Alpine Linux - User contributions [en]

Configure a Wireguard interface (wg)

2023-07-25T16:47:02Z

Jdusablon: Minor formatting

{{DISPLAYTITLE:WireGuard}}
{{TOC right}}

WireGuard has become a nearly ubiquitous vpn solution for multiple platform and is available in the community repository since Alpine 3.10. WireGuard itself is now integrated into the linux kernel since v5.6. Only the userland configuration tools are required.

== Install required packages ==

The most straightforward method, and the one recommended in WireGuard documentation, is to use <code>wg-quick</code>.

Install wireguard-tools, iptables, and sysctl:

apk add wireguard-tools-wg-quick
apk add iptables
apk add sysctl

== Create Server Keys and Interface Config ==

Create a server private and public key:

wg genkey | tee server.privatekey | wg pubkey > server.publickey

Then, we create a new config file <code>/etc/wireguard/wg0.conf</code> using these new keys:

[Interface]
Address = 192.168.2.1/24
ListenPort = 45340
PrivateKey = <server private key value> # the key from the previously generated privatekey file
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT

The PostUp and PostDown iptable rules forward traffic from the wg0 subnet (192.168.2.1/24) to the lan subnet on interface eth0.

Refer to [https://github.com/pirate/wireguard-docs#user-content-config-reference this WireGuard documentation] for information on adding peers to the config file.

Bring up the new wg0 interface:

wg-quick up wg0

To take it down, we can use <code>wg-quick down wg0</code> which will clean up the interface and remove the iptables rules.
Note: If running in a Docker container, you will need to run with <code>--cap-add=NET_ADMIN</code> to modify your interfaces.

== Enable IP Forwarding ==

With a NAT destination rule in place on your router, you should be able connect to the wireguard instance and access the host. However, if you intend for peers to be able to access external resources (including the internet), you will need to enable ip forwarding.

Edit the file <code>/etc/sysctl.conf</code> (or a <code>.conf</code> file under <code>/etc/sysctl.d/</code>) and add the following line:

net.ipv4.ip_forward = 1

Add the sysctl service to run at boot:

rc-update add sysctl

Then either reboot or run <code>sysctl -p /etc/sysctl.conf</code> to reload the settings. To ensure forwarding is turned on, run <code>sysctl -a | grep ip_forward</code> and ensure <code>net.ipv4.ip_forward</code> is set to <code>1</code>.

== Running with modloop ==

If you are running from a RAM disk, you can't modify the modloop.

You can get around it by unpacking the modloop, mounting the unpacked modules folder, then installing WireGuard.

#!/bin/sh
apk add squashfs-tools # install squashfs tools to unpack modloop
unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir
umount /.modloop # unmount existing modloop
mount /root/squash/ /.modloop/ # mount unpacked modloop
apk del wireguard-lts # uninstall previous WireGuard install
apk add wireguard-lts
apk add wireguard-tools

You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.

[[Category:Networking]]

Configure a Wireguard interface (wg)

2023-07-25T15:55:55Z

Jdusablon: Update procedure for wg now integrated in kernel, add ip_forward, add notes about ip forwarding.

{{TOC left}}

WireGuard has become a nearly ubiquitous vpn solution for multiple platform and is available in the community repository since Alpine 3.10.

WireGuard itself is now integrated into the linux kernel since v5.6. Only the userland configuration tools are required.

== Install required packages ==

The most straightforward method, and the one recommended in WireGuard documentation, is to use <code>wg-quick</code>.

Install wireguard-tools, iptables, and sysctl:

apk add wireguard-tools-wg-quick
apk add iptables
apk add sysctl

== Create Server Keys and Interface Config ==

Create a server private and public key:

wg genkey | tee server.privatekey | wg pubkey > server.publickey

Then, we create a new config file <code>/etc/wireguard/wg0.conf</code> using these new keys:

[Interface]
Address = 192.168.2.1/24
ListenPort = 45340
PrivateKey = <server private key value> # the key from the previously generated privatekey file
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE;iptables -A FORWARD -o %i -j ACCEPT
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE;iptables -D FORWARD -o %i -j ACCEPT

The PostUp and PostDown iptable rules forward traffic from the wg0 subnet (192.168.2.1/24) to the lan subnet on interface eth0.

Refer to [https://github.com/pirate/wireguard-docs#user-content-config-reference this WireGuard documentation] for information on adding peers to the config file.

Bring up the new wg0 interface:

wg-quick up wg0

To take it down, we can use <code>wg-quick down wg0</code> which will clean up the interface and remove the iptables rules.
Note: If running in a Docker container, you will need to run with <code>--cap-add=NET_ADMIN</code> to modify your interfaces.

== Enable IP Forwarding ==

With a NAT destination rule in place on your router, you should be able connect to the wireguard instance and access the host. However, if you intend for peers to be able to access external resources (including the internet), you will need to enable ip forwarding.

Edit the file <code>/etc/sysctl.conf</code> (or a <code>.conf</code> file under <code>/etc/sysctl.d/</code>) and add the following line:

net.ipv4.ip_forward = 1

Add the sysctl service to run at boot:

rc-update add sysctl

Then either reboot or run <code>sysctl -p /etc/sysctl.conf</code> to reload the settings. To ensure forwarding is turned on, run <code>sysctl -a | grep ip_forward</code> and ensure <code>net.ipv4.ip_forward</code> is set to <code>1</code>.

