Atemlire

Kubernetes

2022-05-09T00:00:00Z

Create a secret to get a private image from DockerHub and set it in the deployment

kubectl create secret docker-registry regcred --docker-username=<username> --docker-password="<password>" --docker-email=<email> -n <namespace>

spec:
  containers:
    imagePullSecrets:
      - name: regcred

Execute a command in a pod

kubectl -n <namespace> exec -it -c <container> <pod> -- <command>

PostgreSQL

2023-12-12T00:00:00Z

List of databases

\l

List of roles

\du

List of schemas

\dn

Check current/default schema

show search_path;

Change default schema for session

set search_path='public';

Top 10 tables

SELECT
  nspname AS schema_name,
  relname AS table_name,
  pg_size_pretty(pg_relation_size(C.oid)) AS main_data_size,
  pg_size_pretty(pg_total_relation_size(C.oid) - pg_relation_size(C.oid)) AS external_objects_size,
  pg_size_pretty(pg_indexes_size(C.oid)) AS indexes_size
FROM
  pg_class C
LEFT JOIN
  pg_namespace N ON (N.oid = C.relnamespace)
WHERE
  C.relkind = 'r'
ORDER BY
  pg_total_relation_size(C.oid) DESC
LIMIT 10;

Django

2022-05-09T00:00:00Z

Order of model inner classes and standard methods

The order of model inner classes and standard methods should be as follows (noting that these are not all required):

All database fields
Custom manager attributes
class Meta
def str()
def save()
def get_absolute_url()
Any custom methods

Set Django IntegerField by choices=… name

class ThingPriority(models.IntegerChoices):
    LOW = 0, 'Low'
    NORMAL = 1, 'Normal'
    HIGH = 2, 'High'


class Thing(models.Model):
     priority = models.IntegerField(default=ThingPriority.LOW, choices=ThingPriority.choices)


# then in your code
    thing = get_my_thing()
    thing.priority = ThingPriority.HIGH

Git

2023-11-09T00:00:00Z

Reset git branch into a clean state

git fetch origin master
git reset --hard FETCH_HEAD
git clean -f -d

Linux filesystem

2022-05-09T00:00:00Z

General

Rescan physical disk after increased size

echo 1 > /sys/block/sda/device/rescan

Get total files size by year

find . -type f -printf '%TY %s\n' | awk '{b[$1]+=$2} END{for (date in b) printf "%s %5.1f MiB\n", date, b[date]/1024**2}' | sort

Get total files size by month

find . -type f -printf '%TY-%Tm %s\n' | awk '{b[$1]+=$2} END{for (date in b) printf "%s %5.1f MiB\n", date, b[date]/1024**2}' | sort

Get total files size by day

find . -type f -printf '%TY-%Tm-%Td %s\n' | awk '{b[$1]+=$2} END{for (date in b) printf "%s %5.1f MiB\n", date, b[date]/1024**2}' | sort

Get total files by year

find . -type f -printf '%TY\n' | sort | uniq -c

Get total files by month

find . -type f -printf '%TY-%Tm\n' | sort | uniq -c

Get total files by day

find . -type f -printf '%TY-%Tm-%Td\n' | sort | uniq -c

Find files between two dates

find . -type f -newermt "1970-01-01 00:00:00" ! -newermt "1970-01-01 23:59:59"

Remove file starting with dash (ex: -d)

rm -- -d

Linux

2022-05-09T00:00:00Z

Add a user account

Add a system user

useradd -r username

Restore root password

RHEL/CentOS

Reboot the server, and press e to edit the GRUB command line.

Add rd.break at the end of the linux16 line and press ctrl-x to boot in single user mode.

Mount the filesystem in rw:

mount -o remount,rw /sysroot

Chroot inside the folder:

chroot /sysroot

Then change the root password:

passwd root

If SELinux is installed and running, don't forget to relabel the FS:

touch /.autorelabel

Type exit twice and you are done.

