---
title: Server
description: 
published: true
date: 2024-11-24T11:38:12.406Z
tags: 
editor: markdown
dateCreated: 2023-04-28T08:02:53.316Z
---

# Introduction
This guide will set you up with a fresh Arch Linux installation set up as a server with the basics, Once you are done with this guide you can go to the docker guides and host any service you want yourself.

But before we can go there you need to understand a few things.

## Basic Instructions
Understand a command before you execute it, Executing code you don't understand is the best way to break your machine, let your machine get raped, get scammed, or end up in prison. So understand every letter of a command before you execute it.

Be sure to read everything, On this page but also the output of the terminal. Not only because you need to know what you are doing, but also because there are a lot of parameters that need to be changed.

No response means everything went well, If you get an error back make sure you typed the command correctly

## Basic Commands
Troughout the guide we will use several basic commands, The guide assumes you know what they do, And I do not allow you to run a command you do not understand.

`pwd` print working directory
If you type `pwd` in a terminal and press enter it will show in which directory you are at the moment.

`ls` list
it will display all contents of the current directory. I would recommend using this with the options -a and -l `ls -la` would list all files including hidden files in a list with some handy details.

`mkdir` make directory
creates a directory. `mkdir bla` would create a folder called bla in the current directory

`cd` change directory
change to a different directory. `cd bla` would move you to the folder bla in the current directory.

`touch` touch
it will create a file and update the time if it already exists. `touch bla` would create an empty file called bla

`cp` copy
it will copy a file `cp file1 file2` would copy file1 to file2, `cp -r folder1 ../folder2` would copy folder 1 to folder2 next to this directory.

`mv` move
move does the same as copy, only it will move the file or folder and not leave a duplicate, This command is also used to rename files and folders using `mv file1 file2` will rename file1 into file2.

`ln` link
link is used to create links between files, kind of like "Shortcuts" on Windows. we create links like this `ln -sf realfile linkfile` now linkfile will point to realfile and if you make changes to one both will be affected.

`exit` exit
Kinda obvious, but here we exit the shell, if you open bash by typing `bash` pressing enter and then type `exit` and press enter you would be back in the terminal where you started.

`reboot` reboot
Also very obvious, this one reboots your machine, just type `reboot` and press enter

`chmod` change mode
With this you can change the permissions on a file or folder like so `chmod +x file` it would make file executable for everyone, you can do + and - to add and remove permissions, r is read, w is write and x is execute. You can also use numbers like so `chmod 755 file` it would give all permissions to the owner, but only read and execute for the group and others. 4 is read, 2 is write, 1 is execute, you can add them to give multiple rights, so 4 would be read, 6 would be read and write, 7 would be all rights. `chmod 421 file` would make the file readable for only the owner, writeable for only the group, and executable only for others.

`chown` change owner
This changes the owner of a file, a file has a owner, and a file belongs to a group, you can set both like so `chown owner:group file` file will now be owned by owner and belong to the group group.

`echo` echo
echo simply repeats whatever argument you give it `echo Hello` would print back "Hello"

`sudo` super user do
sudo allows you to execute commands as a different user it is mostly used for executing something as the root user `sudo bash` would open a new terminal as the root user. It is not recommended to use your system as the root user, therefore sudo was invented, just use sudo if you need to do something as root. But again, know what you execute.

There are lots and lots more, but these are all you need to know for this guide.

## Basic Syntax
` ` space
The space is a seperator, it seperates commands from the options and the options from the arguments, different forms of whitespace can be used

`/` forward slash
this means next folder if you lead with it you will get an absolute path `/home/user/file` is an absolute path. `./file` or `file` is a relative path, it will expect file in the current directory

`.` period
Current directory, you can use it as an argument for many commands it is most often used to execute something in or on the current directory like `./executable` or `chown user .`

`..` double period
Upper Directory, probably most often used for `cd` like so `cd ../..` to go up 2 directories you can also use it to execute a file in a relative directory like so `../folder/executable`

`\` backslash
Escape character, is used for lots of things, but we only use it for when we want to use a character that has a special meaning, for example space, if we want open a file with vim called "A B C" we would run this command `vim A\ B\ C`

`>` Is Greater Than
overwrite file, when you see this character in a command it is redirecting the output, for the scope of this guide we will use it to redirect output to a file but appending a file behind it, like so `echo Hello > file` will overwrite the content of file with Hello.

`>>` Double Is Greater Than
add to end of file, it does the same as the Greater Than above, but this one doesn't overwrite but adds the output on a new line in the file.

`*` Asterisk
wildcard, expands to everything you can use it to open all files in the current directory using `vim *` only open .c files with `vim *.c` or open all files in every folder `vim */*` ofcourse this also works with absolute paths.

There are lots and lots more, but this is all the syntax you need to know for this guide

## Vim Basics
Vim is this amazing text editor, it is without a doubt the best text editor in existance, you can do more with it than you will ever be able to remember. all in such a nice small extendable package. Yes emacs can do more, But we just want a text editor, not play tetris and browse the web :P

One important thing to know about vim is that it uses different modes, and in the "normal" mode you can't insert characters normally. There are 3 modes in vim; Normal, Insert and Visual.

Normal mode is the default mode in Vim, you can always go back to it from other modes by pressing `esc` on your keyboard. In Normal mode you can look at the file, execute commands that start with `:` search for something by pressing `/` and much much more.

Insert mode is where we edit the file as if it was a normal text editor, you can press `i` to go into it after the cursor, there are different ways to get into it, but they are out of scope for this guide. 

Visual mode is not relevant for this guide, but you can use it, if you press `v` from normal mode you go into visual mode to select text, `d` to cut and `y` to copy. You can also select whole lines with `shift + v` and select a block with `ctrl + v`

The last thing you need to know are commands, with these commands you can save a file, quit vim, or manipulate the text in ways you can't imagine, listing all commands and explaining it alone would make this guide much larger than it is now, so just a few relevant ones.

go to the end of the line by pressing `$` 
go to the beginning with `0` 
go to the end of file with `G` 
go back to the beginning with `g` 
go to line 34 with `34gg`
paste content with `p`
cut a line with `dd`
to save a file type `:w` and press enter
to quit vim type `:q` and press enter
to force an action like `q` and `w` add `!` to your command like this `:q!` or `:w!`
You can also combine actions like so `:wq!`
to execute a terminal command type `:! command` and press enter

# Preparation

## Creating the Bootable USB

First we need to download the latest version of the Arch installation media

Open a webbrowser and go to https://www.archlinux.org/download/

Here you can download the latest image, I recommend using the Torrent or Magnet link, But if you don't have a torrent client you can scroll down for HTTP downloads.

Wait for the download to finish.

Next we need to burn the ISO file to an empty USB

If you are already on Linux you probably know how to flash an image to USB, if not try to right click the .ISO file and open with image writer, Just select the right drive and click write/flash/revert

If you are on Windows I recommend downloading Etcher

https://www.balena.io/etcher/

Just download the portable version or install the normal version and open the program

Select the .ISO file as the image, The USB as the drive and click flash

After it is finished you should have a bootable Arch USB.

## Booting the USB 

Next we need to boot the USB drive, We need to get in the BIOS for that.

Turn off the device and put the USB in the device and keep pressing f2/Del/etc while turning it on to get into your BIOS, Most of the times you will get a screen where it tells you which button you need to press to enter the BIOS

When you are in the BIOS Navigate to the boot screen and make sure the USB is on top. In most cases you can change their priority with F5/F6 or +/-.

Press F10, select yes and press enter to save the settings and reboot,

Now you just have to wait untill you are logged in as the root user on the arch iso

## Check your boot mode 

Run the following command to see if you are running in UEFI mode

	ls /sys/firmware/efi/efivars

If it shows you a bunch of filenames you are in UEFI mode.

If you get an error you are in BIOS mode. If you are sure your system has UEFI disable legacy boot mode or force UEFI in the BIOS. If you can not get the USB to boot into UEFI you can use the legacy mode.

Remember which boot mode you use, It will be important later on.

## Set your Keyboard Layout for the installation 
If you use US International as your keyboard layout you can skip this step.

To list all available keyboard layouts run

	localectl list-keymaps

navigate with the arrow keys to choose the right keyboard layout for your keyboard when you made your choice press q to quit and run the following command with your keyboard layout

	loadkeys layout

for Turkey layout would be replaced with trq for German it would be replaced with de-latin1

If you have set a custom layout remember which layout you set, It will be important later on.

## Make sure you have a network connection 
If you are wired you can skip the WiFi step But test the connection either way.

If you use Wifi or have no option to connect a cable run the following command

	iwctl

You should spawn in an alternative prompt, run the following command to check for devices

	device list

Remember the name of the device and use it in the following command to let it scan for networks

	station wlan0 scan

Then run the following command to display the scan results

	station wlan0 get-networks

And finally you should be able to connect using the Device name and the Network Name (SSID)

	station wlan0 connect SSID

Simply enter the password of your wifi if it asks for it.

then exit the alternative prompt with the following command

	exit


run the following command to test your network connection.

	ping archlinux.org

If you get a ping back hit CTRL + C and go to the next step

It your network device is powered down it is probably soft blocked, in that case run the following command

	rfkill unblock all

## Make sure the time is set correctly 
Not having the right time will prevent your system from installing anything so run the following command

	timedatectl set-ntp true

Check which disk you want to install Arch on 
Run the following command to list all connected drives

	fdisk -l

Check which disk you want to install on, **/dev/sda** or **/dev/nvme0n1** for example, I am going to use **/dev/nvme0n1** from this point on, Remember or write down the drive you want to install on and always replace **/dev/nvme0n1** with the right drive.

# Formatting Disks

## Partitioning the disk (UEFI) 
**Only do this part if you are in UEFI boot mode.**

Start fdisk with the drive of your choice.

	fdisk /dev/nvme0n1

Now we are in fdisk, you can press m for help in the program, But if you do exactly as below everything should be alright

#### Disk Options
1. Hit d and then enter untill there are no more partitions left.
2. Hit g Then press enter, This will make it a gpt disk

#### Boot Partition
1. Press n and then enter to make our first partition 
2. press 2 and press enter to give it partition number 2
3. just press enter to put it in the beginning of the disk 
4. type +2G to give it 2GB for the boot partition and press enter
5. press t and press enter to set the type 
6. skip this step if 2 is preselected otherwise, press 2 and press enter to select the second partition
7. type 1 and hit enter this will make the second partition an EFI partition.

#### Swap Partition
1. press n and press enter to create our swap partition
2. press 3 and press enter to give it partition number 3
3. press enter again to put it next to the previous partition 
4. type +8G to give it 8GB swap, 
If you have less ram I would recommend making it equal to your ram, So +4G if you have 4GB Ram.
5. press t and press enter to set the type 
6. press 3 and press enter to select the third partition 
7. type 19 and hit enter this will make the third partition a Swap partition.

