====== Futur chd-stg2 ======

  * netinstall Debian 9 amd64
  * Français / France
  * hostname : chd-stg2.chd.sx
  * Une seule partition sda1 de la taille du disque virtuel, options discard,noatime, label=chd-stg2-rootfs
  * tasksel : utilitaires usuels, serveur ssh, pas d'env graphique
  * user root et rescue

===== Configuration initiale =====

<file text /root/.ssh/authorized_keys>
[...]
</file>

<file bash /etc/default/grub>
GRUB_CMDLINE_LINUX_DEFAULT=""
GRUB_CMDLINE_LINUX="net.ifnames=0 console=ttyS0,115200n8 console=tty1 systemd.journald.forward_to_console=1 systemd.journald.max_level_console=warning"
GRUB_TERMINAL=console
</file>

<code bash>
chmod -x /etc/grub.d/{05_debian_theme,20_linux_xen,30_os-prober,30_uefi-firmware,40_custom,41_custom}
update-grub

apt install all-knowing-dns apache2 arping bind9 binutils borgbackup dnsutils fail2ban git gt5 htop iftop iotop iperf iperf3 libapache2-mod-php mtr-tiny nmap ntp nullmailer psmisc rsync screen strace sudo sysstat tcpdump tree unzip vim
</code>

<file bash /etc/network/interfaces>
# This file describes the network interfaces available on your system
# and how to activate them. For more information, see interfaces(5).

source /etc/network/interfaces.d/*

# The loopback network interface
auto lo
iface lo inet loopback
	# https://www.kernel.org/doc/Documentation/networking/ip-sysctl.txt
	up sysctl -w net.ipv6.conf.all.accept_ra_pinfo=0
	up sysctl -w net.ipv6.conf.all.accept_redirects=0
	up sysctl -w net.ipv6.conf.all.router_solicitations=0
	up sysctl -w net.ipv6.conf.all.accept_dad=0

# The primary network interface
auto eth0
# Public adresses
iface eth0 inet static
	address 185.131.40.2
	netmask 255.255.255.0
	gateway 185.131.40.1
	# accept_dad=0 après que l'interface soit conifugrée en v4 mais avant
	# qu'elle soit configurée en v6 (ça marche pas si on met ça en pre-up
	# dans la section inet6)
	up sysctl -w net.ipv6.conf.$IFACE.accept_dad=0
	# Allumer le firewall avant d econfigurer les IP publiques
	up iptables-restore < /etc/network/iptables.conf
	up ip6tables-restore < /etc/network/ip6tables.conf

iface eth0 inet6 static
	address 2a03:a0a0::2
	netmask 64
	up ip -6 r r default via fe80::31 dev $IFACE src 2a03:a0a0::2
	