Docker

2022-05-09T00:00:00Z

Cleanup

Once in a while, you may need to cleanup resources (containers, volumes, images, networks) ...

Delete volumes

// see: https://github.com/chadoe/docker-cleanup-volumes   
docker volume rm $(docker volume ls -qf dangling=true)
docker volume ls -qf dangling=true | xargs -r docker volume rm

Delete networks

docker network ls  
docker network ls | grep "bridge"   
docker network rm $(docker network ls | grep "bridge" | awk '/ / { print $1 }')

Remove docker images

// see: http://stackoverflow.com/questions/32723111/how-to-remove-old-and-unused-docker-images
docker images
docker rmi $(docker images --filter "dangling=true" -q --no-trunc)   
docker images | grep "none"
docker rmi $(docker images | grep "none" | awk '/ / { print $3 }')

Remove docker containers

// see: http://stackoverflow.com/questions/32723111/how-to-remove-old-and-unused-docker-images
docker ps
docker ps -a
docker rm $(docker ps -qa --no-trunc --filter "status=exited")

Resize disk space for docker vm

docker-machine create --driver virtualbox --virtualbox-disk-size "40000" default

Firewalld

2022-05-09T00:00:00Z

Commands

Reload Firewalld

firewall-cmd --reload

Zones

List zones

firewall-cmd --get-zones

Add a new zone

firewall-cmd --new-zone=hetzner --permanent

Assign interface to zone

firewall-cmd --zone=hetzner --change-interface=enp7s0 --permanent

Services

Assign service to zone

firewall-cmd --zone=hetzner --add-service=etcd-server --permanent

JavaScript

2022-05-09T00:00:00Z

Set automatically Dark mode in Nuxt.JS and Vuetify

Put the following code to your layout(s)

created () {
  this.initDarkMode()
},
methods: {
  initDarkMode () {
    const mq = window.matchMedia('(prefers-color-scheme: dark)')
    mq.addEventListener('change', (e) => {
      this.$vuetify.theme.dark = e.matches
    })
    if (mq.matches) {
      this.$vuetify.theme.dark = true
    }
  }
}

Linux swap

2022-05-09T00:00:00Z

Find out which process is consuming Swap space

for file in /proc/*/status ; do awk '/Tgid|VmSwap|Name/{printf $2 " " $3}END{ print ""}' $file; done | grep kB  | sort -k 3 -n

Creating and Activating a Swap File

fallocate -l 2G /swapfile

chmod 600 /swapfile

mkswap /swapfile

swapon /swapfile

echo "/swapfile swap swap defaults 0 0" >> /etc/fstab

Podman

2022-05-09T00:00:00Z

Create a pod and expose ports

podman pod create --name pod-name -p 127.0.0.1:3306:3306

Python

2022-05-09T00:00:00Z

Flake8 config file for Black

[flake8]
max-line-length = 88
select = C,E,F,W,B,B9
ignore = E203, E501, W503
exclude = __init__.py

Generate dynamic dict based on function parameter

async def get_ohlc_data(self, pair: str, interval: int, since=None):
    data = {
        arg: value
        for arg, value in locals().items()
        if arg != "self" and value is not None
    }
    return await self.public_request(endpoint="OHLC", data=data)

RPM

2022-05-09T00:00:00Z

Packaging

Download sources of SPEC file

spectool -g -R my-package.spec

Install dependencies of SPEC file

Ensure dnf-plugins-core is installed

dnf builddep my-package.spec

Build package of SPEC file

rpmbuild -ba my-package.spec

WordPress

2022-05-09T00:00:00Z

Discover enqueued styles and scripts in Wordpress

function discover_scripts() 
{
	// Queued styles
	var_dump(wp_styles()->queue);
    // Queued scripts
    var_dump(wp_scripts()->queue);
}
add_action( 'wp_enqueue_scripts', 'discover_scripts', 100 );

How to develop a WordPress theme inside a container

2021-09-14T00:00:00Z

Hi folks, today we will learn about developing a WordPress theme inside a container.

