summaryrefslogtreecommitdiff
path: root/hosts/denpa
diff options
context:
space:
mode:
Diffstat (limited to 'hosts/denpa')
-rw-r--r--hosts/denpa/cgit/cgitrc33
-rw-r--r--hosts/denpa/cgit/custom.css285
-rwxr-xr-xhosts/denpa/cgit/email-libravatar.py38
-rw-r--r--hosts/denpa/cgit/readme_in_summary.diff152
-rw-r--r--hosts/denpa/fail2ban/fail2ban.d/denpa.local2
-rw-r--r--hosts/denpa/fail2ban/jail.d/denpa.local38
-rwxr-xr-xhosts/denpa/init.d/fcgiwrap235
-rwxr-xr-xhosts/denpa/nftables.conf23
-rw-r--r--hosts/denpa/nginx/akoncity76
-rwxr-xr-xhosts/denpa/scripts/fail2ban-ban-ip3
-rwxr-xr-xhosts/denpa/scripts/fail2ban-unban-ip3
-rwxr-xr-xhosts/denpa/scripts/mail-stats2
-rw-r--r--hosts/denpa/systemd/fcgiwrap.service14
-rw-r--r--hosts/denpa/wg-rod.conf.in10
14 files changed, 914 insertions, 0 deletions
diff --git a/hosts/denpa/cgit/cgitrc b/hosts/denpa/cgit/cgitrc
new file mode 100644
index 0000000..31e23d8
--- /dev/null
+++ b/hosts/denpa/cgit/cgitrc
@@ -0,0 +1,33 @@
+enable-http-clone=0
+enable-index-owner=0
+enable-commit-graph=1
+repository-sort=age
+branch-sort=age
+
+logo=
+css=/custom.css
+
+source-filter=/usr/local/lib/cgit/filters/syntax-highlighting.py
+email-filter=/usr/local/lib/cgit/filters/email-libravatar.py
+
+remove-suffix=1
+
+virtual-root=/
+clone-url=https://git.akon.city/$CGIT_REPO_URL
+
+root-title=Akon City Software Inc.
+root-desc=
+
+snapshots=tar.gz tar.bz2 zip
+
+mimetype.gif=image/gif
+mimetype.html=text/html
+mimetype.jpg=image/jpeg
+mimetype.jpeg=image/jpeg
+mimetype.pdf=application/pdf
+mimetype.png=image/png
+mimetype.svg=image/svg+xml
+
+readme=./README.html
+
+scan-path=/mnt/git
diff --git a/hosts/denpa/cgit/custom.css b/hosts/denpa/cgit/custom.css
new file mode 100644
index 0000000..d55d37f
--- /dev/null
+++ b/hosts/denpa/cgit/custom.css
@@ -0,0 +1,285 @@
+/* This Source Code Form is subject to the terms of the Mozilla Public
+ * License, v. 2.0. If a copy of the MPL was not distributed with this
+ * file, You can obtain one at https://mozilla.org/MPL/2.0/. */
+
+@import url("cgit.css");
+
+/*
+div#cgit a.tag-annotated-deco {
+ color: #000;
+ margin: 0px 0.5em;
+ padding: 0px 0.25em;
+ border: solid 1px #777700;
+ background: linear-gradient(90deg, rgba(186,148,62,1) 0%, rgba(236,172,32,1) 30%, rgba(186,148,62,1) 49%, rgba(249,244,180,1) 70%);
+ background: linear-gradient(90deg, rgba(186,148,62,1) 0%, rgba(236,172,32,1) 20%, rgba(186,148,62,1) 39%, rgba(249,244,180,1) 50%, rgba(186,148,62,1) 60%, rgba(236,172,32,1) 80%, rgba(186,148,62,1) 100%);
+ animation: shine 3s infinite;
+ background-size: 200%;
+ background-position: left;
+ background-repeat: repeat-x;
+ -webkit-animation-timing-function: linear;
+ -webkit-animation-duration: 9s;
+}
+
+@keyframes shine {
+ to{background-position: 200%}
+}
+
+div#cgit span.age-hours {
+ color: #080;
+}
+
+div#cgit span.age-days {
+ color: #040;
+}
+
+div#cgit span.age-weeks {
+ color: #444;
+}
+
+div#cgit span.age-months {
+ color: #888;
+}
+
+div#cgit span.age-years {
+ color: #bbb;
+}
+
+div#cgit span.insertions {
+ color: #080;
+}
+
+div#cgit span.deletions {
+ color: #800;
+}
+*/
+
+:root {
+ --background: #fef9fa;
+ --highlight1: 181, 57, 57; /* #b53939 */
+ --highlight2: 130, 137, 69; /* #828945 */
+ --highlight3: 221, 182, 123; /* #ddb67b */