# Admin network overlay
iface eth0 inet static
	address 172.16.0.253
	netmask 255.255.0.0

# ns3 all-knowing-dns - reverse DNS IPv6
iface eth0 inet static
	address 185.131.40.3
	netmask 255.255.255.0

iface eth0 inet6 static
	address 2a03:a0a0::3
	netmask 64
</file>

<file bash /etc/network/ip6tables.conf>
# Generated by ip6tables-save v1.6.0 on Sun Apr 22 17:12:21 2018
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# Accepter tout le traffic local, tous les paquets ICMP et les connexions déjà établies
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p ipv6-icmp -j ACCEPT
-A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
# Accepter tous les paquets depuis les IP d'admin (en overlay sur le L2 public en aval de stg)
-A INPUT -s fe80::/16 -i eth0 -j ACCEPT
# Accepter SSH depuis partout
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
# Accepter les requêtes DNS depuis partout
-A INPUT -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 53 -j ACCEPT
# Accepter les requêtes web depuis partout
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
# Accepter le serveur Munin
#-A INPUT -s XXX -i eth0 -p tcp -m tcp --dport 4949 -j ACCEPT
# Accepter les connexions à AirControl 2 depuis certaines IP (pas open sur le net car pas secure)
#-A INPUT -s XXX -i eth0 -p tcp -m multiport --dports 443,9081 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "ipt6input: " --log-level 7
COMMIT
# Completed on Sun Apr 22 17:12:21 2018
</file>
<file bash /etc/network/iptables.conf>
# Generated by iptables-save v1.6.0 on Sun Apr 22 16:55:29 2018
*filter
:INPUT DROP [0:0]
:FORWARD ACCEPT [0:0]
:OUTPUT ACCEPT [0:0]
# Accepter tout le traffic local, tous les paquets ICMP et les connexions déjà établies
-A INPUT -i lo -j ACCEPT
-A INPUT -i eth0 -p icmp -j ACCEPT
-A INPUT -i eth0 -m conntrack --ctstate ESTABLISHED -j ACCEPT
# Accepter tous les paquets depuis les IP d'admin (en overlay sur le L2 public en aval de stg)
-A INPUT -s 172.16.0.0/12 -i eth0 -j ACCEPT
# Accepter SSH depuis partout
-A INPUT -p tcp -m tcp --dport 22 -j ACCEPT
# Accepter les requêtes DNS depuis partout
-A INPUT -i eth0 -p tcp -m tcp --dport 53 -j ACCEPT
-A INPUT -i eth0 -p udp -m udp --dport 53 -j ACCEPT
# Accepter les requêtes web depuis partout
-A INPUT -i eth0 -p tcp -m tcp --dport 80 -j ACCEPT
# Accepter le serveur Munin
-A INPUT -s 185.61.116.41/32 -i eth0 -p tcp -m tcp --dport 4949 -j ACCEPT
# Accepter les connexions à AirControl 2 depuis certaines IP (pas open sur le net car pas secure)
# 185.131.40.0/23	Adhérents CHD
# 86.71.33.140		aDSL lpouzenc
# 62.212.116.203	aDSL nerim cyril
# 109.190.62.22		aDSL ovh cyril
# 185.61.116.37		sortie vpn prosoluce
-A INPUT -s 185.131.40.0/23,86.71.33.140,62.212.116.203,109.190.62.22,185.61.116.37 -i eth0 -p tcp -m multiport --dports 443,9081 -j ACCEPT
-A INPUT -m limit --limit 5/min -j LOG --log-prefix "ipt4input: " --log-level 7
COMMIT
# Completed on Sun Apr 22 16:55:29 2018
</file>

<code bash>
reboot

apt install munin-node
rm /etc/munin/plugins/ntp_*
rm /etc/munin/plugins/swap
# renommer les if_enp3 en if_eth0 si besoin
ln -s /usr/share/munin/plugins/bind9 /etc/munin/plugins/bind9
ln -s /usr/share/munin/plugins/tcp  /etc/munin/plugins
</code>

<file text /etc/munin/munin-node.conf>
allow ^185\.61\.116\.41$
</file>

<file ini /etc/munin/plugin-conf.d/local>
[bind9]
group bind
</file>

<code bash>
service munin-node restart

apt autoremove --purge aspell os-prober doc-debian doc-debian-fr debian-faq ispell laptop-detect wamerican wfrench xauth 

mkdir -p /var/log/{bind9,remote} /var/cache/build-openwrt{,-dev}/build	
</code>


<file text /etc/fstab>
none	/var/log/bind9	tmpfs	uid=bind,gid=bind,mode=0750,size=30m	0	0
none	/var/cache/build-openwrt/build		tmpfs	uid=33,gid=33,mode=0750,size=512M00
none	/var/cache/build-openwrt-dev/build	tmpfs	uid=33,gid=33,mode=0750,size=512M00
/	/mnt/rootfs	ext4	bind			0	0
# Attention à l'ordre, le mount --bind doit être à la fin
</file>

<file text /etc/rsyslog.d/remote.conf>
module(load="imudp")
input(type="imudp" port="514" ruleset="rs_remote")
template(name="t_remote_logfile" type="string" string="/var/log/remote/%fromhost-ip%.log")
ruleset(name="rs_remote") {
    action(type="omfile" dynaFile="t_remote_logfile" dynaFileCacheSize="400")
}
</file>

<code bash>
mount -a
service rsyslog restart
</code>

<file c /etc/bind/named.conf.local>
//
// Do any local configuration here
//

// Consider adding the 1918 zones here, if they are not used in your
// organization
include "/etc/bind/zones.rfc1918";