#### Root Partition
1. press n to create our final root partition
2. press 1 and press enter to give it partition number 1
3. press enter again to put it next to the previous partition
4. press enter again to give it the remaining space on the disk.
5. press t and press enter to set the type 
6. press 1 and press enter to select the first partition
7. type 20 and press enter this will make the first partition a Linux filesystem.

#### Apply changes
1. Finally hit w and press enter to write all changes to disk

## Partitioning the disk (BIOS) 
**Only do this part if you are in BIOS boot mode.**

Start fdisk with the drive of your choice.

	fdisk /dev/nvme0n1

Now we are in fdisk, you can press m for help in the program, But if you do exactly as below everything should be alright

#### Disk Options
1. Hit d and then enter untill there are no more partitions left.
2. Hit o Then press enter, This will make it a mbr disk

#### Boot Partition
1. Press n and then enter to make our first partition 
2. press p and press enter to make it a primary partition
3. press 2 and press enter to give it partition number 2
4. just press enter to put it in the beginning of the disk 
5. type +2G to give it 2GB for the boot partition
6. press t and press enter to set the type 
7. press 2 and press enter to select the second partition
8. type 83 and hit enter this will make the second partition an EFI partition.

#### Swap Partition
1. press n and press enter to create our swap partition
2. press p and press enter to make it a primary partition
3. press 3 and press enter to give it partition number 3
4. press enter again to put it next to the previous partition 
5. type +8G to give it 8GB swap, 
If you have less ram I would recommend making it equal to your ram, So +4G if you have 4GB Ram.
6. press t and press enter to set the type 
7. press 3 and press enter to select the third partition 
8. type a and hit enter this will make the third partition a Swap partition.

#### Root Partition
1. press n to create our final root partition
2. press p and press enter to make it a primary partition
3. press 1 and press enter to give it partition number 1
4. press enter again to put it next to the previous partition
5. press enter again to give it the remaining space on the disk.
6. press t and press enter to set the type 
7. press 1 and press enter to select the first partition
8. type 82 and press enter this will make the first partition a Linux filesystem.

#### Apply changes
1. Finally hit w and press enter to write all changes to disk

## Format Partitions 
Now we have set the partitions and the labels now we are going to format them all

Be sure that you replace /dev/nvme0n1p# with the correct drive and partition If if is /dev/sda be sure to include the partition number /dev/sda1, /dev/sda2 and /dev/sda3. For the /dev/nvme0n1 you need to add a p and then the partition number so /dev/nvme0n1p1, /dev/nvme0n1p2 and /dev/nvme0n1p3

First we need to give the root partition a filesystem You can opt for btrfs, f2fs or ext4.

btrfs is a newer filesystem with a lot of very cool features, It is not great for databases tho, so if you plan to go for a server it is not the best choice if your database is going to be on your root partition. I have not tested this one with encryption. But let me know how it goes :)

f2fs is made with SSDs in mind, it might be the best choice for SSDs. Also not tested this one with encryption, But let me know how it goes :)

ext4 is very stable and thourogly tested, you can't really go wrong with this one.

So pick a single one of the following options

	mkfs.btrfs /dev/nvme0n1p1
	mkfs.f2fs /dev/nvme0n1p1
	mkfs.ext4 /dev/nvme0n1p1

Then we make the boot partition fat 32

	mkfs.fat -F32 /dev/nvme0n1p2

Make partition 3 swap

	mkswap /dev/nvme0n1p3

Then enable swap on partition 3

	swapon /dev/nvme0n1p3

## Full Disk Encryption (Optional) 
**Encryption is completely optional, If you don't want it, just skip this step completely.**

Many things can go wrong, and if you forget your password the data is lost, Nothing you can do to recover it. Use it at your own risk.

I would recommend Encryption for Mobile devices that hold sensitive data, Laptops you take with you for example.

I would not recommend Encryption for desktops, unless you are worried someone can get physical access.

make the root partition an LUKS partition

	cryptsetup -y -v luksFormat /dev/nvme0n1p1

Mount the encrypted partition to cryptroot

	cryptsetup open /dev/nvme0n1p1 cryptroot

Create a ext4 filesystem on the encrypted partition

	mkfs.ext4 /dev/mapper/cryptroot

You can also encrypt swap if you want to

	swapoff /dev/nvme0n1p3

	cryptsetup -y -v luksFormat /dev/nvme0n1p3

	cryptsetup open /dev/nvme0n1p3 cryptswap

	mkswap /dev/mapper/cryptswap

	swapon /dev/mapper/cryptswap

You can encrypt any partition you want, just don't encrypt the boot partition because this guide doesn't cover that, and it is pretty useless imho.

## Mounting the partitions 
now we are going to mount the 2 partitions and create the /boot directory

Be sure that you replace /dev/nvme0n1p# with the correct drive and partition If it is /dev/sda be sure to include the partition number /dev/sda1 and /dev/sda2. If it is /dev/nvme0n1 you need to add a p and then the partition number so /dev/nvme0n1p1 and /dev/nvme0n1p2.

mount the first partition to /mnt, if you use encryption you mount /dev/mapper/cryptroot here

	mount /dev/nvme0n1p1 /mnt

create the /boot directory

	mkdir /mnt/boot

mount the second partition to /mnt/boot

	mount /dev/nvme0n1p2 /mnt/boot

# Base Install

## Install the base system 
The following command will install the base system and a text editor we need later on.

	pacstrap /mnt base base-devel vim

## Install a Kernel
You can stick to the normal kernel, but you have options

For Desktop use I would recommend the zen kernel

For A Server I would recommend the hardened kernel

so install the kernel you want with one of the following commands

	pacstrap /mnt linux linux-headers

	pacstrap /mnt linux-zen linux-zen-headers

	pacstrap /mnt linux-hardened linux-hardened-headers

## Generate the fstab file 
Generating the fstab file will take all mounted partitions and add them to a file so they mount at boot so if you have any more drives you want to mount at boot mount it before you run the command.

Run the following command

	genfstab -U /mnt > /mnt/etc/fstab

## chroot into the new system 
chroot is a tool to treat any directory as its root directory, In a way we "break" into the system from the live image, So we will switch from USB to your drive with the following command.

	arch-chroot /mnt

## Set your timezone and time 
If you are unsure about your timezone you can list all timezones with the following command.

	timedatectl list-timezones

go up and down with the arrows look for your timezone and hit q to exit.

Next we are going to change the timezone to the one you selected

	ln -sf /usr/share/zoneinfo/your/timezone /etc/localtime

Replace your/timezone with your correct timezone Europe/Amsterdam for example

Finally run hwclock to generate the time file

	hwclock --systohc

## Generate the locale and set the language 
run the following command and remove the # in front of en_US.UTF-8 UTF-8 and any other locales you need.

	vim /etc/locale.gen

Hit esc then :wq and enter to save and exit

Run the following command to generate the locales

	locale-gen

Next we are going to set the language run the following command

	vim /etc/locale.conf

The language you want your system to be should be in this file in this form, if you want it Dutch for example you change en_US.UTF-8 to nl_NL.UTF-8

```
LANG=en_US.UTF-8
```

Hit esc then :wq and enter to save and quit

If you have not set a different keyboard layout in the earlier part "Set your keyboard layout for installation" you can skip the rest of the commands in this step.

If you have set a different layout back in the earlier part "Set your keyboard layout for installation" run the following command

	vim /etc/vconsole.conf

add the keyboard layout you set in the beginning.

```
KEYMAP=layout
```

layout should be trq for Turkish and de-latin1 for German

Hit esc then :wq and enter to save and quit

## Set the hostname and hosts file 
Next we are going to set the hostname, This is the name of your device in the local network.

	vim /etc/hostname

enter a good name for your device without any capital letters or spaces. You can just call it laptop or personal-computer

```
coolcomputername
```

Hit esc then :wq and enter to save and quit

Now we have to create a file, run

	vim /etc/hosts

Type exactly whats below replacing yourdevicename with the name you just gave your device in /etc/hostname

You can use the tab key for the spaces to make it lign up properly

```
127.0.0.1	localhost
::1				localhost
127.0.1.1	yourdevicename.localdomain	yourdevicename
```

Hit esc then :wq and enter to save and quit

## Set the root password 
now we have to set a root password

The root user is like the superuser or administrator account, You will need this password to update your system or change anything outside your personal home folder.

run the following command then type your new password, hit enter, then again to confirm.

	passwd

## Configure Pacman 
Pacman is the PACkage MANager of Arch Linux, It is great, but we can make it even better :)

First we are going to open the pacman.conf file to make some adjustments

	vim /etc/pacman.conf

Under Misc Options uncomment UseSysLog, Color and Parallel Downloads You can also up the number. And add ILoveCandy to get the other Pacman to appear too :)

```
# Misc options
UseSyslog
Color
#NoProgressBar
CheckSpace
#VerbosePkgLists
ParallelDownloads = 16
ILoveCandy
```

Also add base and grub after HoldPkg

```
HoldPkg     = pacman glibc base grub
```

Hit esc then :wq and enter to save and quit

Next up are the mirrors, The defaults are okay and this takes a while, but for faster speeds I would seriously recommend this step. So go ahead and install reflector

	pacman -S reflector

then just run reflector with the following command

	reflector --latest 200 --protocol https --sort rate --save /etc/pacman.d/mirrorlist

You will see a bunch of errors but that is normal, just let it run and wait untill the prompt shows up again.

## Install Microcode (Optional) PROPRIETARY 
Now we are going to install the microcode, this is PROPRIETARY but it will improve stability, choose the right one for your CPU, you can install none if you are in doubt or don't want any non free software on your machine.

