export fqdn="your.server.de"

pkg_add \
  curl-- \
  php--%8.1 \
  php-curl--%8.1 \
  php-pdo_sqlite--%8.1 \
  php-zip--%8.1 \
  pecl81-mcrypt \
  unzip-- \
  zip--

cd /etc/php-8.1.sample/
cp * /etc/php-8.1/

sed -i 's/^upload_max_filesize.*/upload_max_filesize = 25M/' /etc/php-8.1.ini 
sed -i 's/^post_max_size.*/post_max_size = 29M/' /etc/php-8.1.ini 

cat << EOF > /etc/httpd.conf

server "${fqdn}" {
    listen on * port 80
    block return 302 "https://\$SERVER_NAME\$REQUEST_URI"
}

server "${fqdn}" {
    listen on * tls port 443
    tls {
      certificate "/etc/ssl/${fqdn}.fullchain.pem"
      key         "/etc/ssl/private/${fqdn}.key"
    }
    hsts {
      max-age 31556952
      preload
    }
    log {
      access  "${fqdn}-access.log"
      error   "${fqdn}-error.log"
    }

    root "/htdocs/rainloop"
    directory index index.php

    # Value below is 25MB in bytes. 1MB = 1048576 bytes
    connection max request body 26214400

    # security
    location "*/.git*"              { block }

    ## app specific (ref: https://www.rainloop.net/docs/permissions/ )
    location "/data/*"              { block }

    # robots.txt
    location "/robots.txt"          { pass }

    location "/*.php" {
        fastcgi socket "/run/php-fpm.sock"
    }
}
EOF

rcctl enable httpd php81_fpm
rcctl restart httpd php81_fpm

mkdir /var/www/htdocs/rainloop
cd /var/www/htdocs/rainloop

curl -sL https://repository.rainloop.net/installer.php | php-8.1
chown -R www data

ftp https://www.rainloop.net/repository/webmail/rainloop-latest.zip
unzip rainloop-latest.zip
chown -R www data

test -d /var/www/etc || mkdir -p /var/www/etc
test -f /var/www/etc/resolv.conf || cp /etc/resolv.conf /var/www/etc/resolv.conf

version: "3.7"

services:    
  sso:
    image: quay.io/keycloak/keycloak:21.0
    container_name: "keycloak"
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - ./keycloak.conf:/opt/keycloak/conf/keycloak.conf
    command:
      - start-dev
    environment:
      - KEYCLOAK_ADMIN=admin
      - KEYCLOAK_ADMIN_PASSWORD=XxXxXxXxXxXxXx
      - PROXY_ADDRESS_FORWARDING=true
      - VIRTUAL_HOST=keycloak.your.domain.de
      - VIRTUAL_PORT=8080
      - LETSENCRYPT_HOST=keycloak.your.domain.de
    networks:
      - internal

  database:
    image: postgres:13
    container_name: "postgres"
    environment:
      - POSTGRES_USER=keycloak
      - POSTGRES_DATABASE=keycloak
      - POSTGRES_PASSWORD=XxXxXxXxXxXxXx
    volumes:
      - postgres_data:/var/lib/postgresql/data
    networks:
      - internal

  proxy:
    image: nginxproxy/nginx-proxy
    container_name: "nginx"
    ports:
      - "443:443"
      - "80:80"
    volumes:
      - conf:/etc/nginx/conf.d
      - vhost:/etc/nginx/vhost.d
      - html:/usr/share/nginx/html
      - certs:/etc/nginx/certs
      - /var/run/docker.sock:/tmp/docker.sock:ro
    networks:
      - internal

  acme-companion:
    image: nginxproxy/acme-companion
    container_name: "acme-proxy"
    environment:
      - DEFAULT_EMAIL=<mail@your.domain.de>
    volumes_from:
      - proxy
    volumes:
      - certs:/etc/nginx/certs
      - acme:/etc/acme.sh
      - /var/run/docker.sock:/var/run/docker.sock:ro
    networks:
      - internal

networks:
  internal:
    driver: bridge
    driver_opts:
      com.docker.network.driver.mtu: 1450

volumes:
  postgres_data:
  conf:
  vhost:
  html:
  certs:
  acme:

proxy=edge
db=postgres
db-url-host=postgres
db-user=keycloak
db-password=XxXxXxXxXxXxXxXx
db-database=keycloak
db-schema=public
hostname-strict=false
http-enabled=true

docker compose up -d; docker compose logs -f

pkg_add minio

cat << EOF >> /etc/login.conf

# Minio, added $(date)
EOF

cat << 'EOF' >> /etc/login.conf
minio:\
  :openfiles-cur=4096:\
  :openfiles-max=8192:\
  :tc=daemon:
EOF

# Rebuild capdb
cap_mkdb /etc/login.conf

cd /usr/ports/net/scapy

export PKG_PATH="https://your.server.de/pub/OpenBSD/7.2/packages-self/amd64/"

# Check Repo
root@host# pkg_info -Q scapy                                                                                                 
scapy-2.5.0p0

# add Repo
root@host# pkg_add -V scapy
https://your.server.de/pub/OpenBSD/7.2/packages-self/amd64/scapy-2.5.0p0.tgz: unsigned package
Couldn't install scapy-2.5.0p0

# allow unsigned, as this is build on my own
root@host# pkg_add -D unsigned scapy
scapy-2.5.0p0: ok

echo 'domain="your.domain.de"'      > .env
echo 'traefik="traefik.${domain}"'  >> .env
echo 'whoami="whoami.${domain}"'    >> .env
echo 'mail="name@${domain}"'        >> .env
echo -n 'dashboardaccount="' >> .env; echo -n $(htpasswd -nB dashboard) |sed -e s/\\$/\\$\\$/g >> .env; echo '"' >> .env

docker run -it --rm -p 80:80 -p 443:443 --name alpine-ssl alpine /bin/sh

echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
sysctl net.inet.ip.forwarding=1

echo "inet 10.0.0.1 255.255.255.0 10.0.0.2" >> /etc/hostname.tun0
sh /etc/netstart tun0

sed -i '/PermitTunnel .*/PermitTunnel                      yes/' /etc/ssh/sshd_config
rcctl restart sshd

ssh-copy-id root@host2

echo "net.inet.ip.forwarding=1" >> /etc/sysctl.conf
sysctl net.inet.ip.forwarding=1

echo "inet 10.0.0.2 255.255.255.0 10.0.0.1" >> /etc/hostname.tun0
sh /etc/netstart tun0

sed -i '/PermitTunnel .*/PermitTunnel                      yes/' /etc/ssh/sshd_config
rcctl restart sshd

ssh-copy-id root@host1

dmesg |grep sd1

dd if=/dev/random of=/dev/rsd1c bs=1m count=512