// Set up an ACL named "bogusnets" that will block
// RFC1918 space and some reserved space, which is
// commonly used in spoofing attacks.
acl bogus-nets {
    0.0.0.0/8;  192.0.2.0/24; 224.0.0.0/3;
    10.0.0.0/8; 172.16.0.0/12; 192.168.0.0/16;
};

logging {
	channel query {
		file "/var/log/bind9/query.log" versions 2 size 10m;
		print-time yes;
		severity info;
	};
	category queries { query; };
};

zone "40.131.185.in-addr.arpa" {
	type master;
	file "/etc/bind/db.185.131.40";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};

zone "41.131.185.in-addr.arpa" {
	type master;
	file "/etc/bind/db.185.131.41";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};

zone "commingeshautdebit.fr" {
	type master;
	file "/etc/bind/db.commingeshautdebit.fr";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};

zone "ipv4.commingeshautdebit.fr" {
	type master;
	file "/etc/bind/db.ipv4.commingeshautdebit.fr";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};

zone "0.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa" {
	type master;
	file "/etc/bind/db.2a03:a0a0::";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};

zone "1.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa" {
	type master;
	file "/etc/bind/db.2a03:a0a0:1::";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};

zone "0.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa.upstream" {
	type master;
	file "/etc/bind/db.2a03:a0a0::upstream";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};

zone "1.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa.upstream" {
	type master;
	file "/etc/bind/db.2a03:a0a0:1::upstream";
	allow-update { none; };
	allow-transfer { 185.61.116.41; }; # ns1
};
</file>

<file c /etc/bind/named.conf.options>
options {
	directory "/var/cache/bind";

	// TODO configurer proprement DNSSEC
	dnssec-enable no;
	dnssec-validation no;

	auth-nxdomain no;    # conform to RFC1035
	listen-on { 185.131.40.2; };
	listen-on-v6 { 2a03:a0a0::2; };
	blackhole { bogus-nets; };
};
</file>

<file text /etc/bind/db.185.131.40>
;
; 185.131.40.0/24
;
$TTL	86400
@	IN	SOA	ns2.commingeshautdebit.fr.	dnsmaster.commingeshautdebit.fr. (
	2018040901	; Serial
	3h		; Refresh
	15m		; Retry
	1w		; Expire
	3h		; Negative Cache TTL
	)

;
; domain name servers
;
@	IN	NS	ns1.commingeshautdebit.fr.
@	IN	NS	ns2.commingeshautdebit.fr.


; IPv4 rDNS - infra
1	IN	PTR	chd-stg1.chd.sx.
2	IN	PTR	ns2.commingeshautdebit.fr.
3	IN	PTR	ns3.commingeshautdebit.fr.
; [...]

; IPv4 rDNS - adhérents
33	IN	PTR	40-33.ipv4.commingeshautdebit.fr.
;[...]
254	IN	PTR	40-254.ipv4.commingeshautdebit.fr.
</file>
<file text /etc/bind/db.185.131.41>
;
; 185.131.40.0/24
;
$TTL	86400
@	IN	SOA	ns2.commingeshautdebit.fr.	dnsmaster.commingeshautdebit.fr. (
	2017011201	; Serial
	3h		; Refresh
	15m		; Retry
	1w		; Expire
	3h		; Negative Cache TTL
	)

;
; domain name servers
;
@	IN	NS	ns1.commingeshautdebit.fr.
@	IN	NS	ns2.commingeshautdebit.fr.

; IPv4 rDNS - adhérents
1	IN	PTR	41-1.ipv4.commingeshautdebit.fr.
;[...]
254	IN	PTR	41-254.ipv4.commingeshautdebit.fr.
</file>
<file text /etc/bind/db.2a03:a0a0::>
;
; 2a03:a0a0::/48
;
$TTL	86400
@	IN	SOA	ns2.commingeshautdebit.fr.	dnsmaster.commingeshautdebit.fr. (
	2017011201	; Serial
	3h		; Refresh
	15m		; Retry
	1w		; Expire
	3h		; Negative Cache TTL
	)

;
; domain name servers
;
@	IN	NS	ns1.commingeshautdebit.fr.
@	IN	NS	ns2.commingeshautdebit.fr.