AMD

	pacman -S amd-ucode

Intel

	pacman -S intel-ucode

## install and configure grub 
grub stands for GRand Unified Bootloader just so you know.
Now we are going to install grub, only do UEFI or BIOS depending on your system

UEFI

	pacman -S grub efibootmgr
  
	grub-install --target=x86_64-efi --efi-directory=/boot --bootloader-id=Arch
  
	grub-mkconfig -o /boot/grub/grub.cfg

BIOS

	pacman -S grub

	grub-install --target=i386-pc /dev/nvme0n1

	grub-mkconfig -o /boot/grub/grub.cfg

## Full Disk Encryption (Optional) 
if you did the first Encryption part you can NOT skip this step

If you did not go for disk encryption after formatting the disks you MUST skip this step

First we need to get the UUID of the root partition of /dev/nvme0n1p1 in this case and remember it

	blkid

We need to include it in the grub config so open the grub file

	vim /etc/default/grub

Look for the following GRUB_CMDLINE_LINUX_DEFAULT somewhere at the top

```
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet"
```

Adjust it so the line looks like this remember that you have to replace UUID with the correct UUID.

```
GRUB_CMDLINE_LINUX_DEFAULT="loglevel=3 quiet rd.luks.name=UUID=root root=/dev/mapper/root"
```

Now let grub generate a new config file

	grub-mkconfig -o /boot/grub/grub.cfg

Open the mkinitcpio.conf file

	vim /etc/mkinitcpio.conf

Look for the following HOOKS line, it should be somewhere at the bottom

```
HOOKS=(base udev autodetect modconf block filesystems fsck)
```

Make it look like this (order is important)

```
HOOKS=(base systemd autodetect keyboard modconf block sd-encrypt filesystems fsck)
```

finally run the following command to generate the new image

	mkinitcpio -p linux

## Creating the user 
Now it is time to create a user account, This is where you log into, It can do almost everything except install software or change things outside of your personal folder.

you need to remember your username and you can not have capital letters in your username

	useradd -m yourusername

Set a password for the user, You will log into the device with this password, You can make it the same as the root account.

	passwd yourusername

enter a new password and press enter twice

## install and configure sudo 
Sudo allows you to do root stuff while logged in as a user, It will probably become your most used command so install it.

	pacman -S sudo

Now we need to add your username to the sudoers file, run the following command

	vim /etc/sudoers

Look for the lines under User Privilege Specification There should be a line root ALL=(ALL) ALL Add your username in the exact same manner one line below it so that part looks like this.

```
root ALL=(ALL:ALL) ALL
yourusername ALL=(ALL:ALL) ALL
```

You can also make your computer try to insult you if you enter a wrong password, Just add a line with the following content under the Defaults Specification

```
Defaults insults
```

Hit esc then :wq and Enter to save and quit

## Installing DHCP
For network capabilities we need a DHCP client so install it

	pacman -S dhcpcd

That's it

## Reboot into your Installation
Run the following command to escape from the chroot

	exit

Run the following command to restart

	reboot

Remove the USB when your screen turns black and it should boot into a login prompt

## Configure network
Configuring the network is easy with dhcpcd but first we need to know what device we want to enable

	ip address

It should show you a bunch of devices, Ignore lo, there can be multiple, for me it is enp4s0.

so I run the following command to activate the network

	sudo systemctl enable --now dhcpcd@enp4s0

You can then test with ping if it works, if it works you can go on, if not you can disable it again with sudo systemctl disable --now dhcpcd@enp4s0 and try other network devices listed by the previous command.

## Point Domains to your server
If you have any domains, you first need to edit their DNS records to point to your Server.

First we need our public IP so run the following command

	host myip.opendns.com resolver1.opendns.com 

Next up you go to your domain registrar, I can recommend Dynadot.com if you don't have one

You simply login go to domain settings, look for the DNS records and let it point to your IP It should look something like this

```
A    domain.tld      PublicIP
A    *.domain.tld    PublicIP
```

The `A` refers to IPv4, If you need IPv6 you just add both records again this time with `AAAA`

`domain.tld` should be replaced with your custom domain, the `*.domain.tld` is for all subdomains.

If you have a TTL setting, just put it on the lowest possible value and don't forget to save.

## Set Static IP for Server
You need a Static IP on your internal network so you can open ports on that internal IP without the device switching internal IP randomly

For this you need to login into your router, This can be a pain, If you have no idea I recommend resetting it and use the default password to login.

In the router interface you have to look for Static IP or DHCP reservation or something like that.

run the following command and look at the hardware address or MAC/link/ether address for your network device it should look something like this `ab:cd:f0:12:34:56`

	ip address

Now you need to combine the mac address of the server with a static IP given by you, It might be good to plan out your network create different vlans like 192.168.1.X for your servers 192.168.2.X for your trusted devices 192.168.3.X for your smarthome devices and 192.168.4.X for a free wifi guest network, This way you have a seperated network for your home and servers, you can block all smarthome devices from phoning home by just blocking the subnet with 1 rule and you can seperate guests from your own devices. we are going to assume you made a subnet 192.168.1.X for your servers, and this server is 192.168.1.10.

So Mac Adress `ab:cd:f0:12:34:56` needs to be assigned the local IP of `192.168.1.10`.

Make sure you save, Then reboot your server and it should move over to the assigned local IP.

## Open two ports to your server
For now we are only going to open the ports 80 and 443 for http and https respectively

Still in your router interface you have to look for "port forward", Don't worry about clicking trough the menus, as long as you don't press save anywhere you should be fine :)

If you found the port forwarding screen you need to open ports 80 and 443 over TCP to the local static IP of your server. So in this example case

`192.168.1.10 TCP 80`
`192.168.1.10 TCP 443`

Make sure you save and you don't need to reboot anything for this.

Be careful with opening ports here, I would recommend against opening the SSH or the FTP ports, Keep it local which keeps it somewhat safe :)

Also remember that you don't need to open ports for local services, like mysql or any of the proxy ports, You also don't have to open ports for outgoing connections, It is just for incoming connections.

## Firewall
IPtables is present in the kernel and installed by default We don't use it since we are using Docker and all networks will be managed by the router.

## Enable auto login
To make sure everything is getting started automatically after a reboot you can use autologin

edit the getty service file with the following command

	sudo vim /etc/systemd/system/getty.target.wants/getty@tty1.service

Look for the following line

```
ExecStart=./sbin/agetty -o '-p -- \\u' --noclear - $TERM
```

And change it into this

```
ExecStart=-/sbin/agetty -o '-p -- \\u' --noclear --autologin USERNAME - $TERM
```

Save and exit

You can restart to ensure you are automatically logged in, It will still ask you for a password, but it should say Automatic Login after boot. If you want to log in with another user simply press enter (wrong password) and you can type another user when needed. press enter for your other user password and you are in!

## Install and Configure SSH
SSH or Secure SHell is a tool to access your server remotely, In our example we will only use it locally by simply not opening any ports in the router.

Simply install OpenSSH

	sudo pacman -S openssh

We need to configure it properly so open the following file

	sudo vim /etc/ssh/sshd_config

Uncomment LogLevel and change it to VERBOSE so we can use it with fail2ban

	LogLevel VERBOSE

Now start and enable the service

	sudo systemctl enable --now sshd

## Install Docker
Docker is the containerization software we are going to use, Every service will get its own container and network.

Install it with the following command

	sudo pacman -S docker

now we just need to enable it with systemctl

	sudo systemctl enable --now docker

Docker should be up and running.

## Install Docker Compose
Docker Compose is a front end for Docker, It allows us to set up containers and networks in an easy way.

Install it with the following command

	sudo pacman -S docker-compose

Docker Compose parses yaml files, which are designed to be simple configuration files, spaces are everything here, so make sure you get the spacing right. It does allow us to set up containers quick and easy.

We configure 3 main things container details, volumes and networks

container or service details contain the name of the container, which image it should pull, when it should restart, etc.

volumes are like mounting points for persistant storage, For stuff like Configuration files, Databases, File storage, Stuff that must remain intact if you ever remove the container and rebuild it.

Networks are like virtual networks on the local network, they seperate the different services that don't need to talk to eachother. Services can be in multiple networks tho.

I hope the configuration files will make everything more clear, but this is everything you need to know for now.

## Shutdown your server
Aside from fail2ban, certbot, banner/motd and updating and the docker services themself your server is done. It is the perfect time to make some changes. mainly becuase the next sections require a lot of typing and the ability to copy/paste will be very welcome.

So shutdown your machine

	sudo shutdown now

Remove the power cable and press the power button this will drain any power left in the machine. Now you can remove any GPU you needed for a video output, remove any peripherals like keyboard, monitors, and give your server a nice place in your house, Just connect the ethernet and power cable and simply press the power button once to start your server again.

Wait a minute and you should be able to login to your server from a different machine over your local network in our example the Local IP was 192.168.1.10 so our command will be the following

	ssh username@192.168.1.10

Fill in your password associated with your username and press enter. If you run into problems here, double check the Firewall, SSH and static IP steps. Also make sure your home vlan has access to your server vlan if you chose to use different vlans.

## Banner and motd
Next up we are going to adjust the banner it will display on SSH password request

	sudo vim /etc/issue

Add in the following content (you might need to \\ the \ ones)

```
  _________
 /         \
|  Whatsup? |
 \_______  /
         \/
        .--.
       |o_o |
       |:_/ |
      //   \ \
     (|     | )
    /'\_   _/`\
    \___)=(___/
```

Then we have the motd which will display after login

for this we will write a little script so it has up to date information

	mkdir ~/Scripts 
	vim ~/Scripts/updatemotd.sh

Add in the following content

```
#!/bin/bash

printf "        \e[34m/#\\                     \e[0;0m_        \e[34m_ _
       \e[34m/###\\   \e[0;0m   __ _ _ __ ___| |__    \e[34m| (_)_ __  _   ___  __
      \e[34m/#####\\    \e[0;0m/ _' | '__/ __| '_ \\   \e[34m| | | '_ \\| | | \\ \\/ /
     \e[34m/##.-.##\\  \e[0;0m| (_| | | | (__| | | |  \e[34m| | | | | | |_| |>  <
    \e[34m/##(   )##\\  \e[0;0m\\__,_|_|  \\___|_| |_|  \e[34m|_|_|_| |_|\\__,_/_/\\_\\
   \e[34m/#.--   --.#\\
  \e[34m/'           '\\
" > /etc/motd
printf "\e[34mMemory Usage: \e[0;0m" >> /etc/motd && free -m | grep Mem | awk '{ printf("%dMB/%dMB ", $3, $2) }' >> /etc/motd && free | grep Mem | awk '{ printf("%.2f%% used\n", $3*100/$2) }' >> /etc/motd
printf "\e[34mDisk Free: \e[0;0m" >> /etc/motd && df -h | awk '$NF=="/"{printf "root %s ", $4}' >> /etc/motd
printf "" && df -h | awk '$NF=="/data"{printf "data %s ", $4}' >> /etc/motd
printf "" && df -h | awk '$NF=="/music"{printf "data %s ", $4}' >> /etc/motd
printf "" && df -h | awk '$NF=="/video"{printf "data %s ", $4}' >> /etc/motd
printf "\n\e[34mLast Boot: \e[0;0m$(uptime)\n" >> /etc/motd
exit
```

Now we are going to create a Systemtimer which will run the script

	sudo vim /etc/systemd/system/updatemotd.service

Add in the following (replace USSERNAME with your username!)

```
[Unit]
Description=Update the motd
Wants=updatemotd.timer

[Service]
Type=oneshot
ExecStart=/bin/bash /home/USERNAME/Scripts/updatemotd.sh

[Install]
WantedBy=multi-user.target
```

Now we need a timer file

	sudo vim /etc/systemd/system/updatemotd.timer

Add in the following content

```
[Unit]
Description=Runs the update motd service every minute
Requires=updatemotd.service

[Timer]
Unit=updatemotd.service
OnBootSec=1min
OnUnitActiveSec=1min

[Install]
WantedBy=timers.target
```

And now we finally start the timer

	sudo systemctl enable --now updatemotd.timer

You can exit the ssh and log back in to see the results

## Install and Configure Certbot
Certbot will create signed SSL certificates for you (For HTTPS websites)

We simply install it with the following command

	sudo pacman -S certbot

First we need to open port 80 temporarily so that certbot can verify you own the domain.

	sudo iptables -I INPUT -p tcp --dport 80 -j ACCEPT

Next we are going to request a certificate for every domain you pointed to this server.

	sudo certbot certonly -d example.com
  
Just answer the questions and repeat the process for every other domain. Pick 1 if it asks for the authentication method.