== Running with modloop ==

If you are running from a RAM disk, you can't modify the modloop.

You can get around it by unpacking the modloop, mounting the unpacked modules folder, then installing WireGuard.

#!/bin/sh
apk add squashfs-tools # install squashfs tools to unpack modloop
unsquashfs -d /root/squash /lib/modloop-lts # unpack modloop to root dir
umount /.modloop # unmount existing modloop
mount /root/squash/ /.modloop/ # mount unpacked modloop
apk del wireguard-lts # uninstall previous WireGuard install
apk add wireguard-lts
apk add wireguard-tools

You can repack the squash filesystem or put this script in the /etc/local.d/ path so it runs at boot-up.

[[Category:Networking]]

NZBGet

2023-07-04T08:24:03Z

Jdusablon: formatting

{{TOC right}}

= Introduction =

* This guide explains how to install the popular service [https://nzbget.net/ nzbget] on Alpine Linux. Specifically, the environment used is 3.18 running in an LXC container. This guide should still work in a standard Alpine Linux install.
* This guide sets up nzbget as a standard rc init service.
* The path {{path|/opt}} is used in this guide, however the choice of path is immaterial to the outcome, for example, {{path|/srv}} should work fine.
* This guide assumes all commands are run as root unless specified.

== Download and install nzbget ==

Fetch and install the latest nzbget install script. (If you have security concerns, nzbget code is available to inspect at [https://github.com/nzbget/nzbget github]).

<code>wget https://nzbget.net/download/nzbget-latest-bin-linux.run</code>

Run the install script.

<code>chmod +x nzbget-latest-bin-linux.run</code> 
<code>./nzbget-latest-bin-linux.run</code>

Move the nzbget directory to {{path|/opt}}}

<code>mv nzbget /opt/</code>

= Create nzbget service=

Create the nzbget init file:

<code>vi /etc/init.d/nzbget</code>

With the following content:

<pre>
#!/sbin/openrc-run

depend() {
need net
}

start() {
/opt/nzbget/nzbget -D
}

stop() {
/opt/nzbget/nzbget -Q
}
</pre>

Notice that the commands <code>/opt/nzbget/nzbget -D</code> and <code>/opt/nzbget/nzbget -Q</code> are used to cleanly start and stop the service.

Add the service to rc init:

<code>rc-update add nzbget</code>

Start the service:

<code>rc-service nzb start</code>

== Notes ==

* At this point, you should be able to reach nzbget at '''http://<YOURIP>:6789'''. You should be able to start and stop the nzbget service and the service should start after a system restart/reboot:

<code>rc-service nzb start</code> 
<code>rc-service nzb stop</code>

* Any further configs can be set using the webgui or in {{path|/opt/nzbget/nzbget.conf}}.
* Of note is the line in {{path|/opt/nzbget/nzbget.conf}}:

<code>DaemonUsername=root</code>

This allows the service to start and run as a specific user, which is a common setup if nzbget is used in conjunction with other media managers and shared storage. Note that any working directories specified in the settings will require their permissions updated to work correctly.
* nzbget is quite descriptive in its logs. Check nzbget's '''Messages''' section for errors, including permissions and paths.

== Updating nzbget ==

As of version 21.2, the certificate that ships with nzbget for updating from nzbget.net is expired and updates will consequently fail until it is updated. Fortunately, this can be rectified:

Stop the nzbget service:

<code>rc-service nzbget stop</code>

If you run the nzbget service under any other user than root, change this back to root temporarily for the update in {{path|/opt/nzbget/nzbget.conf}}:

<code>DaemonUsername=root</code>

Fetch the new and valid certificate:

<code>curl --remote-name --time-cond cacert.pem https://nzbget.net/info/cacert.pem</code>

Move the new certificate to the correct path:

<code>mv cacert.pem /opt/nzbget/cacert.pem</code>

Start the nzbget service:

<code>rc-service nzbget start</code>

Navigate to your instance of nzbget, Settings, System, Update NZBGet:

[[File:2023-07-04 01-07.png|thumb|left|nzbget update screenshot]]
 

If required, stop the nzbget service again and revert the DaemonUsername to its normal value in {{path|/opt/nzbget/nzbget.conf}}:

<code>rc-service nzbget stop</code> 
<code>DaemonUsername=root</code>

and start the service again:

<code>rc-service nzbget start</code>

[[category:Networking]]

NZBGet

2023-07-04T08:20:15Z

Jdusablon: Initial page setup for nzbget install under Alpine Linux 3.18

{{TOC right}}

= Introduction =

* This guide explains how to install the popular service [https://nzbget.net/ nzbget] on Alpine Linux. Specifically, the environment used is 3.18 running in an LXC container. This guide should still work in a standard Alpine Linux install.
* This guide sets up nzbget as a standard rc init service.
* The path {{path|/opt}} is used in this guide, however the choice of path is immaterial to the outcome, for example, {{path|/srv}} should work fine.
* This guide assumes all commands are run as root unless specified.

== Download and install nzbget ==

Fetch and install the latest nzbget install script. (If you have security concerns, nzbget code is available to inspect at [https://github.com/nzbget/nzbget github]).

<code>wget https://nzbget.net/download/nzbget-latest-bin-linux.run</code>

Run the install script.