We will use Docker compose because infrastructure as code is the way to go nowadays.

If you don't know yet Docker compose, please go to https://docs.docker.com/compose/ and come back to this tutorial.

If you know already everything and just want to clone a working template, here is the GitHub repo : https://github.com/Atem18/docker-wordpress

For reference, here is the Docker Compose we will use:

docker-compose.yml

version: '3'
services:
  db:
    container_name: wordpress-db
    image: mariadb:10.5.8
    restart: unless-stopped
    volumes:
      - ./dev/db/data:/var/lib/mysql
      - ./dev/db/entrypoint:/docker-entrypoint-initdb.d
    ports:
      - "3306:3306"
    networks:
      - mytheme
    environment:
      MYSQL_ROOT_PASSWORD: root
      MYSQL_DATABASE: wordpress
      MYSQL_USER: wordpress
      MYSQL_PASSWORD: wordpress
  wordpress:
    depends_on:
      - db
    container_name: wordpress-fpm
    build:
      context: ./wordpress
    restart: unless-stopped
    volumes:
      - ./wordpress/mytheme.ini:/usr/local/etc/php/conf.d/mytheme.ini
      - ./dev/wordpress:/var/www/html
      - ./mytheme:/var/www/html/wp-content/themes/mytheme
    networks:
      - mytheme
    environment:
      WORDPRESS_DB_HOST: wordpress-db
      WORDPRESS_DB_NAME: wordpress
      WORDPRESS_DB_USER: wordpress
      WORDPRESS_DB_PASSWORD: wordpress
  node:
    container_name: wordpress-node
    build:
      context: ./node
    restart: unless-stopped
    volumes:
      - ./mytheme:/app
  caddy:
    container_name: wordpress-caddy
    build:
      context: ./caddy
    restart: unless-stopped
    environment:
      DOMAIN: www.mydomain.com
    volumes:
      - ./caddy/certs:/etc/caddy/certs
      - ./dev/wordpress:/var/www/html
      - ./mytheme:/var/www/html/wp-content/themes/mytheme
    ports:
      - "80:80"
      - "443:443"
    networks:
      - mytheme
networks:
  mytheme:

As you can see upper in the compose file, we are using MariaDB, WordPress, Node.js and Caddy. It's just as exemple, feel free to swap any component.

MariaDB

Nothing fancy here, we just use the official MariaDB image.

What only changes is that we mount data into a local folder so it's not lost when we restart the container.

And we also mount a local folder so we can easily restore a dump from production.

WordPress

Here comes the first interesting part.

Dockerfile

FROM wordpress:php7.4-fpm
COPY mytheme.ini /usr/local/etc/php/conf.d/mytheme.ini
EXPOSE 9000

We declare a custom Dockerfile for Wordpress because we want to be able to declare our own PHP configuration file.

mytheme.ini

file_uploads = On
memory_limit = 64M
upload_max_filesize = 64M
post_max_size = 64M
max_execution_time = 600
expose_php = off

As you can see, we are tuning some variables. Please refer to the documentation to adjust the values or add values according to your needs.

Node.js

This part is only used in development and because I develop my own Wordpress themes, so feel free to skip it if you don't need it.

Dockerfile

FROM node:lts-alpine as develop-stage
WORKDIR /app
COPY docker-entrypoint.sh /usr/local/bin/
RUN chmod +x /usr/local/bin/docker-entrypoint.sh
ENTRYPOINT ["/usr/local/bin/docker-entrypoint.sh"]

docker-entrypoint.sh

#!/bin/sh
set -e

npm install

npm run watch

The whole point here is to install the node dependencies and watch using the tool of your choice (webpack, vite, etc.). Of course, don't forget to mount the folder /app on your system.

