#!/bin/sh

#OpenSSH  #PasswordAuthentication yes -> no
rm /etc/ssh/sshd_config.d/50-cloud-init.conf


#Automatic updates
#echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean true | debconf-set-selections #https://wiki.debian.org/UnattendedUpgrades
dpkg-reconfigure -f noninteractive unattended-upgrades


#Firewall
apt install nftables
table=ddos
nft add table ip $table
nft add set ip $table deny { type ipv4_addr \; flags dynamic, timeout \; timeout 5m \; }
nft add chain ip $table input { type filter hook input priority 0 \; }
nft add rule ip $table input ip protocol tcp ct state new,untracked limit rate over 10/second add @deny { ip saddr }
nft add rule ip $table input ip saddr @deny drop

nft add table ip6 $table
nft add set ip6 $table deny { type ipv6_addr \; flags dynamic, timeout \; timeout 5m \; }
nft add chain ip6 $table input { type filter hook input priority 0 \; }
nft add rule ip6 $table input ip6 nexthdr tcp ct state new,untracked limit rate over 10/second add @deny { ip6 saddr }
nft add rule ip6 $table input ip6 saddr @deny drop
systemctl enable nftables
echo -e '#!/usr/sbin/nft -f\n\nflush ruleset\n' | tee /etc/nftables.conf
nft list ruleset | tee -a /etc/nftables.conf


#Apache (static)
apt install apache2 dehydrated dehydrated-apache2 cron
a2enmod ssl
a2enmod http2
#a2enmod rewrite
#a2enmod headers
#echo 'Header always set Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"' | tee -a /etc/apache2/conf-enabled/security.conf
systemctl restart apache2
dehydrated --register --accept-terms
echo -e '#!/bin/sh\n/usr/bin/dehydrated -c' | tee /etc/cron.weekly/dehydrated
chmod +x /etc/cron.weekly/dehydrated


#Apache VirtualHost
fqdn="fox-echo.info"
echo $fqdn | tee -a /etc/dehydrated/domains.txt
a2ensite 000-default; systemctl reload apache2; dehydrated -c; a2dissite 000-defaulta2ensite 000-default; systemctl reload apache2; dehydrated -c; a2dissite 000-default

tee /etc/apache2/sites-available/$fqdn.conf << EOF
<VirtualHost *:80>
	ServerName $fqdn
	DocumentRoot /var/www/$fqdn
	#RewriteEngine On
	#RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301]
</VirtualHost>
<VirtualHost *:443>
	ServerName $fqdn
	DocumentRoot /var/www/$fqdn
	SSLEngine on
	SSLCertificateFile /var/lib/dehydrated/certs/$fqdn/cert.pem
	SSLCertificateKeyFile /var/lib/dehydrated/certs/$fqdn/privkey.pem
	SSLCertificateChainFile /var/lib/dehydrated/certs/$fqdn/chain.pem
	<Directory /var/www/$fqdn>
		Options None
	</Directory>
</VirtualHost>
EOF

mkdir -p /var/www/$fqdn
chown debian /var/www/$fqdn
a2ensite $fqdn
systemctl reload apache2


#Apache VirtualHost
fqdn="linomad.fox-echo.info"
a2ensite 000-default; systemctl reload apache2; dehydrated -c; a2dissite 000-default

tee /etc/apache2/sites-available/$fqdn.conf << EOF
<VirtualHost *:80>
	ServerName $fqdn
	DocumentRoot /var/www/$fqdn
	#RewriteEngine On
	#RewriteRule ^(.*)$ https://%{HTTP_HOST}$1 [redirect=301]
</VirtualHost>
<VirtualHost *:443>
	ServerName $fqdn
	DocumentRoot /var/www/$fqdn
	SSLEngine on
	SSLCertificateFile /var/lib/dehydrated/certs/$fqdn/cert.pem
	SSLCertificateKeyFile /var/lib/dehydrated/certs/$fqdn/privkey.pem
	SSLCertificateChainFile /var/lib/dehydrated/certs/$fqdn/chain.pem
	<Directory /var/www/$fqdn>
		Options None
	</Directory>
	<Directory /var/www/$fqdn/downloads>
		Options Indexes FollowSymLinks
	</Directory>
</VirtualHost>
EOF

mkdir -p /var/www/$fqdn/downloads
chown -R debian /var/www/$fqdn
a2ensite $fqdn
systemctl reload apache2