; IPv6 rDNS delegation to all-knowing-dns
0	IN	NS	ns3.commingeshautdebit.fr.
1	IN	NS	ns3.commingeshautdebit.fr.
2	IN	NS	ns3.commingeshautdebit.fr.
3	IN	NS	ns3.commingeshautdebit.fr.
4	IN	NS	ns3.commingeshautdebit.fr.
5	IN	NS	ns3.commingeshautdebit.fr.
6	IN	NS	ns3.commingeshautdebit.fr.
7	IN	NS	ns3.commingeshautdebit.fr.
8	IN	NS	ns3.commingeshautdebit.fr.
9	IN	NS	ns3.commingeshautdebit.fr.
a	IN	NS	ns3.commingeshautdebit.fr.
b	IN	NS	ns3.commingeshautdebit.fr.
c	IN	NS	ns3.commingeshautdebit.fr.
d	IN	NS	ns3.commingeshautdebit.fr.
e	IN	NS	ns3.commingeshautdebit.fr.
f	IN	NS	ns3.commingeshautdebit.fr.
</file>
<file text /etc/bind/db.2a03:a0a0:1::>
; idem /etc/bind/db.2a03:a0a0::
</file>
<file text /etc/bind/db.2a03:a0a0::upstream>
;
; 2a03:a0a0::/48 - all-knowing-dns upstream zone for custom entries
;
$TTL	86400
@	IN	SOA	ns2.commingeshautdebit.fr.	dnsmaster.commingeshautdebit.fr. (
	2017011203	; Serial
	3h		; Refresh
	15m		; Retry
	1w		; Expire
	3h		; Negative Cache TTL
	)

;
; domain name servers
;
@	IN	NS	ns1.commingeshautdebit.fr.
@	IN	NS	ns2.commingeshautdebit.fr.


; IPv6 PTR entries (0.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa.upstream.)
1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0    IN    PTR    chd-stg1.chd.sx.
2.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0    IN    PTR    ns2.commingeshautdebit.fr.
3.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0    IN    PTR    ns3.commingeshautdebit.fr.
</file>
<file text /etc/bind/db.2a03:a0a0:1::upstream>
;
; 2a03:a0a0::/48 - all-knowing-dns upstream zone for custom entries
;
$TTL	86400
@	IN	SOA	ns2.commingeshautdebit.fr.	dnsmaster.commingeshautdebit.fr. (
	2017011201	; Serial
	3h		; Refresh
	15m		; Retry
	1w		; Expire
	3h		; Negative Cache TTL
	)

;
; domain name servers
;
@	IN	NS	ns1.commingeshautdebit.fr.
@	IN	NS	ns2.commingeshautdebit.fr.


; IPv6 PTR entries (1.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa.upstream.)
;1.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0.0    IN    PTR    this-is-an-example.commingeshautdebit.fr.
</file>
<file text /etc/bind/db.commingeshautdebit.fr>
;
; ipv4.commingeshautdebit.fr
;
$TTL	86400
@	IN	SOA	ns2.commingeshautdebit.fr.	dnsmaster.commingeshautdebit.fr. (
	2017011203	; Serial
	3h		; Refresh
	15m		; Retry
	1w		; Expire
	3h		; Negative Cache TTL
	)

;
; domain name servers
;
@	IN	NS	ns1.commingeshautdebit.fr.
@	IN	NS	ns2.commingeshautdebit.fr.

; Serveurs DNS de cette zone
ns1	IN	A	185.61.116.41
ns2	IN	A	185.131.40.2
ns2	IN	AAAA	2a03:a0a0::2

; Redirect vers all-knowing-dns sur chd2 pour les reverse IPv6
ns3	IN	A	185.131.40.3
ns3	IN	AAAA	2a03:a0a0::3
ipv6	IN	NS	ns3.commingeshautdebit.fr.

; Redirection pour site web commingeshautdebit.net
@	IN	A	185.61.116.41
www	IN	A	185.61.116.41
</file>
<file text /etc/bind/db.ipv4.commingeshautdebit.fr>
;
; ipv4.commingeshautdebit.fr
;
$TTL	86400
@	IN	SOA	ns2.commingeshautdebit.fr.	dnsmaster.commingeshautdebit.fr. (
	2017011201	; Serial
	3h		; Refresh
	15m		; Retry
	1w		; Expire
	3h		; Negative Cache TTL
	)

;
; domain name servers
;
@	IN	NS	ns1.commingeshautdebit.fr.
@	IN	NS	ns2.commingeshautdebit.fr.