+ --highlight4: 66, 49, 82; /* #423152 */
+ --color1: rgba(var(--highlight1), 0.045);
+ --color2: rgba(var(--highlight1), 0.09);
+ --color3: #fef9fa;
+ --black: #13090c;
+ --gray0: #393232;
+ --gray1: #777;
+ --gray2: #aaa;
+ --gray: 119, 119, 119; /* #777777 */
+}
+
+* {
+ line-height: 1.4em;
+}
+
+body {
+ background-color: var(--background);
+}
+
+a:hover {
+ color: rgb(var(--highlight1)) !important;
+}
+
+div#cgit {
+ margin: auto;
+ font-family: monospace;
+ font-size: 11pt;
+ -moz-tab-size: 4;
+ tab-size: 4;
+ background: var(--background);
+ color: var(--gray0);
+}
+
+div#cgit table.tabs {
+ border-bottom: solid 2px var(--color1);
+}
+
+div#cgit table.tabs td {
+ padding: 2px 0.75em;
+}
+
+div#cgit table.tabs td a {
+ padding: 1px 0.75em;
+ color: var(--gray1);
+ font-size: 110%;
+}
+
+div#cgit table.tabs td a.active {
+ color: var(--gray0);
+ background: var(--color1);
+ border-bottom: solid 2px var(--gray2);
+}
+
+div#cgit table#header td.main {
+ font-size: 2em;
+}
+
+div#cgit table#header td.main a {
+ color: var(--gray0);
+}
+
+div#cgit table#header td.sub {
+ border-top: none;
+}
+
+div#cgit table#header td.sub.right {
+ padding-right: 1em;
+}
+
+div#cgit div.content {
+ border-bottom: none;
+ padding: 0em;
+}
+
+div#cgit table.list th a {
+ color: inherit;
+}
+
+div#cgit table.list tr:nth-child(even) {
+ background: inherit;
+}
+
+div#cgit table.list tr:nth-child(odd) {
+ background: var(--color1);
+}
+
+div#cgit table.list tr:hover {
+ background: var(--color2);
+}
+
+div#cgit table.list tr.nohover {
+ background: inherit;
+}
+
+div#cgit table.list tr.nohover:hover {
+ background: inherit;
+}
+
+div#cgit table.list tr.nohover-highlight:hover:nth-child(even) {
+ background: inherit;
+}
+
+div#cgit table.blob td.linenumbers a:target {
+ color: goldenrod;
+ text-decoration: underline;
+ outline: none;
+}
+
+div#cgit a.deco {
+ background-color: rgba(var(--highlight1), 0.65);
+ border: solid 1px var(--black);
+}
+
+div#cgit a.branch-deco {
+ background-color: rgba(var(--highlight2), 0.65);
+ border: solid 1px var(--black);
+}
+
+div#cgit a.tag-annotated-deco {
+}
+
+div#cgit div#summary {
+ max-width: 80ch;
+ margin: 0.5em;
+ overflow-wrap: break-word;
+}
+
+div#cgit table.diffstat {
+ border-collapse: collapse;
+ border: solid 1px var(--gray2);
+ background-color: var(--color3);
+}
+
+div#cgit table.diffstat td.graph td.add {
+ background-color: rgba(var(--highlight2), 0.75);
+}
+
+div#cgit table.diffstat td.graph td.rem {
+ background-color: rgba(var(--highlight1), 0.75);
+}
+
+div#cgit table.diffstat td.add a {
+ color: rgba(var(--highlight2), 0.85);
+}
+
+div#cgit table.diffstat td.del a {
+ color: rgba(var(--highlight1), 0.85);
+}
+
+div#cgit table.diffstat td.upd a {
+ color: rgba(var(--highlight3), 0.9);
+}
+
+div#cgit table.diff td div.head {
+ color: var(--gray0);
+}
+
+div#cgit table.diff td div.del {
+ color: rgba(var(--highlight1), 1.0);
+}
+
+div#cgit table.diff td div.add {
+ color: rgba(var(--highlight2), 1.0);
+}
+
+div#cgit table.diff td div.hunk {
+ color: rgba(var(--highlight3), 0.9);
+}
+
+div#cgit div.cgit-panel table {
+ border-collapse: collapse;
+ border: solid 1px var(--gray2);
+ background-color: var(--color3);
+}
+
+div#cgit input,
+div#cgit select {
+ background-color: var(--color3);
