Home | panticz.de

LEGO - Automatic Certificates and HTTPS for everyone.

Install LEGO

LEGO_VERSION=$(curl -s https://api.github.com/repos/go-acme/lego/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
curl -L "https://github.com/go-acme/lego/releases/download/${LEGO_VERSION}/lego_${LEGO_VERSION}_linux_amd64.tar.gz" | tar -xz
sudo mv lego /usr/local/sbin
sudo chown root:root /usr/local/sbin
sudo chmod 644 /usr/local/sbin

LEGO with Hetzner

# https://console.hetzner.cloud/ dSecurity → API tokens → Generate (Read & Write)
export HETZNER_API_TOKEN="xxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxxx"
export HETZNER_PROPAGATION_TIMEOUT=600

LEGO confiuration file

# .lego.yml
accounts:
  default:
    email: mail@example.com
    acceptsTermsOfService: true

challenges:
  hetzner:
    dns:
      provider: hetzner
      #envFile: /root/.lego/hetzner.env
      dnsTimeout: 600

certificates:
  example.com:
    challenge: hetzner
    domains:
      - example.com
      - '*.example.com'
  i.example.com:
    challenge: hetzner
    domains:
      - i.example.com
      - '*.i.example.com'

LEGO CLI

DOMAINS="--domains example.com --domains *.example.com --domains example.com

lego run \
  --dns hetzner \
  --email it@example.com \
  --accept-tos \
  ${DOMAINS}

Debug

lego certificates list
--server https://acme-staging-v02.api.letsencrypt.org/directory \
curl -s -H "Authorization: Bearer $HETZNER_API_TOKEN" "https://api.hetzner.cloud/v1/zones"

Links
https://github.com/go-acme/lego
https://go-acme.github.io/lego/dns/

Create Incus WireGuard container

Create container

CONTAINER=wireguard

# Create Incus container
incus launch images:ubuntu/26.04 ${CONTAINER}

# update APT packages
incus exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt update && apt -y dist-upgrade && apt -y autoremove"

# Install WireGuard
incus exec ${CONTAINER} -- bash -c "export http_proxy=${http_proxy} && apt install -y wireguard iptables iputils-ping"

Configure UDP port forward to wireguard container

PORT=51820
incus config device add ${CONTAINER} udp${PORT} proxy listen=udp:0.0.0.0:${PORT} connect=udp:127.0.0.1:${PORT}

Configure WireGuard

incus shell ${CONTAINER}

cd /etc/wireguard
umask 077;
wg genkey | tee privatekey | wg pubkey > publickey

# /etc/wireguard/wg0.conf
[Interface]
Address = 192.168.8.1/24
ListenPort = 51820
PrivateKey = aI+ohS+Jd5T5lMIDXqvLwp8g6eT6U28bQVS43t5YaU8=
PostUp = iptables -A FORWARD -i %i -j ACCEPT; iptables -A FORWARD -o %i -j ACCEPT; iptables -t nat -A POSTROUTING -o eth0 -j MASQUERADE
PostDown = iptables -D FORWARD -i %i -j ACCEPT; iptables -D FORWARD -o %i -j ACCEPT; iptables -t nat -D POSTROUTING -o eth0 -j MASQUERADE

[Peer]
PublicKey = yD3wRcoQ94Wu9o9WaLzjfA0S2IQrD91E8xxpSiMU6yE=
AllowedIPs = 192.168.8.2/32

Enable and start WireGuard systemd service

# wg-quick up wg0
sudo systemctl enable --now wg-quick@wg0.service

WireGuard Home configuration

Create LetsEncrypt wildcard certificate with LEGO and OpenStack Designate

Download LEGO binary
https://github.com/go-acme/lego/releases/

LEGO_VERSION=$(curl -s https://api.github.com/repos/go-acme/lego/releases/latest | grep '"tag_name"' | cut -d'"' -f4)
curl -L "https://github.com/go-acme/lego/releases/download/${LEGO_VERSION}/lego_${LEGO_VERSION}_linux_amd64.tar.gz" | tar -xz
sudo mv lego /usr/local/sbin
sudo chown root:root /usr/local/sbin
sudo chmod 644 /usr/local/sbin