; IPv4 DNS - adhérents
40-33	IN	A	185.131.40.33
;[...]
41-254	IN	A	185.131.41.254
</file>


<file bash /etc/all-knowing-dns.conf>
# Configuration file for AllKnowingDNS v1.3
listen 185.131.40.3
listen 2a03:a0a0::3

# CHD IPv6 #1
network 2a03:a0a0::/48
	resolves to 0000%DIGITS%.ipv6.commingeshautdebit.fr
	with upstream 2a03:a0a0::2

# CHD IPv6 #2
network 2a03:a0a0:1::/48
	resolves to 0001%DIGITS%.ipv6.commingeshautdebit.fr
	with upstream 2a03:a0a0::2
</file>

<file text /etc/resolv.conf>
search chd.sx
nameserver 185.131.40.1
</file>

<code bash>
service all-knowing-dns restart
service bind9 restart
ls /var/log/bind9/query.log

# Requêtes d'essai :
$ dig +short 0.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa. SOA
ns2.chd.sx. dnsmaster.chd.sx. 2016121101 10800 900 604800 10800
$ dig +short 0.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa. NS
ns1.chd.sx. # bind slave
ns2.chd.sx. # bind master
$ dig +short 0.0.0.0.0.0.a.0.a.3.0.a.2.ip6.arpa. NS
ns3.chd.sx. # all-knowing-dns

$ dig +short 40.131.185.in-addr.arpa. SOA
ns2.chd.sx. dnsmaster.chd.sx. 2016121101 10800 900 604800 10800
$ dig +short 41.131.185.in-addr.arpa. SOA
ns2.chd.sx. dnsmaster.chd.sx. 2016121101 10800 900 604800 10800
$ dig +short 40.131.185.in-addr.arpa. NS
ns2.chd.sx.
ns1.chd.sx.

$ dig +short -x 2a03:a0a0::1
chd-stg1.chd.sx.
$ dig +short -x 2a03:a0a0::2
chd-stg2.chd.sx.
$ dig +short -x 2a03:a0a0::3
ipv6-000000000000000000000003.chd.sx.
$ dig +short -x 2a03:a0a0:0:8001:2f5:f0ff:fe40:71fe
ipv6-0000800102f5f0fffe4071fe.chd.sx.

$ dig +short -x 185.131.40.1
chd-stg1.chd.sx.
$ dig +short -x 185.131.40.2
chd-stg2.chd.sx.
$ dig +short -x 185.131.40.3
chd-stg2.chd.sx.
$ dig +short -x 185.131.40.4
$ dig +short -x 185.131.40.11
$ dig +short -x 185.131.40.33
ipv4-40-33.chd.sx.
$ dig +short -x 185.131.40.34
ipv4-40-34.chd.sx.
$ dig +short -x 185.131.40.254
ipv4-40-254.chd.sx.
$ dig +short -x 185.131.41.1
ipv4-41-1.chd.sx.
$ dig +short -x 185.131.41.2
ipv4-41-2.chd.sx.
$ dig +short -x 185.131.41.254
ipv4-41-254.chd.sx.
</code>

<file ini /etc/systemd/system/getty@tty1.service.d/noclear.conf>
[Service]
TTYVTDisallocate=no
</file>

<file text /etc/motd>
      _         _           _        ____  
  ___| |__   __| |      ___| |_ __ _|___ \ 
 / __| '_ \ / _` |_____/ __| __/ _` | __) |
| (__| | | | (_| |_____\__ \ || (_| |/ __/ 
 \___|_| |_|\__,_|     |___/\__\__, |_____|
                               |___/       

                                           chd-stg2.chd.sx

</file>

<file bash /root/.bashrc>
# You may uncomment the following lines if you want `ls' to be colorized:
export LS_OPTIONS='--color=auto'
eval "`dircolors`"
alias ls='ls $LS_OPTIONS'
alias ll='ls $LS_OPTIONS -l'
alias l='ls $LS_OPTIONS -lA'
#
# Some more alias to avoid making mistakes:
alias rm='rm -i'
alias cp='cp -i'
alias mv='mv -i'

export HISTIGNORE=' *'

systemctl is-system-running --quiet || systemctl --state=failed;
</file>

<file text /root/.vimrc>
syn on
</file>

<code>
/etc/fail2ban/
├── action.d
│   └── route.conf
├── fail2ban.conf
├── fail2ban.d
├── filter.d
│   ├── common.conf
│   ├── pam-generic.conf
│   └── sshd.conf
├── jail.conf
├── jail.d
│   ├── customisation.local
│   └── defaults-debian.conf
├── paths-common.conf
├── paths-debian.conf
└── paths-opensuse.conf
# idem config chd-stg1
</code>


