` to `/etc/nginx/sites-enabled/REPLACEME.tld.conf`
Increase the nginx diffie hellman parameter generate command bitrate to 4096 and add a line to the readme 2016-04-28 00:14:19 -04:00			7. Run `openssl dhparam -out /etc/nginx/dhparam.pem 4096` to generate the diffie-hellman parameter
			8. Run `systemctl start php-fpm nginx` to start the web services and `systemctl status php-fpm` and `systemctl status nginx` to check for errors
Fix incorrect service names in the nginx setup instructions 2016-05-02 22:29:32 -04:00			9. If there were no errors in the previous command, run `systemctl enable php-fpm nginx` to enable the web services at boot
Increase the nginx diffie hellman parameter generate command bitrate to 4096 and add a line to the readme 2016-04-28 00:14:19 -04:00			10. Ensure the public web directory exists and run `systemctl start letsencrypt` to generate the SSL certificates
Increase the maximum upload size to 30 megs in php and nginx, and update the let's encrypt renewal service 2016-09-12 18:41:03 -04:00			11. Run `systemctl start certbot-renewal.timer` and `systemctl enable certbot-renewal.timer` to start and enable the auto-renewal process
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
Add php config and instructions for setting up mysql. 2016-02-23 23:41:30 -05:00			`### MySQL Config`

Add note about locking mysql down to local server access 2016-12-15 21:19:19 -05:00			1. Add `bind-address = 127.0.0.1` to `/etc/mysql/my.cnf`
Fix mysql db install command in the instructions 2016-05-02 22:31:08 -04:00			1. Run `mysql_install_db --user=mysql --basedir=/usr --datadir=/var/lib/mysql`
Add php config and instructions for setting up mysql. 2016-02-23 23:41:30 -05:00			2. Run `systemctl start mysqld` and `systemctl enable mysqld` to start mysqld and enable it at boot
			3. Run `mysql_secure_installation`.
			`4. Create a new password.`
			5. Say `yes` to everything (e.g. "Remove anonymous users? Disallow root logging remotely? Remove test database and access to it? Reload privilege tables now?")

Add initial configuration and instructions 2016-02-23 22:05:00 -05:00			`## Mail Server`

Be more specific in setup instruction headings 2016-05-02 22:39:40 -04:00			`### Package Requirements for Mail Server`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			`dovecot, postfix, procmail, opendkim`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
Remove FIXME and specify what folders are for 2016-05-02 22:23:02 -04:00			`### Folders for Mail Server`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			`dovecot, pam.d, postfix, procmailrc, skel, systemd, opendkim`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
Be more specific in setup instruction headings 2016-05-02 22:39:40 -04:00			`### Setup Instructions for Mail Server`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
			1. Install the packages in the `Package Requirements` above
			2. Copy the folders above that aren't already configured to their equivalent location in `/etc`
Smooth some confusing edges in the README mail server setup 2017-01-24 14:49:21 -05:00			`3. Add an A DNS record for the FQDN and a hostname for the server`
Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			4. Set the hostname of the server with `hostnamectl set-hostname SOMETHING.REPLACEME.TLD` where `SOMETHING.REPLACEME.TLD` is the server hostname
			5. Add the hostname of the server to the end of the line starting with `127.0.0.1` in `/etc/hosts`
Smooth some confusing edges in the README mail server setup 2017-01-24 14:49:21 -05:00			6. In `/etc/dovecot/dovecot.conf` and `/etc/opendkim/opendkim.conf` replace occurances of `REPLACEME.TLD` and occurances of `REPLACEME` with the first part of the hostname
Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			7. In `/etc/postfix/main.cf` replace occurances of `REPLACEME.TLD` with the hostname (not the name)
Smooth some confusing edges in the README mail server setup 2017-01-24 14:49:21 -05:00			8. Run `opendkim-genkey -r -s REPLACEME -d REPLACEME.TLD` where `REPLACEME` is the first part of the hostname
Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			9. In `/etc/postfix/aliases`, replace the instance of `REPLACEME` with the user that should receive domain-level emails
			10. Run `newaliases` to update the aliases database with the contents of `/etc/postfix/aliases`
			11. Run `systemctl start postfix dovecot opendkim` to start the mail services and `systemctl status postfix dovecot opendkim` to check for errors
			12. If there were no errors in the previous command, run `systemctl enable postfix dovecot opendkim` to enable the mail services at boot
Smooth some confusing edges in the README mail server setup 2017-01-24 14:49:21 -05:00			13. Create an MX DNS record for `REPLACEME.TLD` containing the hostname (`REPLACEME.TLD` can usually be left out of the input field)
			14. Create a TXT DNS record for the host `REPLACEME._domainkey.REPLACEME.TLD` containing `v=DKIM1; k=rsa; s=email; p=PASSWORD`, replacing the occurance of `REPLACEME` with the first part of the hostname and `PASSWORD` with the string following `p=` in `/etc/opendkim/REPLACEME.txt` (`REPLACEME.TLD` can usually be left out of the input field)
			15. Create a TXT DNS record for the host `REPLACEME.TLD` containing `v=spf1 mx -all` (`REPLACEME.TLD` can usually be left out of the input field)
			16. Create a TXT DNS record for the host `_dmarc.REPLACEME.TLD` containing `v=DMARC1; p=none` (`REPLACEME.TLD` can usually be left out of the input field)
Update the mail server config to include the missing pieces to avoid getting detected as spam 2017-01-23 00:14:19 -05:00			`17. Set the reverse DNS record for the VPS to the hostname`
Add initial configuration and instructions 2016-02-23 22:05:00 -05:00
			`### Add Accounts`

			1. Create an account by running `useradd -m -d /home/REPLACEME -s /bin/bash REPLACEME` (replacing `REPLACEME` with the username associated with the mail account)
			2. Set the password by running `passwd REPLACEME` (replacing `REPLACEME` with the username associated with the mail account)