Now we can restore the firewall settings again by running the following command

	sudo iptables -D INPUT -p tcp -m tcp --dport 80 -j ACCEPT

Your certificates are only valid for 90 days, so we need to update them every once in a while, personally I just run a script every week that makes sure all certificates are valid

Create the script

	vim ~/Scripts/renewcerts.sh

Add in the following content (replace USSERNAME with your username!)

```
#!/bin/bash

docker-compose -f /home/USERNAME/Docker/nginx/docker-compose.yml down
iptables -I INPUT -p tcp --dport 80 -j ACCEPT
certbot renew
iptables -D INPUT -p tcp -m tcp --dport 80 -j ACCEPT
docker-compose -f /home/USERNAME/Docker/nginx/docker-compose.yml up -d
```

Next we need a service which actually executes the script so create the service file

	sudo vim /etc/systemd/system/renewcerts.service

Add in the following content (replace USSERNAME with your username!)

```
[Unit]
Description=Updates all expiring certificates
Wants=renewcerts.timer

[Service]
Type=oneshot
ExecStart=/bin/bash /home/USERNAME/Scripts/renewcerts.sh

[Install]
WantedBy=multi-user.target
```

Next we need a timer which actually calls the service so create the timer file

	sudo vim /etc/systemd/system/renewcerts.timer

Add in the following content

```
[Unit]
Description=Runs the update certificates service every week
Requires=renewcerts.service

[Timer]
OnCalendar=Tue 04:00
Persistent=true

[Install]
WantedBy=timers.target
```

Finally start and enable the timer so it will actually run

	sudo systemctl enable --now renewcerts.timer

## Install and Configure Fail2Ban
Fail2Ban will read your logs for failed login attempts or other fishy things, when it crosses a certain amount of attempts it will block the IP using the firewall.

So first we are going to install fail2ban

	sudo pacman -S fail2ban

Next enable and start the service

	sudo systemctl enable --now fail2ban

Create a file where we will store all of our configuration

	sudo vim /etc/fail2ban/jail.local

Replace the whole contents with the following

```
[INCLUDES]

before = paths-arch.conf

[DEFAULT]

## Settings
ignoreip = 127.0.0.1/8 ::1 192.168.1.1/16 172.20.0.0/16
findtime = 1h
maxretry = 3
bantime = 1h
bantime.increment = true
bantime.rndtime = 3600
bantime.multipliers = 1 3 5 12 24 168 4200 999999999 
bantime.overalljails = true
banaction = action

## SSH Jail
[sshd]
enabled = true
```

For now we only set some default settings you can always overwrite them later on

ignoreip is pretty self explanitory, You can add your own IPs
findtime is the period in which these attempts are are allowed
maxretry is the number of attempts to trigger a ban
bantime is pretty self explanitory
bantime.increment this increments the bantime
bantime.rndtime adds a random time to the bantime to fool scripts
bantime.multipliers sets a custom ban time for repeated offenders
bantime.overalljails makes fail2ban check accross all jails so 1 attempt at 3 services is a ban
banaction is which action to perform, we will write a custom action in the next section
Finally under `[sshd]` we enabled sshd, we have to enable every service we add.
We will add more later depending on the services you want to activate

Save and exit the file

Now we need to create a banaction so fail2ban knows what to do when it needs to ban someone.

	sudo vim /etc/fail2ban/action.d/action.conf
  
Add in the following lines

```
[Definition]
actionban = iptables -I INPUT -s <ip> -j REJECT
            iptables -I FORWARD -s <ip> -j REJECT
            iptables -I DOCKER-USER -s <ip> -j REJECT
	          echo "<matches>" >> /var/log/fail2ban.log

actionunban = iptables -D INPUT -s <ip> -j REJECT
              iptables -D FORWARD -s <ip> -j REJECT
              iptables -D DOCKER-USER -s <ip> -j REJECT
```

Here you can see that everytime it needs to ban someone it will simply execute some iptables commands that reject requests for docker and the host system. 

I also put in the echo so it prints the why in the fail2ban log it can be handy for debugging but you can remove it.

Don't forget to restart the service to make the changes take effect

	sudo systemctl restart fail2ban

You can use fail2ban-client to unban people or view some statistics

	sudo fail2ban-client

Lets add some Aliases so viewing the banned list and unbanning people gets easier

WIP!

## Install and Configure Nginx
eNGINe X is a very powerful webserver, It can do many things and is highly configurable.

We will use it as a reverse proxy to forward requests to the correct container.

Create some folders in your home directory

	mkdir -p ~/Docker/nginx

Now create a docker compose file in that directory

	vim ~/Docker/nginx/docker-compose.yml

Add in the following text

```
version: '3'

services:
  nginx:
    image: nginx:latest
    container_name: nginx
    restart: always
    volumes:
      - /data/nginx/config:/etc/nginx
      - /data/nginx/log/error.log:/var/log/error.log
      - /data/nginx/log/access.log:/var/log/access.log
      - /etc/letsencrypt/:/etc/letsencrypt/
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 80:80
      - 443:443
```

First we need to create a folder for the configuration

	sudo mkdir -p /data/nginx/config

We need to add the nginx configuration file

	sudo vim /data/nginx/config/nginx.conf

Add in the following text

```
# Global Settings
user                 nginx;
pid                  /var/run/nginx.pid;
worker_processes     auto;
worker_rlimit_nofile 65535;

events {
    multi_accept       on;
    worker_connections 1024;
}


# Web Traffic
http {
  charset utf-8;
  sendfile on;
  tcp_nopush on;
  tcp_nodelay on;
  server_tokens off;
  error_log /var/log/error.log warn;
  access_log /var/log/access.log;
  proxy_cache_path /etc/nginx/cache keys_zone=one:500m max_size=1000m;
  types_hash_max_size 2048;
  types_hash_bucket_size 64;
  client_max_body_size 16M;
  client_body_buffer_size 16M;
  client_header_buffer_size 16M;
  large_client_header_buffers 2 16M;

  # MIME
  default_type           application/octet-stream;

  # Limits
  limit_req_log_level    warn;
  limit_req_zone         $binary_remote_addr zone=login:10m rate=10r/m;

  # SSL
  ssl_session_timeout    1d;
  ssl_session_cache      shared:SSL:10m;
  ssl_session_tickets    off;
  ssl_protocols          TLSv1.2 TLSv1.3;
  ssl_stapling           on;
  ssl_stapling_verify    on;

  # Services
  include /etc/nginx/services/*.active;
}
```

We need to create the 2 log files so docker compose won't create directories

	sudo touch /data/nginx/log/access.log /data/nginx/log/error.log

We also nened to create 2 directories which will house our auth

	sudo mkdir -p /data/nginx/config/auth /data/nginx/config/services

Nginx should be good now, lets start the container

	sudo docker-compose -f ~/Docker/nginx/docker-compose.yml up -d 

Now we only need to setup fail2ban for Nginx, so create the following file

	sudo vim /etc/fail2ban/filter.d/nginxx.local

add in the following content

```
[INCLUDES]
before = common.conf

[Definition]
failregex = ^<HOST>.*"(GET|POST).*" (400|401|403|404|405|406|407|423|429) .*$
```

This will ban everyone getting any of the error codes in the failregex line.

Now we need to activate the filter in our main fail2ban configuration file

	sudo vim /etc/fail2ban/jail.local
  
Add the following to the bottom

```
## Nginx
[nginxx]
enabled = true
logpath = /data/nginx/log/access.log
```

Restart fail2ban to make the changes take effect

	sudo systemctl restart fail2ban

## Install and Configure MariaDB
MariaDB is a drop in replacement for MySQL, which is a database used by many services.

First we create some folders

	mkdir -p ~/Docker/mariadb

First we will create a docker compose file

	vim ~/Docker/mariadb/docker-compose.yml

Add in the following text

```
version: '3'

services:
  mariadb:
    image: mariadb:latest
    container_name: mariadb
    restart: always
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
    volumes:
      - /data/mariadb/data:/var/lib/mysql
      - /data/mariadb/config:/etc/mysql/conf.d
      - /data/mariadb/logs:/var/log/mysql
      - /etc/localtime:/etc/localtime:ro

    environment:
      - MYSQL_ROOT_PASSWORD=SETAMYSQLROOTPASSWORDHERE
```

Be sure to set your mysql root password

Lets start the container

	sudo docker-compose -f ~/Docker/mariadb/docker-compose.yml up -d 

Now we only need to initialize the database

	sudo docker exec -it mariadb mariadb-secure-installation

Answer the first 3 questions with No and the rest with Yes

## Install and Configure Nextcloud
Nextcloud is a great application, It is great for storing and syncing data, storing your contacts, bookmarks, passwords, calendar, tasks. It also has a great RSS reader, full office suite and many many more. I truly can't live without it. And neither should you which is why I picked it as the example for this guide

First we need to create a network for the service.

	sudo docker network create --subnet=172.20.30.0/24 nextcloud

Next we are going to create some folders

	mkdir -p ~/Docker/nextcloud

Now we will create a docker compose file

	vim ~/Docker/nextcloud/docker-compose.yml

Add in the following text

```
version: '3'

services:
  nextcloud:
    image: nextcloud
    container_name: nextcloud
    restart: always
    volumes:
      - /etc/localtime:/etc/localtime:ro
      - /data/nextcloud:/var/www/html
    networks:
      nextcloud:
        ipv4_address: 172.20.30.10

networks:
  nextcloud:
    external: true
    name: nextcloud
    ipam:
      config:
        - subnet: 172.20.30.0/24
```

Now we need to add a server block for nextcloud to the Nginx config file so create a file that will be included by the main nginx config file
  
