As a user I want to have differential backups of my documents and git directories from my computer at work to my remote off-site server.

Frequency of backups is one time a day at 1:00 AM.
Retention policy is to keep backups 12 months.

Install rdiff-backup on source computer and on destination server also.

apt-get install rdiff-backup

First you have to copy SSH public key from your source computer at work to remote server.

ssh-copy-id backup@faix.cz

Edit crontab as a backup user on source computer.

crontab -e

00 1 * * *       rdiff-backup /data/documents backup@faix.cz::/disk/backup/documents/ 1> /dev/null
01 1 * * *       rdiff-backup /data/git backup@faix.cz::/disk/backup/git/ 1> /dev/null
02 1 * * *       rdiff-backup --remove-older-than 12M --force backup@faix.cz::/disk/backup/documents/ 1> /dev/null
25 1 * * *       rdiff-backup --remove-older-than 12M --force backup@faix.cz::/disk/backup/git/ 1> /dev/null

On remote server create destination directories and make sure user backup is owner of it.

mkdir /disk/backup/{documents,git}
chown backup /disk/backup/{documents,git}

From source computer run firs backup manually and check results on destination computer.

rdiff-backup /data/documents backup@faix.cz::/disk/backup/documents/
rdiff-backup /data/git backup@faix.cz::/disk/backup/git/

M/Monit monitoring

Server
apt-get install libapache2-mod-proxy-html libxml2-dev

cd /usr/local/
wget https://mmonit.com/dist/mmonit-3.3-linux-x64.tar.gz
tar -zxvf mmonit-3.3-linux-x64.tar.gz

/etc/apache2/sites-available/monit

<VirtualHost *:80>
    ServerAdmin jan@faix.cz
    ServerName monit.faix.cz
    ServerAlias monitoring.faix.cz

    <Location />
         Order deny,allow
         Allow from all
    </Location>

    ProxyPass / http://localhost:8080/
    ProxyPassReverse / http://localhost:8080/
</VirtualHost>

a2enmod proxy proxy_http
a2ensite monit

service apache2 restart

/etc/hosts

127.0.0.1   localhost monit.faix.cz

/usr/local/mmonit/conf/server.xml

    <Connector address="*" port="8080" processors="10" proxyScheme="http" proxyName="monit.faix.cz" proxyPort="80" />
    <Engine name="mmonit" defaultHost="monit.faix.cz" fileCache="10MB">
    <Host name="monit.faix.cz" appBase=".">

/etc/init/mmonit.conf

 description "M/Monit system monitoring"

 limit core unlimited unlimited

 start on runlevel [2345]
 stop on runlevel [!2345]

 expect daemon
 respawn

 exec /usr/local/mmonit/bin/mmonit

 pre-stop exec /usr/local/mmonit/bin/mmonit stop

initctl reload-configuration
start mmonit

Go to http://monit.faix.cz/.
Login as user “admin” with password “swordfish“.

Jabber gTalk notifications

server: talk.google.com
port: 5222
user: jan.faix@gmail.com
password: app specific

Client
apt-get install monit

/etc/monit/conf.d/myserver

set daemon 120
set logfile /var/log/monit.log
set idfile /var/lib/monit/id
set statefile /var/lib/monit/state
set eventqueue basedir /var/lib/monit/events slots 1000

set httpd port 2812
use address localhost
    allow 0.0.0.0/0.0.0.0
    allow monit:password

set mailserver localhost
set mmonit http://monit:password@monit.faix.cz/collector

check system faix.cz
    if loadavg (1min) > 4 then alert
    if loadavg (5min) > 2 then alert
    if memory usage > 75% then alert
    if swap usage > 25% then alert
    if cpu usage (user) > 70% then alert
    if cpu usage (system) > 30% then alert
    if cpu usage (wait) > 20% then alert

check process sshd with pidfile /var/run/sshd.pid
    start program "/etc/init.d/ssh start"
    stop program "/etc/init.d/ssh stop"
    if failed port 22 protocol ssh then restart
    if 5 restarts within 5 cycles then timeout

check process apache with pidfile /run/apache2.pid
    start program = "/etc/init.d/apache2 start" with timeout 60 seconds
    stop program  = "/etc/init.d/apache2 stop"

check filesystem data with path /dev/mapper/data
    start program  = "/bin/mount /mnt/data"
    stop program  = "/bin/umount /mnt/data"
    if failed permission 660 then unmonitor
    if failed uid root then unmonitor
    if failed gid disk then unmonitor
    if space usage > 80% for 5 times within 15 cycles then alert
    if space usage > 99% then stop
    if inode usage > 100000000 then alert
    if inode usage > 99% then stop

monit -t
service monit restart
monit monitor all
monit status

apt-get install transmission-daemon

Your server is running nonstop, so why to download torrents from your desktop, when you can conveniently start the download from your web browser using Transmission-daemon running on your server.

service transmission-daemon stop

usermod -a -G users debian-transmission
usermod -d /var/lib/transmission-daemon debian-transmission
chown -R debian-transmission:debian-transmission /etc/transmission-daemon /var/lib/transmission-daemon/info
rm /var/lib/transmission-daemon/info/settings.json

There has to be link to current /etc/transmission-daemon/setting.json:
ls -l /var/lib/transmission-daemon/info/settings.json

/var/lib/transmission-daemon/info/settings.json -> /etc/transmission-daemon/settings.json

/etc/transmission-daemon/settings.json
These are my custom setting suites my needs.