Caddy

Nothing complex as well here, we want to build a Dockerfile with a custom Caddyfile which you can find below. The only thing we are doing is to generate a fake SSL certificate using mkcert. If you don't have it, install it for your OS : https://github.com/FiloSottile/mkcert

mkcert "*.local.mydomain.com"

FROM caddy:2.4.5-alpine
ADD ./certs /etc/caddy/certs
ADD ./Caddyfile /etc/caddy/Caddyfile

{$DOMAIN} {
  root * /var/www/html
  php_fastcgi wordpress:9000
  file_server
  encode gzip zstd
  tls /etc/caddy/certs/_wildcard.local.mydomain.com.pem /etc/caddy/certs/_wildcard.local.mydomain.com-key.pem
}

Also don't forget to add the following in your DNS

127.0.0.1 www.local.mydomain.com

That's all folks!

How to resolve DNS issue in MicroK8s

2021-05-20T00:00:00Z

Hi folks, today, we will learn how to resolve DNS issue in MicroK8s.

If like me you happened to discover that you don't have internet in your pod but can ping 8.8.8.8, then you most likely have a DNS issue.

Also, there is a good chance that the issue might be this one: https://kubernetes.io/docs/tasks/administer-cluster/dns-debugging-resolution/#known-issues

To solve it, you need to edit the file /var/snap/microk8s/current/args/kubelet in all of your MicroK8s nodes and add at the end of the file:

--resolv-conf=/run/systemd/resolve/resolv.conf

Then restart kubelet :

systemctl restart snap.microk8s.daemon-kubelet

Finally, restart CoreDNS:

microk8s kubectl rollout restart -n kube-system deployment/coredns

You should also restart any pod that was affected by the issue with:

 microk8s kubectl rollout restart deployment mypod

That's all folks !

How to setup a VPN on CentOS using Wireguard

2020-12-01T00:00:00Z

Hi folks, today, we will learn how to setup Wireguard as VPN on CentOS.

This tutorial has been tested on CentOS 8.

Keep also in mind that Wireguard is different than OpenVPN for example because there is no concept of client/server, but only peers. So in my example, I will be using the CentOS as a « server » and the iOS as a « client » but in reality it’s just a point to point VPN between two machines.

Installation

Wireguard is not included in CentOS’s main repositories so you have to add additional repos to install it:

dnf install elrepo-release epel-release
dnf install kmod-wireguard wireguard-tools

As Wireguard is a kernel module, you will need to check if it’s enabled and enable it if it’s not.

To check if you will have to do so:

lsmod | grep wireguard

If it’s ok, you will get something like this:

root@centos:~# lsmod | grep wireguard
wireguard             208896  0
ip6_udp_tunnel         16384  1 wireguard
udp_tunnel             16384  1 wireguard

If you get nothing, you will have to enable it either :

Manually for one time:

modprobe wireguard

Automatically so it starts at boot:

echo "wireguard" > /etc/modules-load.d/wireguard.conf

Configuration

There are many ways to configure Wireguard. I will present you one that works but feel free to research for other methods.

Wireguard works kinda like OpenSSH, each peer have a pair of private and public key but unlike OpenSSH, Wireguard needs to know each public keys and private IP address of each peer he will allow the connection.

All the following commands will be performed on Ubuntu which as said previously will be our « server ».

Server configuration

Create private and public keys

mkdir /etc/wireguard
cd /etc/wireguard
wg genkey | tee privatekey | wg pubkey > publickey

Then, create a configuration file for wg0 which will be our device for routing.

/etc/wireguard/wg0.conf

[Interface]
Address = 192.168.2.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

[Peer]
# iphone
PublicKey = PEER_IPHONE_PUBLIC_KEY
AllowedIPs = 192.168.2.2/32

Adress: Here we define a network in /24, feel free to change it.

ListenPort: We also make our "server" listen on port 51820 in UDP so don't forget to open it in your firewall(s).

PrivateKey: Replace SERVER_PRIVATE_KEY by the content of /etc/wireguard/privatekey.