Request certificate

DOMAIN=example.com
export OS_CLOUD=os-project1
export DESIGNATE_ZONE_NAME="${DOMAIN}."
export OS_REGION_NAME=de-de1

./lego run \
  --email foo@${DOMAIN} \
  --accept-tos \
  --dns designate \
  --domains "*.${DOMAIN}" \
  --domains ${DOMAIN}

List certificates

ls -l .lego/certificates

Convert to p12 file

openssl pkcs12 -passout "pass:" -export -in _.${DOMAIN}.crt -inkey _.${DOMAIN}.key -out _.${DOMAIN}.p12

Debug

export GODEBUG=http2debug=2 
export LEGO_LOG_LEVEL=debug 

# letsencrypt staging server
--server https://acme-staging-v02.api.letsencrypt.org/directory

Links
https://github.com/go-acme/lego/

Sinilink XY6014 modbus control with ESP8266 ESPhome

ESPhome configuration

DAIKIN Altherma M HW

DAIKIN Altherma M HW 200 EKHHE200PCV37 / FERROLI - EGEA TECH LT
https://www.daikin.eu/en_us/products/product.html/EKHHE-PCV37.html
https://www.ferroli.com/media/3540000410_03_EGEA_TECH_200%20LT%20-%20260%20LT%20-%20200%20LT-S%20-%20260%20LT-S.pdf

Manual
https://www.daikin.eu/content/dam/document-library/installation-manuals/heat/domestic-hot-water-heat-pump/EKHHE-PCV37_User,%20Installations%20and%20Maintenance%20Manual_digital.pdf

RS485 module with ESP32
https://de.aliexpress.com/item/1005009583388691.html - TTL Turn RS485 485 to Serial UART Level Mutual Conversion Hardware Automatic Flow Control Board Module XY-017
https://github.com/lorbetzki/Daikin-EKHHE
https://github.com/jcappaert/esphome-daikin-ekhhe
https://www.bizkit.ru/en/2019/02/21/12563/
https://how2electronics.com/how-to-use-modbus-rtu-with-esp32-to-read-sensor-data/

ESPhome
https://esphome.io/guides/troubleshooting/

gPlugM integration in Home Assistant

Manufacter
https://gplug.ch/produkte/gplugm/

Installation
https://gplug.ch/installationsanleitung/gplugmt/

configuration.yaml
https://gplug.ch/blog/integration-gplugm-in-home-assistant/
https://gplug.ch/blog/integration-gplug-in-home-assistent/

homeassistant:
  customize_glob:
    sensor.gplugm_z_ei:
      unit_of_measurement: "kWh"
      device_class: energy
      state_class: total_increasing
      last_reset: 1970-01-01T00:00:00+00:00
    sensor.gplugm_z_ei1:
      unit_of_measurement: "kWh"
    sensor.gplugm_z_ei2:
      unit_of_measurement: "kWh"
    sensor.gplugm_z_eo:
      unit_of_measurement: "kWh"
      device_class: energy
      state_class: total_increasing
      last_reset: 1970-01-01T00:00:00+00:00
    sensor.gplugm_z_eo1:
      unit_of_measurement: "kWh"
    sensor.gplugm_z_eo2:
      unit_of_measurement: "kWh" 
    sensor.gplugm_z_i1:
      unit_of_measurement: "A"
    sensor.gplugm_z_i2:
      unit_of_measurement: "A"
    sensor.gplugm_z_i3:
      unit_of_measurement: "A"
    sensor.gplugm_z_v1:
      unit_of_measurement: "V"
    sensor.gplugm_z_v2:
      unit_of_measurement: "V"
    sensor.gplugm_z_v3:
      unit_of_measurement: "V"
    sensor.gplugm_z_pi:
      unit_of_measurement: "kW"
    sensor.gplugm_z_po:
      unit_of_measurement: "kW"