<code>chmod +x nzbget-latest-bin-linux.run</code>
<code>./nzbget-latest-bin-linux.run</code>

Move the nzbget directory to {{path|/opt}}}

<code>mv nzbget /opt/</code>

= Create nzbget service=

Create the nzbget init file:

<code>vi /etc/init.d/nzbget</code>

With the following content:

<pre>
#!/sbin/openrc-run

depend() {
need net
}

start() {
/opt/nzbget/nzbget -D
}

stop() {
/opt/nzbget/nzbget -Q
}
</pre>

Notice that the commands <code>/opt/nzbget/nzbget -D</code> and <code>/opt/nzbget/nzbget -Q</code> are used to cleanly start and stop the service.

Add the service to rc init:

<code>rc-update add nzbget</code>

Start the service:

<code>rc-service nzb start</code>

== Notes ==

* At this point, you should be able to reach nzbget at '''http://<YOURIP>:6789'''. You should be able to start and stop the nzbget service and the service should start after a system restart/reboot:

<code>rc-service nzb start</code>
<code>rc-service nzb stop</code>

* Any further configs can be set using the webgui or in /opt/nzbget/nzbget.conf.
* Of note is the line

<code>DaemonUsername=root</code>

This allows the service to start and run as a specific user, which is a common setup if nzbget is used in conjunction with other media managers and shared storage. Note that any working directories specified in the settings will require their permissions updated to work correctly.
* nzbget is quite descriptive in its logs. Check nzbget's '''Messages''' section for errors, including permissions and paths.

== Updating nzbget ==

As of version 21.2, the certificate that ships with nzbget for updating from nzbget.net is expired and updates will consequently fail until it is updated. Fortunately, this can be rectified:

Stop the nzbget service:

<code>rc-service nzbget stop</code>

If you run the nzbget service under any other user than root, change this back to root temporarily for the update in {{{path|/opt/nzbget/nzbget.conf}}:

<code>DaemonUsername=root</code>

Fetch the new and valid certificate:

<code>curl --remote-name --time-cond cacert.pem https://nzbget.net/info/cacert.pem</code>

Move the new certificate to the correct path:

<code>mv cacert.pem /opt/nzbget/cacert.pem</code>

Start the nzbget service:

<code>rc-service nzbget start</code>

Navigate to your instance of nzbget, Settings, System, Update NZBGet:

[[File:2023-07-04 01-07.png|thumb|left|nzbget update screenshot]]
 

If required, stop the nzbget service again and revert the DaemonUsername to its normal value in {{path|/opt/nzbget/nzbget.conf}}:

<code>rc-service nzbget stop</code> 
<code>DaemonUsername=root</code>

and start the service again:

<code>rc-service nzbget start</code>

[[category:Networking]]

File:2023-07-04 01-07.png

2023-07-04T08:08:29Z

Jdusablon:

nzbget update screenshot

UniFi Controller

2023-07-04T06:41:58Z

Jdusablon: Add warning about the effective deprecation of MongoDB on Alpine Linux >v.3.9

{{TOC right}}

= '''''Notice''''' =

The Ubiquiti Unifi controller linux self-contained java image relies on MongoDB, and MongoDB has been removed from alpine linux packages after version 3.9 due to SPL license changes. MongoDB can technically be installed by adding Alpine Linux 3.9 repositories and installing mongodb and yaml-cpp=0.6.2-r2, however this solution requires pinning yaml-cpp to version 0.6.2, which is likely to cause issues with any other packages relying on yaml parsing using yaml-cpp.

= Introduction =

This guide explains how to install the generic Unix UniFi Controller, as available from [http://www.ui.com/ Ubiquiti Networks]. At the time of writing this, a native Alpine Linux package is not available.

Furthermore, this guide uses the incredibly reliable and efficient [http://www.skarnet.org/software/s6/ s6] supervision suite to start and control the UniFi Controller.

A summarized schematic of what will be installed on the filesystem.

The choice of {{path|/srv}} for the UniFi Controller's root directory is based on the fact that it contains both run-time and configuration data, so installing to {{path|/usr/local}}, {{path|/opt}} or {{path|/home}} didn't seem appropriate. Feel free to adjust the steps below, replacing {{path|/srv/unifi}} with wherever you would prefer to install the UniFi Controller software.

<pre>
/
`--etc
|-- unifi
| `-- log
|-- srv
| `-- unifi
| |-- bin
| |-- conf
| |-- data
| |-- dl
| |-- lib
| |-- logs
| |-- run
| `-- webapps
|-- run
| `-- openrc
| `-- s6-scan
| `-- unifi --> /etc/unifi
`-- var
`-- log
`-- unifi
</pre>

= Prerequisite Packages =

== OpenJDK 8 JRE ==

Install <code>openjdk8-jre</code> from the community repository.

Edit <code>/etc/apk/repositories</code> and uncomment the appropriate community repository for your Alpine version:

<code><nowiki>http://host.name/alpine_version/community</nowiki></code>

Update the package cache.

<code>apk update</code>

Install the package.

<code>apk add openjdk8-jre</code>

== MongoDB ==

Install MongoDB

<code>apk add mongodb</code>

== s6 ==

Install [http://www.skarnet.org/software/s6/ s6]

<code>apk add s6</code> which is a service supervision suite, for reliably and efficiently starting, stopping and keeping services running.