Leave PEER_IPHONE_PUBLIC_KEY for now, we will replace it after with our client's public key.

AllowedIPs: Change the AllowedIPs if you change the network or if you want to attribute another IP to your peer/client.

Client configuration

We will host "clients" keys and configuration files on the "server" in that example. But you can also generate them on your client and keep them safely there. It's up to you. {: .notice--info}

Create a new directory to put client's configuration files

mkdir -p /etc/wireguard/clients/iphone

Generate private and public keys

cd /etc/wireguard/clients/iphone
wg genkey | tee privatekey | wg pubkey > publickey

Create client's configuration file

/etc/wireguard/clients/iphone/iphone.conf

[Interface]
Address = 192.168.2.2/24
PrivateKey = PEER_IPHONE_PRIVATE_KEY
DNS = 192.168.2.1

[Peer]
PublicKey = SERVER_PUBLICKEY
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = ubuntu.mydomain.com:51820

Address: Client’s IP address, it has to match the one you defined in the server’s configuration.

PrivateKey: Replace PEER_IPHONE_PRIVATE_KEY by the content of /etc/wireguard/clients/iphone/privatekey

DNS: Put whatever DNS you want.

PublicKey: Replace SERVER_PUBLICKEY by the content of /etc/wireguard/publickey.

AllowedIPs: Allow specific IP if it's a static one or all if it's dynamic IP.

Endpoint: Specify the hostname or IP of your server and the port.

In /etc/wireguard/wg0.conf, replace PEER_IPHONE_PUBLIC_KEY by the content of /etc/wireguard/clients/iphone/publickey

Start Wireguard at boot

You can simply use systemd and wg-quick to enable and start your interface:

systemctl enable wg-quick@wg0 
systemctl start wg-quick@wg0

Mobile clients configuration

Create configuration manually

This is self-explanatory, you actually create the config on the mobile device then transfer the relevant keys to the server's config.

Create configuration from archive

Here you have to create a .zip archive of the client configuration file, transfer it to the device then import it into the app.

Import by reading a QR code (most secure method)

The mobile client supports QR code based input.

You need to install qrencode to generate a qr code from a configuration file:

apt install qrencode

Then call qrencode and pass the client configuration:

qrencode -t ansiutf8 < client.conf

This will generate a QR code that is readable by the mobile client.

The advantage of this approach is that there is no need to transfer sensitive information via data channels that can potentially be compromised and there is no need of any other supplementary software besides a terminal or console.

Conclusion

I hope you enjoyed this small tutorial about WireGuard on CentOS 8.

Feel free to comment below :D

How to create a small and secure container for your Python applications

2020-11-23T00:00:00Z

Hi folks, today, we will learn how to create a small and secure container for your Python applications.

Introduction

Whether you are using Docker, Podman, Kubernetes or something else, if you want to put a Python application in a container, you will have to create an image and most of the time, people don't really know how to get a small and secure image. Let's fix it.

TL;DR: For reference, here is the Dockerfile we will be using:

FROM python:3.8.6 AS develop-stage
WORKDIR /app
ENV PATH="/venv/bin:$PATH"
ENV PYTHONPATH=/app
COPY requirements.txt /requirements.txt
RUN python -m venv /venv
RUN pip install -r /requirements.txt
CMD ["python", "main.py"]

FROM develop-stage as build-stage
RUN mkdir tmp
RUN apt update && apt install patchelf
COPY --from=develop-stage /venv /venv
COPY ./app /app
RUN pyinstaller -F main.py
RUN staticx /app/dist/main /app/dist/main_tmp

FROM scratch
USER 65535
COPY --from=build-stage --chown=65535:65535 /app/tmp /tmp
COPY --from=build-stage --chown=65535:65535 /app/dist/main_tmp /app/main
CMD ["/app/main"]

Do note that this is a minimal example, your final one will most probably have more commands.

Explanations

As you can see in the example, we are declaring three "FROM" as opposed to regular one "FROM". It's called multi-stage. Think of it like pipelines or jobs in your CI/CD tool. Three stages, each one has a specific utility.

