# 1. install script:
git clone https://github.com/Neilpang/acme.sh.git acme.sh.repo

cd acme.sh.repo

DIR="$HOME/letsencrypt"
./acme.sh --install                           \
  --home          $DIR/acme.sh                \
  --certhome      $DIR/certs                  \
  --accountkey    $DIR/acme.sh/myaccount.key  \
  --accountconf   $DIR/acme.sh/myaccount.conf \
  --accountemail  "xxx@yyy.com"

exit # and reopen a shell

# 2. set autoupdate of the script:
acme.sh --upgrade --auto-upgrade

# 3. run it twice per day on a random minute, set crontab:
#    see: https://certbot.eff.org/#debianwheezy-nginx
10  0 * * * /path_to/acme.sh/acme.sh --cron --home /path_to/acme.sh > /dev/null
20 12 * * * /path_to/acme.sh/acme.sh --cron --home /path_to/acme.sh > /dev/null

# 4a. issue a certificate (add --test for the staging environment):
acme.sh --issue -d acavalin.com -d www.acavalin.com -w /path_to/webserver_public_root

# 4b. issue a wildcard certificate with a specific dns service plugin
acme.sh --issue -d acavalin.com -d '*.acavalin.com' --dns dns_plugin_name

# 5. install certificate for NGINX (do not manually copy acme.sh files!):
acme.sh --install-cert -d acavalin.com \
  --key-file       /path_to/ssl_app.key \
  --fullchain-file /path_to/ssl_app.crt \
  --reloadcmd      "/path_to/server_script.sh restart"

#!/usr/bin/env sh
# acme.sh plugin @ $HOME/letsencrypt/acme.sh/dnsapi/dns_dnsmasq.sh

CONF=/etc/dnsmasq.d/acme-challenge.conf

dns_dnsmasq_add() {
  echo "txt-record=$1,\"$2\"" >> $CONF
  systemctl restart dnsmasq ; sleep 1
}

dns_dnsmasq_rm() {
  sed -i "/$1,.$2./d" $CONF
  systemctl restart dnsmasq ; sleep 1 # optional
}

apt-get install ufw

# write rules in /lib/ufw/user.rules
ufw reset # reset to defaults
# set our defaults
ufw default allow outgoing
ufw default deny  incoming
ufw allow 22/tcp        # ssh
ufw allow 80/tcp        # http
ufw allow 443/tcp       # https
ufw allow 1194/udp      # openvpn
ufw allow 1100:1200/tcp # port range (proto required23)
ufw allow 53            # allow both tcp and udp (eg: DNS)
ufw allow from 1.2.3.4  # single host
ufw allow from 192.168.1.0/24 # subnet
ufw allow from 1.2.3.4 to any port 22 proto tcp

# block an IP if it has attempted to initiate 6 or more
# connections in the last 30 seconds
ufw limit 22/tcp

# show rules added before enabling firewall
ufw show added

# remove rule
ufw status numbered
ufw delete row_number

# show rules
ufw show added
ufw show raw

# other reports
ufw show builtins
ufw show before-rules
ufw show user-rules
ufw show after-rules
ufw show logging-rules

# start/stop/status service
ufw enable
ufw disable
ufw status
ufw status verbose
ufw reload # reload cfg

# see logs
ufw logging low # off/low/medium/high/full
tail -f /var/log/ufw.log

# check system compatibility
wget -q -O - https://raw.githubusercontent.com/docker/docker/master/contrib/check-config.sh | \
  bash | tee docker-check.txt

# install docker: key, repo, packages
apt-get install apt-transport-https ca- curl gnupg2 software-properties-common
curl -fsSL https://download.docker.com/linux/debian/gpg | apt-key add -

# echo "deb [arch=amd64] https://download.docker.com/linux/debian stretch stable" > /etc/apt/sources.list.d/docker-ce.list # armhf @ raspi
add-apt-repository "deb [arch=amd64] https://download.docker.com/linux/debian $(lsb_release -cs) stable" # armhf @ raspi

apt-get update && apt-get install docker-ce

# allow user to use docker
usermod -aG docker username

# test installation
docker version
docker info

# run a simple test image
docker run hello-world

touch Dockerfile # and fill it
docker build -t test-myimg . # create the image with a tag

# test run image
docker run -p 4000:80    test-myimg
docker run -it test-myimg /bin/bash

# run image detached/on background
docker run -p 4000:80 -d --name tmi test-myimg
docker container ls -a
docker container stop <container_id>
docker container start -i tmi # restart container