The below shows a schematic process tree of how the UniFi Controller will be started and supervised by s6. The controller is written in Java, hence the Java process and it in turn, launches a dedicated instance of MongoDB to store its configuration and run-time data.

<pre>
init
`-- s6-svscan
`-- s6-supervise
|-- s6-log
`-- java
`-- mongod
</pre>

= Install UniFi Controller =

Create the <code>unifi</code> user and group.

<code>adduser -D -H -h /srv/unifi unifi</code>

Change to the parent folder within which you wish to install the UniFi Controller.

<code>cd /srv</code>

Download the generic unix archive of the <code>VERSION</code> you wish to install.

<code>wget http://www.ubnt.com/downloads/unifi/VERSION/UniFi.unix.zip</code>

Unpack the archive.

<code>unzip UniFi.unix.zip</code>

Rename the unpacked directory.

<code>mv UniFi unifi</code>

Change ownership.

<code>chown -R unifi:unifi unifi</code>

Lock down permissions.

<code>chmod o-rwx unifi</code>

Change into the UniFi bin directory.

<code>cd /srv/unifi/bin</code>

Remove the existing file.

<code>rm mongod</code>

Create a symlink to <code>/usr/bin/mongod</code>

<code>ln -s /usr/bin/mongod</code>

= Configure Service Management =

== Create UniFi Service Directory and Files ==

Create an s6 service directory for UniFi.

<code>mkdir -p /etc/unifi/log</code>

Add the <code>run</code> script, using your favourite editor.

<code>vim /etc/unifi/run</code>

Copy and paste the following into it.

<pre>
#!/bin/ash

user='unifi'
group='unifi'

exec 2>&1

base='/srv/unifi'

if [ -d $base ]; then
cd $base
chown -R $user:$group .
version=`head -1 webapps/ROOT/app-unifi/.version`
echo "Starting UniFi Controller $version"
exec s6-setuidgid $user java -jar lib/ace.jar start
else
echo "Missing $base ... aborting"
touch down
fi
</pre>

Ensure that the <code>run</code> script is executable:

<code>chmod 755 /etc/unifi/run</code>

Add the <code>log/run</code> script, using your favourite editor.

<code>vim /etc/unifi/log/run</code>

Copy and paste the following into it.

<pre>
#!/bin/ash

log_user='log'

exec s6-setuidgid $log_user s6-log -b n20 s1000000 t /var/log/unifi
</pre>

Ensure that the log/run script is executable:

<code>chmod 755 /etc/unifi/log/run</code>

== Create log User and Directory ==

Create the <code>log</code> user and group.

<code>adduser -D -H -h /var/log log</code>

Create the <code>/var/log/unifi</code> directory

<code>mkdir -p /var/log/unifi</code>

Update the directory ownership.

<code>chown log:log /var/log/unifi</code>

Lock down the permissions.

<code>chmod 750 /var/log/unifi</code>

== Create the OpenRC Service Script ==

Open the script file using your favourite editor.

<code>vim /etc/init.d/unifi</code>

Paste the following into it.

<pre>
#!/sbin/openrc-run

name="unifi"
supervisor=s6
s6_service_path="${RC_SVCDIR}/s6-scan/${name}"

depend() {
need net s6-svscan
after firewall
}

start_pre() {
if [ ! -L "${RC_SVCDIR}/s6-scan/${name}" ]; then
ln -s "/etc/${name}" "${RC_SVCDIR}/s6-scan/${name}"
fi
}
</pre>

Ensure that the script is executable.

<code>chmod 755 /etc/init.d/unifi</code>

== Start the UniFi Controller Service ==

<code>rc-service unifi start</code>

== Configure the UniFi Controller Service to start on boot ==

<code>rc-update add unifi boot</code>

= Simple Backup Script =

Create <code>/usr/local/bin/unifi-backup</code> using your favourite editor.

'''Note:''' This script assumes the use of s6-svc to control unifi. I will modify it in time, to use rc-service instead.

Paste the following into the file.

<pre>
#!/bin/ash

conf_dir='/etc/unifi'
backup_dir='/srv/backup/unifi'
service_dir='/run/openrc/s6-scan/unifi'

start_state='down'

if s6-svok $service_dir; then
if s6-svstat -o up,ready $service_dir | grep -q true; then
echo 'Stopping the UniFi Controller'
start_state='up'
s6-svc -d $service_dir
sleep 3
fi
else
echo 'Warning: The UniFi Controller is not supervised'
exit 1
fi

if s6-svstat -o up $service_dir | grep -q false; then
echo 'Success: The UniFi Controller was stopped'
else
echo 'Error: The UniFi Controller is still running'
exit 1
fi

stamp=`date +%Y-%m-%d_%H%M%S`

mkdir -p $backup_dir
cd $backup_dir
mkdir "data-$stamp"

echo "Backing up to /srv/backup/unifi/data-$stamp.tar.gz"

if rsync -az /srv/unifi/data/ "data-$stamp"; then
echo '* rsync succeeded'
if tar czf "data-$stamp.tar.gz" "data-$stamp"; then
echo '* tar succeeded'
rm -rf "data-$stamp"
echo 'Backup succeeded'
else
echo 'Backup failed: tar failed'
exit 1
fi
fi

if [ "$start_state" == 'up' ]; then
echo 'Starting the UniFi Controller'
s6-svc -u $service_dir
sleep 5
s6-svstat $service_dir
fi
</pre>

[[category:Networking]]

Setting up Transmission (bittorrent) with Clutch WebUI

2023-05-25T19:51:57Z

Jdusablon: Corrected install package name

== Introduction ==

This document will show you how you can setup Transmission BitTorrent client on Alpine Linux and control it with a nice HTTP web-interface. I assume that you know the basics about Alpine Linux (package management and internals) and you have enough storage available to store your downloaded media (ie USB hard-drive) and of course a working internet connection.