+ border: solid 1px var(--gray2);
+ border-radius: 0.25em;
+}
+
+div#cgit input.txt {
+ background-color: var(--color3);
+}
+
+div#cgit div.path {
+ margin: 0px;
+ padding: 5px 2em 2px 2em;
+ color: var(--black);
+ background-color: var(--background);
+}
+
+div#cgit a {
+ color: rgba(var(--highlight4), 1.0);
+}
+
+div#cgit a.permalink {
+ color: inherit;
+}
+
+/* https://git.zx2c4.com/cgit.css:905 */
+div#cgit span.libravatar img.onhover {
+ display: none;
+ border: 0.1em solid gray;
+ padding: 0px;
+ border-radius: 0.3em;
+ width: 12em;
+ height: 12em;
+}
+
+div#cgit span.libravatar img.inline {
+ width: 1.4em;
+ height: 1.4em;
+ margin-right: 0.2em;
+ vertical-align: bottom;
+}
+
+div#cgit span.libravatar:hover > img.onhover {
+ display: block;
+ position: absolute;
+ margin-left: 1.5em;
+ background-color: var(--background);
+ box-shadow: 0.15em 0.15em 0.4em rgba(var(--gray), 0.75);
+}
diff --git a/hosts/denpa/cgit/email-libravatar.py b/hosts/denpa/cgit/email-libravatar.py
new file mode 100755
index 0000000..045ca17
--- /dev/null
+++ b/hosts/denpa/cgit/email-libravatar.py
@@ -0,0 +1,38 @@
+#!/usr/bin/env python3
+
+# This script may be used with the email-filter or repo.email-filter settings in cgitrc.
+#
+# The following environment variables can be used to retrieve the configuration
+# of the repository for which this script is called:
+# CGIT_REPO_URL ( = repo.url setting )
+# CGIT_REPO_NAME ( = repo.name setting )
+# CGIT_REPO_PATH ( = repo.path setting )
+# CGIT_REPO_OWNER ( = repo.owner setting )
+# CGIT_REPO_DEFBRANCH ( = repo.defbranch setting )
+# CGIT_REPO_SECTION ( = section setting )
+# CGIT_REPO_CLONE_URL ( = repo.clone-url setting )
+#
+# It receives an email address on argv[1] and text on stdin. It prints
+# to stdout that text prepended by a gravatar at 10pt.
+
+import sys
+import hashlib
+import codecs
+
+email = sys.argv[1].lower().strip()
+if email[0] == "<":
+ email = email[1:]
+if email[-1] == ">":
+ email = email[0:-1]
+
+page = sys.argv[2]
+
+sys.stdin = codecs.getreader("utf-8")(sys.stdin.detach())
+sys.stdout = codecs.getwriter("utf-8")(sys.stdout.detach())
+
+md5 = hashlib.md5(email.encode()).hexdigest()
+text = sys.stdin.read().strip()
+
+baseurl = "https://seccdn.libravatar.org"
+
+print(f"<span class='libravatar'><img class='inline' src='{baseurl}/avatar/{md5}?s=32&amp;d=retro'/><img class='onhover' src='{baseurl}/avatar/{md5}?s=192&amp;d=retro'/></span>" + text)
diff --git a/hosts/denpa/cgit/readme_in_summary.diff b/hosts/denpa/cgit/readme_in_summary.diff
new file mode 100644
index 0000000..33756f9
--- /dev/null
+++ b/hosts/denpa/cgit/readme_in_summary.diff
@@ -0,0 +1,152 @@
+diff --git a/cmd.c b/cmd.c
+index 0eb75b1..be316f4 100644
+--- a/cmd.c
++++ b/cmd.c
+@@ -49,7 +49,7 @@ static void about_fn(void)
+ cgit_redirect(redirect, true);
+ free(currenturl);
+ free(redirect);
+- } else if (ctx.repo->readme.nr)
++ } else if (0)
+ cgit_print_repo_readme(ctx.qry.path);
+ else if (ctx.repo->homepage)
+ cgit_redirect(ctx.repo->homepage, false);
+diff --git a/ui-shared.c b/ui-shared.c
+index baea6f2..6b01d08 100644
+--- a/ui-shared.c
++++ b/ui-shared.c
+@@ -1078,7 +1078,7 @@ void cgit_print_pageheader(void)
+
+ html("<table class='tabs'><tr><td>\n");
+ if (ctx.env.authenticated && ctx.repo) {
