setup raspberry pi 4

sudo apt-get update
sudo apt-get upgrade

ifconfig

#install RealVNC server
sudo apt update
sudo apt install realvnc-vnc-server

#enable VNC > Interfacing Options > VNC › Yes
sudo raspi-config

#https://raspberrypi-guide.github.io/networking/set-up-static-ip-address
#find the network interface name (Iface)
netstat -nr
#edit
sudo nano /etc/dhcpcd.conf
# 192.x.x.x - raspberry IP
# 192.168.1.1 - your router IP
interface eth0
inform 192.x.x.x
static routers=192.168.1.1
static domain_name_servers=192.168.1.1

#see network info
netstat -nr
ifconfig

#Pi ARM CPU temperature -- https://www.cyberciti.biz/faq/linux-find-out-raspberry-pi-gpu-and-arm-cpu-temperature-command/
cpu=$(</sys/class/thermal/thermal_zone0/temp)
echo "$((cpu/1000)) c"

#GPU temperature
vcgencmd measure_temp

# memory status - Free vs Available https://haydenjames.io/free-vs-available-memory-in-linux/
free -m

# list all process
#https://geek-university.com/list-running-processes/
#https://sites.google.com/site/petersraspi/learning-linux-1/showallrunningprocessesinraspbian
top

#lists active services running on ports
sudo lsof -iTCP -sTCP:LISTEN -P

#prevent package to be updated / upgraded - https://askubuntu.com/a/18656
sudo apt-mark hold xxx

#restart an application
sudo systemctl restart xxx

#list folder contents - https://www.tecmint.com/15-basic-ls-command-examples-in-linux/
ls -l
ls -lh //shows sizes formatted
ls -R -l //recursively

#create folder
mkdir xx
#the -p tag will create any directories in our path that doesn’t already exist
mkdir -p /home/pi/git/myFirstRepository

# remove a folder with all contents https://linuxhint.com/delete-a-folder-in-bash/
rm -rf xx

#view a text file
cat xx

#https://www.geeksforgeeks.org/od-command-linux-example/
#view as oct
od -c -tx1 xx
#view as hex
od -c -Ax -tx1 xx

#list of installed packages
apt list --installed
dpkg --get-selections

#list the manually installed packages in the Raspberry OS
apt-mark showmanual

#list of packages which are installed automatically on the Raspberry Pi OS
apt-mark showauto

#infromation of the package -- https://www.opentechguides.com/how-to/article/raspberry-pi/84/package-management.html
apt show apache2

#delete the cache files by /var/cache/apt/archives
sudo apt clean

#install synaptic app manager
sudo apt-get install synaptic

#https://pimylifeup.com/raspberry-pi-git-server/ -- https://pimylifeup.com/raspberry-pi-gitea/
#https://docshield.kofax.com/RPA/en_US/11.0.0_qrvv5i5e1a/help/BestPracticesHelp/rpa_rlm_best_practices/c_initialize_bare.html
#install git if is not already in the system
sudo apt install git

#set your information
sudo git config user.name "name"
sudo git config --global user.email "the@email"

#make a folder to store the repos
sudo mkdir -p /home/git/example.git

#navigate to specific repo
cd /home/git/example.git

#init the repo
sudo git init --bare

#go back one dir and chown
cd ..
sudo chown -R pi example.git

#clone the repo
sudo git clone example.git
cd example

#done a dummy commit
sudo git commit --allow-empty -m 'initial commit'

#push to repo
sudo git push origin

#on windows side - clone the repo
#in case you have problem due SSH PuTTY private key read -- https://www.pipiscrew.com/threads/16486/post-50959
git clone pi@192.168.xxx.xxx:/home/git/example

#open your favorite gitGUI

#https://jamesjdavis.medium.com/how-to-restart-raspberry-pi-safely-and-quickly-488243907fa3
#reboot
sudo reboot
sudo shutdown -r now
sudo shutdown -r 10 # after 10 minutes
sudo init 6

#shutdown
sudo halt
sudo poweroff
sudo shutdown -h now
sudo shutdown -h 10 # after 10 minutes
sudo init 0

#https://docs.pi-hole.net/main/basic-install/
curl -sSL https://install.pi-hole.net | bash

#https://raspberrypi.stackexchange.com/a/117849
cd etc/lighttpd

#edit the file (is empty by default)
sudo nano external.conf

#add
server.port := 8000

#save
#restart server
sudo systemctl restart lighttpd

# https://docs.pi-hole.net/ftldns/configfile/
# https://www.reddit.com/r/pihole/comments/s7u6ca/comment/htgvwmv/
# https://www.reddit.com/r/pihole/comments/g55b8p/comment/fo1fyqv/

# edit the
sudo nano /etc/pihole/pihole-FTL.conf

#paste
MAXDBDAYS=5

# restart the service
sudo service pihole-FTL restart

#------------------------

# apart from sqlite cleanup^ cleans also the log file
sudo nano /var/log/pihole/pihole.log

# empty log file - https://docs.pi-hole.net/core/pihole-command
pihole flush

# https://www.cyberciti.biz/faq/stop-lighttpd-server/
# https://www.cyberciti.biz/tips/howto-lighttpd-enable-disable-directory-listing.html
#make the new folder myshare
sudo mkdir =p /var/www/html/myshare

#edit config
sudo nano /etc/lighttpd/lighttpd.conf

#add this line
$HTTP["url"] =~ "^/myshare($|/)" { server.dir-listing = "enable" }

#restart
sudo /etc/init.d/lighttpd restart

#-----

# to write a file by PHP, the directory must belong to www-data, go one dir back by your_folder_name
# https://stackoverflow.com/a/11282294
sudo chown www-data your_folder_name
# **OR** the file must belong to www-data group

# (not tried) password protected directory
https://www.cyberciti.biz/tips/lighttpd-setup-a-password-protected-directory-directories.html

# https://raspiblog.noblogs.org/post/2018/04/09/securing-lighttpd/
# https://www.digitalocean.com/community/tutorials/how-to-protect-an-apache-server-with-fail2ban-on-ubuntu-14-04

#https://www.oreilly.com/library/view/running-linux-third/156592469X/ch04s14.html
#read permission for user
chmod 400 example.txt

#read permission for user + group
chmod 440 example.txt

#read + write + execute for all
chmod 777 example.txt

#change recursively the permissions for a folder to rwxr-xr-x
chmod -R 755 exampleDIR

#change owner and group
chown ravikumar:ravikumar Arkit2.txt

#change owner
chown root Arkit2.txt

#change group
chown :ravikumar Arkit5.txt

#change owner recursively
chown -R pi exampleDIR

# list user groups
groups pi

# add user to the www-data group -- https://www.cyberciti.biz/faq/ubuntu-add-user-to-group-www-data/
usermod -a -G www-data pi

#Apache config - alter Listen line
sudo nano /etc/apache2/ports.conf

#Virtual host config - - alter VirtualHost *:
sudo nano /etc/apache2/sites-available/000-default.conf

#restart Apache service
sudo systemctl restart apache2

#in case needed to login with dietpi and not root
chown dietpi -R /var/www

#unzip
sudo unzip test.zip

#find where is the php.ini, by creating the a.php has <?php phpinfo(); ?>
sudo nano /etc/php/8.2/fpm/php.ini
# set the --> disable_functions = exec,system,passthru,popen,proc_open,shell_exec
# unremark --> session.save_path = "/var/lib/php/sessions"
# enable modules --> curl / fileinfo / gd / gettext / intl / mbstring / exif / mysqli / pdo_mysql / pdo_sqlite

sudo chmod 700 /var/lib/php/sessions/
sudo chown -R www-data:www-data /var/lib/php/sessions
sudo find / -name config.inc.php #find phpmyadmin config file across whole disk
sudo nano /var/www/phpmyadmin/config.inc.php # add after the /declare(strict_types=1);/  --> $cfg['SessionSavePath'] = '/var/lib/php/sessions';
sudo systemctl restart php8.2-fpm
sudo systemctl restart apache2

#see if rewrite exists to apache
apache2ctl -M | grep rewrite

#if there is no output, it means that mod_rewrite is not enabled. Enable it via :
sudo a2enmod rewrite
sudo systemctl restart apache2

#then you have to edit Apache config
sudo nano /etc/apache2/apache2.conf
#at <Directory /var/www/> tag set 'AllowOverride All'

<VirtualHost *:8080>
        ServerName 192.168.1.155
        # Log file location
        CustomLog ${APACHE_LOG_DIR}/access.log common
        ErrorLog ${APACHE_LOG_DIR}/error.log
</VirtualHost>

# if you want to disable log rotation, remark all lines at
sudo nano /etc/logrotate.d/apache2

mkdir /var/myLogs
sudo chown -R www-data:www-data /var/myLogs

# fix the location to new directory
sudo nano /etc/apache2/sites-available/000-default.conf
<VirtualHost *:8080>
        ServerName 192.168.1.155
        # Log file location
        CustomLog /var/myLogs/access.log common
        ErrorLog /var/myLogs/error.log
</VirtualHost>

sudo systemctl restart apache2

# pdo_sqlite relies on sqlite3
sudo apt install php8.2-sqlite3

# enable on /etc/php/8.2/fpm/php.ini
extension=pdo_sqlite

#restart
sudo systemctl restart php8.2-fpm
sudo systemctl restart apache2

# dont forget the 'dbase file' must be under 'www-data', here doing all files&folders at 'apps' folder recursively.. (manually add permissions 600)
sudo chown -R www-data:www-data /var/www/apps

# install & run sqlite3 CLI to manipulate dbase files (no required for web server)
sudo apt install sqlite3
sqlite3

# open dbase
.open /var/www/appslocal/dbase.db

# show tables
.tables

# always add semicolon at end
select * from products;

#exit cli
.exit

# open a new shell with root (superuser) privileges
sudo -i

#rename file
mv old_filename new_filename

#delete zip files from the dir
rm *.zip

#create directory
sudo mkdir tmp

#make file executable
chmod +x testAppImage

#restart services
sudo systemctl restart php8.2-fpm
sudo systemctl restart apache2

#create file and edit
sudo touch a.html
sudo nano a.html

#file permissions
sudo chmod 700 /var/lib/php/sessions/

#file owner
sudo chown yourusername -R /var/www[

#extract tar
tar -xvzf test.tar.gz

#extract gzip
gzip -d filename.gz

#zip folder
sudo apt install zip
zip -r my_folder.zip my_folder

#7zip install & extract
sudo apt install p7zip-full
7z x yourfile.7z

#copy files&folders and overwrite to destination directory
cp -rf /source/directory/* /destination/directory/

#cron jobs of all users on a machine - https://ittavern.com/cron-jobs-on-linux-comprehensive-guide/
grep "^[^#;]" /var/spool/cron/crontabs/* /etc/crontab /etc/cron.d/*

# In terminal emulator, pressing Esc followed by Backspace can delete the entire line. The CTRL+U also doing the same.
# In terminal emulator, pressing CTRL + L clears the screen, pressing again CTRL+L delete also the history.

# see also https://www.snort.org/
# ----------------------------------------------------- fail2ban -----------------------------------------------------
# you must install python3-systemd
sudo apt install python3-systemd

# -y is used to automatically answer "yes" to any prompts
sudo apt install fail2ban -y
Created symlink /etc/systemd/system/multi-user.target.wants/fail2ban.service → /lib/systemd/system/fail2ban.service.

# Copy the default configuration file to a new file
sudo cp /etc/fail2ban/jail.conf /etc/fail2ban/jail.local

# edit the config file
sudo nano /etc/fail2ban/jail.local

# fix the apache log path of apache + enable it + set backend
[apache-auth]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/error.log

[apache-badbots]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/access.log
bantime  = 48h
maxretry = 1

[apache-noscript]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/error.log

[apache-overflows]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/error.log
maxretry = 2

[apache-nohome]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/error.log
maxretry = 2

[apache-botsearch]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/error.log
maxretry = 2

[apache-fakegooglebot]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/access.log
maxretry = 1
ignorecommand = %(fail2ban_confpath)s/filter.d/ignorecommands/apache-fakegooglebot <ip>

[apache-modsecurity]
backend=systemd
enabled = true
port     = http,https
logpath  = /var/myLogs/error.log
maxretry = 2

[apache-shellshock]
backend=systemd
enabled = true
port    = http,https
logpath = /var/myLogs/error.log
maxretry = 1

# misc
sudo systemctl restart fail2ban
sudo systemctl status fail2ban
sudo fail2ban-client status
sudo nano /var/log/fail2ban.log

# check specific jail
sudo fail2ban-client status apache-auth

sudo nano /etc/fail2ban/jail.d/defaults-debian.conf
sudo nano /etc/fail2ban/filter.d/apache-auth.conf
sudo nano /etc/fail2ban/jail.local

sudo nano /var/myLogs/access.log
sudo nano /var/myLogs/error.log

# install nftables vs iptables - see more https://tuxcare.com/blog/iptables-vs-nftables-in-linux-what-is-the-difference/ - https://is.gd/YX8cLX
sudo apt install nftables

# ensuring it starts automatically at boot
sudo systemctl enable nftables

# creates a new *table* named filter in the ip family, which is used for managing IPv4 packet filtering rules
#sudo nft add table ip filter
# adds a new *chain* named input to the filter table
#sudo nft 'add chain ip filter input { type filter hook input priority 0; }'

# have a file called 'a.txt' has all the ips needed (per line) to BAN
# create a file called 'addips.sh' contains :
while read -r ip; do
    sudo nft add rule inet filter input ip saddr $ip drop
done < a.txt

# make addips.sh executable
chmod +x addips.sh

# exec addips.sh
./addips.sh

# save to default config file ( configuration always lives in memory (will lost on restart) to avoid misconfigurations, once user validate it store it to config file )
sudo nft list ruleset > /etc/nftables.conf

# load the config file as the active ruleset ( nothing done automatically ) - ALWAYS FLUSH first!!!!!!!!!
sudo nft flush ruleset
sudo nft -f /etc/nftables.conf

#misc
# configuration - https://wiki.nftables.org/wiki-nftables/index.php
# see sample configuration at https://www.datapacket.com/blog/securing-your-server-with-nftables
sudo nano /etc/nftables.conf
nft list ruleset # current active ruleset ( by default lists nftables.conf, in case user, add rule will be overwrite the active ruleset )

# examples - see workstation
cd /usr/share/doc/nftables/examples/
sudo nano /usr/share/doc/nftables/examples/workstation.nft

# start the nftables service
sudo systemctl start nftables

# check the status of the nftables service
sudo systemctl status nftables

# sets the entire firewall configuration to a clean state (remove all existing rules, chains, and tables)
nft flush ruleset

#samples of nftables.conf rule
#ip saddr 184.105.139.0/24 drop #all addresses from 184.105.139.0 to 184.105.139.255
#ip saddr 157.66.27.45 drop #single IP

#fail2ban with nftables
https://wiki.meurisse.org/wiki/Fail2Ban

# install terminal multiplexer
sudo apt install tmux

# add mouse support, by creating '.tmux.conf'
sudo nano ~/.tmux.conf
# add & save
set -g mouse on
set-option -g set-clipboard on

# init tmux (you will have a green bar on bottom) :
tmux

# when into tmux press CTRL+B release both keys and press c
# now you got new session of tmux
# the active session has an asterisk on name
# switch between sessions by pressicng CTRL+B release 0 or 1 or n

# example open nano
sudo nano /var/myLogs/access.log

# select text by mouse and press right click
# switch to session 1 press mouse right click

# to exit a session exec exit ;)

# stop the nftables service
sudo systemctl stop nftables

# prevent nftables from starting automatically on boot,
sudo systemctl disable nftables

# check the status of the nftables service
sudo systemctl status nftables

# User Crontab   - /var/spool/cron/crontabs/username - each user has his own cronjobs
# System Crontab - /etc/crontab
# Cron.d Directory - Additional cron jobs can be placed in files within /etc/cron.d/
# edit  the file that contains the cron jobs
crontab -e

# add a line (this is will executed every minute) and export log to specified path
# always needs an empty line in the end of the file
* * * * * /usr/bin/php /var/www/test.php >> /var/myLogs/cron.log 2>&1

# lists the cron jobs by reading the file used with '-e' parameter
crontab -l

# see status
sudo systemctl status cron

# cron job example call with curl ( and not php cli ) and write the result to /tmp/cron_test.log
0 7 * * * /usr/bin/curl "http://localhost:8080/apps/index.php/?test=1" >> /tmp/cron_test.log
# access subdomain 0 7 * * * /usr/bin/curl "http://offers.83u4283274.xyz/?test=1"

# good idea on errors to check apache error.log, while you have enabled on php.ini
display_errors = On
display_startup_errors = On

sudo apt install nmap
sudo nmap -sC -sV -Pn -n -p- targetIP --open --min-rtt-timeout 500ms --min-rate 2000
# or sudo nmap -sS -Pn -T5 -p- targetIP
# or sudo nmap -sC -sV -Pn -n -p- targetIP --open

alternative
https://github.com/RustScan/RustScan
https://github.com/robertdavidgraham/masscan

ref - https://www.reddit.com/r/tryhackme/comments/1alan6y/fast_way_to_scan_all_ports_using_nmap/

# install chromedriver
sudo apt-get install chromium-chromedriver

# whereis chromedriver
# chromedriver: /usr/bin/chromedriver

# install pip for python3
sudo apt install python3-pip

# install selenium
sudo apt install python3-selenium

# create a python script
sudo nano test.py

#execute test.py
python3 test.py

#the sample script
from selenium import webdriver
from selenium.webdriver.common.by import By
from selenium.webdriver.common.keys import Keys
from selenium.webdriver.chrome.service import Service
from selenium.webdriver.chrome.options import Options
from selenium.webdriver.support.ui import WebDriverWait
from selenium.webdriver.support import expected_conditions as EC
from selenium.common.exceptions import TimeoutException, WebDriverException
import time

# Specify the path to the ChromeDriver executable
chrome_driver_path = '/usr/bin/chromedriver'

# Create a Service object for ChromeDriver
service = Service(chrome_driver_path)

# Set up Chrome options for headless mode
chrome_options = Options()
chrome_options.add_argument("--headless")  # Run in headless mode
chrome_options.add_argument("--no-sandbox")  # Bypass OS security model
chrome_options.add_argument("--disable-dev-shm-usage")  # Overcome limited resource problems

try:
    # Initialize the Chrome WebDriver with the Service object and options
    driver = webdriver.Chrome(service=service, options=chrome_options)

    # Open a webpage
    driver.get("https://www.ab.gr/el/eshop/Oporopoleio/Lachanika/Chorta/Pantzaria-ston-Atmo-Viologika-Eisagogis-500g/p/7650216")

    page_source = driver.page_source
    file_path = 'web_response.html'

    # Write page response to file
    with open(file_path, 'w', encoding='utf-8') as file:
       file.write(page_source)

    # Wait for the search box to be present and interactable
#    search_box = WebDriverWait(driver, 10).until(
#        EC.element_to_be_clickable((By.NAME, "q"))
#    )
    promotion_label_element = WebDriverWait(driver, 10).until(
        EC.visibility_of_element_located((By.CSS_SELECTOR, '[data-testid="promotion-label-component"]'))
    )

    # Locate the parent element using its data-testid
    parent_element = driver.find_element("css selector", '[data-testid="promotion-label-component"]')

    # Now find the child elements within the parent element
    hi1_element = parent_element.find_element("css selector", '[data-testid="tag-label"]')
    hi2_element = parent_element.find_element("css selector", '[data-testid="tag-promo-expiration-date"]')
    # Get the text of the child elements
    hi1_text = hi1_element.text
    hi2_text = hi2_element.text

    # Print the texts
    print("hi1:", hi1_text)
    print("hi2:", hi2_text)


    # Type a search term and hit Enter
    search_box.send_keys("Selenium Python")
    search_box.send_keys(Keys.RETURN)

    # Wait for a few seconds to see the results
    time.sleep(5)

except TimeoutException:
    print("The button did not become clickable in time.")
except WebDriverException as e:
    print("WebDriverException occurred:", e)
except Exception as e:
    print("An unexpected error occurred:", e)
finally:
    # Close the browser
    driver.quit()

ref - https://www.youtube.com/watch?v=tRNwTXeJ75U

# The chromedriver is for Selenium (open source), which is a different library and not related to Playwright (microsoft).

# install browsers dependency ( outside virtual environment )
sudo apt-get install -y \
    libgstreamer1.0-0 \
    libgstreamer-plugins-base1.0-0 \
    libvpx-dev \
    libevent-dev \
    libglib2.0-0 \
    libwebp-dev \
    libharfbuzz-dev \
    libenchant-2-2 \
    libsecret-1-0 \
    libhyphen0 \
    libflite1 \
    libx264-dev

sudo apt-get install gstreamer1.0-plugins-base gstreamer1.0-plugins-good gstreamer1.0-plugins-bad gstreamer1.0-plugins-ugly gstreamer1.0-libav

sudo apt-get install libmanette-0.2-0

sudo apt-get install woff2

# install virtual environment
sudo apt install python3.11-venv

# create virtual environment ( this will create a folder named myenv )
cd ~
sudo python3 -m venv myenv

# enter to virtual environment
source myenv/bin/activate

# to exit execute
#deactivate

# install playwright
pip install playwright

# download browsers  Chromium / Firefox / ffmpeg / Webkit ( by https://playwright.azureedge.net/builds )
playwright install

# create a file
sudo nano test.py

# run
python test.py

# contents of test.py - https://stackoverflow.com/a/77062039
from playwright.sync_api import sync_playwright

with sync_playwright() as p:
    browser = p.chromium.launch(headless=True)
    context = browser.new_context()
    page = context.new_page()
    page.goto('https://www.ab.gr/el/eshop/Oporopoleio/Lachanika/Chorta/Pantzaria-ston-Atmo-Viologika-Eisagogis-500g/p/7650216')
 
    html_source = page.content()

    file_path = 'web_response_play.html'

    # Write page response to file
    with open(file_path, 'w', encoding='utf-8') as file:
       file.write(html_source)
 
    # Print the HTML source
    print(html_source)
 
    # Close the browser
    browser.close()


# troubleshooting
# info of the installation ( inside virtual environment )
pip show playwright
# delete browsers ( outside virtual environment )
rm -rf ~/.cache/ms-playwright

#original article python - https://abstractexpr.com/2023/05/07/simple-raspberry-pi-backup/
#using '--to-stdout' on powershell working but because the transfer made ASCII (not binary) the archive becomes corrupted.
#solution is to create the archive on linux /tmp folder, then transfer it to windows with scp
# Define backup directories and user host
$BACKUP_DIRS = @('/var/www', '/var/Logs')
$USER_HOST = 'xxx@192.168.1.155'
$DATE = (Get-Date -Format "yyyy-MM-dd")
$ARCHIVE_NAME = "backup_$DATE.tar.gz"
$TEMP_DIR = "/tmp"  # Temporary directory on the Linux machine
$MYSQL_BACKUP_NAME = "mysql_backup_$DATE.sql.gz"

# Check if the archive already exists on the Windows machine
if (Test-Path ".\$ARCHIVE_NAME") {
    Write-Host "Backup archive $ARCHIVE_NAME already exists. Aborting execution." -ForegroundColor Red
    exit 1
}

# Create a tar.gz backup of the specified directories on the Linux machine
$backupDirsString = $BACKUP_DIRS -join ' '
Write-Host "Creating backup of directories: $backupDirsString on Linux machine..."
$tarCommand = "ssh $USER_HOST 'tar -czf $TEMP_DIR/$ARCHIVE_NAME $backupDirsString' 2> error.log"
$res = Invoke-Expression $tarCommand

if ($LASTEXITCODE -ne 0) {
    Write-Host "Failed to create backup archive on Linux machine" -ForegroundColor Red
    exit 1
}

# Create a MySQL backup on the Linux machine
Write-Host "Creating MySQL backup on Linux machine..."
$mysqlCommand = "ssh $USER_HOST 'mysqldump --all-databases | gzip -c > $TEMP_DIR/$MYSQL_BACKUP_NAME'"
$res = Invoke-Expression $mysqlCommand

if ($LASTEXITCODE -ne 0) {
    Write-Host "Failed to backup MySQL data on Linux machine" -ForegroundColor Red
    exit 1
}

# Transfer the archive and MySQL backup to the Windows machine using scp
Write-Host "Transferring backup files to Windows machine..."
$scpCommand = "scp ${USER_HOST}:${TEMP_DIR}/${ARCHIVE_NAME} ."
$res = Invoke-Expression $scpCommand

if ($LASTEXITCODE -ne 0) {
    Write-Host "Failed to transfer backup archive to Windows machine" -ForegroundColor Red
    exit 1
}

$scpMysqlCommand = "scp ${USER_HOST}:${TEMP_DIR}/$MYSQL_BACKUP_NAME ."
$res = Invoke-Expression $scpMysqlCommand

if ($LASTEXITCODE -ne 0) {
    Write-Host "Failed to transfer MySQL backup to Windows machine" -ForegroundColor Red
    exit 1
}

# Optionally, clean up the temporary files on the Linux machine
Write-Host "Cleaning up temporary files on Linux machine..."
$cleanupCommand = "ssh $USER_HOST 'rm $TEMP_DIR/$ARCHIVE_NAME $TEMP_DIR/$MYSQL_BACKUP_NAME'"
$res = Invoke-Expression $cleanupCommand

if ($LASTEXITCODE -ne 0) {
    Write-Host "Failed to clean up temporary files on Linux machine" -ForegroundColor Red
    exit 1
}

# Housekeeping: Keep only the 3 most recent backups
$backupFiles = Get-ChildItem -Filter "backup_*.tar.gz" | Sort-Object LastWriteTime -Descending
if ($backupFiles.Count -gt 3) {
    $filesToDelete = $backupFiles | Select-Object -Skip 3
    foreach ($file in $filesToDelete) {
        Remove-Item $file.FullName -Force
        Write-Host "Deleted old backup: $($file.Name)" -ForegroundColor Yellow
    }
}

$mysqlBackupFiles = Get-ChildItem -Filter "mysql_backup_*.sql.gz" | Sort-Object LastWriteTime -Descending
if ($mysqlBackupFiles.Count -gt 3) {
    $filesToDelete = $mysqlBackupFiles | Select-Object -Skip 3
    foreach ($file in $filesToDelete) {
        Remove-Item $file.FullName -Force
        Write-Host "Deleted old MySQL backup: $($file.Name)" -ForegroundColor Yellow
    }
}

Write-Host "Backup completed successfully."

table inet filter {
    chain input {
        type filter hook input priority filter; policy accept;

        # Allow SSH from the LAN
        ip saddr 192.168.1.0/24 tcp dport 22 accept

        # Allow MySQL from the LAN
        ip saddr 192.168.1.0/24 tcp dport 3306 accept

        # Drop SSH from other sources
        tcp dport 22 drop

        # Drop MySQL from other sources
        tcp dport 3306 drop

# enable default-ssl.conf file
a2ensite default-ssl
#to disable - sudo a2dissite default-ssl

# enabling module ssl
a2enmod ssl

# install certbot
sudo apt-get install certbot python3-certbot-apache

# configure virtual hosts for ssl + update the certication files
sudo nano /etc/apache2/sites-enabled/default-ssl.conf

# restart apache
systemctl restart apache2

# verify apache configuration (incl default-ssl.conf)
sudo apache2ctl configtest

sudo nano /etc/apache2/sites-available/000-default.conf

<VirtualHost *:8080>
        ServerName 83u4283274.xyz
        DocumentRoot /var/www/home

        RemoteIPHeader CF-Connecting-IP
        # Log file location
        CustomLog /var/myLogs/access.log common
        ErrorLog /var/myLogs/error.log
</VirtualHost>

<!-- directives getting inherited, we explicitly override CustomLog + ErrorLog to write to different files -->
<VirtualHost *:8080>
   ServerName blog.83u4283274.xyz
   DocumentRoot /var/www/blog

   CustomLog /var/myLogs/blog-access.log common
   ErrorLog /var/myLogs/blog-error.log
<!-- test -->
   <Directory /var/www/blog>
       # Deny access to all other file types than
       <FilesMatch "\.(?!png|jpg|gif|css|php|html|js$)">
           Require all denied
       </FilesMatch>
   </Directory>
</VirtualHost>
<!-- source - https://dev.to/tikam02/configuring-domains-and-sub-domains-in-apache-webserver-1bl1-->

# create the blog folder with
mkdir /var/www/blog

# create a dummy index
sudo nano /var/www/blog/index.html

# all must have owner the www-data user
sudo chown -R www-data:www-data /var/www

# check config for errors
sudo apachectl configtest

# restart apache
sudo systemctl restart apache2

# the symbolic link allows Nginx to use the configuration defined in sites-available
sudo rm /etc/nginx/sites-enabled/default

# reload nginx
sudo systemctl reload nginx

# name as you wish the configuration file
sudo nano /etc/nginx/sites-available/83u4283274.conf

# create symbolic link to folder sites-enabled (allows Nginx to use it)
sudo ln -s /etc/nginx/sites-available/83u4283274.conf /etc/nginx/sites-enabled/

# test configuration file
sudo nginx -t

# restart
sudo systemctl restart nginx

# sample of /etc/nginx/sites-available/83u4283274.conf
server {
    listen 8080;
    server_name 83u4283274.xyz;

    root /var/www/home;
    index index.php index.html index.htm;

    access_log /var/myLogs/access.log;
    error_log /var/myLogs/error.log;

    location / {
        try_files $uri $uri/ =404;
    }
# source - https://reintech.io/blog/configuring-php-fpm-nginx-debian-12
    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

# customize php.ini as you wish
sudo systemctl restart php8.2-fpm
sudo systemctl restart nginx

# source - https://developers.cloudflare.com/support/troubleshooting/restoring-visitor-ips/restoring-original-visitor-ips/

# reference - http://nginx.org/en/docs/http/ngx_http_realip_module.html
# see if '--with-http_realip_module' exists to your Nginx installation (most probably does)
nginx -V

# edit nginx configuration
sudo nano /etc/nginx/nginx.conf

# add the following below http block
http {
# cloudflare IPs
        set_real_ip_from 103.21.244.0/22;
        set_real_ip_from 103.22.200.0/22;
        set_real_ip_from 103.31.4.0/22;
        set_real_ip_from 104.16.0.0/13;
        set_real_ip_from 104.24.0.0/14;
        set_real_ip_from 108.162.192.0/18;
        set_real_ip_from 131.0.72.0/22;
        set_real_ip_from 141.101.64.0/18;
        set_real_ip_from 162.158.0.0/15;
        set_real_ip_from 172.64.0.0/13;
        set_real_ip_from 173.245.48.0/20;
        set_real_ip_from 188.114.96.0/20;
        set_real_ip_from 190.93.240.0/20;
        set_real_ip_from 197.234.240.0/22;
        set_real_ip_from 198.41.128.0/17;
        set_real_ip_from 2400:cb00::/32;
        set_real_ip_from 2606:4700::/32;
        set_real_ip_from 2803:f800::/32;
        set_real_ip_from 2405:b500::/32;
        set_real_ip_from 2405:8100::/32;
        set_real_ip_from 2a06:98c0::/29;
        set_real_ip_from 2c0f:f248::/32;

        real_ip_header CF-Connecting-IP;

# beware to change made to 'log format' as the cloudflare page mentioning :
# To Include the original visitor IP in your logs, add the variables $http_cf_connecting_ip and $http_x_forwarded_for in the log_format directive.
# incase you needed (at /etc/nginx/nginx.conf > inside http block) :
# log_format main '$remote_addr - $remote_user [$time_local] "$request" '                   '$status $body_bytes_sent "$http_referer" '                   '"$http_user_agent" "$http_cf_connecting_ip" "$http_x_forwarded_for"';


# restart
sudo systemctl restart nginx

# source - https://frankindev.com/2020/11/18/allow-cloudflare-only-in-nginx/
# reference - http://nginx.org/en/docs/http/ngx_http_realip_module.html
# see if '--with-http_realip_module' exists to your Nginx installation (most probably does)
nginx -V

# edit nginx configuration
sudo nano /etc/nginx/nginx.conf

# include the following to http block
http {

    map $http_x_forwarded_for $real_client_ip {
        ~^(\d+\.\d+\.\d+\.\d+) $1;
        default $http_cf_connecting_ip;
    }

    log_format custom_log_format '$real_client_ip - $remote_user [$time_local] '
                                 '"$request" $status $body_bytes_sent '
                                 '"$http_host" "$upstream_response_time"'
                                 '"$http_referer" "$http_user_agent"';

---

# create a new file /etc/nginx/allow-cloudflare-only.conf and paste :
# https://www.cloudflare.com/ips
allow 103.21.244.0/22;
allow 103.22.200.0/22;
allow 103.31.4.0/22;
allow 104.16.0.0/13;
allow 104.24.0.0/14;
allow 108.162.192.0/18;
allow 131.0.72.0/22;
allow 141.101.64.0/18;
allow 162.158.0.0/15;
allow 172.64.0.0/13;
allow 173.245.48.0/20;
allow 188.114.96.0/20;
allow 190.93.240.0/20;
allow 197.234.240.0/22;
allow 198.41.128.0/17;
allow 2400:cb00::/32;
allow 2606:4700::/32;
allow 2803:f800::/32;
allow 2405:b500::/32;
allow 2405:8100::/32;
allow 2a06:98c0::/29;
allow 2c0f:f248::/32;

# deny all remaining ips
deny all;

---

#on server configuration example /etc/nginx/sites-available/83u4283274.conf
server {
    listen 8080;
    server_name 83u4283274.xyz;

    root /var/www/home;
    index index.php index.html index.htm;
# this line defines the custom_log_format;
    access_log /var/myLogs/access.log custom_log_format;
    error_log /var/myLogs/error.log;
# and this line includes the allow/deny rules
    include /etc/nginx/allow-cloudflare-only.conf;

    location / {
        try_files $uri $uri/ =404;
    }

    location ~ \.php$ {
        include snippets/fastcgi-php.conf;
        fastcgi_pass unix:/run/php/php8.2-fpm.sock;
        fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
        include fastcgi_params;
    }
}

# restart
sudo systemctl restart nginx

# source - https://docs.nginx.com/nginx/admin-guide/security-controls/configuring-http-basic-authentication/

# install
sudo apt install apache2-utils

# generate password for user testuser
sudo htpasswd -c /etc/nginx/.htpasswd testuser

# on servers configuration file, must have these
    location / {
        auth_basic "Restricted Access";
        auth_basic_user_file /etc/nginx/.htpasswd;

        autoindex on;
        autoindex_exact_size off;
        autoindex_format html;
        autoindex_localtime on;
    }

# restart
sudo systemctl restart nginx

<!-- source - https://www.linickx.com/css-styling-nginx-directory-listings -->

<!-- [1] create /var/html/nginx-before.txt -->

<!DOCTYPE html>
<html lang="en">
<head>
        <title>files</title>
        <meta charset="utf-8" />
        <meta name="viewport" content="width=device-width, initial-scale=1.0">
        <link rel="stylesheet" href="https://cdn.jsdelivr.net/npm/water.css@2/out/water.css">
        <link href="https://fonts.googleapis.com/css?family=Gloria+Hallelujah|Sigmar+One&v2" rel="stylesheet" type="text/css">
 
        <style> * { font-family: Gloria Hallelujah; } </style>
</head>

<body>
<div>

<!-- [2] create /var/html/nginx-after.txt -->
</div>

</body>
</html>

<!-- [3] on server configuration example /etc/nginx/sites-available/83u4283274.conf -->
server {
    listen 8080;
    server_name blog.83u4283274.xyz;

    root /var/www/blog;
.
.
.
    location / {
        auth_basic "Restricted Access";
        auth_basic_user_file /etc/nginx/.htpasswd;
<!-- the files are one folder back so it will not be visible to the user -->
        add_before_body /../nginx-before.txt;
        add_after_body /../nginx-after.txt;
        autoindex on;
        autoindex_exact_size off;
        autoindex_format html;
        autoindex_localtime on;
    }

<!--
alternative
https://github.com/aperezdc/ngx-fancyindex
use of https://neilmenon.com/blog/install-nginx-fancyindex/
-->

# https://learn.microsoft.com/en-us/dotnet/core/tools/dotnet-install-script
# https://learn.microsoft.com/en-us/dotnet/iot/deployment
wget https://dot.net/v1/dotnet-install.sh

# make it executable
chmod +x ./dotnet-install.sh

# run the script
sudo ./dotnet-install.sh --channel LTS --install-dir /opt/dotnet

# edit environment variables
nano ~/.bashrc

# add & save
export DOTNET_ROOT=/opt/dotnet
export PATH=$PATH:/opt/dotnet
export DOTNET_CLI_TELEMETRY_OPTOUT=1

# refresh environment variables
source ~/.bashrc

# verify .net version
dotnet --version

# gather information
dotnet --info

# create sample console hello world
dotnet new console -o console1
cd console1
dotnet run (wait a minute or two with blinking cursor)

# create sample .NET Web App MVC hello world
dotnet new mvc -o mvc1


-----------------
# Run and display an ASP.NET Core Web App + Add service for your ASP.NET app
https://chronicdev.io/devlog/raspberry-pi-web-app-asp-dotnet-core/#publish-your-aspnet-core-project-reference
https://dev.to/vimaltwit/hosting-net-web-api-on-raspberry-pi-part-2-12kn

# Deploy and Run ASP.NET Core Applications
https://edi.wang/post/2019/9/29/setup-net-core-30-runtime-and-sdk-on-raspberry-pi-4