"blocklist-enabled": true,
"blocklist-url": "http://list.iblocklist.com/?list=bt_level1&fileformat=p2p&archiveformat=gz",
"download-dir": "/disk/downloads",
"incomplete-dir": "/home/xbmc/Downloads",
"message-level": 1,
"peer-id-ttl-hours": 6,
"peer-port": 9058,
"peer-port-random-high": 9098,
"peer-port-random-low": 9026,
"port-forwarding-enabled": true,
"rpc-authentication-required": false,
"rpc-password": "{MyTopSecretToken",
"rpc-whitelist": "127.0.0.1,192.168.122.*",
"rpc-whitelist-enabled": false,
"speed-limit-up": 30,
"speed-limit-up-enabled": true,
"umask": 1,

/etc/default/transmission-daemon

ENABLE_DAEMON=1
CONFIG_DIR="/var/lib/transmission-daemon/info" 
OPTIONS="--config-dir $CONFIG_DIR"

service transmission-daemon start

You can access your Transmission using your web browser:
http://your_server_address:9091/transmission/web/

Network interfaces

/etc/network/interfaces

# The loopback network interface
auto lo
iface lo inet loopback

# WAN network interface
auto eth0
iface eth0 inet static
address 172.16.2.19
netmask 255.255.255.240
network 172.16.2.16
broadcast 172.16.2.31
gateway 172.16.2.17

# LAN network interface
auto eth1
iface eth1 inet static
address 192.168.122.1
netmask 255.255.255.224
network 192.168.122.0
broadcast 192.168.122.31

UFW

apt-get install ufw

/etc/default/ufw

DEFAULT_FORWARD_POLICY="ACCEPT"

/etc/ufw/sysctl.conf

net/ipv4/ip_forward=1

/etc/ufw/before.rules

#add the following code to the top

# NAT table rules
*nat
:PREROUTING ACCEPT [0:0]
:POSTROUTING ACCEPT [0:0]

# Port Forwardings
-A PREROUTING -i eth0 -p tcp --dport 10000 -j DNAT --to-destination 192.168.122.14:10000

# Forward traffic through eth0 (Internet)
-A POSTROUTING -s 192.168.122.0/27 -o eth0 -j MASQUERADE

# don't delete the 'COMMIT' line or these nat table rules won't
# be processed
COMMIT

#insert lines between ='"#allow dhcp client to work' and '#ufw-not-local'

# allow dhcp server (broadcast requests)
-A ufw-before-input -p udp -i eth1 --sport 67:68 --dport 67:68 -j ACCEPT

ufw allow in on eth1 to any
ufw allow out on eth1 to any

ufw allow ssh
ufw allow smtp
ufw allow https
ufw allow http
ufw allow 9058

ufw disable && ufw enable

Dnsmasq

apt-get install dnsmasq

/etc/dnsmasq.conf

domain-needed
bogus-priv
resolv-file=/etc/resolv.dnsmasq
local=/homelan/
user=dnsmasq
listen-address=127.0.0.1
listen-address=192.168.122.1
no-dhcp-interface=eth0
expand-hosts
domain=homelan
dhcp-range=192.168.122.2,192.168.122.20,255.255.255.224,72h
dhcp-host=home-desktop,192.168.122.2,6c:f0:49:7a:52:10
dhcp-host=home-laptop,192.168.122.3,00:13:e8:99:4b:f7
dhcp-host=home-receiver,192.168.122.4,00:1e:b8:06:4e:11
dhcp-host=faix-desktop,192.168.122.5,00:18:8b:68:aa:4b
dhcp-host=faix-laptop,192.168.122.6,00:13:ce:11:02:fc
dhcp-host=faix-receiver,192.168.122.7,00:1e:b8:06:4c:72
dhcp-host=jan-phone,192.168.122.8,d4:20:6d:44:72:ac
dhcp-host=wassana-phone,192.168.122.9,e8:99:c4:02:2c:00
dhcp-host=home-printer,192.168.122.10,00:01:e6:7d:14:36
dhcp-host=faix-printer,192.168.122.11,00:01:e6:31:6d:e7
dhcp-host=home-tablet,192.168.122.12,ac:22:0b:a1:af:f6
dhcp-host=faix-xbmc,192.168.122.13,b8:27:eb:ad:47:a5
dhcp-host=home-alarm,192.168.122.14,00:19:ba:02:6a:49
dhcp-option=option:router,192.168.122.1
dhcp-option=option:ntp-server,192.168.122.1
dhcp-option=27,1
dhcp-option=vendor:MSFT,2,1i
dhcp-lease-max=20
dhcp-leasefile=/var/lib/misc/dnsmasq.leases
dhcp-authoritative
neg-ttl=3600
mx-target=home-server
localmx
log-facility=/var/log/dnsmasq.log
conf-dir=/etc/dnsmasq.d
dns-forward-max=200
log-async

touch /var/log/dnsmasq.log /var/lib/misc/dhcp.leases
chown dnsmasq /var/log/dnsmasq.log /var/lib/misc/dhcp.leases

