From 899388be7642dc261b68cf8924f8c2f8fe9a6ac9 Mon Sep 17 00:00:00 2001 From: Loki <59907407+Loki-101@users.noreply.github.com> Date: Mon, 16 Jan 2023 23:38:29 -0800 Subject: [PATCH 01/36] Fedora Server 37 Support With this small modification Fedora Server 37 will work with this guide out of the box. --- community/installation-guides/panel/centos8.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/installation-guides/panel/centos8.md b/community/installation-guides/panel/centos8.md index d9cde11d..bedfde12 100644 --- a/community/installation-guides/panel/centos8.md +++ b/community/installation-guides/panel/centos8.md @@ -32,7 +32,7 @@ systemctl enable mariadb We recommend the remi repo to get the latest php packages. ```bash -## Install Repos +## Install Repos (If on Fedora Server 37, skip the "Install Repos" step and instead install php-process with "dnf install php-process". Then, continue at the "Get dnf updates" step.) dnf install epel-release dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm dnf module enable php:remi-8.0 From ea3e3502fa67e49c5b01d646683fa1750ad9347e Mon Sep 17 00:00:00 2001 From: Loki <59907407+Loki-101@users.noreply.github.com> Date: Tue, 17 Jan 2023 15:55:39 -0800 Subject: [PATCH 02/36] Design fix Just moved my earlier change outside the markdown block so it would be easier to see after I realized with the first commit people would have to scroll to the right just to see the instructions. It's also more uniform with other instructions now. --- community/installation-guides/panel/centos8.md | 3 ++- 1 file changed, 2 insertions(+), 1 deletion(-) diff --git a/community/installation-guides/panel/centos8.md b/community/installation-guides/panel/centos8.md index bedfde12..9a6dfe8b 100644 --- a/community/installation-guides/panel/centos8.md +++ b/community/installation-guides/panel/centos8.md @@ -30,9 +30,10 @@ systemctl enable mariadb ### PHP 8.0 We recommend the remi repo to get the latest php packages. +If on Fedora Server 37, skip the "Install Repos" step and instead install php-process with "dnf install php-process". Then, continue at the "Get dnf updates" step. ```bash -## Install Repos (If on Fedora Server 37, skip the "Install Repos" step and instead install php-process with "dnf install php-process". Then, continue at the "Get dnf updates" step.) +## Install Repos dnf install epel-release dnf install https://rpms.remirepo.net/enterprise/remi-release-8.rpm dnf module enable php:remi-8.0 From 9900d312ea6d6f915d4df042612a0443ba274f36 Mon Sep 17 00:00:00 2001 From: Loki <59907407+Loki-101@users.noreply.github.com> Date: Tue, 31 Jan 2023 17:47:52 -0800 Subject: [PATCH 03/36] Forgot a label --- community/installation-guides/panel/centos8.md | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/community/installation-guides/panel/centos8.md b/community/installation-guides/panel/centos8.md index 9a6dfe8b..7858fa33 100644 --- a/community/installation-guides/panel/centos8.md +++ b/community/installation-guides/panel/centos8.md @@ -1,4 +1,4 @@ -# CentOS 8, Rocky Linux 8, AlmaLinux 8 +# CentOS 8, Rocky Linux 8, AlmaLinux 8, Fedora Server 37 In this guide we will install Pterodactyl v1.X — including all of it's dependencies — and configure our webserver to serve it using SSL. [[toc]] From d78769743e3e60347554508197e5647ba918e2d4 Mon Sep 17 00:00:00 2001 From: Quinten <67589015+QuintenQVD0@users.noreply.github.com> Date: Wed, 15 Mar 2023 18:27:53 +0100 Subject: [PATCH 04/36] Set nodejs version to 16 --- .github/workflows/github-pages.yml | 4 ++++ 1 file changed, 4 insertions(+) diff --git a/.github/workflows/github-pages.yml b/.github/workflows/github-pages.yml index 6b8705bf..c6799f92 100644 --- a/.github/workflows/github-pages.yml +++ b/.github/workflows/github-pages.yml @@ -17,6 +17,10 @@ jobs: - name: Checkout uses: actions/checkout@v3 + - uses: actions/setup-node@v3 + with: + node-version: 16 + - name: Install dependencies run: yarn install --frozen-lockfile From cddd051bbcfcbcaded137b3f5e638017d289f00e Mon Sep 17 00:00:00 2001 From: Vojtech Mares Date: Sun, 2 Jul 2023 13:31:15 +0200 