Raspberry Pi home server

About this page.

This page contains explanation of the things i did to make different projects live together on a single Raspberri Pi.

https://www.pestmeester.nl/ is the base inspiration for my Home Server.
https://github.com/pi-hole/ provides super easy installation of an AdBlocking Domain Name Server functionality.
https://github.com/pivpn/ provides super easy installation and administration of OpenVPN Server funnctionality.

Hardware

Raspberry Pi 3 Model B
4 Gb MicroSD card.
USB Harddrive, 500 Gb SSHD
Raspberry Pi Camera Board v2.

Basic installation

Download and write Raspian Lite to the MicroSD card

Raspi-config

Go thrugh all the menu points of the Rapsberry Pi SOftware Configuration Tool, and change the basic configuration to fit the needs of this Home Server.

Hardening + SSH

Follow the guide: Hardened SSH daemon using the 'sudo' command when root powah is required.

Add USB HD

I configured /dev/sdb1 to be mounted on /data, not the strange UUID..

Nginx, PHP7, MySQL

First the 'easy' stuff. Answer all install questions wisely!

sudo apt-get install nginx php-apc mysql-server

Then, because PHP 7 is not available in jessie repo I get it from the stretch repo:

# Add the GPG keys needed to use the stretch repository
sudo gpg --keyserver pgpkeys.mit.edu --recv-key  8B48AD6246925553      
sudo gpg -a --export 8B48AD6246925553 | sudo apt-key add -
sudo gpg --keyserver pgpkeys.mit.edu --recv-key 7638D0442B90D010      
sudo gpg -a --export 7638D0442B90D010 | sudo apt-key add -
# Add the stretch repo as a source for apt
sudo echo "deb http://httpredir.debian.org/debian stretch main contrib non-free" | sudo tee /etc/apt/sources.list.d/debian-stretch.list
# Update the local apt index so the stretch repo is present
sudo apt-get -y update
# Install the needed PHP7 packages
sudo apt-get -y install -y php7.0-fpm php7.0-curl php7.0-gd php7.0-cli php7.0-mcrypt php7.0-mysql php7.0-mbstring -t stretch
# Remove the stretcg repo as a source
sudo rm /etc/apt/sources.list.d/debian-stretch.list
# Lastly I update the local apt source lists so stretch repo is removed.
sudo apt-get -y update

Then continue the pestmeester guide but change the nginx configuration (/etc/nginx/sites-available/[your_configuration_file_name]) so it utilizes PHP7 and not the missing PHP5 ;-) Here you see what i use:

## Begin - PHP
location ~ \.php$ {
  fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
  fastcgi_split_path_info ^(.+\.php)(/.+)$;
  fastcgi_index index.php;
  include fastcgi_params;
  fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
}
## End - PHP

LetsEncrypt

This is my /etc/nginx/sites-available/[your_configuration_file_name] that force all clients to use HTTPS, and PHP7 :

server {
       listen 80 default_server;
       listen [::]:80 default_server;
       server_name install.pulspc.dk;
       return 301 https://$server_name$request_uri;
}
#
server {
listen 443 ssl default_server;
listen [::]:443 ssl default_server;
   server_name mysite.com www.mysite.com;
   #
   ssl_certificate          /etc/letsencrypt/live/install.pulspc.dk/fullchain.pem;
   ssl_certificate_key      /etc/letsencrypt/live/install.pulspc.dk/privkey.pem;
   #
   root /data/websites/rpiii/html;
   index index.php index.html index.htm;
   #
   error_page 404 /404.html;
   error_page 500 502 503 504 /50x.html;
   location = /50x.html {
       root /data/websites/rpiii/html;
   }
   #
   # Error & Access logs
   error_log /data/websites/rpiii/logs/error.log error;
   access_log /data/websites/rpiii/logs/access.log;
   #
   location / {
       index index.html index.php;
   }
   #
   location ~ /.well-known {
               allow all;
   }
   ## Begin - PHP
   location ~ \.php$ {
     fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
     fastcgi_split_path_info ^(.+\.php)(/.+)$;
     fastcgi_index index.php;
     include fastcgi_params;
     fastcgi_param SCRIPT_FILENAME $document_root/$fastcgi_script_name;
   }
   ## End - PHP
}

PiHole DNS

This must be installed using the option to NOT install the normally included webinterface, because that will require lighttpd, wich is not compatible with OwnCloud ;-)
All PiHole administration must consequentially be done using terminal commands.