# run interactive shell into debian image (temporary)
docker run --name prova --rm -it debian /bin/bash 

# run interactive shell into debian image
docker run -it debian /bin/bash 

apt-get update

apt-get install -y dialog nano ncdu
apt-get install -y locales

localedef -i en_US -c -f UTF-8 -A /usr/share/locale/locale.alias en_US.UTF-8
echo "LANG=en_US.utf8" >> /etc/environment

rm -rf /var/lib/apt/lists/*

docker commit e2b7329257ba myimg:v1

docker run --rm -it myimg:v1 /bin/bash

# run a command in a running container
docker exec -ti a123098734e bash -il

docker stop a123098734e
docker kill a123098734e

docker save imgname | gzip > imgname.tgz
zcat imgname.tgz | docker load

# flatten image layers (losing Dockerfile)
docker export <id> | docker import - imgname:tag

# push image to gitlab registry
docker login registry.gitlab.com
docker tag test-myimg registry.gitlab.com/username/repo:tag # add new tag...
docker rmi test-myimg # ...and remove the old tag
docker push registry.gitlab.com/username/repo:tag

# https://ownyourbits.com/2018/06/27/running-and-building-arm-docker-containers-in-x86/
apt-get install qemu-user-static

docker run \
  -v /usr/bin/qemu-arm-static:/usr/bin/qemu-arm-static \
  -e LANG=en_US.utf8 -ti --name myarmimg arm32v7/debian:wheezy

[...]

docker commit myarmimg myarmimg

docker container prune -f

docker run \
  -v /usr/bin/qemu-arm-static:/usr/bin/qemu-arm-static \
  -ti --rm --name myarmimg \
  myarmimg /bin/bash -il

# install docker-compose
curl -L  -o /usr/local/bin/docker-compose https://github.com/docker/compose/releases/download/1.24.0-rc1/docker-compose-`uname -s`-`uname -m`
chmod 755 /usr/local/bin/docker-compose

docker swarm init

docker stack deploy --with-registry-auth -c docker-compose.yml getstartedlab
docker service ls
docker service ps getstartedlab_web # or docker stack ps getstartedlab

# change the yml file and restart service
docker stack deploy --with-registry-auth -c docker-compose.yml getstartedlab
docker service ps getstartedlab_web
docker container prune -f

# stop & destroy service
docker stack rm getstartedlab
docker container prune -f

# leave the swarm
docker swarm leave --force

# install docker-machine
curl -L -o /usr/local/bin/docker-machine https://github.com/docker/machine/releases/download/v0.16.1/docker-machine-`uname -s`-`uname -m`
chmod 755 /usr/local/bin/docker-machine

# setup each VMs
ssh-copy-id -i ~/.ssh/id_rsa user@ww.xx.yy.zz
docker-machine create --driver generic --generic-ssh-key ~/.ssh/id_rsa \
  --generic-ip-address=ww.xx.yy.zz myvm1

ssh-copy-id -i ~/.ssh/id_rsa user@ww.xx.yy.kk
docker-machine create --driver generic --generic-ssh-key ~/.ssh/id_rsa \
  --generic-ip-address=ww.xx.yy.kk myvm2

docker-machine ls

# run a command via ssh in a VM
docker-machine ssh myvm1 "ls -l"                 # use internal SSH lib
docker-machine --native-ssh ssh myvm1 "bash -il" # use system SSH lib

# set env to run all docker commands remotely on a VM
eval $(docker-machine env myvm1) # on bash
docker-machine use myvm1         # on fish + omf plugin-docker-machine

# set VM1 to be a swarm manager
docker-machine use myvm1
docker swarm init # --advertise-addr ww.xx.yy.zz
docker swarm join-token worker # get token for adding worker nodes

# set VM2 to join the swarm as a worker
docker-machine use myvm2
docker swarm join --token SWMTKN-xxx ww.xx.yy.zz:2377

# check cluster status on your local machine...
docker-machine ls
# ...or on the manager node
docker-machine use myvm1
docker node ls

# locally login on your registry...
docker-machine unset
docker login registry.gitlab.com
# ...then deploy the app on the swarm manager
docker-machine use myvm1
docker stack deploy --with-registry-auth -c docker-compose.yml getstartedlab
docker service ls
docker service ps getstartedlab_web

# access cluster from any VM's IP
curl http://ww.xx.yy.zz:4000
curl http://ww.xx.yy.kk:4000

# eventually re-run "docker stack deploy ..." to apply changes

# undo app deployment
docker-machine use myvm1
docker stack rm getstartedlab

# remove the swarm
docker-machine run myvm2 "docker swarm leave"
docker-machine run myvm1 "docker swarm leave --force"

docker-machine use myvm1
docker-machine ssh myvm1 "mkdir ./data" # create redis data folder

# run stack / deploy app
docker stack deploy -c docker-compose.yml getstartedlab
docker stack ps getstartedlab

firefox http://<myvm1-ip>:8080/ # docker visualizer
redis-cli -h <myvm1-ip>         # interact with redis

docker stack rm getstartedlab