Also, the order of commands matter because you want to use Docker cache as much as possible. So respect those requirements:

Put the commands that are changing less often of top of the other to use as much as cache as possible
Don't call RUN command to execute a bash script, unless it's un the CMD or ENTRYPOINT commands
Don't pipe commands that will not change

Now let's review the stages.

Develop stage

ENV PATH="/venv/bin:$PATH"
ENV PYTHONPATH=/app
COPY requirements.txt /requirements.txt
RUN python -m venv /venv
RUN pip install -r /requirements.txt
CMD ["python", "main.py"]

In this stage, the goal is to have the best container for developing your application. It does not have to be minimal in size or secured because it will never be used outside of your device.

FROM python:3.8.6 AS develop-stage

We use the official Python docker image with all the tools, because we want to have a full Python environement to develop.

WORKDIR /app

We set the workdir to /app so each next commands are executed in the directory /app

ENV PATH="/venv/bin:$PATH"
ENV PYTHONPATH=/app

We add the venv/bin directory to the path because we want to be able to call some binaries from our project. This is optional if you don't do it.

The PYTHONPATH env var is optional if your program does not depends on it but it's always good to set it.

COPY requirements.txt /requirements.txt

We copy the requirements of your project.

RUN python -m venv /venv

We create a folder where to install all the dependencies.

RUN pip install -r /requirements.txt

We install the dependencies. PIP will install them in the folder /venv because we did previously set ENV PATH="/venv/bin:$PATH"

CMD ["python", "main.py"]

Finally we run the app.

If you use docker-compose, you can specify the following to develop using that specific stage.

build:
  context: ./app
  target: develop-stage

Build stage

FROM develop-stage as build-stage
RUN mkdir tmp
RUN apt update && apt install patchelf
COPY --from=develop-stage /venv /venv
COPY ./app /app
RUN pyinstaller -F main.py
RUN staticx /app/dist/main /app/dist/main_tmp

In this stage, the goal is to generate the binary of your application. It does not have to be minimal in size or secured because it will never be used outside of your device.

FROM develop-stage as build-stage

We are using the same container as the develop-stage to save time and space.

RUN mkdir tmp

We create a tmp folder that we will use later. It's for Pyinstaller because it needs to uncompress some files into /tmp and the final image "scratch" has no utility to create that /tmp folder.

RUN apt update && apt install patchelf

We install patchelf as it's a dependency of staticx, the tool we will use to generate our final binary with the system libs embeded.

COPY --from=develop-stage /venv /venv

We copy the Python dependencies so we can call Pyinstaller and it can find all your program dependencies.

COPY ./app /app

We copy your program source source.

RUN pyinstaller -F main.py

Now, we generate a static binary out of your main entry program. Don't forget to add pyinstaller to your requirements.txt.

RUN staticx /app/dist/main /app/dist/main_tmp

Finally, we link the system libs against your app and generate a file out of it. Don't forget to add statixc to your requirements.txt.

You can now either stop and distribute the file main_tmp to your clients or keep reading and distribute a container with only your application inside.

Production stage

FROM scratch
USER 65535
COPY --from=build-stage --chown=65535:65535 /app/tmp /tmp
COPY --from=build-stage --chown=65535:65535 /app/dist/main_tmp /app/main
CMD ["/app/main"]

In this stage, the goal is to generate the final container for your application. We need it to be minimal in size and secured, that's why we will be using scratch as base image.

FROM scratch

As said previously, we use scratch as it's an empty image so there is no exploit possible outside of your application.

USER 65535

We set the user to a non-root user. Please do note that your application cannot bind to a port lower than 1024 because it does not run as root.

COPY --from=build-stage --chown=65535:65535 /app/tmp /tmp

As said previously, Pyinstaller needs a /tmp directory so we copy it from the previous stage.