<file bash /etc/cron.d/aircontrol2>
# cron-jobs for aircontrol 2
MAILTO=root

0 2 28 * *	root if [ -x /opt/Ubiquiti/AirControl2/cleanDB ]; then cd /opt/Ubiquiti/AirControl2; ./cleanDB -e 300 -t 300 -s 30 -v > /dev/null; echo "VACUUM FULL;" | sudo -u postgres psql ac2; fi
</file>

===== Installation d’AirControl 2 =====

AirControl 2 nécéssite une JVM >= 1.8 :

<code>
apt install default-jre
</code>

Téléchargement et lancement du script d’installation :

<code>
cd /opt
wget https://dl.ubnt.com/aircontrol2/aircontrol-v2.1-180316-1259-unix64.bin
chmod +x aircontrol-v2.1-180316-1259-unix64.bin
./aircontrol-v2.1-180316-1259-unix64.bin
</code>

Éléments de configuration :

  * Cocher ''Server'' ; décocher ''Client''
  * Installer ''PostgreSQL''
  * Port du serveur AirControl : ''9081''
  * Nom de la base : ''ac2'' (default)
  * Port de la base : ''5432'' (default)
  * Compte super-utilisateur : ''admin'' / *****
  * Compte invité : ''ubnt'' / *****

Une fois le serveur démarré utiliser le client AirContorl 2 pour continuer la configuration (via le compte "admin") :

  * Control panel > Server settings
    * ServerName : chd-stg2
    * IP list (comma separated) : 172.16.0.253,185.131.40.2,2a03:a0a0::2
    * HTTPS port 443
    * Check for Beta/RC/GA airControl Update : décoché
  * Control Panel > Firmwares
    * Upload XM/XW/AF5 et WA

<file bash /opt/Ubiquiti/AirControl2/pgsql/data/pg_hba.conf>
# "local" is for Unix domain socket connections only
local   all             all                                     ident
local   all             all                                     md5
# IPv4 local connections:
host    all             all             127.0.0.1/32            md5
# IPv6 local connections:
host    all             all             ::1/128                 md5
</file>

<file bash /root/ac2-database.sh>
#!/bin/sh
sudo -u postgres /opt/Ubiquiti/AirControl2/pgsql/bin/pg_dump ac2 | /root/pg-COPY-line-count.pl
</file>

<file perl /root/pg-COPY-line-count.pl>
#!/usr/bin/env perl

use strict;
use warnings;

my $t='(header)';
my $l=0;
my $c=0;

while (<STDIN>) {
	if ( $_ =~ /^COPY (.*) FROM stdin;$/ ) {
		$a = int(($c / $l) + 0.5);
		print "$t : $l lines (average : $a chars)\n";
		$t=$1;
		$l=0;
		$c=0;
	} else {
		$l=$l+1;
		$c=$c+length($_);
	}
}
$a = int(($c / $l) + 0.5);
print "$t : $l lines (average : $a chars)\n";
</file>

<file bash /root/.netrc>
machine priv.chd.sx login api password XXXXXXXXXXX
</file>

<file bash /etc/cron.daily/etat_reseau>
#!/bin/sh
wget -O /var/www/html/etat_reseau/index.html https://priv.chd.sx/api/gen_etat_reseau.php
</file>

<code bash>
cd /root
mkdir git
cd git
git clone root@chd.sx:/var/git/chd_gestion
git clone root@chd.sx:/var/git/chd_openwrt
</code>


===== OpenWRT / LEDE / mise à jour routeur =====
<code bash>
cd ~/git/chd_openwrt/maj
cp config.default.php config.php
vim config.php 

ln -s /root/git/chd_openwrt/build-openwrt.sh /usr/local/bin/
ln -s /root/git/chd_openwrt/build-openwrt-dev.sh  /usr/local/bin/

chown www-data: /var/cache/build-openwrt*
apt install git-core build-essential libssl-dev libncurses5-dev zlib1g-dev unzip gawk subversion manpages-dev-
</code>

===== TODO =====
<code>
documenter le contenu de /var/www/html non git'é
configurer munin/multiping
netconsole config
backup borg
mailer + mail alert (smartmontools/logcheck ?)
</code>