Subject: [PATCH 05/36] Add guide on setting up Caddy as webserver and tutorial for using Caddy with Cloudflare DNS in proxy mode --- .snippets/webservers/Caddyfile | 56 +++++++++++++++++ .snippets/webservers/Caddyfile-nossl | 56 +++++++++++++++++ panel/1.0/webserver_configuration.md | 48 +++++++++++++++ tutorials/creating_ssl_certificates.md | 83 ++++++++++++++++++++++++++ 4 files changed, 243 insertions(+) create mode 100644 .snippets/webservers/Caddyfile create mode 100644 .snippets/webservers/Caddyfile-nossl diff --git a/.snippets/webservers/Caddyfile b/.snippets/webservers/Caddyfile new file mode 100644 index 00000000..7d4fc9ba --- /dev/null +++ b/.snippets/webservers/Caddyfile @@ -0,0 +1,56 @@ +{ + servers :443 { + timeouts { + read_body 120s + } + } +} + + { + root * /var/www/pterodactyl/public + + file_server + + php_fastcgi unix//run/php/php8.1-fpm.sock { + root /var/www/pterodactyl/public + index index.php + + env PHP_VALUE "upload_max_filesize = 100M \n post_max_size = 100M" + env HTTP_PROXY "" + # env HTTPS "on" + + read_timeout 300s + dial_timeout 300s + write_timeout 300s + } + + header Strict-Transport-Security "max-age=16768000; preload;" + header X-Content-Type-Options "nosniff" + header X-XSS-Protection "1; mode=block;" + header X-Robots-Tag "none" + header Content-Security-Policy "frame-ancestors 'self'" + header X-Frame-Options "DENY" + header Referrer-Policy "same-origin" + + request_body { + max_size 100m + } + + respond /.ht* 403 + + log { + output file /var/log/caddy/pterodactyl.app-access.log { + roll_size 100MiB + roll_keep_for 7d + } + level INFO + } + + log { + output file /var/log/caddy/pterodcatyl.app-error.log { + roll_size 100MiB + roll_keep_for 7d + } + level ERROR + } +} \ No newline at end of file diff --git a/.snippets/webservers/Caddyfile-nossl b/.snippets/webservers/Caddyfile-nossl new file mode 100644 index 00000000..0d985325 --- /dev/null +++ b/.snippets/webservers/Caddyfile-nossl @@ -0,0 +1,56 @@ +{ + servers :80 { + timeouts { + read_body 120s + } + } +} + +http:// { + root * /var/www/pterodactyl/public + + file_server + + php_fastcgi unix//run/php/php8.1-fpm.sock { + root /var/www/pterodactyl/public + index index.php + + env PHP_VALUE "upload_max_filesize = 100M \n post_max_size = 100M" + env HTTP_PROXY "" + # env HTTPS "on" + + read_timeout 300s + dial_timeout 300s + write_timeout 300s + } + + header Strict-Transport-Security "max-age=16768000; preload;" + header X-Content-Type-Options "nosniff" + header X-XSS-Protection "1; mode=block;" + header X-Robots-Tag "none" + header Content-Security-Policy "frame-ancestors 'self'" + header X-Frame-Options "DENY" + header Referrer-Policy "same-origin" + + request_body { + max_size 100m + } + + respond /.ht* 403 + + log { + output file /var/log/caddy/pterodactyl.app-access.log { + roll_size 100MiB + roll_keep_for 7d + } + level INFO + } + + log { + output file /var/log/caddy/pterodcatyl.app-error.log { + roll_size 100MiB + roll_keep_for 7d + } + level ERROR + } +} \ No newline at end of file diff --git a/panel/1.0/webserver_configuration.md b/panel/1.0/webserver_configuration.md index a74074cb..4a259b93 100644 --- a/panel/1.0/webserver_configuration.md +++ b/panel/1.0/webserver_configuration.md @@ -4,6 +4,10 @@ When using the SSL configuration you MUST create SSL certificates, otherwise your webserver will fail to start. See the [Creating SSL Certificates](/tutorials/creating_ssl_certificates.html) documentation page to learn how to create these certificates before continuing. ::: +::: tip +If you are using [Caddy With Automatic SSL](#caddy-with-automatic-ssl), you do not have to create SSL certificates manually, Caddy will take care of it automatically. +::: + :::: tabs ::: tab "Nginx With SSL" First, remove the default NGINX configuration. @@ -109,6 +113,50 @@ sudo a2enmod rewrite sudo systemctl restart apache2 ``` +::: +::: tab "Caddy With Automatic SSL" + +You should paste the contents of the file bellow, replacing `` with your domain name. + +The default config path is `/etc/caddy/Caddyfile`. + +<<< @/.snippets/webservers/Caddyfile{9} + +::: tip +If you are using Cloudflare DNS in proxy mode, refer to [this tutorial](/tutorials/creating_ssl_certificates.html#method-3:-caddy-(using-cloudflare-api)), to see how to configure Caddy to use DNS challenge for obtaining SSL certificates. +::: + +### Enabling Configuration + +The final step is to validate configuration and restart Caddy. + +```bash +caddy validate --config /etc/caddy/Caddyfile + +systemctl restart caddy +``` + +::: +::: tab "Caddy Without SSL" + +You should paste the contents of the file bellow, replacing `` with your domain name. + +The default config path is `/etc/caddy/Caddyfile`. + +The only two differences are that we have prefixed the `` with `http://` (or you can use `:80` suffix behind the ``) and in the global config at `servers` directive, we have changed the port from `:443` to `:80`. + +<<< @/.snippets/webservers/Caddyfile-nossl{2,9} + +### Enabling Configuration + +The final step is to validate configuration and restart Caddy. + +```bash +caddy validate --config /etc/caddy/Caddyfile + +systemctl restart caddy +``` + ::: :::: diff --git a/tutorials/creating_ssl_certificates.md b/tutorials/creating_ssl_certificates.md index 6abce13f..308255d9 100644 --- a/tutorials/creating_ssl_certificates.md +++ b/tutorials/creating_ssl_certificates.md @@ -139,5 +139,88 @@ After running the script for the first time, it will be added to the crontab aut sudo crontab -e ``` +::: +::: tab "Method 3: Caddy (using Cloudflare API)" +This is for advanced users, who are running Cloudflare in proxy mode or do not have access to port `80`. + +### Installing Caddy with Cloudflare DNS plugin + +Caddy does not come by default with Cloudflare DNS plugin, you need to install it yourself. + +There are two main methods: + +1. using `xcaddy` - CLI tool to build your own Caddy build +2. downloading prebuilt binary from [Caddy's download page](https://caddyserver.com/download). +3. using Ansible to download and install Caddy with plugins. See [caddy-ansible](https://github.com/caddy-ansible/caddy-ansible) + +#### Build Caddy using `xcaddy` on your server + +Please refer to [Caddy docs on building Caddy](https://caddyserver.com/docs/build#xcaddy). + +### Obtaining CloudFlare API Token + +After installing acme.sh, we need to fetch a CloudFlare API key. Please make sure that a DNS record (A or CNAME record) is pointing to your target node, and set the cloud to grey (bypassing CloudFlare proxy). Then go to My Profile > API keys and on Global API Key subtab, click on "view", enter your CloudFlare password, and copy the API key to clipboard. + +After install Caddy with Cloudflare DNS plugin, we need to fetch a Cloudflare API token. Please make sure that a DNS record (A or CNAME record) is pointing at your target node. Then go to My Profile > API Tokens and on API Tokens click "Create Token". Create API Token > API token templates, at the end of line with "Edit zone DNS", click "Use template". Under **Zone Resources**, select your DNS zone for which you wish to create the API token, click "Continue to summary". Review the API token summary and click "Create Token". And finally copy the API token to clipboard. + +### Reconfiguring Caddy to use Cloudflare DNS for obtaining certificates + +Create an environment variable file (like `.env`), keep in mind that this file contains secrets and should not be accessed by public. + +```bash +# /etc/caddy/.secrets.env +CLOUDFLARE_API_TOKEN= +``` + +For security reasons, we recommend setting permissions to `0600` (only owner can read or write to the file). + +```bash +# Set ownership of the `.secrets.env` file to `caddy` system user +chown caddy:caddy /etc/caddy/.secrets.env + +# Set read-write permissions only to owner - the `caddy` system user +chmod 0600 /etc/caddy/.secrets.env +``` + +Modify the systemd unit file, to load environment variables from file (add `--envfile /etc/caddy/.secrets.env` flag to `ExecStart`): + +```unit{12} +# /etc/systemd/system/caddy.service +[Unit] +Description=Caddy +Documentation=https://caddyserver.com/docs/ +After=network.target