== Setting up Transmission ==

Lets install it:

{{Cmd|apk add transmission-daemon}}

This should install Transmission 3.0.0. After the installation is complete you should have default configuration file for init in:

/etc/conf.d/transmission-daemon

By default, transmission will run as the user "transmission". If you need to make changes, do so, and save them. You can restart transmission-daemon and see if all is working ok:

{{Cmd|rc-service transmission-daemon restart}}

To configure the transmission settings (including the download location), edit the configuration file:

/var/lib/transmission/config/settings.json

If everything is OK you should see transmission-daemon running with the following command:

{{Cmd|ps}}

If you change the download location in the settings, remember to transfer ownership to the transmission user and group.

{{Cmd|chown -R transmission:transmission <DOWNLOAD_FODLER>}}

It may also be convienent for the "root" user to be able to access the files when administering the server. An easy way to do this is to add the root user to the transmission group:

{{Cmd|addgroup root transmission}}

Lets add transmission to our system start:

{{Cmd|rc-update add transmission-daemon}}

The transmission web GUI will run on http://<IP_ADDRESS>:9091/transmission

== Saving your changes to disk ==

Now is a good time to write you changes to disk:

{{Cmd|lbu_commit device}}

[[Category:Server]]

ZoneMinder video camera security and surveillance

2023-05-12T08:18:47Z

Jdusablon:

[https://www.zoneminder.com/ ZoneMinder] usually runs with [[Apache]], but in this short how-to we use [[Lighttpd]].

==Base Install==

ZoneMinder is found in the community repositories, please enable it by following the instructions [[Repositories#Enabling_the_community_repository|here]]

Then, add the needed packages to our system

apk add zoneminder mariadb mysql-client lighttpd php8-fpm php8-pdo php8-pdo_mysql

''Note: In Alpine 3.17, php 8.1 replaces php8.0''

apk add zoneminder mariadb mysql-client lighttpd php81-fpm php81-pdo php81-pdo_mysql

===Database===

Initialize [https://www.mysql.com/ MySQL] database

/etc/init.d/mariadb setup

Start the database

/etc/init.d/mariadb start

Set root password for MySQL as instructed by MySQL setup

/usr/bin/mysqladmin -u root password 'your_secure_root_mysql_password'

You can log into MySQL as current root user with
mysql

Create a ZoneMinder MySQL database and user

mysql> create database zm;

mysql> CREATE USER zmuser@localhost IDENTIFIED BY 'your_zm_password_as_set_in_config';

mysql> grant ALL on zm.* to zmuser@localhost;

===Web Server===

We are running <code>lighttpd</code>, so let's run <code>php-fpm</code> as lighttpd user/group

vi /etc/php8/php-fpm.conf

''Note: for php 8.1''

vi /etc/php81/php-fpm.conf

Add this section to the bottom of the file:

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
; will be used.
;user = nobody
;group = nobody
user = lighttpd
group = lighttpd

Enable the php cgi fpm config in <code>lighttpd.conf</code>

vi /etc/lighttpd/lighttpd.conf

Go down to the server modules section and uncomment <code>mod_alias</code>, which is needed for the cgi-bin, and <code>mod_rewrite</code>, for the api. It should look like:

# {{{ modules
# At the very least, mod_access and mod_accesslog should be enabled.
# All other modules should only be loaded if necessary.
# NOTE: the order of modules is important.
server.modules = (
"mod_rewrite",
# "mod_redirect",
"mod_alias",
"mod_access",
# "mod_cml",
# "mod_trigger_b4_dl",
# "mod_auth",
# "mod_status",
# "mod_setenv",
# "mod_proxy",
# "mod_simple_vhost",
# "mod_evhost",
# "mod_userdir",
# "mod_deflate",
# "mod_ssi",
# "mod_usertrack",
# "mod_expire",
# "mod_secdownload",
# "mod_rrdtool",
# "mod_webdav",
"mod_accesslog"
)
# }}}

Go down to the includes section, it should look like:
# {{{ includes
include "mime-types.conf"
# uncomment for cgi support
include "mod_cgi.conf"
# uncomment for php/fastcgi support
# include "mod_fastcgi.conf"
# uncomment for php/fastcgi fpm support
include "mod_fastcgi_fpm.conf"

# }}}

In order for video streaming to work in 1.36, you'll need the following
added to /etc/lighttpd/lighttpd.conf:
server.stream-response-body = 1

In lighttpd.conf for the API, we will want to redirect any api+ requests to cakephp. Thus, add:
url.rewrite = (
"^/zm/api(.+)$" => "/zm/api/index.php"
)

Edit lighttpd cgi config and add old style cgi support by adding to cgi.assign

vi /etc/lighttpd/mod_cgi.conf

which should look like

cgi.assign = (
"" => "",
".pl" => "/usr/bin/perl",
".cgi" => "/usr/bin/perl"
)

Also add the following to alias.url in mod_cgi.conf so that it looks like

alias.url = (
"/cgi-bin/" => var.basedir + "/cgi-bin/",
"/zm/api" => "/usr/share/webapps/zoneminder/htdocs/api/app/webroot/",
"/zm/" => "/usr/share/webapps/zoneminder/htdocs/"
)

Remove the symlink in /var/www/localhost/htdocs (we will be using the alias, not the symlink).
unlink /var/www/localhost/htdocs/zm

Start php-fpm

/etc/init.d/php-fpm8 start

''Note:'' for php-fpm8, use the follwing command:

/etc/init.d/php-fpm81 start

Start lighttpd

/etc/init.d/lighttpd start

===Zoneminder===

Set the MySQL hostname, username, password.