COPY --from=build-stage --chown=65535:65535 /app/dist/main_tmp /app/main

We copy our final binary to the main directory.

CMD ["/app/main"]

Finally, we set the final command of the container.

Conclusion

I hope you liked the article and that it will help you to deliver Python apps to many people and in a secure way ! :)

Feel free to comment if you have any questions/suggestions.

Have a good day, Kevin.

How to setup a VPN on Ubuntu using Wireguard

2020-08-27T00:00:00Z

Hi folks, today, we will learn how to setup Wireguard as VPN on Ubuntu.

This tutorial has been tested on Ubuntu 20.04.

Keep also in mind that Wireguard is different than OpenVPN for example because there is no concept of client/server, but only peers. So in my example, I will be using the Ubuntu as a « server » and the iOS as a « client » but in reality it’s just a point to point VPN between two machines.

Installation

Wireguard is already included in Ubuntu’s main repositories so you only have to call APT to install it:

apt install wireguard

As Wireguard is a kernel module, you will need to check if it’s enabled and enable it if it’s not.

To check if you will have to do so:

lsmod | grep wireguard

If it’s ok, you will get something like this:

root@ubuntu:~# lsmod | grep wireguard
wireguard             208896  0
ip6_udp_tunnel         16384  1 wireguard
udp_tunnel             16384  1 wireguard
root@ubuntu:~#

If you get nothing, you will have to enable it either :

Manually for one time:

modprobe wireguard

Automatically so it starts at boot:

echo "wireguard" > /etc/modules-load.d/wireguard.conf

In my fresh Ubuntu installation, I had to enable it manually.

Configuration on Ubuntu

There are many ways to configure Wireguard. I will present you one that works but feel free to research for other methods.

All the following commands will be performed on Ubuntu which as said previously will be our « server ».

Server configuration

Create private and public keys

mkdir /etc/wireguard
cd /etc/wireguard
wg genkey | tee privatekey | wg pubkey > publickey

Then, create a configuration file for wg0 which will be our device for routing.

/etc/wireguard/wg0.conf

[Interface]
Address = 192.168.2.1/24
ListenPort = 51820
PrivateKey = SERVER_PRIVATE_KEY

# note - substitute eth0 in the following lines to match the Internet-facing interface
# if the server is behind a router and receive traffic via NAT, this iptables rules are not needed
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
# iphone
PublicKey = PEER_IPHONE_PUBLIC_KEY
AllowedIPs = 192.168.2.2/32

Adress: Here we define a network in /24, feel free to change it.

ListenPort: We also make our "server" listen on port 51820 in UDP so don't forget to open it in your firewall(s).

PrivateKey: Replace SERVER_PRIVATE_KEY by the content of /etc/wireguard/privatekey.

Leave PEER_IPHONE_PUBLIC_KEY for now, we will replace it after with our client's public key.

AllowedIPs: Change the AllowedIPs if you change the network or if you want to attribute another IP to your peer/client.

Client configuration

We will host "clients" keys and configuration files on the "server" in that example. But you can also generate them on your client and keep them safely there. It's up to you. {: .notice--info}

Create a new directory to put client's configuration files

mkdir -p /etc/wireguard/clients/iphone

Generate private and public keys

cd /etc/wireguard/clients/iphone
wg genkey | tee privatekey | wg pubkey > publickey

Create client's configuration file

/etc/wireguard/clients/iphone/iphone.conf

[Interface]
Address = 192.168.2.2/24
PrivateKey = PEER_IPHONE_PRIVATE_KEY
DNS = 192.168.2.1

[Peer]
PublicKey = SERVER_PUBLICKEY
AllowedIPs = 0.0.0.0/0, ::/0
Endpoint = ubuntu.mydomain.com:51820

Address: Client’s IP address, it has to match the one you defined in the server’s configuration.

PrivateKey: Replace PEER_IPHONE_PRIVATE_KEY by the content of /etc/wireguard/clients/iphone/privatekey

DNS: Put whatever DNS you want.