/etc/resolv.conf

nameserver 127.0.0.1

/etc/resolv.dnsmasq

domain homelan
search homelan
nameserver 8.8.8.8
nameserver 8.8.4.4

chown dnsmasq /etc/resolv.dnsmasq

/etc/hosts

127.0.0.1 localhost
192.168.122.1 home-server server
192.168.122.2 home-desktop
192.168.122.3 home-laptop
192.168.122.4 home-receiver
192.168.122.5 faix-desktop
192.168.122.6 faix-laptop
192.168.122.7 faix-receiver
192.168.122.8 jan-phone jan
192.168.122.9 wassana-phone wassana
192.168.122.10 home-printer printer1
192.168.122.11 faix-printer printer2
192.168.122.12 home-tablet tablet
192.168.122.13 faix-xbmc
192.168.122.14 home-alarm alarm
192.168.122.29 home-switch switch
192.168.122.30 home-wifi wifi

/etc/logrotate.d/dnsmasq

/var/log/dnsmasq.log {
    weekly
    missingok
    rotate 5
    notifempty
    delaycompress
    sharedscripts
    postrotate
        [ ! -f /var/run/dnsmasq/dnsmasq.pid ] || kill -USR2 `cat /var/run/dnsmasq/dnsmasq.pid`
    endscript
    create 0640 dnsmasq root

NTP server

apt-get install ntp

/etc/ntp.conf

driftfile /var/lib/ntp/ntp.drift
statistics loopstats peerstats clockstats
filegen loopstats file loopstats type day enable
filegen peerstats file peerstats type day enable
filegen clockstats file clockstats type day enable

server 195.113.144.201
server 195.113.144.238
server 127.127.1.0
fudge 127.127.1.0 stratum 10

restrict -4 default kod notrap nomodify nopeer noquery
restrict 127.0.0.1
restrict 192.168.122.0 mask 255.255.255.224 nomodify notrap noquery

broadcast 192.168.122.224

Linux kernel settings

/etc/sysctl.conf

net.ipv4.ip_forward=1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv6.conf.all.disable_ipv6 = 1
net.ipv6.conf.default.disable_ipv6 = 1
net.ipv6.conf.lo.disable_ipv6 = 1
net.ipv4.tcp_rfc1337 = 1
fs.file-max = 100000
vm.swappiness = 10
net.core.rmem_max = 16777216
net.core.wmem_max = 16777216
net.core.rmem_default = 16777216
net.core.wmem_default = 16777216
net.core.optmem_max = 40960
net.ipv4.tcp_rmem = 4096 87380 16777216
net.ipv4.tcp_wmem = 4096 65536 16777216
net.core.netdev_max_backlog = 50000
net.ipv4.tcp_max_syn_backlog = 30000
net.ipv4.tcp_max_tw_buckets = 2000000
net.ipv4.tcp_tw_reuse = 1
net.ipv4.tcp_fin_timeout = 10
net.ipv4.tcp_slow_start_after_idle = 0
net.ipv4.udp_rmem_min = 8192
net.ipv4.udp_wmem_min = 8192
net.ipv4.conf.all.accept_redirects = 0
net.ipv4.conf.all.accept_source_route = 0
net.ipv4.conf.all.log_martians = 1
net.ipv4.tcp_window_scaling = 0
net.ipv4.tcp_timestamps = 0

My Skype refused to start, saying following error:

skype: error while loading shared libraries: libGL.so.1: cannot open shared object file: No such file or directory

First locate “missing” library or use find / -name libGL.so.1 command.

locate libGL.so.1

/etc/alternatives/glx--libGL.so.1-x86_64-linux-gnu
/etc/alternatives/nvidia--libGL.so.1-x86_64-linux-gnu
/usr/lib/mesa-diverted/i386-linux-gnu/libGL.so.1
/usr/lib/mesa-diverted/i386-linux-gnu/libGL.so.1.2.0
/usr/lib/mesa-diverted/x86_64-linux-gnu/libGL.so.1
/usr/lib/mesa-diverted/x86_64-linux-gnu/libGL.so.1.2.0
/usr/lib/x86_64-linux-gnu/libGL.so.1
/usr/lib/x86_64-linux-gnu/nvidia/libGL.so.1
/usr/lib/x86_64-linux-gnu/nvidia/current/libGL.so.1

I’m using Intel Graphics, so I picked up Mesa driver. Skype is i386 application. My choice was the directory below containing “missing” library.

nano /etc/ld.so.conf.d/skype.conf

/usr/lib/mesa-diverted/i386-linux-gnu/

Happy Skyping!