+- if (ctx.repo->readme.nr)
++ if (0)
+ reporevlink("about", "about", NULL,
+ hc("about"), ctx.qry.head, NULL,
+ NULL);
+diff --git a/ui-summary.c b/ui-summary.c
+index 947812a..faf943e 100644
+--- a/ui-summary.c
++++ b/ui-summary.c
+@@ -40,31 +40,6 @@ static void print_url(const char *url)
+ html("</a></td></tr>\n");
+ }
+
+-void cgit_print_summary(void)
+-{
+- int columns = 3;
+-
+- if (ctx.repo->enable_log_filecount)
+- columns++;
+- if (ctx.repo->enable_log_linecount)
+- columns++;
+-
+- cgit_print_layout_start();
+- html("<table summary='repository info' class='list nowrap'>");
+- cgit_print_branches(ctx.cfg.summary_branches);
+- htmlf("<tr class='nohover'><td colspan='%d'>&nbsp;</td></tr>", columns);
+- cgit_print_tags(ctx.cfg.summary_tags);
+- if (ctx.cfg.summary_log > 0) {
+- htmlf("<tr class='nohover'><td colspan='%d'>&nbsp;</td></tr>", columns);
+- cgit_print_log(ctx.qry.head, 0, ctx.cfg.summary_log, NULL,
+- NULL, NULL, 0, 0, 0);
+- }
+- urls = 0;
+- cgit_add_clone_urls(print_url);
+- html("</table>");
+- cgit_print_layout_end();
+-}
+-
+ /* The caller must free the return value. */
+ static char* append_readme_path(const char *filename, const char *ref, const char *path)
+ {
+@@ -99,25 +74,11 @@ static char* append_readme_path(const char *filename, const char *ref, const cha
+ return full_path;
+ }
+
+-void cgit_print_repo_readme(const char *path)
++static void print_readme_file(const char *path)
+ {
+- char *filename, *ref, *mimetype;
++ char *filename, *ref;
+ int free_filename = 0;
+
+- mimetype = get_mimetype_for_filename(path);
+- if (mimetype && (!strncmp(mimetype, "image/", 6) || !strncmp(mimetype, "video/", 6))) {
+- ctx.page.mimetype = mimetype;
+- ctx.page.charset = NULL;
+- cgit_print_plain();
+- free(mimetype);
+- return;
+- }
+- free(mimetype);
+-
+- cgit_print_layout_start();
+- if (ctx.repo->readme.nr == 0)
+- goto done;
+-
+ filename = ctx.repo->readme.items[0].string;
+ ref = ctx.repo->readme.items[0].util;
+
+@@ -125,7 +86,7 @@ void cgit_print_repo_readme(const char *path)
+ free_filename = 1;
+ filename = append_readme_path(filename, ref, path);
+ if (!filename)
+- goto done;
++ return;
+ }
+
+ /* Print the calculated readme, either from the git repo or from the
+@@ -142,6 +103,52 @@ void cgit_print_repo_readme(const char *path)
+ html("</div>");
+ if (free_filename)
+ free(filename);
++}
++
++void cgit_print_summary(void)
++{
++ int columns = 3;
++
++ if (ctx.repo->enable_log_filecount)
++ columns++;
++ if (ctx.repo->enable_log_linecount)
++ columns++;
++
++ cgit_print_layout_start();
++ html("<table summary='repository info' class='list nowrap'>");
++ cgit_print_branches(ctx.cfg.summary_branches);
++ htmlf("<tr class='nohover'><td colspan='%d'>&nbsp;</td></tr>", columns);
++ cgit_print_tags(ctx.cfg.summary_tags);
++ if (ctx.cfg.summary_log > 0) {
++ htmlf("<tr class='nohover'><td colspan='%d'>&nbsp;</td></tr>", columns);
++ cgit_print_log(ctx.qry.head, 0, ctx.cfg.summary_log, NULL,
++ NULL, NULL, 0, 0, 0);
++ }
++ urls = 0;
++ cgit_add_clone_urls(print_url);
++ html("</table>");
++ if (ctx.repo->readme.nr)
++ print_readme_file(ctx.qry.path);
++ cgit_print_layout_end();
++}
++
++void cgit_print_repo_readme(const char *path)
++{
++ char *mimetype = get_mimetype_for_filename(path);
++ if (mimetype && (!strncmp(mimetype, "image/", 6) || !strncmp(mimetype, "video/", 6))) {
++ ctx.page.mimetype = mimetype;
++ ctx.page.charset = NULL;
++ cgit_print_plain();
++ free(mimetype);
++ return;
++ }
++ free(mimetype);
++
++ cgit_print_layout_start();
++ if (ctx.repo->readme.nr == 0)
++ goto done;
++
++ print_readme_file(path);
+
+ done:
+ cgit_print_layout_end();
diff --git a/hosts/denpa/fail2ban/fail2ban.d/denpa.local b/hosts/denpa/fail2ban/fail2ban.d/denpa.local
new file mode 100644
index 0000000..b3d98c4
--- /dev/null
+++ b/hosts/denpa/fail2ban/fail2ban.d/denpa.local
@@ -0,0 +1,2 @@
+[DEFAULT]
+allowipv6 = true
diff --git a/hosts/denpa/fail2ban/jail.d/denpa.local b/hosts/denpa/fail2ban/jail.d/denpa.local
new file mode 100644
index 0000000..70973fe
--- /dev/null
+++ b/hosts/denpa/fail2ban/jail.d/denpa.local
@@ -0,0 +1,38 @@
+[DEFAULT]
+maxretry = 4
+findtime = 60m
+bantime = 24h
+backend = systemd
+logtarget = SYSTEMD-JOURNAL
+banaction = nftables-multiport
+banaction_allports = nftables-allports
+#mta = sendmail
+#destemail = mark@akon.city
+#action = %(action_)s
+# %(mta)s-whois-matches[sender="%(sender)s", dest="%(destemail)s", chain="%(chain)s"]
+
+[postfix]
+enabled = true
+mode = aggressive
+journalmatch=_SYSTEMD_UNIT=postfix@-.service
+
+[postfix-sasl]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=postfix@-.service
+
+[sieve]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[dovecot]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=dovecot.service
+
+[nginx-limit-req]
+enabled = true
+journalmatch=_SYSTEMD_UNIT=nginx.service
+
+[sshd]
+enabled = true
+mode = aggressive
+journalmatch=_SYSTEMD_UNIT=ssh.service
diff --git a/hosts/denpa/init.d/fcgiwrap b/hosts/denpa/init.d/fcgiwrap
new file mode 100755
index 0000000..33b2b7d
--- /dev/null
+++ b/hosts/denpa/init.d/fcgiwrap
@@ -0,0 +1,235 @@
+#!/bin/sh
+### BEGIN INIT INFO
+# Provides: fcgiwrap
+# Required-Start: $remote_fs
+# Required-Stop: $remote_fs
+# Should-Start:
+# Should-Stop:
+# Default-Start: 2 3 4 5
+# Default-Stop: 0 1 6
+# Short-Description: FastCGI wrapper
+# Description: Simple server for running CGI applications over FastCGI
+### END INIT INFO
+
+PATH=/usr/local/sbin:/usr/local/bin:/sbin:/bin:/usr/sbin:/usr/bin
+
+SPAWN_FCGI="/usr/bin/spawn-fcgi"
+DAEMON="/usr/sbin/fcgiwrap"
+NAME="fcgiwrap"
+DESC="FastCGI wrapper"
+
+PIDFILE="/run/$NAME.pid"
+
+test -x $SPAWN_FCGI || exit 0
+test -x $DAEMON || exit 0
+
+# FCGI_APP Variables
+FCGI_CHILDREN="1"
+FCGI_SOCKET="/run/$NAME.socket"
+FCGI_USER="git"
+FCGI_GROUP="git"
+
+. /lib/lsb/init-functions
+
+# Default options, these can be overriden by the information
+# at /etc/default/$NAME
+DAEMON_OPTS="-f" # By default we redirect STDERR output from executed
+ # CGI through FastCGI, to disable this behaviour set
+ # DAEMON_OPTS to an empty value in the default's file
+
+ENV_VARS="PATH='$PATH'" # We reset the environ for spawn-fcgi, but we use the
+ # contents of this variable as a prefix when calling it
+ # to export some variables (currently just the PATH)
+DIETIME=10 # Time to wait for the server to die, in seconds
+ # If this value is set too low you might not
+ # let some servers to die gracefully and
+ # 'restart' will not work
+QDIETIME=0.5 # The same as DIETIME, but a lot shorter for the
+ # stop case.