Change the ZoneMinder user (<code>ZM_WEB_USER</code>) and group (<code>ZM_WEB_GROUP</code>) to lighttpd

And set <code>ZM_SERVER_HOST</code> to your ZoneMinder hostname/ipaddress

vi /etc/zm/zm.conf

Which should look like:

# Username and group that web daemon (httpd/apache) runs as
ZM_WEB_USER=lighttpd
ZM_WEB_GROUP=lighttpd
ZM_PATH_DATA=/usr/share/zoneminder

# ZoneMinder database type: so far only mysql is supported
ZM_DB_TYPE=mysql

# ZoneMinder database hostname or ip address
ZM_DB_HOST=localhost

# ZoneMinder database name
ZM_DB_NAME=zm

# ZoneMinder database user
ZM_DB_USER=zmuser

# ZoneMinder database password
ZM_DB_PASS=your_zm_password_as_set_in_config

# Host of this machine
ZM_SERVER_HOST=yourserver

Change ownership of <code>zm.conf</code> to <code>lighttpd</code>

chown lighttpd.lighttpd /etc/zm/zm.conf

Zoneminder will create a cache in <code>/var/cache/zoneminder</code> which isn't created by default. Create this directory and allow lighttpd access to it. Note that if you are using a diskless install, you must lbu add /var/cache/zoneminder.

mkdir /var/cache/zoneminder
chown lighttpd.lighttpd /var/cache/zoneminder

Initialize the ZoneMinder database

/etc/init.d/zoneminder setup

Start ZoneMinder

/etc/init.d/zoneminder start

Profit!

===Conclusion===

To access ZoneMinder, browse to <nowiki>http://yourserver/zm/</nowiki>

To test the API, run
curl -X GET http://yourserver/zm/api/host/getVersion.json
(This assumes you aren't using authentication.)

To make it start automatically on boot:

rc-update add lighttpd default
rc-update add mariadb default
rc-update add php-fpm8 default
rc-update add zoneminder default

== Added notes to work with Nginx ==
Later to add some notes about running via nginx

==Related Links==
* https://wiki.alpinelinux.org/wiki/Raspberry_Pi_3_-_Browser_Client - Kiosk to watch Streams

[[Category:Software]]
[[Category:Security]]

ZoneMinder video camera security and surveillance

2023-05-10T08:17:50Z

Jdusablon: Update php conf line for php8.1

[https://www.zoneminder.com/ ZoneMinder] usually runs with [[Apache]], but in this short how-to we use [[Lighttpd]].

==Base Install==

ZoneMinder is found in the community repositories, please enable it by following the instructions [[Repositories#Enabling_the_community_repository|here]]

Then, add the needed packages to our system

apk add zoneminder mariadb mysql-client lighttpd php8-fpm php8-pdo php8-pdo_mysql

''Note: In Alpine 3.17, php 8.1 replaces php8.0''

apk add zoneminder mariadb mysql-client lighttpd php81-fpm php81-pdo php81-pdo_mysql

===Database===

Initialize [https://www.mysql.com/ MySQL] database

/etc/init.d/mariadb setup

Start the database

/etc/init.d/mariadb start

Set root password for MySQL as instructed by MySQL setup

/usr/bin/mysqladmin -u root password 'your_secure_root_mysql_password'

You can log into MySQL as current root user with
mysql

Create a ZoneMinder MySQL database and user

mysql> create database zm;

mysql> CREATE USER zmuser@localhost IDENTIFIED BY 'your_zm_password_as_set_in_config';

mysql> grant ALL on zm.* to zmuser@localhost;

===Web Server===

We are running <code>lighttpd</code>, so let's run <code>php-fpm</code> as lighttpd user/group

vi /etc/php8/php-fpm.conf

''Note: for php 8.1''

vi /etc/php81/php-fpm.conf

Add this section to the bottom of the file:

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
; will be used.
;user = nobody
;group = nobody
user = lighttpd
group = lighttpd

Enable the php cgi fpm config in <code>lighttpd.conf</code>

vi /etc/lighttpd/lighttpd.conf

Go down to the server modules section and uncomment <code>mod_alias</code>, which is needed for the cgi-bin, and <code>mod_rewrite</code>, for the api. It should look like:

# {{{ modules
# At the very least, mod_access and mod_accesslog should be enabled.
# All other modules should only be loaded if necessary.
# NOTE: the order of modules is important.
server.modules = (
"mod_rewrite",
# "mod_redirect",
"mod_alias",
"mod_access",
# "mod_cml",
# "mod_trigger_b4_dl",
# "mod_auth",
# "mod_status",
# "mod_setenv",
# "mod_proxy",
# "mod_simple_vhost",
# "mod_evhost",
# "mod_userdir",
# "mod_deflate",
# "mod_ssi",
# "mod_usertrack",
# "mod_expire",
# "mod_secdownload",
# "mod_rrdtool",
# "mod_webdav",
"mod_accesslog"
)
# }}}