And create the file

	sudo vim /data/nginx/config/services/nextcloud.active

add in the following text

```
server {
  server_name example.com;
  listen      443 ssl;

# Settings
  autoindex off;
  client_max_body_size 5000M;

# Locations
  location / {
    proxy_pass http://nextcloud:80;
    proxy_http_version                 1.1;
    proxy_cache_bypass                 $http_upgrade;
    proxy_ssl_server_name              on;
    proxy_set_header Upgrade           $http_upgrade;
    proxy_set_header X-Real-IP         $remote_addr;
    proxy_set_header X-Forwarded-For   $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header X-Forwarded-Host  $host;
    proxy_set_header X-Forwarded-Port  $server_port;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_connect_timeout              600m;
    proxy_send_timeout                 600m;
    proxy_read_timeout                 600m;
  }

  location /.well-known/carddav {
    return 301 $scheme://$host/remote.php/dav;
  }

  location /.well-known/caldav {
    return 301 $scheme://$host/remote.php/dav;
  }

  location ~ /\.(?!well-known) {
    deny all;
  }

  location = /favicon.ico {
    log_not_found off;
  }

  location = /robots.txt {
    log_not_found off;
  }

# GZip
  gzip            on;
  gzip_vary       on;
  gzip_proxied    any;
  gzip_comp_level 6;
  gzip_types      text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

# Headers
  add_header X-XSS-Protection          "1; mode=block" always;
  add_header X-Content-Type-Options    "nosniff" always;
  add_header X-Frame-Options "SAMEORIGIN";
  add_header Referrer-Policy           "no-referrer-when-downgrade" always;
  add_header Content-Security-Policy   "default-src 'self' http: https: ws: wss: data: blob: 'unsafe-inline'; frame-ancestors 'self';" always;
  add_header Permissions-Policy        "interest-cohort=()" always;
  add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;

# SSL
  ssl_certificate     /etc/letsencrypt/live/example.com/fullchain.pem;
  ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
  ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;
}

# Redirect
server {
  listen 80;
  server_name example.com;
  return 301 https://example.com$request_uri;
}
```

Be sure to replace `example.com` 6 times

Now we need to add nextcloud to the mariadb and nginx networks, because it needs a database and a proxy.

open the nginx compose file

	vim ~/Docker/nginx/docker-compose.yml
  
add the nextcloud network so it looks like this

```
version: '3'

services:
  nginx:
    image: nginx:latest
    container_name: nginx
    restart: always
    volumes:
      - /data/nginx/config:/etc/nginx
      - /data/nginx/log/error.log:/var/log/error.log
      - /data/nginx/log/access.log:/var/log/access.log
      - /etc/letsencrypt/:/etc/letsencrypt/
      - /etc/localtime:/etc/localtime:ro
    ports:
      - 80:80
      - 443:443
      - 8448:8448
    networks:
      nextcloud:
        ipv4_address: 172.20.30.20

networks:
  nextcloud:
    external: true
    name: nextcloud
```

open the mariadb compose file

	vim ~/Docker/mariadb/docker-compose.yml

add the nextcloud network so it looks like this

```
version: '3'

services:
  mariadb:
    image: mariadb:latest
    container_name: mariadb
    restart: always
    command: --transaction-isolation=READ-COMMITTED --binlog-format=ROW --skip-innodb-read-only-compressed
    volumes:
      - /data/mariadb/data:/var/lib/mysql
      - /data/mariadb/config:/etc/mysql/conf.d
      - /data/mariadb/logs:/var/log/mysql
      - /etc/localtime:/etc/localtime:ro

    environment:
      - MYSQL_ROOT_PASSWORD=SETAMYSQLROOTPASSWORDHERE
    networks:
      nextcloud:
        ipv4_address: 172.20.30.30

networks:
  nextcloud:
    external: true
    name: nextcloud
```

Now we are going to start the nextcloud container and restart the nginx and mariadb containers. 

	sudo docker-compose -f ~/Docker/nextcloud/docker-compose.yml up -d
	sudo docker-compose -f ~/Docker/nginx/docker-compose.yml down && sudo docker-compose -f ~/Docker/nginx/docker-compose.yml up -d
	sudo docker-compose -f ~/Docker/mariadb/docker-compose.yml down && sudo docker-compose -f ~/Docker/mariadb/docker-compose.yml up -d

Nextcloud should be accessable from your browser using the domain you chose.
If you have not setup your dns records but only adjusted your .active file for nginx you need to do 2 things first before you go on.
- make sure you have chosen a domain (nextcloud.example.com) and used it in your .active file for nginx.
- make sure you have valid certificates for this domain. if not go back to the certbot part so you can repeat those instructions for your nextcloud domain.

But first we need to create a database, a user and set the permissions.

You can get into the database with the following command (only if mariadb is running)

	sudo docker exec -it mariadb mariadb -p

Enter the Mysql root password you provided during the creation of the mariadb container and you should be in.

Now run the following commands to create a database, create a user with privileges, and make them take effect.

	create database nextcloud;
	create user nextcloud@'172.20.30.10' identified by 'NEXTCLOUDDATABASEPASSWORD';
	grant all privileges on nextcloud.* to nextcloud@'172.20.30.10';
	flush privileges;

You can exit the mysql prompt with `exit;` and then pressing enter.

Now we just need to go to example.com and follow the steps

The Database is nextcloud, the user is nextcloud, The IP is 172.20.30.30:3306 and the password is what you gave it.

We also need to force HTTPS, else it will give problems since we are running from behind a proxy

	sudo vim /data/nextcloud/config/config.php

Add in the following line preferrrably under the overwrite.cli.url line.

```
'overwriteprotocol' => 'https',
```

Nextcloud requires some tasks to be executed every 5 minutes, for that we are going to use systemd timers, like we did for certbot

Create a little script

	vim ~/Scripts/nextcloudcron.sh

add in the following content

```
#!/bin/bash

docker exec -u 33 -t nextcloud php -f /var/www/html/cron.php
exit
```

Create a systemd service

	sudo vim /etc/systemd/system/nextcloudcron.service

Add in the following content

```
[Unit]
Description=Runs Nextcloud Cron
Wants=nextcloudcron.timer

[Service]
Type=oneshot
ExecStart=/bin/bash /home/USERNAME/Scripts/nextcloudcron.sh

[Install]
WantedBy=multi-user.target
```

Create a timer file

	sudo vim /etc/systemd/system/nextcloudcron.timer
  
and add in the following content

```
[Unit]
Description=Runs Nextcloud Cron
Requires=nextcloudcron.service

[Timer]
Unit=nextcloudcron.service
OnBootSec=5min
OnUnitActiveSec=5min

[Install]
WantedBy=timers.target
```

Finally start the timer

	sudo systemctl enable --now nextcloudcron.timer

Nextcloud should be all good and ready to go, You can check the persistance by completely deleting all containers and all volumes, When you start it again all your stuff should still be there :)

Nextcloud has its own Brute force protection, but we still are going to add a fail2ban filter because we want attackers to be banned from all services and not just nextcloud.

So lets create a new nextcloud filter

	sudo vim /etc/fail2ban/filter.d/nextcloud.local

add in the following content

```
[Definition]
failregex=^{"reqId":".*","remoteAddr":".*","app":"core","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)","level":2,"time":".*"}$
          ^{"reqId":".*","level":2,"time":".*","remoteAddr":".*","user":".*","app":".*","method":".*","url":".*","message":"Login failed: '.*' \(Remote IP: '<HOST>'\)".*}$
          ^{"reqId":".*","level":2,"time":".*","remoteAddr":".*","user":".*","app":".*","method":".*","url":".*","message":"Login failed: .* \(Remote IP: <HOST>\).*}$
```

Now add the filter to your main fail2ban config file

	sudo vim /etc/fail2ban/jail.local
  
Add the following to the end of the file

```
## Nextcloud
[nextcloud]
filter = nextcloud
enabled = true
logpath = /data/nextcloud/data/nextcloud.log
```

restart fail2ban to make it take effect

	sudo systemctl restart fail2ban

## Updating the Server
To maintain the system we simply need to update it by running the following command

	sudo pacman -Syu

To update the docker containers we need to pull every container and then restart it, it would be a lot of work every time you want to upgrade. It is easier to create a script instead of manually typing all the commands every time.

So create a file

	vim ~/Scripts/update-docker.sh

put in the following text

```
#!/bin/bash

# Update Nginx
docker-compose -f /home/USERNAME/Docker/nginx/docker-compose.yml pull
docker-compose -f /home/USERNAME/Docker/nginx/docker-compose.yml down
docker-compose -f /home/USERNAME/Docker/nginx/docker-compose.yml up -d --remove-orphans

# Update MariaDB
docker-compose -f /home/USERNAME/Docker/mariadb/docker-compose.yml pull
docker-compose -f /home/USERNAME/Docker/mariadb/docker-compose.yml down
docker-compose -f /home/USERNAME/Docker/mariadb/docker-compose.yml up -d --remove-orphans

# Update Nextcloud
docker-compose -f /home/USERNAME/Docker/nextcloud/docker-compose.yml pull
docker-compose -f /home/USERNAME/Docker/nextcloud/docker-compose.yml down
docker-compose -f /home/USERNAME/Docker/nextcloud/docker-compose.yml up -d --remove-orphans
```

You should add any services you add to this simple script so all containers get updated

Save, exit and then make it executable with the following command

	sudo chmod u+x update-docker.sh

You can now run the script to update all docker containers

## Let the script run with pacman
Why mess around with 2 commands, when you can simply force the docker-update.sh script to run when you update your system using pacman. We can do this very easy with pacman hooks

create a file in the hooks directory for docker

	sudo vim /usr/share/libalpm/hooks/docker.hook

Add in the following text

```
[Trigger]
Operation = Upgrade
Type = Package
Target = *
[Action]
Description = Update Docker Containers
When = PostTransaction
Exec = /bin/bash /home/USERNAME/Scripts/update-docker.sh
```

Save and exit and try to update your system, if you are lucky you have an update and you can see the script in action after the update.

# Terminal

## Installing ZSH
ZSH is a pretty cool lightweight shell that is very configurable, Install it with the following command

	sudo pacman -S zsh

Now we are going to make ZSH the default shell with the following command

	chsh -s $(chsh -l | grep -m1 zsh)

We are going to create zshrc config files in a central config folder for easy backups.

	mkdir ~/Config

then create 2 files in there

	touch ~/Config/zshrc-global ~/Config/zshrc-user

Now we need to create a new user zsh config folder

	mkdir ~/.config/zsh

now we are going to symlink the config files to where zsh expects them to be

	sudo ln -sf ~/Config/zshrc-global /etc/zsh/zshrc
	ln -sf ~/Config/zshrc-user ~/.config/zsh/.zshrc

Now we need to set the dotfile location in zshenv

	sudo vim /etc/zsh/zshenv

Add in the following line

	export ZDOTDIR=~/.config/zsh

Save and exit

ZSH should be functional with a terrible prompt, so lets fix that first.

## Powerlevel10K
Powerlevel10K is a great theme for ZSH, it is very configurable and has a lot of cool features

Sadly it is unmaintained, but it works fine, we can clone the repo into our /usr/share folder.

	sudo git clone https://github.com/romkatv/powerlevel10k.git /usr/share/zsh-theme-powerlevel10k/

Now we need to include the following lines in our zshrc-global file

```
#P10k
source /usr/share/zsh-theme-powerlevel10k/powerlevel10k.zsh-theme
```

And the following lines to our zshrc-user file

```
#P10k
[[ ! -f ~/.config/zsh/.p10k.zsh ]] || source ~/.config/zsh/.p10k.zsh
```

To configure Powerlevel10K you must run the following command

	p10k configure

Have some patience and run trough the interactive configuration

Now we just need to symlink the config file to the expected location

	ln -sf ~/Config/p10k.zsh ~/.config/zsh/.p10k.zsh

When you exit the terminal and start it again it should look all nice :)

## Installing LSD
lsd is like ls with colors, nice icons and other visual cues that help you.

It is in the repos, simply install it with the following command

	sudo pacman -S lsd

You can now run it with lsd, we will later alias ls to lsd in our zsh configuration.

try the following command for example

	lsd -la ~

## Adding ZSH Options and Keybinds
ZSH options change the default behavior so do keybinds

You can add them all or just the ones you like to your zshrc-global file

Give flag suggestions for programs

```
autoload -Uz compinit && compinit
```

Gives you a menu when navigating suggestions

```
zstyle ':completion:*' menu select
zstyle ':completion::complete:*' gain-privileges 1
```

History settings for ZSH

```
export HISTFILE=~/.config/zsh/.zsh_history
export HISTSIZE=1000000
export SAVEHIST=1000000
setopt EXTENDED_HISTORY
setopt HIST_IGNORE_ALL_DUPS
setopt HIST_FIND_NO_DUPS
setopt inc_append_history
```

Press up and down to search to matching history

```
bindkey "^[[A" history-beginning-search-backward
bindkey "^[[B" history-beginning-search-forward
```

Case insensitive tab completion, Also enables cd doc/fo/su to go to /documents/folder/subfolder

```
zstyle ':completion:*' matcher-list 'm:{a-z}={A-Z}' 'r:|[._-]=* r:|=*' 'l:|=* r:|=*'
```

I really don't see the use for Flow Control

```
unsetopt flow_control
```

Fix navigation keys

```
bindkey  "^[[H"   beginning-of-line
bindkey  "^[[F"   end-of-line
bindkey  "^[[3~"  delete-char
bindkey  "^[[5~"  beginning-of-line
bindkey  "^[[6~"  end-of-line
```

## Adding Aliases
Aliases are simply alternatives for a string of text, as an easy example, v will type nvim, and sv will type sudo nvim. You can also chose to remove some or add more.

Simply add the following text to one of your ~/config/zshrc files, user will set it for you, and global will set it for everyone,

```
alias a="awk"
alias b="btrfs"
alias c="cryptsetup"
alias d="docker"
alias e="echo"
alias f="fdisk"
alias g="git"
alias h="history"
alias j="jobs -l"
alias k="kubectl"
alias l="ls -la" 
alias m="man"
alias n="neofetch"
alias o="openssl"
alias p="pacman"
alias r="reboot"
alias s="sudo"
alias t="tail -f"
alias u="uname"
alias v="nvim"
alias w="whence"
alias sudo="sudo "
alias ffs="sudo !!"
alias distro="cat /etc/*-release"
alias hk="cat ~/config/hotkeys"
alias sv="sudo v"
alias md="mkdir -p"
alias tk="take"
alias rmd="rm -rf"
alias sgrep="grep -R -n -H -C 5 --exclude-dir={.git,.svn,CVS} "
alias hgrep="fc -El 0 | grep"
alias please='sudo'
alias phone='ssh houtworm@pinephone'
alias server='ssh houtworm@server'
alias game='gamemoderun mangohud'
alias ytflac="youtube-dl -x --audio-format flac --prefer-ffmpeg"
alias ytmkv="youtube-dl -F"
alias lol='lolcat'
alias cd1="cd .."
alias cd2="cd ../.."
alias cd3="cd ../../.."
alias cd4="cd ../../../.."
alias cd5="cd ../../../../.."
alias cd6="cd ../../../../../.."
alias cd7="cd ../../../../../../.."
alias cd8="cd ../../../../../../../.."
alias cd9="cd ../../../../../../../../.."
alias scls="systemctl list-unit-files"
alias scs="sudo systemctl status "
alias scre="sudo systemctl restart "
alias scst="sudo systemctl start "
alias scsp="sudo systemctl stop "
alias scen="sudo systemctl enable "
alias scenn="sudo systemctl enable now "
alias scdi="sudo systemctl disable "
alias fwd="firewall-cmd"
alias fwdlist="firewall-cmd --list-all-zones"
alias fwdre="firewall-cmd --reload"
alias gi="git init"
alias ga="git add *"
alias gc="git commit -m"
alias gp="git push"
alias me="ifconfig | grep "inet " | cut -b 9- | cut -d" " -f2"
alias allcolor="for i in {0..255}; do print -Pn "%K{$i}  %k%F{$i}${(l:3::0:)i}%f " ${${(M)$((i%6)):#3}:+$"\n"}; done"
alias rainbow="printf "$BBLA\n$BRED\n$BGRE\n$BYEL\n$BBLU\n$BMAG\n$BCYA\n$BWHI\n\n""
alias dud="du -d 1 -h"
alias duf="du -sh *"
alias :q="exit"
alias ls="lsd" 
alias ports="netstat -tulanp"
alias compr="gcc -Wall -Wextra -Werror *.c && ./a.out && rm a.out" 
alias compra="gcc -Wall -Wextra -Werror *.c && ./a.out" 
alias norme="norminette -R CheckForbiddenSourceHeader" 
alias valg="gcc *.c -ggdb3 && valgrind --show-leak-kinds=all --leak-check=full --track-origins=yes ./a.out && rm a.out"
alias valga="gcc *.c -ggdb3 && valgrind --show-leak-kinds=all --leak-check=full --track-origins=yes ./a.out" 
alias normsh="checkbashisms" 
alias banned='sudo fail2ban-client banned | tr -t "[{" " \n" | tr -d ":]},"'
```

## Adding ZSH Functions
ZSH functions are like tiny scripts that perform a task, you can add the ones you think are useful to you to one of the zshrc files, I suggest global so anyone can use them :)

Press Ctrl + Z to bring stuff to the background but also bring stuff back to the foreground instead of typing fg

```
backforeswitch () {
  if [[ $#BUFFER -eq 0 ]]; then
    BUFFER="fg"
    zle accept-line -w
  else
    zle push-input -w
    zle clear-screen -w
  fi
}
zle -N backforeswitch
bindkey '^Z' backforeswitch
```

Press Esc twice to put sudo in front of your previous command.

```
sudoswitch() {
    [[ -z $BUFFER ]] && zle up-history
    if [[ $BUFFER == sudo\ * ]]; then
        LBUFFER="${LBUFFER#sudo }"
    elif [[ $BUFFER == $EDITOR\ * ]]; then
        LBUFFER="${LBUFFER#$EDITOR }"
        LBUFFER="sudoedit $LBUFFER"
    elif [[ $BUFFER == sudoedit\ * ]]; then
        LBUFFER="${LBUFFER#sudoedit }"
        LBUFFER="$EDITOR $LBUFFER"
    else
        LBUFFER="sudo $LBUFFER"
    fi
}
zle -N sudoswitch
bindkey "\e\e" sudoswitch
bindkey -M vicmd '\e\e' sudoswitch
```

Make the man pages all colorful

```
function man() {
    env \
        LESS_TERMCAP_mb=$(printf "\e[1;31m") \
        LESS_TERMCAP_md=$(printf "\e[1;31m") \
        LESS_TERMCAP_me=$(printf "\e[0m") \
        LESS_TERMCAP_se=$(printf "\e[0m") \
        LESS_TERMCAP_so=$(printf "\e[0;37;102m") \
        LESS_TERMCAP_ue=$(printf "\e[0m") \
        LESS_TERMCAP_us=$(printf "\e[4;32m") \
        PAGER="${commands[less]:-$PAGER}" \
        _NROFF_U=1 \
        GROFF_NO_SGR=1 \
        PATH=${HOME}/bin:${PATH} \
    man "$@"
}
```

Creates a TAR archive of a file or folder.

```
function maketar() { tar cvzf "${1%%/}.tar.gz"  "${1%%/}/"; }
```

Create a ZIP archive of a file or folder.

```
function makezip() { zip -r "${1%%/}.zip" "$1" ; }
```

Extracts any type of archive automagically

```
function extract {
 if []; then
    echo "Usage: extract <path/file_name>.<zip|rar|bz2|gz|tar|tbz2|tgz|Z|7z|xz|ex|tar.bz2|tar.gz|tar.xz>"
 else
    if [] ; then
        case $1 in
          *.tar.bz2)   tar xvjf $1    ;;
          *.tar.gz)    tar xvzf $1    ;;
          *.tar.xz)    tar xvJf $1    ;;
          *.lzma)      unlzma $1      ;;
          *.bz2)       bunzip2 $1     ;;
          *.rar)       unrar x -ad $1 ;;
          *.gz)        gunzip $1      ;;
          *.tar)       tar xvf $1     ;;
          *.tbz2)      tar xvjf $1    ;;
          *.tgz)       tar xvzf $1    ;;
          *.zip)       unzip $1       ;;
          *.Z)         uncompress $1  ;;
          *.7z)        7z x $1        ;;
          *.xz)        unxz $1        ;;
          *.exe)       cabextract $1  ;;
          *)           echo "extract: '$1' - unknown archive method" ;;
        esac
    else
        echo "$1 - file does not exist"
    fi
fi
}
```

The git riddle

```
function iacp() {
if []
then
	echo "Usage: iacp <name> <link> <comment>"
else
	git init
	git add *
	git commit -m "$3"
	git remote add $1 $2
	git push --set-upstream $1 master
fi
}
```

The git push

```
function acp() {
if []
then
	echo "Usage: acp <comment>"
else
	git add *
	git commit -m "$1"
	git push
fi
}
```

take or tk = mkdir -p and cd in one

```
function take() {
	md "$1"
	cd "$1"
}
```

Really clear the screen with Ctrl + L

```
clearbetter () {
  BUFFER="clear"
  zle accept-line -w
}
zle -N clearbetter
bindkey '^L' clearbetter
```

Reload ZSH with Ctrl + S

```
resourcezsh () {
  BUFFER="exec -l zsh"
  zle accept-line -w
  BUFFER="clear"
  zle accept-line -w
}
zle -N resourcezsh
bindkey '^S' resourcezsh
```

Exit with Ctrl + Q

```
ctrlqexit () {
  BUFFER=":q"
  zle accept-line -w
}
zle -N ctrlqexit
bindkey '^Q' ctrlqexit
```

Unban IPs with fail2ban

```
unban () {
  sudo fail2ban-client unban $@
}
```

## ZSH Plugins
To add plugins to ZSH we simply need to download them and source the main .zsh file of that plugin in one of your zshrc files. Below are the ones I use

Fast Syntax Highlighting is great, it gives your input color based on brackets, if it is correct or not, etc

	git clone https://github.com/z-shell/F-Sy-H /usr/share/zsh/plugins/F-Sy-H

Now simply source the .zsh file in your global zshrc by adding the following line to it

```
source /usr/share/zsh/plugins/F-Sy-H/F-Sy-H.plugin.zsh
```

Alias Tips helps you remember the aliases you set, if you don't use a set alias it will notify you of the alias in a way that doesn't annoy you.

	git clone https://github.com/djui/alias-tips /usr/share/zsh/plugins/alias-tips

Now simply source the .zsh file in your global zshrc by adding the following line to it

```
source /usr/share/zsh/plugins/alias-tips/alias-tips.plugin.zsh
```

ZSH Autosuggestions is nice, it tries to complete a command based on your history

	git clone https://github.com/zsh-users/zsh-autosuggestions /usr/share/zsh/plugins/zsh-autosuggestions

Now simply source the .zsh file in your global zshrc by adding the following line to it

```
source /usr/share/zsh/plugins/zsh-autosuggestions/zsh-autosuggestions.zsh
```

Also add the following line to the /etc/zsh/zshenv file to drastically speed up this plugin

```
export ZSH_AUTOSUGGEST_MANUAL_REBIND
```

Z is a pretty cool plugin for fast navigation just type z nameoffolder and it will jump to it based on history.

	git clone https://github.com/agkozak/zsh-z /usr/share/zsh/plugins/z

Now simply source the .zsh file in your global zshrc by adding the following line to it

```
source /usr/share/zsh/plugins/z/zsh-z.plugin.zsh
```

Also be sure to set the ZSHZ_DATA variable in /etc/zsh/zshenv by adding the following line to it

```
export ZSHZ_DATA=~/.config/zsh/.z
```

You can install any more you like, just be sure it doesn't slow down your shell.


## Updating ZSH Plugins with Pacman
Updating these plugins is important for compatibility and new features.

Create a file for the script

    vim ~/Scripts/update-zshplugins.sh

Add in the following content

```
	git -C /usr/share/zsh/plugins/F-Sy-H pull
	git -C /usr/share/zsh/plugins/alias-tips pull
	git -C /usr/share/zsh/plugins/zsh-autosuggestions pull
	git -C /usr/share/zsh/plugins/z pull
```

create a file in the pacman hooks directory for zsh plugins

    sudo vim /usr/share/libalpm/hooks/zsh.hook

Add in the following text

```
[Trigger]
Operation = Upgrade
Type = Package
Target = *
[Action]
Description = Update ZSH Plugins
When = PostTransaction
Exec = /bin/bash /home/USERNAME/Scripts/update-zshplugins.sh
```

Save and exit and try to update your system, if you are lucky you have an update and you can see the script in action after the update.

## ZSH Hotkeys
Just a simple overview of all the hotkeys you can use
Up and Down Arrow = Browse history matching current line
Ctrl + A = Go to start of line
Ctrl + B = Move 1 character back
Ctrl + C = Cancel, Stop the current operation.
Ctrl + D = Quit the session
Ctrl + E = Go to end of line
Ctrl + F = Move 1 character forward
Ctrl + G = Nothing
Ctrl + H = DOUBLE Delete Character before the cursor
Ctrl + I = Nothing
Ctrl + J = Nothing
Ctrl + K = Remove everything behind the cursor
Ctrl + L = clear screen
Ctrl + M = Nothing
Ctrl + N = Browse History matching current line
Ctrl + O = Nothing
Ctrl + P = Browse History matching current line
Ctrl + Q = Quit, Types exit and presses enter.
Ctrl + R = Search in History
Ctrl + S = Nothing
Ctrl + T = Nothing
Ctrl + U = Delete everything before the cursor
Ctrl + V = Nothing
Ctrl + W = Delete the word before the cursor
Ctrl + X = Nothing
Ctrl + Y = Undo
Ctrl + Z = toggle program to background and foreground

## Installing Neofetch
Neofetch is a cool tool that shows some system information and a asci art logo of your distro. Install it with the following command

	sudo pacman -S neofetch

Now you can run it by just typing neofetch in a terminal :)

# Programming
Even if you are not into programming and have no interest in learning it, some of these programs might be useful, in the case of Neovim it is a lot easier to read configuration files for example, If you want to get into programming these programs are an absolute must.

## Installing Neovim
We are using Neovim over Vim because Neovim has LSP support

install it using pacman

	sudo pacman -S neovim

We will configure it later, we will start with ZSH

## Neovim Options and Keybinds
We already installed Neovim in the first step, but we still need to configure it the way we want to. First we need create config files

	touch ~/Config/init.vim ~/Config/sysinit.vim

Now we are going to create a symlink for the user config file

	ln -sf ~/Config/init.vim ~/.config/nvim/init.vim

Do the same for the global config file

	sudo ln -sf ~/Config/sysinit.vim /etc/xdg/nvim/sysinit.vim

We can now set some options, I recommend putting them in the system file this way you have the same configuration with the root user

	sv ~/Config/init.vim

Add in the following options, Going over them all is beyond the scope of this guide, But you can look them all up to see what they do exactly.

```
"Options for Neovim"
:setlocal list
set listchars=eol:↓,tab:··▸,trail:●,extends:…,precedes:…,space:·
set updatetime=300
set shortmess+=c
syntax on
set number
set nu rnu
set tabstop=4
set cursorline
set showcmd
filetype indent on
set wildmenu
set showmatch
set incsearch
set hlsearch
set nospell
set spelllang=en_us
set autoindent
set ruler
set confirm
set cmdheight=2
set shiftwidth=4
set noexpandtab
set hidden
set nowrap
set encoding=utf-8
set pumheight=10
set mouse=a
set splitbelow
set splitright
set t_Co=256
set conceallevel=0
set smarttab
set smartindent
set background=dark
set showtabline=0
set noshowmode
set nobackup
set nowritebackup
set clipboard=unnamedplus
set dir=~/tmp,/tmp
set scrolloff=3
set sidescrolloff=7
set sidescroll=1
set ignorecase smartcase
set undofile
set undodir=~/.nvim/undo
set inccommand=nosplit
set signcolumn=number
set backspace=indent,eol,start
set complete-=i
```

Now add some keyboard remaps

```
"Keyboard Remaps"
nmap <C-d> :windo bd<CR>
nmap <A-o> :tabnew<CR>
nmap <A-e> :tabp<CR>
nmap <A-w> :tabn<CR>
nmap <C-o> :ene<CR>
nmap <C-w> :bp<CR>
nmap <C-e> :bn<CR>
nmap <C-n> :vs<CR>
nmap <C-b> :split<CR>
nmap <C-q> :q<CR>
nmap <C-s> :w<CR>
nmap <C-p> :set nu! rnu!<CR>
nmap <A-c> :set list!<CR>
nmap <S-up> :resize +3<CR>
nmap <S-down> :resize -3<CR>
nmap <S-left> :vertical resize +3<CR>
nmap <S-right> :vertical resize -3<CR>
nmap <S-k> :resize +3<CR>
nmap <S-j> :resize -3<CR>
nmap <S-h> :vertical resize +3<CR>
nmap <S-l> :vertical resize -3<CR>
nmap <c-k> :wincmd k<CR>
nmap <c-j> :wincmd j<CR>
nmap <c-h> :wincmd h<CR>
nmap <c-l> :wincmd l<CR>
nmap <c-up> :wincmd k<CR>
nmap <c-down> :wincmd j<CR>
nmap <c-left> :wincmd h<CR>
nmap <c-right> :wincmd l<CR>
nmap <A-j> :m .+1<CR>==
nmap <A-k> :m .-2<CR>==
imap <A-j> <Esc>:m .+1<CR>==gi
imap <A-k> <Esc>:m .-2<CR>==gi
vmap <A-j> :m '>+1<CR>gv=gv
vmap <A-k> :m '<-2<CR>gv=gv
nmap <A-down> :m .+1<CR>==
nmap <A-up> :m .-2<CR>==
imap <A-down> <Esc>:m .+1<CR>==gi
imap <A-up> <Esc>:m .-2<CR>==gi
vmap <A-down> :m '>+1<CR>gv=gv
vmap <A-up> :m '<-2<CR>gv=gv
nmap <A-h> <<
nmap <A-l> >>
imap <A-h> <Esc> <<
imap <A-l> <Esc> >>
vmap <A-h> <
vmap <A-l> >
nmap <A-left> <<
nmap <A-right> >>
imap <A-left> <Esc> <<
imap <A-right> <Esc> >>
vmap <A-left> <
vmap <A-right> >
```

## Neovim Plugins
Vim Plug will be our plugin manager, It will handle most of the work

We will install it system wide

	sudo mkdir /etc/xdg/nvim/autoload
	sudo curl -o /etc/xdg/nvim/autoload/plug.vim https://raw.githubusercontent.com/junegunn/vim-plug/master/plug.vim

Plugins get installed locally so we have to install plugins for every user seperately, We can make it universal, but this will prevent users from adding their own plugins. With our configuration we can set global plugins for everyone and any extra plugins the user may want using their own init.vim file.

We can add plugins to either init.vim or sysinit.vim If you want to Install for yourself or everyone respectively, they do have to be inside a special block like this.

```
call plug#begin()
Plug '<link plugin 1>'
Plug '<link plugin 2>''
call plug#end()
```

You can use PlugUpdate to update and install all selected plugins, PlugClean te remove unselected plugins and, PlugUpgrade to update vim plug itself.

Just add whichever plugin you think will improve your workflow, these are the ones I use.

This plugin will add a ton of icons to Neovim, many of the following plugins will use them, but they are optional.

```
Plug 'kyazdani42/nvim-web-devicons'
```

vim-airline is a very cool plugin that gives some color to Neovim, it gives you a powerline with a ton of information, clear visual cues in which mode you are, where you are in the document, how big it is, what type it is, etc.

```
Plug 'vim-airline/vim-airline'
```

Barbar is a very nice Tab bar for Neovim, It will help you navigate your open tabs visually instead of just guessing the next or previous tab.

```
Plug 'romgrk/barbar.nvim'
```

Nvim-Tree is a directory browser, It is very handy if you want to have an overview of the files in the directory, browse and open them for editing.

```
Plug 'kyazdani42/nvim-tree.lua'
```

Be sure to add the Ctrl + T keybind

```
nmap <C-t> :NvimTreeToggle<CR>
```

Also add the following to your vim.init somewhere after loading the plugins

```
lua require("nvim-tree").setup()
```

Floaterm is a simple terminal which is handy for obvious reasons.

```
Plug 'voldikss/vim-floaterm'
```

Be sure to add the Ctrl + Y keybind

```
nmap <C-y> :FloatermNew --autoclose=2 --wintype=split --height=0.3<CR>
```

Ctrl P is a great plugin that allows you to open files directly with a hotkey typing (part of) the filename you want to open and press enter to edit it directly.

```
Plug 'ctrlpvim/ctrlp.vim'
```

Be sure to add the Ctrl + F Keybind

```
nmap <C-f> :CtrlP<CR>
```

Also add the following between the plugin options somewhere after the plug block

```
let g:ctrlp_map = '<c-/>'
```

Undotree is a great plugin that allows you to look into your undo history see the acctual changes you made and revert to any of the previous stages of your document, You can also go forward after you went back ofcourse.

```
Plug 'mbbill/undotree'
```

Be sure to add the Ctrl + U keymap

```
nmap <C-u> :UndotreeToggle<CR>
```

GitGutter is a great plugin that can show you git diffs and much much more git functionality

```
Plug 'airblade/vim-gitgutter'
```

Be sure to add the CTRL + G toggle as a keymap to your init.vim

```
nmap <C-g> :GitGutterToggle<CR>
```

Nerdcommenter is a handy plugin to comment out lines or a bunch of lines with a single key.

```
Plug 'preservim/nerdcommenter'
```

Be sure to add the keymaps for Ctrl + C in normal and visual mode

```
nmap <C-c> <Plug>NERDCommenterInvert
vmap <C-c> <Plug>NERDCommenterInvert
```

Autopairs is a simple plugin to handle quotes, brackets and other pairs of characters for you.

```
Plug 'jiangmiao/auto-pairs'
```

42Header is something we need to use for school, But I made some little changes to it so it supports changing the ascii art to something like a little Tux :)

```
Plug 'pbondoer/vim-42header'
```

## Neovim LSP Config
Language Server Protocol is used for live code checking using external Language Servers

For the scope of this guide we will set up a few languages but first we need to install the nvim-lspconfig plugin to make it all a bit easier

Add the following line in your init.vim on a empty line inside the plug block

```
Plug 'neovim/nvim-lspconfig'
```

Run the following command to install it

	nvim +PlugUpdate +qall

Now we can simply install language servers using pacman and add them to the init.vim file accordingly

Lets start with Bash, simply install the language server using pacman

	sudo pacman -S bash-language-server

Now add the language server to your init.vim file of choice

```
lua require'lspconfig'.bashls.setup{}
```

Next up is C, Install the language server with pacman

	sudo pacman -S ccls

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.ccls.setup{}
```

Next up is CSS, Install the language server with pacman

	sudo pacman -S vscode-css-languageserver

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.cssls.setup{}
```

Next up is HTML, Install the language server with pacman

	sudo pacman -S vscode-html-languageserver

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.html.setup{}
```

Next up is JS, Install the language server with pacman

	sudo pacman -S deno

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.denols.setup{}
```

Next up is json, Install the language server with pacman

	sudo pacman -S vscode-json-languageserver

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.jsonls.setup{}
```

Next up is Lua, Install the language server with pacman

	sudo pacman -S lua-language-server

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.sumneko_lua.setup{}
```

Next up is Python, Install the language server with pacman

	sudo pacman -S pyright

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.pyright.setup{}
```

Next up is Rust, Install the language server with pacman

	sudo pacman -S rust-analyzer

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.rust_analyzer.setup{}
```

Next up is YAML, Install the language server with pacman

	sudo pacman -S yaml-language-server

And add the language server to your init.vim file of choice

```
lua require'lspconfig'.yamlls.setup{}
```

You can add many many more, just look for nvim plugins online	

## Hotkeys
Just a simple overview of all the hotkeys you can use

```
a = Append, Enter Insert mode 1 character after the cursor
b = Move 1 word backwards, Works with numbers
c = Nothing
d = Delete, Deletes a character, double press it to delete the line, also works with numbers and move commands
e = Nothing
f = Find, Finds a character and jumps to that position
g = Goto, enter a line press g twice and you will jump to the line, double press it to go to the first line
h = Left, Same function as the left arrow, but closer to your hand.
i = Insert, Enter Insert mode on the cursor
j = Down, Same function as the down arrow, but closer to your hand.
k = Up, Same function as the up arrow, but closer to your hand.
l = Right, Same function as the right arrow, but closer to your hand.
m = Bookmark position, press m, then press another character to bind it to, use ' to go to the section
n = Nothing
o = Enter insert mode on a new line below the current line.
p = Paste, Pastes the buffer after the current cursor position
q = Record, Press a key after hitting q to start recording, do some stuff and press q again in normal mode to save the recording, then type @key to repeat the action, type 20@key to do it 20 times.
r = Nothing
s = Nothing
t = Nothing
u = Undo your previous action.
v = Visual mode, Switch to Visual mode to select stuff character for character.
w = Move 1 word forward, works with numbers
x = Delete character under the cursor
y = Yank, Or Copy in recent terms, press it once to copy the selection, press it twice to copy the entire line and include a number to copy that amount of line.
z = Nothing

Shift + Arrows = Resize Splits
A = Append, Enter insert mode at the end of the line.
B = Move 1 whitespace backwards
C = Nothing
D = Delete everything on line after the cursor
E = Nothing
F = Find, Finds a character going backwards and jumps to that position
G = Move to the end of the file
H = Make split smaller horizontally
I = Nothing
J = Make split smaller vertically
K = Make split bigger vertically
L = Make split bigger horizontally
M = Nothing
N = Nothing
O = Nothing
P = Paste before cursor
Q = Enter insert mode on a new line above the current line
R = Replace Characters instead of Inserting them
S = Nothing
T = Nothing
U = Nothing
V = Visual Line mode, Select lines to edit, yank, or manipulate
W  = Move 1 whitespace forward
X = Nothing
Y = Nothing
Z = Double press it to save and exit

0 = Go to beginning of line
~ = Change case of current character
!
@ = enter @ and then type the letter of the recording made with q to play in
# = Highlight the word you are standing on in the rest of the document
$ = Go to end of line
%
^ = Go to the first character on the line
&
*
( = Jump to previous sentence
) = Jump to next sentence
=
-
[
]
{ = Navigate up a codeblock
} = Navigate down a codeblock
' = Go to bookmark saved earlier with m
"
;
:
<
>
,
.
/ search, type, press enter and press n/N to go to the next/previous result
?

Ctrl + Arrows = Change active split
Ctrl + A = increments ints
Ctrl + B = Split window below
Ctrl + C = Comment out line or selection
Ctrl + D = Delete current buffer
Ctrl + E = Next Buffer
Ctrl + F = Find file and open it quickly
Ctrl + G = Toggle Git
Ctrl + H = Navigate around splits to the left
Ctrl + I = Nothing
Ctrl + J = Navigate around splits to below
Ctrl + K = Navigate around splits to up
Ctrl + L = Navigate around splits to the right
Ctrl + M = Toggle invisible characters
Ctrl + N = Split window next
Ctrl + O = Open new Buffer
Ctrl + P = Toggle Numberline
Ctrl + Q = Quit
Ctrl + R = Redo your previous action
Ctrl + S = Save current buffer
Ctrl + T = Toggle directory tree
Ctrl + U = Open undo history
Ctrl + V = Visual Block Mode, Select a custom block of text to manipulate
Ctrl + W = Previous Buffer
Ctrl + X = Decrements ints
Ctrl + Y = Show Terminal
Ctrl + Z = Places the application in the background

Alt + Arrows = move line or selection
Alt + A = Nothing
Alt + B = Nothing
Alt + C = Toggle Invisible Characters
Alt + D = Nothing
Alt + E = Next Tab
Alt + F = Nothing
Alt + G = Nothing
Alt + H = Remove indent for line or selection
Alt + H = Nothing
Alt + I = Move Tab to the Right
Alt + J = Nothing
Alt + J = Move line or selection to the line below
Alt + K = Move line or selection to the line above
Alt + L = Add indent for line or selection
Alt + M = Nothing
Alt + N = Nothing
Alt + O = Open New Tab
Alt + P = Toggle Autopairs
Alt + Q = Nothing
Alt + R = Nothing
Alt + S = Nothing
Alt + T = Nothing
Alt + U = Move Tab to the Left
Alt + V = Nothing
Alt + W = Previous Tab
Alt + X = Nothing
Alt + Y = Nothing
Alt + Z = Nothing
```

## Pacman Hooks for Updating Plugins
It is important that we update our plugins regularly, I will add more later WIP!

## GDB
GDB is the GNU Debugger, It is extremely powerfull, I will add this one later WIP!

## Valgrind
Valgrind is the best memory checker I have used, I will add this one later WIP!

## Installing Geekbench
Geekbench is a very nice benchmarking toolkit for benchmarking your CPU and GPU, It runs on almost everything, So you can compare your PC against your Phone and your Server for example :)

	git clone https://aur.archlinux.org/geekbench.git

Now change the directory to the just downloaded folder

	cd geekbench

Now build and install the package

	makepkg -si

Now you should be able to benchmark your system by running the following commands, There are more beenchmarks available but these 2 are the important ones :)

CPU

	geekbench --cpu

GPU Vulkan

	geekbench --compute vulkan

## Install MPD
MPD is the Media Player Daemon, It is a media player as a service that needs an mpd client to steer it. It is great for a raspberry connected to your receiver for example. I use it on my PC with Ampache installed on my server controlling it.

	sudo pacman -S mpd && systemctl --user enable mpd

If you want media keys to work with MPD

	sudo pacman -S mpd-mpris

# Cleaning up and maintaining the system
Lastly we are going to clean up a bit, We left a lot of mess in your home directory during in the few hours, You can remove all the folders we used for installing the AUR packages, like pamac-aur, nautilus-nextcloud, numix-square-icons, etc

To maintain your system all you have to do is update it, you can run the following command to update your entire system.

	sudo pacman -Syu

If you followed the complete guide and installed Pamac, you can just use pamac to update all packages on your system including the ones from the AUR.

You don't have to update every day, You can ofcourse, But if you want to update every week or every 2 weeks that is fine too, I do think the sweet spot is between 3 days and a week. Unless you don't use the device I would not wait longer than a month with updates, some of the updates are pretty important for the security of the device, Which is the main reason why you MUST update.

You can also remove orphaned packages every once in a while with the following command

	sudo pacman -Rnsc $(pacman -Qqdt)

You do this in pamac by going to the installed tab, then click on orphans and then select all to remove them.

I would be careful with executing commands from the internet, especially the sudo command, It is extremely powerful, You could mess up everything with many simple commands.

If you need extra software, always try the repos first! Nothing wrong with needing something from the AUR, but try to keep it to a minimum, and regularly check the "Foreign Packages" under installed in Pamac to check what AUR packages are still installed, If you see anything you don't recognize, try to remove it, If it is a dependency Pamac will warn you and you can always cancel.

I would recommend against Installing software from git, web, trough scripts, make, curl, wget, etc. Don't unless you absolutely need it and know what you are doing, But by that time I would recommend to just add it to the AUR yourself.

I would also recommend keeping your home directory nice and orderly.