network-online.target +Requires=network-online.target + +[Service] +Type=notify +User=caddy +Group=caddy +ExecStart=/usr/bin/caddy run --environ --envfile /etc/caddy/.secrets.env --config /etc/caddy/Caddyfile +ExecReload=/usr/bin/caddy reload --config /etc/caddy/Caddyfile +TimeoutStopSec=5s +LimitNOFILE=1048576 +LimitNPROC=512 +PrivateTmp=true +ProtectSystem=full +AmbientCapabilities=CAP_NET_BIND_SERVICE + +[Install] +WantedBy=multi-user.target +``` + +You can add a `tls` block to your `Caddyfile`, under the `` block of your panel configuration: + +```caddyfile{5-7} +# /etc/caddy/Caddyfile + { + # ... + + tls { + dns cloudflare {env.CLOUDFLARE_API_TOKEN} + } +} +``` + ::: :::: From bd8bed38be7c5723c1e6ef07a1b1315c5720c9b0 Mon Sep 17 00:00:00 2001 From: Boy132 Date: Sat, 5 Aug 2023 21:38:39 +0200 Subject: [PATCH 06/36] Do not recommend to use the panel db user for a database host (#533) --- tutorials/mysql_setup.md | 6 ++---- 1 file changed, 2 insertions(+), 4 deletions(-) diff --git a/tutorials/mysql_setup.md b/tutorials/mysql_setup.md index d0c768ea..14f1c642 100644 --- a/tutorials/mysql_setup.md +++ b/tutorials/mysql_setup.md @@ -39,12 +39,10 @@ CREATE DATABASE panel; ### Assigning permissions Finally, we need to tell MySQL that our pterodactyl user should have access to the panel database. To do this, simply -run the command below. If you plan on also using this MySQL instance as a database host on the Panel you'll want to -include the `WITH GRANT OPTION` (which we are doing here). If you won't be using this user as part of the host setup -you can remove that. +run the command below. ``` sql -GRANT ALL PRIVILEGES ON panel.* TO 'pterodactyl'@'127.0.0.1' WITH GRANT OPTION; +GRANT ALL PRIVILEGES ON panel.* TO 'pterodactyl'@'127.0.0.1'; ``` ## Creating a Database Host for Nodes From d433b15bbacf41cb9e96264c2f9851010e963ebc Mon Sep 17 00:00:00 2001 From: Baptiste Ferrando <53260217+Verttigo28@users.noreply.github.com> Date: Sat, 5 Aug 2023 21:39:05 +0200 Subject: [PATCH 07/36] Change Cloudflare acme requierements (#522) --- tutorials/creating_ssl_certificates.md | 7 ++++--- 1 file changed, 4 insertions(+), 3 deletions(-) diff --git a/tutorials/creating_ssl_certificates.md b/tutorials/creating_ssl_certificates.md index 6abce13f..ca596057 100644 --- a/tutorials/creating_ssl_certificates.md +++ b/tutorials/creating_ssl_certificates.md @@ -105,7 +105,7 @@ curl https://get.acme.sh | sh ### Obtaining CloudFlare API Key -After installing acme.sh, we need to fetch a CloudFlare API key. Please make sure that a DNS record (A or CNAME record) is pointing to your target node, and set the cloud to grey (bypassing CloudFlare proxy). Then go to My Profile > API keys and on Global API Key subtab, click on "view", enter your CloudFlare password, and copy the API key to clipboard. +After installing acme.sh, we need to fetch a CloudFlare API key. On Cloudfare's website, select your domain, then on the right side, copy your "Zone ID" and "Account ID" then click on "Get your API token", click on "Create Token" > select the template "Edit zone DNS" > select the scope of "Zone Ressources" and then click on "Continue to summary", copy your token. ### Creating a Certificate @@ -118,8 +118,9 @@ sudo mkdir /etc/letsencrypt/live/example.com After installing acme.sh and obtaining CloudFlare API key, we need to then generate a certificate. First input the CloudFlare API credentials. ```bash -export CF_Key="Your_CloudFlare_API_Key" -export CF_Email="Your_CloudFlare_Account@example.com" +export CF_Token="Your_CloudFlare_API_Key" +export CF_Account_ID="Your_CloudFlare_Account_ID" +export CF_Zone_ID="Your_CloudFlare_Zone_ID" ``` From b4a8d06e004d1f42a8e84cdd90d4d132009932a6 Mon Sep 17 00:00:00 2001 From: PadowYT2 Date: Sat, 5 Aug 2023 22:39:59 +0300 Subject: [PATCH 08/36] Change sponsor link (#527) --- .vuepress/theme/Home.vue | 2 +- 1 file changed, 1 insertion(+), 1 deletion(-) diff --git a/.vuepress/theme/Home.vue b/.vuepress/theme/Home.vue index 5ee7b226..ee60bc38 100644 --- a/.vuepress/theme/Home.vue +++ b/.vuepress/theme/Home.vue @@ -135,7 +135,7 @@