218 lines
5 KiB
Markdown
218 lines
5 KiB
Markdown
# Niver
|
|
|
|
## Presentation
|
|
|
|
Niver is an ecosystem whose main component is the Web interface written in PHP.
|
|
|
|
This PHP Web interface allow it's users to manage 3 services, that can be used together :
|
|
|
|
* A domain registry
|
|
* A nameserver
|
|
* An hypertext service, that allow a directory containing hypertext documents to be accessed with the choice of the protocol and the routing method :
|
|
* HTTP(S) or Gemini
|
|
* DNS access or Onion (the Tor's system)
|
|
|
|
## Setup
|
|
|
|
Niver will use and need specific configuration for
|
|
|
|
* Knot DNS
|
|
* OpenSSH
|
|
* Nginx
|
|
* Tor
|
|
* Gmnisrv
|
|
|
|
To do root-level actions, Niver will also use a privileged binary, written in Rust, called Maniver.
|
|
|
|
Niver has been deployed on the following distributions :
|
|
|
|
* Debian 10, using Nginx 1.14.2 and OpenSSH 7.9p1, and latest available version of Tor, Knot and gmnisrv using their official release channel.
|
|
* Arch Linux
|
|
|
|
To provide all features:
|
|
|
|
`# pacman -S tor knot openssh sudo nginx nginx-mod-headers-more certbot certbot-nginx php-fpm php-sqlite`
|
|
|
|
Some tools you might find usefull to manage a server:
|
|
|
|
`# pacman -S vnstat htop nload ufw vim man-db curl`
|
|
|
|
### maniver installation
|
|
|
|
```
|
|
# pacman -S rustup git
|
|
$ rustup default stable
|
|
$ git clone https://code.antopie.org/miraty/maniver-dev
|
|
$ cd maniver-dev
|
|
$ cargo build --release
|
|
# cp ./target/release/maniver /usr/local/bin/
|
|
```
|
|
|
|
### gmnisrv installation
|
|
|
|
```
|
|
# pacman -S make git pkgconf openssl scdoc
|
|
$ git clone https://git.sr.ht/~sircmpwn/gmnisrv # Download gmnisrv sources
|
|
$ mkdir gmnisrv/build
|
|
$ cd gmnisrv/build
|
|
$ ../configure --prefix=/usr # Check gmnisrv dependencies and setup files needed for building
|
|
$ make # Build gmnisrv
|
|
# make install # Install gmnisrv binary and manpages on the system
|
|
# useradd -U -r -s /usr/bin/nologin gmnisrv # Add the gmnisrv system user and group
|
|
# vim /etc/systemd/system/gmnisrv.service
|
|
```
|
|
|
|
```
|
|
[Unit]
|
|
Description=A Gemini server
|
|
After=network.target
|
|
Wants=network.target
|
|
|
|
[Service]
|
|
Type=simple
|
|
ExecStart=/usr/local/bin/gmnisrv
|
|
ExecStop=
|
|
#Restart=on-failure
|
|
User=gmnisrv
|
|
Group=gmnisrv
|
|
WorkingDirectory=/srv/ht
|
|
|
|
[Install]
|
|
WantedBy=multi-user.target
|
|
```
|
|
```
|
|
# systemctl daemon-reload
|
|
# mkdir -p /srv/gemini/niver.atope.art
|
|
# echo "This is a testing Gemini capsule" > /srv/gemini/niver.atope.art/index.gmi
|
|
# mkdir /var/local/gmnisrv
|
|
# chmod -R 700 /var/local/gmnisrv
|
|
# chown -R gmnisrv:gmnisrv /var/local/gmnisrv
|
|
# vim /usr/local/etc/gmnisrv.ini
|
|
```
|
|
|
|
```
|
|
# Space-separated list of hosts
|
|
listen=0.0.0.0:1965 [::]:1965
|
|
|
|
[:tls]
|
|
# Path to store certificates on disk
|
|
store=/var/local/gmnisrv
|
|
|
|
[niver.atope.art]
|
|
root=/srv/gemini/niver.atope.art
|
|
```
|
|
|
|
To add knot as an additional group for user php-niver:
|
|
`usermod -aG knot php-niver`
|
|
|
|
To generate a key/certificate pair with ed25519 expiring in 10 years
|
|
`openssl req -subj '/CN=domain' -new -newkey ED25519 -days 3650 -nodes -x509 -keyout domain.key -out domain.crt`
