OVH [ns3024499.ip-149-202-72.eu]

• 1. Vendor Setup
• 2. Initial Login
• 3. System Defaults
• 4. Core System Packages Config
• Custom Scripts /usr/local/bin
• 5. Core Application Services
• Tailscale VPN
• Webmin
• Docker
• APT Sources
• Tailscale APT Sources
• Docker APT Sources

1. Vendor Setup

2. Initial Login

3. System Defaults

4. Core System Packages Config

Custom Scripts /usr/local/bin

5. Core Application Services

Tailscale VPN

Tailscale VPN from https://tailscale.com/ 

• configures a host interface tailscale0 
• installs auto-start for tailscale daemon /etc/systemd/system/multi-user.target.wants/tailscaled.service
  
• starts service at boot allocating IP address 100.100.69.2 to the tailscale0 nic
• attaches tailscale0 nic to the shared VPN 
  • makes accessible 100.100.69.X addresses
  • makes the HOST available as an exit node

configured to use account pkswansea@outlook.com via the admin console via https://login.tailscale.com/admin 

The server SSH service running on port 69 isonly exposed on the tailscale0 interface via the IP 100.100.69.2 once the daemon has started via /etc/systemd/system/ssh-after-tailscale.service and can only be accessed when connected to a valid VPN client

#!/bin/bash while ! ip addr show tailscale0 | grep -q "inet "; do     sleep 10 done systemctl start ssh

Webmin

Webmin from https://webmin.com/

• installed onto host system via 3rd party apt repository
• installs and auto-configured for start at boot-time
• OOB installation listens on all interfaces https://<ip>:10000
  • post install modify the /etc/webmin./miniserv.conf 
  • we will only listen on internally accessible networks
  • we will disable SSL 
  • we will reverse proxy via nginx proxy manager https to http:10000

Installation Steps

1. install webmin repo

   wget -O - https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh | sudo bash

2. update repo

   sudo apt update

3. install webmin package

   sudo apt install -y webmin

4. start and verify service

   sudo systemctl status webmin
   sudo netstat -anp|grep 10000 | grep LISTEN | awk '{print $4}' | awk '{print "https://"$1}'

5. access initial webmin UI and login as root

wget -O - https://raw.githubusercontent.com/webmin/webmin/master/webmin-setup-repo.sh | sudo bash
sudo apt update
sudo apt install -yq webmin
sudo systemctl status webmin
sudo netstat -anp|grep 10000 | grep LISTEN | awk '{print $4}' | awk '{print "http://"$1}' | xargs -n1 open

Update OOB installation

We can update via the webmin UI to change a minimal set of options to use Webmin behind a local IP which we access via https proxy through the nginx proxy 

For the following configuration to be enabled, follow the setup steps below

Pre-Setup Requirements

• Docker installed on HOST
• Docker networks configured on HOST
• Nginx Proxy Manager container setup as per The NGINX Proxy Manager Install Guide
• Access from your local machine to the server Tailscale IP address via Tailscale VPN

NGINX Proxy Host Configuration

Your NGINX Docker compose file should be setup to listen on your VPN (Tailscsale) Server IP Address

      - 100.100.69.2:80:80
      - 100.100.69.2:443:443
      - 100.100.69.2:81:81

We now setup an inbound host to listen on HTTP and HTTPS, setting the Domain Name and then rourting traffic to one of the internal IP addresses that Webmin is listening on 

Next you want to request an SSL certificate or use the wildcard cert that should be available; ensure to enable Force SSL so all conections are secure; as a final check, we setup the advanced nginx config to check source IP ranges - if the address is not local or VPN, it is denied

Post Install Configuration (WebUI)

Open Console Login as root
Post Login Error	When loading using only the proxied address (https://webmin.admin.tld.com) it may redirect to https://webmin.admin.tld.co.uk:10000 - which will cause an error (as we should have blocked access externally to 10000) - simply remove the port from the URL and hit enter to load the page
Open the Webmin Config Page
update IPs leave internal IP remove external   modify listen ports as required (only change if there are conflicts)
disable SSL as the NGINX proxy will receive the SSL connection and terminate it using HTTP internally (optional but easier) Setup SSL Certs if you use SSL - use your *.admin wildcard SSL cert
Update the approved referer DNS names

Docker

APT Sources

Tailscale APT Sources

#/bin/bash -e
GPG_URL=https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).noarmor.gpg
GPG_KEYFILE=/usr/share/keyrings/tailscale-archive-keyring.gpg
APT_URL=https://pkgs.tailscale.com/stable/ubuntu/$(lsb_release -cs).tailscale-keyring.list
APT_LIST=/etc/apt/sources.list.d/tailscale.list


which lsb_release || apt install -yq lsb-release
echo [ -f ${GPG_KEYFILE} ] || curl -fsSL ${GPG_URL} | sudo tee ${GPG_KEYFILE} >/dev/null
echo curl -fsSL ${APT_URL} | sudo tee ${APT_LIST}

Docker APT Sources

#!/bin/bash -e

for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove -y $pkg; done

sudo apt-get update
sudo apt-get install ca-certificates curl
sudo install -m 0755 -d /usr/share/keyrings
sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /usr/share/keyrings/docker.asc
sudo chmod a+r /usr/share/keyrings/docker.asc

# Add the repository to Apt sources:
echo \
  "deb [arch=$(dpkg --print-architecture) signed-by=/usr/share/keyrings/docker.asc] https://download.docker.com/linux/ubuntu \
  $(. /etc/os-release && echo "${UBUNTU_CODENAME:-$VERSION_CODENAME}") stable" | \
  sudo tee /etc/apt/sources.list.d/docker.list > /dev/null
sudo apt-get update
sudo apt-get install -y docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin