crony/cronyakatsuki.xyz
1
0
Fork 0
Code Issues Pull Requests Packages Projects Releases Wiki Activity
70eacb2517
cronyakatsuki.xyz/public/blog/index.xml
CronyAkatsuki 70eacb2517 First commit.
2023-10-05 21:05:32 +02:00

291 lines
61 KiB
XML
Raw Blame History

<rss version="2.0"
xmlns:atom="http://www.w3.org/2005/Atom">
<channel>
<title>Blog on Crony Akatsuki&#39;s Website</title>
<link>https://cronyakatsuki.xyz/blog/</link>
<description>Recent content in Blog on Crony Akatsuki&#39;s Website</description>
<generator>Hugo -- gohugo.io</generator>
<language>en-us</language>
<lastBuildDate>Wed, 27 Sep 2023 00:00:00 +0000</lastBuildDate>
<atom:link href="https://cronyakatsuki.xyz/blog/index.xml" rel="self" type="application/rss+xml" />
<item>
<title>Setup dns with adblock and dot/doh with pi-hole and unbound</title>
<link>https://cronyakatsuki.xyz/blog/setup-dns-pihole-unbound/</link>
<pubDate>Wed, 27 Sep 2023 00:00:00 +0000</pubDate>
<guid>https://cronyakatsuki.xyz/blog/setup-dns-pihole-unbound/</guid>
<description>&lt;p&gt;Just another day I seted up my own private dns server that has adblocking ( and other stuff ) using pihole and uses unbound as a resolver. To safelly connect to the dns server I&amp;rsquo;m using DNS over HTTPS for my browser&amp;rsquo;s and HTTPS over TLS for stuffy for my whole desktop and private dns in android ( Android has DoH support but only for google and cloudflare right now). Let&amp;rsquo;s get on to setting everything up&lt;/p&gt;
&lt;!-- raw HTML omitted --&gt;
&lt;h2 id=&#34;1-pihole&#34;&gt;1. Pihole&lt;/h2&gt;
&lt;p&gt;Let&amp;rsquo;s start with setting up pihole. I will be installing it with their script on a debian system for easier unbound integration ( unbound doesn&amp;rsquo;t have an official docker container ).&lt;/p&gt;
&lt;p&gt;I recommend to read up on the pihole&amp;rsquo;s docs on exactly how to install it since pihole get&amp;rsquo;s frequent updates. &lt;a href=&#34;https://docs.pi-hole.net/main/basic-install/&#34;&gt;DOCS&lt;/a&gt;&lt;/p&gt;
&lt;p&gt;I recommend you to install the admin page for easier managmenet and ability to change the upstream dns server ( needed for changing it to unbound later on ). To be able to access the admin page I use an nginx configuration like this one.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-nginx&#34; data-lang=&#34;nginx&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#ca9ee6&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;server_name&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;example.com&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;location&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;return&lt;/span&gt; 403&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;location&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/admin&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_pass&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;http://127.0.0.1:8185/admin&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;Host&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$host&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# If you want to log user activity, comment these
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;access_log&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/dev/null&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;error_log&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/dev/null&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;[::]:443&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;ssl&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; 443 &lt;span style=&#34;color:#a6d189&#34;&gt;ssl&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_certificate&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/live/example.com/fullchain.pem&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_certificate_key&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/live/example.com/privkey.pem&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;include&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/options-ssl-nginx.conf&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_dhparam&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/ssl-dhparams.pem&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#ca9ee6&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;if&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;(&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;$host&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;=&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;example.com)&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;return&lt;/span&gt; 301 &lt;span style=&#34;color:#a6d189&#34;&gt;https://&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;$host$request_uri&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;server_name&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;example.com&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; 80&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;[::]:80&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;return&lt;/span&gt; 404&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# managed by Certbot
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;The main point of this config is the &lt;code&gt;/admin&lt;/code&gt; location that you need to pass the lighttpd port to acces the website, you can just do it on your main website also.
Also to make lighttpd work with nginx listening on port 80 you need to edit the &lt;code&gt;server.port&lt;/code&gt; to port you wan&amp;rsquo;t to use in lighttpd config file located at &lt;code&gt;/etc/lighttpd/lighttpd.conf&lt;/code&gt; and then just restart lighttpd&lt;/p&gt;
&lt;h2 id=&#34;2-unbound&#34;&gt;2. Unbound&lt;/h2&gt;
&lt;p&gt;For this part I will just link the pi-hole&amp;rsquo;s unbound documentation because it is the most correct one and updated as things change regulary.
&lt;a href=&#34;https://docs.pi-hole.net/guides/dns/unbound/&#34;&gt;Pi-hole unbound docs&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;3-dns-over-tls&#34;&gt;3. DNS over TLS&lt;/h2&gt;
&lt;p&gt;For dns over tls you need to first have a ssl certificate. I recommend on using certbot to generate one with this command &lt;code&gt;certbot --nginx -d dot.example.com&lt;/code&gt;.&lt;/p&gt;
&lt;p&gt;Next you will need a reverse proxy, in my case I use nginx. You will need to add this configuration to your main nginx config located at &lt;code&gt;/etc/nginx/nginx.conf&lt;/code&gt;. &lt;strong&gt;Make sure to add this outside of the http block and change example.com to your domain&lt;/strong&gt;&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-nginx&#34; data-lang=&#34;nginx&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#ca9ee6&#34;&gt;stream&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;log_format&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;basic&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#39;&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;$remote_addr&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;[&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;$time_local]&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$protocol&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$status&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$bytes_sent&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$bytes_received&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$session_time&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$upstream_addr&amp;#39;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;upstream&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;dns&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;zone&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;dns&lt;/span&gt; 64k&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;127.0.0.1&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;:&lt;/span&gt;53&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; 853 &lt;span style=&#34;color:#a6d189&#34;&gt;ssl&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;access_log&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/var/log/nginx/dot-access.log&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;basic&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;error_log&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/var/log/nginx/dot-error.log&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_certificate&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/live/dot.example.com/fullchain.pem&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_certificate_key&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/live/dot.example.com/privkey.pem&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_protocols&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;TLSv1.2&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;TLSv1.3&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_ciphers&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;HIGH:!aNULL:!MD5&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_handshake_timeout&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;10s&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_session_cache&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;shared:SSL:20m&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_session_timeout&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;4h&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_pass&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;dns&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_responses&lt;/span&gt; 1&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_timeout&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;1s&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;Also make sure to enable port 853, example ufw command is &lt;code&gt;ufw allow 853/tcp&lt;/code&gt;. Then restart nginx, to test if this configuration is working you can use your android phone by setting the private dns address to &lt;code&gt;dot.example.com&lt;/code&gt; and then visit the website&lt;a href=&#34;https://dnsleaktest.com&#34;&gt;dnsleaktest&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;4-dns-over-https&#34;&gt;4. DNS over HTTPS&lt;/h2&gt;
&lt;p&gt;For using dns over https we will be installing additional package called dnsdinst. On debian systems just run &lt;code&gt;apt install dnsdinst&lt;/code&gt;. Next you will need to setup dnsdinst config and restart it. Make sure to change example.com.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-conf&#34; data-lang=&#34;conf&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;--&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;dnsdist&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;configuration&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;file&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;an&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;example&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;can&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;be&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;found&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;in&lt;/span&gt; &lt;span style=&#34;color:#e78284&#34;&gt;/&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;usr&lt;/span&gt;&lt;span style=&#34;color:#e78284&#34;&gt;/&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;share&lt;/span&gt;&lt;span style=&#34;color:#e78284&#34;&gt;/&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;doc&lt;/span&gt;&lt;span style=&#34;color:#e78284&#34;&gt;/&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;dnsdist&lt;/span&gt;&lt;span style=&#34;color:#e78284&#34;&gt;/&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;examples&lt;/span&gt;&lt;span style=&#34;color:#e78284&#34;&gt;/&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;--&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;disable&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;security&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;status&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;polling&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;via&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;DNS&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;setSecurityPollSuffix&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;(&lt;/span&gt;&lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;--&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;fix&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;up&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;possibly&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;badly&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;truncated&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;answers&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;from&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;pdns&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;2.9.22&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;--&lt;/span&gt; &lt;span style=&#34;color:#99d1db&#34;&gt;truncateTC&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;(&lt;/span&gt;&lt;span style=&#34;color:#ca9ee6;font-style:italic&#34;&gt;true&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;--&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;Answer&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;to&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;only&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;clients&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;from&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;this&lt;/span&gt; &lt;span style=&#34;color:#e5c890&#34;&gt;subnet&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;setACL&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;(&lt;/span&gt;&lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;127.0.0.1/8&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;--&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;Define&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;upstream&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;DNS&lt;/span&gt; &lt;span style=&#34;color:#99d1db&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;(&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;Pi-hole&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;)&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;newServer&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;({&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;address&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;&lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;127.0.0.1&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;name&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;&lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;Pi-hole&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;checkName&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;&lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;example.com&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;checkInterval&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;60&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;mustResolve&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;&lt;span style=&#34;color:#ca9ee6;font-style:italic&#34;&gt;true&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;})&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;--&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;Create&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;local&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;DOH&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;listener&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;in&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;DNS&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;over&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;HTTP&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;mode&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;otherwise&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;the&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;information&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;coming&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;from&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;nginx&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;won&lt;/span&gt;&lt;span style=&#34;color:#e78284&#34;&gt;&amp;#39;&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;t&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;be&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;processed&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;well&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;addDOHLocal&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;(&lt;/span&gt;&lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;127.0.0.1:5300&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;nil&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;nil&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;/dns-query&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;,&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;reusePort&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;&lt;span style=&#34;color:#ca9ee6;font-style:italic&#34;&gt;true&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;})&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;Next we will need another ssl certificate for the doh domain, for that we will once again using certbot with this command &lt;code&gt;certbot --nginx -d doh.example.com&lt;/code&gt;after that add this configuratin to nginx either in sites-available and linking it to sites enabled or in http block in main nginx configuration.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-nginx&#34; data-lang=&#34;nginx&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Proxy Cache storage - so we can cache the DoH response from the upstream
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt;&lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_cache_path&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/var/run/doh_cache&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;levels=1:2&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;keys_zone=doh_cache:10m&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#ca9ee6&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; 80&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;server_name&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;doh.example.com&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;return&lt;/span&gt; 301 &lt;span style=&#34;color:#a6d189&#34;&gt;https://doh.example.com/&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;$request_uri&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# This virtual server accepts HTTP/2 over HTTPS
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt;&lt;span style=&#34;color:#ca9ee6&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; 443 &lt;span style=&#34;color:#a6d189&#34;&gt;ssl&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;http2&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;server_name&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;doh.example.com&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;access_log&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/var/log/nginx/doh.access&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;error_log&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/var/log/nginx/doh.error&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;error&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_certificate&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/live/doh.example.com/fullchain.pem&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_certificate_key&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/etc/letsencrypt/live/doh.example.com/privkey.pem&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# DoH may use GET or POST requests, Cache both
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_cache_methods&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;GET&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;POST&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Return 404 to all responses, except for those using our published DoH URI
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;location&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;try_files&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$uri&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$uri/&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;=&lt;/span&gt;404&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;ssl_protocols&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;TLSv1.2&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;TLSv1.3&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_ssl_ciphers&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;HIGH:!aNULL:!MD5&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# This is our published DoH URI
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;location&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/dns-query&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Proxy HTTP/1.1, clear the connection header to enable Keep-Alive
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_http_version&lt;/span&gt; 1&lt;span style=&#34;color:#a6d189&#34;&gt;.1&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;Connection&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;&amp;#34;&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Enable Cache, and set the cache_key to include the request_body
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_cache&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;doh_cache&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_cache_key&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$scheme$proxy_host$uri$is_args$args$request_body&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# proxy pass to dnsdist
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_pass&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;http://127.0.0.1:5300&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# proxy pass address
&lt;/span&gt;&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;&lt;/span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;X-Forwarded-For&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$proxy_add_x_forwarded_for&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;After restarting nginx with this configuration you can it to your web browser as a DNS over HTTPS resolver and once again checkout &lt;a href=&#34;https://dnsleaktest.com&#34;&gt;dnsleaktest&lt;/a&gt; website and check if it is all working.&lt;/p&gt;
&lt;p&gt;Hope this has been helpfull and if anybody has any way on how to make this guied better you can open a pull request or make an issue on the website&amp;rsquo;s &lt;a href=&#34;https://code.cronyakatsuki.xyz/crony/website&#34;&gt;repo&lt;/a&gt;.&lt;/p&gt;
</description>
</item>
<item>
<title>Piped videos not loading</title>
<link>https://cronyakatsuki.xyz/blog/piped-video-not-loading/</link>
<pubDate>Sun, 26 Feb 2023 00:00:00 +0000</pubDate>
<guid>https://cronyakatsuki.xyz/blog/piped-video-not-loading/</guid>
<description>&lt;p&gt;Recently I have received and experienced an issue of videos not loading on my personal &lt;a href=&#34;https://piped.cronyakatsuki.xyz&#34;&gt;piped&lt;/a&gt; instance and on the official instance. But I have found a fix and a way to watch the videos even without the fix.&lt;/p&gt;
&lt;!-- raw HTML omitted --&gt;
&lt;h2 id=&#34;what-creates-the-issue&#34;&gt;What creates the issue?&lt;/h2&gt;
&lt;p&gt;From what I have been able to find on the issues over on the &lt;a href=&#34;https://github.com/TeamPiped/Piped&#34;&gt;piped github&lt;/a&gt; it seems to be an lbry issue of the videos not loading mostly on firefox, the issue seems to not happen on the chromium browsers.&lt;/p&gt;
&lt;h3 id=&#34;how-to-fix-the-issue&#34;&gt;How to fix the issue&lt;/h3&gt;
&lt;p&gt;To fix the issue you just have to enable an option in the instance settings called &lt;code&gt;disable lbry for streaming&lt;/code&gt;. This will disable loading of lbry for videos and the issue will mostly just be bypassed.&lt;/p&gt;
&lt;h3 id=&#34;fun-way-to-also-watch-the-videos&#34;&gt;Fun way to also watch the videos&lt;/h3&gt;
&lt;p&gt;If you are like me and bored you can also watch the videos without using the fix by opening the firefox debug console, and in the errors you will see the link of the video that the frontend wasn&amp;rsquo;t able to embed. Just click the link and you will be able to watch the video or it will say that the content isn&amp;rsquo;t reachable and then you will need to do the fix otherwise it&amp;rsquo;s a no no to watch that video otherwise.&lt;/p&gt;
</description>
</item>
<item>
<title>miniflux setup on debian</title>
<link>https://cronyakatsuki.xyz/blog/miniflux-setup/</link>
<pubDate>Wed, 30 Nov 2022 00:00:00 +0000</pubDate>
<guid>https://cronyakatsuki.xyz/blog/miniflux-setup/</guid>
<description>&lt;p&gt;Looking for a minimal self-hosted feed reader I found &lt;a href=&#34;https://miniflux.app/&#34;&gt;miniflux&lt;/a&gt;. But trying to set it up I found my self trying to set it up for 3 freaking hours since I only recently started to self-host things. So here I will try to explaing it in the most easy way how to set it up on a debian server with https using certbot and nginx.&lt;/p&gt;
&lt;!-- raw HTML omitted --&gt;
&lt;p&gt;For this tutorial I expect that you already have a server seted up with nginx and certbot. To set up this things check out &lt;a href=&#34;https://landchad.net&#34;&gt;landchad&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;installing-needed-packages&#34;&gt;Installing needed packages&lt;/h2&gt;
&lt;p&gt;You will first need to setup miniflux apt repository to install it on your system.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#c6d0f5;font-style:italic&#34;&gt;echo&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#34;deb [trusted=yes] https://repo.miniflux.app/apt/ /&amp;#34;&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;|&lt;/span&gt; sudo tee /etc/apt/sources.list.d/miniflux.list &amp;gt; /dev/null
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;apt update
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;Then just install the needed packages.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;apt install miniflux postgresql
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;h2 id=&#34;setting-up-postgres-database-and-miniflux&#34;&gt;Setting up postgres database and miniflux&lt;/h2&gt;
&lt;p&gt;Here I will detail steps to create the postgres database.&lt;/p&gt;
&lt;h3 id=&#34;initial-postgres-setup&#34;&gt;Initial postgres setup&lt;/h3&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Switch to the postgres user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ su - postgres
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Creating a miniflux user, enter a safe and secure password&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ createuser -P miniflux
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Create a database for miniflux that belongs to our user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ createdb -O miniflux miniflux
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Create a database for miniflux that belongs to our user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ createdb -O miniflux miniflux
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Creating extension hstore as superuser&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ psql miniflux -c &lt;span style=&#34;color:#a6d189&#34;&gt;&amp;#39;create extension hstore&amp;#39;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Managing the miniflux database&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ psql &lt;span style=&#34;color:#babbf1&#34;&gt;$MINIFLUX_DATABASE&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Giving miniflux user all privileges&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&amp;gt; alter user miniflux with superuser&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Exit the postgres database&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&amp;gt; &lt;span style=&#34;color:#8caaee&#34;&gt;\q&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Exit postgres user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ &lt;span style=&#34;color:#c6d0f5;font-style:italic&#34;&gt;exit&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;h3 id=&#34;miniflux-configuration-file&#34;&gt;Miniflux configuration file&lt;/h3&gt;
&lt;p&gt;Open the miniflux configuration file in path &lt;code&gt;/etc/miniflux.conf&lt;/code&gt; and edit it like this.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# See https://miniflux.app/docs/configuration.html&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;LISTEN_ADDR&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;127.0.0.1:8080
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;DATABASE_URL&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;user&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;miniflux &lt;span style=&#34;color:#babbf1&#34;&gt;password&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;PASSWORD_HERE &lt;span style=&#34;color:#babbf1&#34;&gt;dbname&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;miniflux &lt;span style=&#34;color:#babbf1&#34;&gt;sslmode&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;disable
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#babbf1&#34;&gt;RUN_MIGRATIONS&lt;/span&gt;&lt;span style=&#34;color:#99d1db&#34;&gt;=&lt;/span&gt;1
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;h3 id=&#34;migrating-the-database-and-removing-superuser-privileges-in-postgres&#34;&gt;Migrating the database and removing superuser privileges in postgres&lt;/h3&gt;
&lt;p&gt;Now we will migrate the database and remove unneded superuser privileges, since it is reccomended in the miniflux documentation.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Migrating the database&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ miniflux -c /etc/miniflux.conf -migrate
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Creating miniflux admin user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ miniflux -c /etc/miniflux.conf -create-admin
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Restarting the systemctl service&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ systemctl restart miniflux
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Entering postgres database user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ su - postgres
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Entering miniflux database&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ psql &lt;span style=&#34;color:#babbf1&#34;&gt;$MINIFLUX_DATABASE&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Removing unneded superuser privileges from miniflux user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&amp;gt; alter user miniflux with nosuperuser&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Exit the postgres database&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&amp;gt; &lt;span style=&#34;color:#8caaee&#34;&gt;\q&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#626880;font-style:italic&#34;&gt;# Exit postgres user&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ &lt;span style=&#34;color:#c6d0f5;font-style:italic&#34;&gt;exit&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;h2 id=&#34;nginx-and-certbot-setup&#34;&gt;Nginx and certbot setup&lt;/h2&gt;
&lt;p&gt;Make sure to have a domain to use for your miniflux setup.&lt;/p&gt;
&lt;p&gt;Create and open a nginx config with path &lt;code&gt;/etc/nginx/sites-available/miniflux.conf&lt;/code&gt; and add this&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-nginx&#34; data-lang=&#34;nginx&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#ca9ee6&#34;&gt;server&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;server_name&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;your.domain.ext&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; 80&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;listen&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;[::]:80&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;location&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;/&lt;/span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;{&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_pass&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;http://127.0.0.1:8080&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_redirect&lt;/span&gt; &lt;span style=&#34;color:#e5c890&#34;&gt;off&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;Host&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$host&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;X-Real-IP&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$remote_addr&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;X-Forwarded-For&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$proxy_add_x_forwarded_for&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#ca9ee6&#34;&gt;proxy_set_header&lt;/span&gt; &lt;span style=&#34;color:#a6d189&#34;&gt;X-Forwarded-Proto&lt;/span&gt; &lt;span style=&#34;color:#babbf1&#34;&gt;$scheme&lt;/span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;;&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt; &lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;&lt;span style=&#34;color:#c6d0f5&#34;&gt;}&lt;/span&gt;
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;Now just link the config to enabled sites and restart nginx service.&lt;/p&gt;
&lt;div class=&#34;highlight&#34;&gt;&lt;pre tabindex=&#34;0&#34; style=&#34;color:#ef9f76;background-color:#303446;-moz-tab-size:4;-o-tab-size:4;tab-size:4;&#34;&gt;&lt;code class=&#34;language-bash&#34; data-lang=&#34;bash&#34;&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ ln -s /etc/nginx/sites-available/miniflux.conf /etc/nginx/sites-enabled/miniflux.conf
&lt;/span&gt;&lt;/span&gt;&lt;span style=&#34;display:flex;&#34;&gt;&lt;span&gt;$ systemctl restart nginx
&lt;/span&gt;&lt;/span&gt;&lt;/code&gt;&lt;/pre&gt;&lt;/div&gt;&lt;p&gt;To get https on your domain you just need to run &lt;code&gt;certbot --nginx&lt;/code&gt; same as in this &lt;a href=&#34;https://landchad.net/basic/certbot/&#34;&gt;tutorial&lt;/a&gt;&lt;/p&gt;
&lt;h2 id=&#34;finishing-words&#34;&gt;Finishing words&lt;/h2&gt;
&lt;p&gt;I hope that this wasn&amp;rsquo;t hard to follow and shouldn&amp;rsquo;t take hours like it took me first time I tried to set this all up.&lt;/p&gt;
</description>
</item>
</channel>
</rss>
Reference in New Issue View Git Blame Copy Permalink