Go down to the includes section, it should look like:
# {{{ includes
include "mime-types.conf"
# uncomment for cgi support
include "mod_cgi.conf"
# uncomment for php/fastcgi support
# include "mod_fastcgi.conf"
# uncomment for php/fastcgi fpm support
include "mod_fastcgi_fpm.conf"

# }}}

In order for video streaming to work in 1.36, you'll need the following
added to /etc/lighttpd/lighttpd.conf:
server.stream-response-body = 1

In lighttpd.conf for the API, we will want to redirect any api+ requests to cakephp. Thus, add:
url.rewrite = (
"^/zm/api(.+)$" => "/zm/api/index.php"
)

Edit lighttpd cgi config and add old style cgi support by adding to cgi.assign

vi /etc/lighttpd/mod_cgi.conf

which should look like

cgi.assign = (
"" => "",
".pl" => "/usr/bin/perl",
".cgi" => "/usr/bin/perl"
)

Also add the following to alias.url in mod_cgi.conf so that it looks like

alias.url = (
"/cgi-bin/" => var.basedir + "/cgi-bin/",
"/zm/api" => "/usr/share/webapps/zoneminder/htdocs/api/app/webroot/",
"/zm/" => "/usr/share/webapps/zoneminder/htdocs/"
)

Remove the symlink in /var/www/localhost/htdocs (we will be using the alias, not the symlink).
unlink /var/www/localhost/htdocs/zm

Start php-fpm

/etc/init.d/php-fpm8 start

Start lighttpd

/etc/init.d/lighttpd start

===Zoneminder===

Set the MySQL hostname, username, password.

Change the ZoneMinder user (<code>ZM_WEB_USER</code>) and group (<code>ZM_WEB_GROUP</code>) to lighttpd

And set <code>ZM_SERVER_HOST</code> to your ZoneMinder hostname/ipaddress

vi /etc/zm/zm.conf

Which should look like:

# Username and group that web daemon (httpd/apache) runs as
ZM_WEB_USER=lighttpd
ZM_WEB_GROUP=lighttpd
ZM_PATH_DATA=/usr/share/zoneminder

# ZoneMinder database type: so far only mysql is supported
ZM_DB_TYPE=mysql

# ZoneMinder database hostname or ip address
ZM_DB_HOST=localhost

# ZoneMinder database name
ZM_DB_NAME=zm

# ZoneMinder database user
ZM_DB_USER=zmuser

# ZoneMinder database password
ZM_DB_PASS=your_zm_password_as_set_in_config

# Host of this machine
ZM_SERVER_HOST=yourserver

Change ownership of <code>zm.conf</code> to <code>lighttpd</code>

chown lighttpd.lighttpd /etc/zm/zm.conf

Zoneminder will create a cache in <code>/var/cache/zoneminder</code> which isn't created by default. Create this directory and allow lighttpd access to it. Note that if you are using a diskless install, you must lbu add /var/cache/zoneminder.

mkdir /var/cache/zoneminder
chown lighttpd.lighttpd /var/cache/zoneminder

Initialize the ZoneMinder database

/etc/init.d/zoneminder setup

Start ZoneMinder

/etc/init.d/zoneminder start

Profit!

===Conclusion===

To access ZoneMinder, browse to <nowiki>http://yourserver/zm/</nowiki>

To test the API, run
curl -X GET http://yourserver/zm/api/host/getVersion.json
(This assumes you aren't using authentication.)

To make it start automatically on boot:

rc-update add lighttpd default
rc-update add mariadb default
rc-update add php-fpm8 default
rc-update add zoneminder default

== Added notes to work with Nginx ==
Later to add some notes about running via nginx

==Related Links==
* https://wiki.alpinelinux.org/wiki/Raspberry_Pi_3_-_Browser_Client - Kiosk to watch Streams

[[Category:Software]]
[[Category:Security]]

ZoneMinder video camera security and surveillance

2023-05-10T08:02:13Z

Jdusablon: Add package requirements for Alpine 3.17

[https://www.zoneminder.com/ ZoneMinder] usually runs with [[Apache]], but in this short how-to we use [[Lighttpd]].

==Base Install==

ZoneMinder is found in the community repositories, please enable it by following the instructions [[Repositories#Enabling_the_community_repository|here]]

Then, add the needed packages to our system

apk add zoneminder mariadb mysql-client lighttpd php8-fpm php8-pdo php8-pdo_mysql

''Note: In Alpine 3.17, php 8.1 replaces php8.0''

apk add zoneminder mariadb mysql-client lighttpd php81-fpm php81-pdo php81-pdo_mysql

===Database===

Initialize [https://www.mysql.com/ MySQL] database

/etc/init.d/mariadb setup

Start the database

/etc/init.d/mariadb start

Set root password for MySQL as instructed by MySQL setup

/usr/bin/mysqladmin -u root password 'your_secure_root_mysql_password'

You can log into MySQL as current root user with
mysql

Create a ZoneMinder MySQL database and user

mysql> create database zm;

mysql> CREATE USER zmuser@localhost IDENTIFIED BY 'your_zm_password_as_set_in_config';

mysql> grant ALL on zm.* to zmuser@localhost;

===Web Server===

We are running <code>lighttpd</code>, so let's run <code>php-fpm</code> as lighttpd user/group

vi /etc/php8/php-fpm.conf

Add this section to the bottom of the file:

; Unix user/group of processes
; Note: The user is mandatory. If the group is not set, the default user's group
; will be used.
;user = nobody
;group = nobody
user = lighttpd
group = lighttpd

Enable the php cgi fpm config in <code>lighttpd.conf</code>

vi /etc/lighttpd/lighttpd.conf

Go down to the server modules section and uncomment <code>mod_alias</code>, which is needed for the cgi-bin, and <code>mod_rewrite</code>, for the api. It should look like:

# {{{ modules
# At the very least, mod_access and mod_accesslog should be enabled.
# All other modules should only be loaded if necessary.
# NOTE: the order of modules is important.
server.modules = (
"mod_rewrite",
# "mod_redirect",
"mod_alias",
"mod_access",
# "mod_cml",
# "mod_trigger_b4_dl",
# "mod_auth",
# "mod_status",
# "mod_setenv",
# "mod_proxy",
# "mod_simple_vhost",
# "mod_evhost",
# "mod_userdir",
# "mod_deflate",
# "mod_ssi",
# "mod_usertrack",
# "mod_expire",
# "mod_secdownload",
# "mod_rrdtool",
# "mod_webdav",
"mod_accesslog"
)
# }}}

Go down to the includes section, it should look like:
# {{{ includes
include "mime-types.conf"
# uncomment for cgi support
include "mod_cgi.conf"
# uncomment for php/fastcgi support
# include "mod_fastcgi.conf"
# uncomment for php/fastcgi fpm support
include "mod_fastcgi_fpm.conf"

# }}}

In order for video streaming to work in 1.36, you'll need the following
added to /etc/lighttpd/lighttpd.conf:
server.stream-response-body = 1

In lighttpd.conf for the API, we will want to redirect any api+ requests to cakephp. Thus, add:
url.rewrite = (
"^/zm/api(.+)$" => "/zm/api/index.php"
)

Edit lighttpd cgi config and add old style cgi support by adding to cgi.assign

vi /etc/lighttpd/mod_cgi.conf

which should look like

cgi.assign = (
"" => "",
".pl" => "/usr/bin/perl",
".cgi" => "/usr/bin/perl"
)

Also add the following to alias.url in mod_cgi.conf so that it looks like

alias.url = (
"/cgi-bin/" => var.basedir + "/cgi-bin/",
"/zm/api" => "/usr/share/webapps/zoneminder/htdocs/api/app/webroot/",
"/zm/" => "/usr/share/webapps/zoneminder/htdocs/"
)

Remove the symlink in /var/www/localhost/htdocs (we will be using the alias, not the symlink).
unlink /var/www/localhost/htdocs/zm

Start php-fpm

/etc/init.d/php-fpm8 start

Start lighttpd

/etc/init.d/lighttpd start

===Zoneminder===

Set the MySQL hostname, username, password.

Change the ZoneMinder user (<code>ZM_WEB_USER</code>) and group (<code>ZM_WEB_GROUP</code>) to lighttpd

And set <code>ZM_SERVER_HOST</code> to your ZoneMinder hostname/ipaddress

vi /etc/zm/zm.conf

Which should look like:

# Username and group that web daemon (httpd/apache) runs as
ZM_WEB_USER=lighttpd
ZM_WEB_GROUP=lighttpd
ZM_PATH_DATA=/usr/share/zoneminder

# ZoneMinder database type: so far only mysql is supported
ZM_DB_TYPE=mysql

# ZoneMinder database hostname or ip address
ZM_DB_HOST=localhost

# ZoneMinder database name
ZM_DB_NAME=zm

# ZoneMinder database user
ZM_DB_USER=zmuser

# ZoneMinder database password
ZM_DB_PASS=your_zm_password_as_set_in_config

# Host of this machine
ZM_SERVER_HOST=yourserver

Change ownership of <code>zm.conf</code> to <code>lighttpd</code>

chown lighttpd.lighttpd /etc/zm/zm.conf

Zoneminder will create a cache in <code>/var/cache/zoneminder</code> which isn't created by default. Create this directory and allow lighttpd access to it. Note that if you are using a diskless install, you must lbu add /var/cache/zoneminder.

mkdir /var/cache/zoneminder
chown lighttpd.lighttpd /var/cache/zoneminder

Initialize the ZoneMinder database

/etc/init.d/zoneminder setup

Start ZoneMinder

/etc/init.d/zoneminder start

Profit!

===Conclusion===

To access ZoneMinder, browse to <nowiki>http://yourserver/zm/</nowiki>

To test the API, run
curl -X GET http://yourserver/zm/api/host/getVersion.json
(This assumes you aren't using authentication.)

To make it start automatically on boot:

rc-update add lighttpd default
rc-update add mariadb default
rc-update add php-fpm8 default
rc-update add zoneminder default

== Added notes to work with Nginx ==
Later to add some notes about running via nginx

==Related Links==
* https://wiki.alpinelinux.org/wiki/Raspberry_Pi_3_-_Browser_Client - Kiosk to watch Streams

[[Category:Software]]
[[Category:Security]]