+
+#STARTTIME=2 # Time to wait for the server to start, in seconds
+ # If this value is set each time the server is
+ # started (on start or restart) the script will
+ # stall to try to determine if it is running
+ # If it is not set and the server takes time
+ # to setup a pid file the log message might
+ # be a false positive (says it did not start
+ # when it actually did)
+
+# Include defaults if available
+if [ -f /etc/default/$NAME ] ; then
+ . /etc/default/$NAME
+fi
+
+set -e
+
+running_pid() {
+# Check if a given process pid's cmdline matches a given name
+ pid=$1
+ name=$2
+ [ -z "$pid" ] && return 1
+ [ ! -d /proc/$pid ] && return 1
+ cmd="$(cat /proc/$pid/cmdline | tr "\000" "\n"|head -n 1 |cut -d : -f 1)"
+ # Is this the expected server
+ [ "$cmd" != "$name" ] && return 1
+ return 0
+}
+
+running() {
+# Check if the process is running looking at /proc
+# (works for all users)
+ # No pidfile, probably no daemon present
+ [ ! -f "$PIDFILE" ] && return 1
+ PIDS="$(cat "$PIDFILE")"
+ for pid in $PIDS; do
+ if [ -n "$pid" ]; then
+ running_pid $pid $DAEMON && return 0 || true
+ fi
+ done
+ return 1
+}
+
+start_server() {
+ ARGS="-P $PIDFILE"
+ # Adjust NUMBER of processes
+ if [ -n "$FCGI_CHILDREN" ]; then
+ ARGS="$ARGS -F '$FCGI_CHILDREN'"
+ fi
+ # Adjust SOCKET or PORT and ADDR
+ if [ -n "$FCGI_SOCKET" ]; then
+ ARGS="$ARGS -s '$FCGI_SOCKET'"
+ elif [ -n "$FCGI_PORT" ]; then
+ if [ -n "$FCGI_ADDR" ]; then
+ ARGS="$ARGS -a '$FCGI_ADDR'"
+ fi
+ ARGS="$ARGS -p '$FCGI_PORT'"
+ fi
+ # Adjust user
+ if [ -n "$FCGI_USER" ]; then
+ ARGS="$ARGS -u '$FCGI_USER'"
+ if [ -n "$FCGI_SOCKET" ]; then
+ if [ -n "$FCGI_SOCKET_OWNER" ]; then
+ ARGS="$ARGS -U '$FCGI_SOCKET_OWNER'"
+ else
+ ARGS="$ARGS -U '$FCGI_USER'"
+ fi
+ fi
+ fi
+ # Adjust group
+ if [ -n "$FCGI_GROUP" ]; then
+ ARGS="$ARGS -g '$FCGI_GROUP'"
+ if [ -n "$FCGI_SOCKET" ]; then
+ if [ -n "$FCGI_SOCKET_GROUP" ]; then
+ ARGS="$ARGS -G '$FCGI_SOCKET_GROUP'"
+ else
+ ARGS="$ARGS -G '$FCGI_GROUP'"
+ fi
+ fi
+ fi
+ eval $(echo env -i $ENV_VARS $SPAWN_FCGI $ARGS -- $DAEMON $DAEMON_OPTS) \
+ > /dev/null
+ errcode="$?"
+ return $errcode
+}
+
+stop_server() {
+ # Force the process to die killing it manually
+ [ ! -e "$PIDFILE" ] && return
+ PIDS="$(cat "$PIDFILE")"
+ for pid in $PIDS; do
+ if running_pid $pid $DAEMON; then
+ kill -15 $pid
+ # Is it really dead?
+ sleep "$QDIETIME"s
+ if running_pid $pid $DAEMON; then
+ kill -9 $pid
+ sleep "$QDIETIME"s
+ if running_pid $pid $DAEMON; then
+ echo "Cannot kill $NAME (pid=$pid)!"