|
|
|
|
### SFTP setup
|
|
|
|
```
|
|
# groupadd ht
|
|
# echo "Ce compe n'est accessible qu'en SFTP, pas en SSH.
|
|
This account is only available over SFTP, not over SSH." > /etc/nologin.txt
|
|
```
|
|
|
|
### Quota setup
|
|
|
|
```
|
|
# pacman -S quota-tool
|
|
# dd if=/dev/zero of=/srv/ht.img count=4194304 # count is the size in octet
|
|
# mkfs.ext4 /srv/ht.img
|
|
# mkdir /srv/ht
|
|
# mount /srv/ht.img /srv/ht
|
|
```
|
|
|
|
### PHP setup
|
|
|
|
In php.ini :
|
|
expose_php = Off
|
|
|
|
### Niver PHP setup
|
|
|
|
```
|
|
EDITOR=vim visudo
|
|
php-niver ALL=(root) NOPASSWD: /usr/local/bin/maniver
|
|
```
|
|
|
|
## Features
|
|
|
|
### Web interface
|
|
|
|
* Anonymous: you only need a pseudo/password set
|
|
* Page lower than 10 KiB
|
|
* No JavaScript, no images, and CSS are optionnal
|
|
* Dark and light themes
|
|
* Free service running libre software
|
|
|
|
### Hypertext
|
|
|
|
* SFTP access
|
|
* HTTP and Gemini
|
|
* IPv4 and IPv6
|
|
* TLS 1.2 & 1.3 or TLS 1.3 only
|
|
* DNS (ICANN, OpenNIC or anything) and Onion v3 (through Tor)
|
|
* HTTP/1.1 and HTTP/2
|
|
* Let's Encrypt certificates
|
|
* All HTTP security headers
|
|
|
|
### Nameserver
|
|
|
|
* DNSSEC (with NSEC3)
|
|
* NS, A, AAAA, TXT, and CAA records
|
|
|
|
### Registry
|
|
|
|
* Glue record
|
|
* DNSSEC delegation with any modern cypher
|
|
|
|
## Anti-features
|
|
|
|
* No internationalized domain name support (you can only use ASCII in your domain name)
|
|
* No BIND-style plaintext configuration (you need to fill a form for every record you add or remove)
|
|
|
|
## Nginx mimetypes association
|
|
|
|
```
|
|
text/plain txt;
|
|
text/gemini gmi;
|
|
text/markdown md;
|
|
text/html html;
|
|
text/css css;
|
|
text/xml xml;
|
|
text/csv csv;
|
|
text/javascript js;
|
|
|
|
application/xhtml+xml xhtml;
|
|
application/atom+xml atom;
|
|
application/rss+xml rss;
|
|
|
|
application/json json;
|
|
application/gzip gz;
|
|
application/zip zip;
|
|
application/epub+zip epub;
|
|
application/pdf pdf;
|
|
|
|
font/woff woff;
|
|
font/woff2 woff2;
|
|
|
|
image/png png;
|
|
image/tiff tif tiff;
|
|
image/gif gif;
|
|
image/jpeg jpeg jpg;
|
|
image/svg+xml svg svgz;
|
|
image/webp webp;
|
|
|
|
audio/mpeg mp3;
|
|
audio/ogg ogg oga opus spx;
|
|
audio/webm weba;
|
|
audio/flac flac;
|
|
|
|
video/webm webm;
|
|
video/mp4 mp4;
|
|
video/ogg ogv;
|
|
|
|
```
|