PublicKey: Replace SERVER_PUBLICKEY by the content of /etc/wireguard/publickey.

AllowedIPs: Allow specific IP if it's a static one or all if it's dynamic IP.

Endpoint: Specify the hostname or IP of your server and the port.

In /etc/wireguard/wg0.conf, replace PEER_IPHONE_PUBLIC_KEY by the content of /etc/wireguard/clients/iphone/publickey

Start Wireguard at boot

You can simply use systemd and wg-quick to enable and start your interface:

systemctl enable wg-quick@wg0 
systemctl start wg-quick@wg0

Mobile clients configuration

Create configuration manually

This is self-explanatory, you actually create the config on the mobile device then transfer the relevant keys to the server's config.

Create configuration from archive

Here you have to create a .zip archive of the client configuration file, transfer it to the device then import it into the app.

Import by reading a QR code (most secure method)

The mobile client supports QR code based input.

You need to install qrencode to generate a qr code from a configuration file:

apt install qrencode

Then call qrencode and pass the client configuration:

qrencode -t ansiutf8 < client.conf

This will generate a QR code that is readable by the mobile client.

The advantage of this approache is that there is no need to transfer sensitive information via data channels that can potentially be compromised and there is no need of any other supplementary software besides a terminal or console.

Conclusion

I hope you enjoyed this small tutorial about WireGuard on Ubuntu.

Feel free to comment below :D

How to easily create your own adblock using Dnsmasq

2020-07-05T00:00:00Z

Hi folks, today we will learn how to build your own adblock, one that does not sell your navigation data to big corporations.

We will be using Dnsmasq as our DNS server which will have a list of domains to block (spoiler: domain ads). And we will update that list everyday by cron. Of course that means that you should then update your DNS to use the one we are configuring.

Installation

For Debian

apt update && apt install dnsmasq

For CentOS

yum update && yum install dnsmasq

Configuration

We copy the original file in case we want to restore it

cp /etc/dnsmasq.conf /etc/dnsmasq.conf.ori

Then create a configuration file named /etc/dnsmasq.conf and put the following content

domain-needed
bogus-priv
resolv-file=/etc/dnsmasq-dns.conf
strict-order
user=dnsmasq
group=dnsmasq
addn-hosts=/etc/dnsmasq-hosts.conf
expand-hosts
domain=mydomain.lan

Replace mydomain.lan by a custom domain you would like to be served via your DNS.
Omit the line if you don't want to serve one.

DNS

Open your firewall on port 53 both in UDP and TCP.

Create a file named /etc/dnsmasq-dns.conf and put the following inside:

nameserver 1.1.1.1
nameserver 1.0.0.1

If you don't like Cloudflare's DNS, feel free to use others.

If you've put the line "domain" in /etc/dnsmasq.conf, then create a file named /etc/dnsmasq-custom.conf where you will put custom domain resolution like :

127.0.0.1 alpha
127.0.0.1 beta

They will resolve as alpha.mydomain.lan and beta.mydomain.lan

CRON

Create a file called /etc/cron.daily/adblocker and put the following content

#!/bin/bash

curl -s -o /etc/dnsmasq-adblock https://raw.githubusercontent.com/StevenBlack/hosts/master/hosts

cat /etc/dnsmasq-custom > /etc/dnsmasq-hosts.conf

cat /etc/dnsmasq-adblock >> /etc/dnsmasq-hosts.conf

systemctl restart dnsmasq

Basically what we are doing is :

getting the last version of the ads domains
put any custom domain to dnsmasq hosts file
append ads domain to the previous list
restart dnsmasq

We are using the excellent project https://github.com/StevenBlack/hosts

Feel free to use another list or even run your own. It will work as long as it's a list in the same format than an hosts file.

Conclusion

Setting up and maintaining your own adblock is really easy.

Also if you wish to use it as you go like on your mobile phone, feel free to use my tutorial about Wireguard.

That's all folks!