+ exit 1
+ fi
+ fi
+ fi
+ done
+ rm -f "$PIDFILE"
+ if [ -n "$FCGI_SOCKET" ]; then
+ rm -f "$FCGI_SOCKET"
+ fi
+}
+
+case "$1" in
+ start)
+ log_daemon_msg "Starting $DESC" "$NAME"
+ # Check if it's running first
+ if running ; then
+ log_progress_msg "apparently already running"
+ log_end_msg 0
+ exit 0
+ fi
+ if start_server ; then
+ # NOTE: Some servers might die some time after they start,
+ # this code will detect this issue if STARTTIME is set
+ # to a reasonable value
+ [ -n "$STARTTIME" ] && sleep $STARTTIME # Wait some time
+ if running ; then
+ # It's ok, the server started and is running
+ log_end_msg 0
+ else
+ # It is not running after we did start
+ log_end_msg 1
+ fi
+ else
+ # Either we could not start it
+ log_end_msg 1
+ fi
+ ;;
+ stop|force-stop)
+ log_daemon_msg "Stopping $DESC" "$NAME"
+ if running ; then
+ # Only stop the server if we see it running
+ errcode=0
+ stop_server || errcode=$?
+ log_end_msg $errcode
+ else
+ # If it's not running don't do anything
+ log_progress_msg "apparently not running"
+ log_end_msg 0
+ exit 0
+ fi
+ ;;
+ restart|force-reload)
+ log_daemon_msg "Restarting $DESC" "$NAME"
+ errcode=0
+ stop_server || errcode=$?
+ # Wait some sensible amount, some server need this
+ [ -n "$DIETIME" ] && sleep $DIETIME
+ start_server || errcode=$?
+ [ -n "$STARTTIME" ] && sleep $STARTTIME
+ running || errcode=$?
+ log_end_msg $errcode
+ ;;
+ status)
+
+ log_daemon_msg "Checking status of $DESC" "$NAME"
+ if running ; then
+ log_progress_msg "running"
+ log_end_msg 0
+ else
+ log_progress_msg "apparently not running"
+ log_end_msg 1
+ exit 1
+ fi
+ ;;
+ # Use this if the daemon cannot reload
+ reload)
+ log_warning_msg "Reloading $NAME daemon: not implemented, as the daemon"
+ log_warning_msg "cannot re-read the config file (use restart)."
+ ;;
+ *)
+ N=/etc/init.d/$NAME
+ echo "Usage: $N {start|stop|force-stop|restart|force-reload|status}" >&2
+ exit 1
+ ;;
+esac
+
+exit 0
diff --git a/hosts/denpa/nftables.conf b/hosts/denpa/nftables.conf
new file mode 100755
index 0000000..8f736ce
--- /dev/null
+++ b/hosts/denpa/nftables.conf
@@ -0,0 +1,23 @@
+#!/usr/sbin/nft -f
+
+flush ruleset
+
+table inet filter {
+ chain input_ipv4 {
+ icmp type echo-request limit rate 5/second accept
+ }
+
+ chain input_ipv6 {
+ icmpv6 type { nd-neighbor-solicit, nd-router-advert, nd-neighbor-advert } accept
+ icmpv6 type echo-request limit rate 5/second accept
+ }
+
+ chain input {
+ type filter hook input priority filter; policy drop;
+ ct state vmap { established : accept, related : accept, invalid : drop }
+ iifname lo accept
+ meta protocol vmap { ip : jump input_ipv4, ip6 : jump input_ipv6 }
+ tcp dport { ssh, http, https, 993, 465, 25, 587 } accept
+ log prefix "(nftables) input denied: " counter drop
+ }
+}
diff --git a/hosts/denpa/nginx/akoncity b/hosts/denpa/nginx/akoncity
new file mode 100644
index 0000000..bd5d254
--- /dev/null
+++ b/hosts/denpa/nginx/akoncity
@@ -0,0 +1,76 @@
+server {
+ error_log syslog;
+
+ server_name akon.city www.akon.city;
+
+ root /var/www/akoncity;
+ index index.html;
+
+ location / {
+ limit_req zone=main burst=20 nodelay;
+ limit_req_log_level error;
+ try_files $uri $uri/ =404;
+ }
+
+ listen [::]:443 ssl ipv6only=on; # managed by Certbot
+ listen 443 ssl; # managed by Certbot
+ ssl_certificate /etc/letsencrypt/live/akon.city/fullchain.pem; # managed by Certbot
