Sysadmin on yequari.com

Nginx notes

Mon, 05 Oct 2026 11:59:00 -0700

Enable an available site

sudo ln -s /etc/nginx/sites-available/your_site.conf /etc/nginx/sites-enabled/

Test config

sudo nginx -t

Reload nginx

sudo systemctl reload nginx

Postgresql Notes

Mon, 05 Oct 2026 11:59:00 -0700

Configure connections

Configure listen addresses in /etc/postgresql/17/main/postgresql.conf
Configure what addresses can access which databases with which users in /etc/postgresql/17/main/pg_hba.conf

Create a user and a database owned by them

psql
CREATE USER username WITH PASSWORD 'password';
CREATE DATABASE dbname OWNER owneruser;
GRANT ALL PRIVILEGES ON DATABASE dbname TO username;
\c dbname
GRANT ALL ON SCHEMA public TO username;

# for Discourse
CREATE EXTENSION hstore;
CREATE EXTENSION pg_trgm;
CREATE EXTENSION unaccent;
CREATE EXTENSION vector;

# temporarily add superuser to restore user
ALTER USER username WITH SUPERUSER;
ALTER USER username WITH NOSUPERUSER;

Connect via `psql`

psql -h host -p port -U username -d dbname

Migrate data directory

Stop postgresql service
cp -a source_data_directory destination_data_directory
`chown -R postgres_user /destination_data_directory
export PGDATA=destination_data_directory
Changing data directory to destination_data_directory within postgresql.conf
pg_ctl start

Server Administration Basics

Mon, 05 Oct 2026 11:59:00 -0700

These are the first steps I do to setup a brand new server

TODO: Provide explanations for what all this actually does and why you should do it.

Add user

useradd -m yequari
passwd yequari
usermod -aG sudo yequari

Copy SSH key

Assuming you are currently root, trying to set up SSH on your new user

mkdir /home/yequari/.ssh
echo <pubkey> >> /home/yequari/.ssh/authorized_keys
chown -R yequari:yequari /home/yequari/.ssh
chmod 0700 /home/yequari/.ssh
chmod 0600 /home/yequari/.ssh/authorized_keys

Disable Password Auth

Edit /etc/ssh/sshd_config

PasswordAuthenticaion no
KbdInteractiveAuthentication no

Restart ssh service

sudo systemctl restart ssh.service

Install fail2ban and ufw

sudo apt install fail2ban ufw

Set up firewall

sudo ufw default deny incoming
sudo ufw default allow outgoing
sudo ufw allow 22/tcp
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp

To allow connection to port from only specific hosts

sudo ufw allow from <host_ip> to any port <port#>

See DigitalOcean Community for more ufw tips

Example Systemd Service

Mon, 06 May 2024 00:00:00 -0700

System units go in /etc/systemd/system

User units go in $HOME/.config/systemd/user

[Unit]  
Description=Webring test service 
After=network.target
StartLimitIntervalSec=0

[Service]  
Type=simple
Restart=always
RestartSec=1
WorkingDir=/code/webring
ExecStart=/code/webring/webring --dsn /code/webring/webring.db --addr :8000
  
[Install]  
WantedBy=multi-user.target

Sysadmin on yequari.com

Nginx notes

Postgresql Notes

Configure connections

Create a user and a database owned by them

Connect via psql

Migrate data directory

Server Administration Basics

Add user

Copy SSH key

Disable Password Auth

Install fail2ban and ufw

Set up firewall

Example Systemd Service

Connect via `psql`