6.6 KiB
setup
Personal guide to configuring a new system entirely from scratch.
We use the latest version of Debian (12/Bookworm in this case) and everything we run is containerized, via Docker.
Setup
Boot up the Debian installer and set it up. The guided installer does everything for us and is simple to go through. Just make sure the admin password, user account password, hostname etc., is all set correctly. Also make sure you don't mess up the GRUB installation if it prompts to be installed. Ensure you're installing it only using the SSH server and basic system utilities (something along those lines - it should be the last on the list and automatically selected) presets.
Once installed and rebooted into the system, we can log in. At this point, it's also possible to use SSH with the default configurations as Debian automatically enables it.
Post-setup
Sudo
Once logged in, let's get started with sudo. It's missing by default. Get a root shell by typing in su - along with the root password when asked, and first do an update of apt with apt update && apt upgrade then do apt install sudo. Install it, and now do usermod -aG sudo <your username> to make yourself a sudoer. Once that's done, exit the root shell, log out then log back in. Try sudo against anything to confirm it works, and congrats! Sudo now exists here.
SSH
As I've said before, SSH is already installed and configured. For now, we're just going to change the port to something else to prevent it from being attacked immediately.
Open up /etc/ssh/sshd_config.d/01-port.conf in your text editor (Neovim isn't installed right now - sudo apt install neovim) and just fill in the following for the server we're setting it up for:
Phosphorus
Port 6720
Cerium
Port 6721
Neptunium
Port 6721
Synthnix
Leave it as the default port to make it be easier for users to log in.
This is exactly what it says. It opens SSH to use the port of what is specified instead of the default 22. Later, we'll configure it to disable password logins, but for now this will work. Restart SSH via sudo systemctl restart sshd (and sudo systemctl restart ssh, one of these should work and I don't know which) for it to take effect. Log in for now by adding -p <port> before the IP when doing ssh until we get a proper configuration.
firewalld
For the sake of our own safety and concern, we'll get a basic firewall up. Technically, it's not required to do so as Docker will just bypass it anyways, but I still prefer it as a safety measure to ensure that nothing else that could possible be running on a system level is exposed to the outside world from the system.
First install firewalld with sudo apt install firewalld, which will install and automatically enable it.
Now run this command to open the port 6720 for SSH:
sudo firewall-cmd --permanent --add-port=6720/tcp
And then reload the firewall:
sudo firewall-cmd --reload
And we're done for now here, until we configure other things later on.
synths group
We use a custom group to allow access to folders that would other be unreadable/unwritable to our users. This is used for our /srv/docker folder.
Use the following command to create the synths group:
sudo groupadd synths
Then we add ourselves to the synths group:
sudo usermod -aG synths <your username>
Then, apply permissions to /srv/docker (create the folder if it doesn't exist):
sudo chgrp synths /srv/docker
sudo chmod g+rwx /srv/docker
And now /srv/docker is readable and writable by everyone in the synths group!*
*Files written/made by others, however, will be owned by them, and will require sudo to modify their files.
Package installations
Now that we're mostly set up and secure, let's install all of the packages required to continue with setting everything else up:
- Docker
- Up to date instructions can be found here. Don't do the "post-install" steps, it's not really a good security practice.
- Neovim
htop/btopzram-tools- Will be configured aftwards
rsyncbackblaze-b2unzipnpmgitjqzsh
sudo apt install neovim htop btop zram-tools rsync backblaze-b2 unzip git jq zsh
Docker installation is another process, please refer to their links to do it.
ZRam
ZRam lets us do fancy compressed ram stuff to improve performance. So we'll configure it now.
Once we install the package, as per the Debian wiki, let's configured it so we can use 50% of our total ram dedicated to ZRam's compressed swap space:
echo -e "ALGO=zstd\nPERCENT=50" | sudo tee -a /etc/default/zramswap
sudo service zramswap reload
Once that's done, ZRAM should now be configured properly!
SSH keys
We should disable password logins.
Caddy
Unlike our previous setup, we use Caddy in a container, mainly becaues it makes it easier to manage things like custom builds. Let's start by creating the /srv/docker/caddy folder.
Phosphorus
Refer to the files in the phosphorus, it's all we need for our Phosphorus setup.
Personal configurations
Now that we have the basics, We can set up our own user and shell and such to how we want.
ZSH
I prefer zsh over bash, but also mainly because it has a cooler scene with plugins and stuff. Since we already installed zsh earlier, just launch it with zsh, which will bring up a menu, hit 2 to get the default configuration.
Antidote/zdotdir
Antidote is a neat and fast little plugin manager for zsh.
We will simply be using zdotdir, which is a starting point framework by the Antidote devs. It provides good and sane defaults, so we won't actually need to mess much with it. Follow the instruction here to do our initial install for it.
The Powerlevel10k configuration prompt should appear, just follow it and configure it as wanted, and we should be done here. Yay.
Atuin
Atuin gives up a near little history viewer over the default when we press the up arrow on our keyboard.
We use their suggested command to install it:
curl --proto '=https' --tlsv1.2 -LsSf https://setup.atuin.sh | sh
It will automatically add itself to the correct .zshrc file, so it will load in with a new shell session.
Of course, however, since we installed it in a way not integrated with our system, we'll need to manage updates for it. We can just set a cronjob on our user to do that automatically though. Type in crontab -e and append 0 9 * * * atuin-update to the bottom of the file.