+ ssl_certificate_key /etc/letsencrypt/live/akon.city/privkey.pem; # managed by Certbot
+ include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
+ ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot
+}
+
+server {
+ error_log syslog;
+
+ server_name git.akon.city;
+
+ root /var/www/htdocs/cgit;
+ try_files $uri @cgit;
+
+ location ~ ^.*\.git/(HEAD|info/refs|objects/info/.*|git-(upload|receive)-pack)$ {
+ client_max_body_size 0;
+ include fastcgi_params;
+ fastcgi_param SCRIPT_FILENAME /usr/lib/git-core/git-http-backend;
+ fastcgi_param GIT_HTTP_EXPORT_ALL "";
+ fastcgi_param GIT_PROJECT_ROOT /mnt/git;
+ fastcgi_param PATH_INFO $uri;
+ fastcgi_pass unix:/var/run/fcgiwrap.socket;
+ }
+
+ location @cgit {
+ index cgit.cgi;
+ include fastcgi_params;
+ fastcgi_param DOCUMENT_ROOT $document_root;
+ fastcgi_param SCRIPT_FILENAME $document_root/cgit.cgi;
+ fastcgi_param PATH_INFO $uri;
+ fastcgi_param QUERY_STRING $args;
+ fastcgi_param HTTP_HOST $server_name;
+ fastcgi_pass unix:/var/run/fcgiwrap.socket;
+ }
+
+ listen [::]:443 ssl;
+ listen 443 ssl;
+ ssl_certificate /etc/letsencrypt/live/git.akon.city/fullchain.pem;
+ ssl_certificate_key /etc/letsencrypt/live/git.akon.city/privkey.pem;
+}
+
+server {
+ if ($host = www.akon.city) {
+ return 301 https://$host$request_uri;
+ } # managed by Certbot
+
+ if ($host = akon.city) {
+ return 301 https://$host$request_uri;
+ } # managed by Certbot
+
+ if ($host = git.akon.city) {
+ return 301 https://$host$request_uri;
+ }
+
+ listen 80;
+ listen [::]:80;
+
+ server_name akon.city www.akon.city;
+ return 404; # managed by Certbot
+}
diff --git a/hosts/denpa/scripts/fail2ban-ban-ip b/hosts/denpa/scripts/fail2ban-ban-ip
new file mode 100755
index 0000000..b1b97c6
--- /dev/null
+++ b/hosts/denpa/scripts/fail2ban-ban-ip
@@ -0,0 +1,3 @@
+#! /usr/bin/env sh
+# Get jail names: sudo fail2ban-client status
+fail2ban-client set $1 banip $2
diff --git a/hosts/denpa/scripts/fail2ban-unban-ip b/hosts/denpa/scripts/fail2ban-unban-ip
new file mode 100755
index 0000000..a562cbc
--- /dev/null
+++ b/hosts/denpa/scripts/fail2ban-unban-ip
@@ -0,0 +1,3 @@
+#! /usr/bin/env sh
+# Get jail names: sudo fail2ban-client status
+fail2ban-client set $1 unbanip $2
diff --git a/hosts/denpa/scripts/mail-stats b/hosts/denpa/scripts/mail-stats
new file mode 100755
index 0000000..4f703a1
--- /dev/null
+++ b/hosts/denpa/scripts/mail-stats
@@ -0,0 +1,2 @@
+#! /usr/bin/env sh
+sudo journalctl --no-tail _SYSTEMD_UNIT=postfix@-.service | sudo pflogsumm
diff --git a/hosts/denpa/systemd/fcgiwrap.service b/hosts/denpa/systemd/fcgiwrap.service
new file mode 100644
index 0000000..8617259
--- /dev/null
+++ b/hosts/denpa/systemd/fcgiwrap.service
@@ -0,0 +1,14 @@
+[Unit]
+Description=Simple CGI Server
+After=nss-user-lookup.target
+Requires=fcgiwrap.socket
+
+[Service]
+Environment=DAEMON_OPTS=-f
+EnvironmentFile=-/etc/default/fcgiwrap
+ExecStart=/usr/sbin/fcgiwrap ${DAEMON_OPTS}
+User=git
+Group=git
+
+[Install]
+Also=fcgiwrap.socket
diff --git a/hosts/denpa/wg-rod.conf.in b/hosts/denpa/wg-rod.conf.in
new file mode 100644
index 0000000..dc295c7
--- /dev/null
+++ b/hosts/denpa/wg-rod.conf.in
@@ -0,0 +1,10 @@
+[Interface]
+Address = <ipv4>/24, <ipv6>/64
+ListenPort = <port>
+PrivateKey =
+
+[Peer]
+AllowedIPs = 0.0.0.0/0, ::/0
+Endpoint = <ip>:<port>
+PersistentKeepalive = 25
+PublicKey =
generated by cgit v1.2.3-101-g0448 (git 2.54.0) at 2026-07-25 17:21:08 +0000