utility_meter:
  energy_in_daily:
    source: sensor.gplugm_z_ei
    cycle: daily
  energy_in_weekly:
    source: sensor.gplugm_z_ei
    cycle: weekly
  energy_in_monthly:
    source: sensor.gplugm_z_ei
    cycle: monthly
  energy_in_yearly:
    source: sensor.gplugm_z_ei
    cycle: yearly

k9s

Install k9s
https://github.com/derailed/k9s/releases

RELEASE=$(curl -s https://api.github.com/repos/derailed/k9s/releases/latest | jq -r .tag_name)
wget -q https://github.com/derailed/k9s/releases/download/${RELEASE}/k9s_linux_amd64.deb -P /tmp/
sudo dpkg -i /tmp/k9s_linux_amd64.deb

Install k9s with Ansible
https://github.com/derailed/k9s/releases

- hosts: localhost
  tasks:
    - name: Install k9s from https://github.com/derailed/k9s/releases
      become: true
      block:
        - name: Get latest k9s version
          ansible.builtin.uri:
            url: "https://api.github.com/repos/derailed/k9s/releases/latest"
            return_content: yes
          register: k9s_version

        - name: Set k9s version
          ansible.builtin.set_fact:
            k9s_release: "{{ k9s_version.json.tag_name }}"      

        - name: Install k9s binary
          ansible.builtin.apt:
            deb: https://github.com/derailed/k9s/releases/download/{{ k9s_release }}/k9s_linux_amd64.deb

Proton VPN on Ubuntu

Install Proton VPN with Ansible

- name: Install ProtonVPN
  become: true
  block:
    - name: Add protonvpn APT repository
      vars:
        protonvpn_release: 1.0.8
      ansible.builtin.apt:
        deb: https://repo.protonvpn.com/debian/dists/stable/main/binary-all/protonvpn-stable-release_{{ protonvpn_release }}_all.deb

    - name: Install ProtonVPN client
      apt:
        update_cache: true
        name:
          - proton-vpn-gnome-desktop

Links
https://protonvpn.com/support/de/official-linux-vpn-ubuntu

SSH forward traffic and DNS with socks5h

Socks SSH forward internet and DNS
https://datawookie.dev/blog/2023/12/ssh-tunnel-dynamic-port-forwarding/

# local
ssh -R 1080 user@remote

# remote
export http_proxy=socks5h://localhost:1080
export https_proxy=socks5h://localhost:1080
# export HTTPS_PROXY=socks5://localhost:1080/

#echo "nameserver 127.0.0.1" > /etc/resolv.conf

cat < /etc/apt/apt.conf.d/12proxy
Acquire::http::Proxy "socks5h://localhost:1080";
Acquire::https::Proxy "socks5h://localhost:1080";
EOF

cat <> /etc/environment
#export http_proxy=socks5h://localhost:1080
#export https_proxy=socks5h://localhost:1080
export all_proxy=socks5h://localhost:1080
EOF


# Configurte scks5h proxy in Docker
mkdir /etc/systemd/system/docker.service.d
cat < /etc/systemd/system/docker.service.d/proxy.conf
[Service]
Environment="HTTP_PROXY=socks5h://127.0.0.1:1080"
Environment="HTTPS_PROXY=socks5h://127.0.0.1:1080"
EOF
sudo systemctl daemon-reload
sudo systemctl restart docker docker.service


# python
sudo apt install -y python3-socks

# git
git config --global http.proxy 'socks5h://127.0.0.1:1080'


# SSH config
Host my-remote
    HostName my_server.com
    RemoteForward 1080
    ServerAliveInterval 60
    ServerAliveCountMax 3


or optional
# dns2socks
# http(s) / socks export
# https://lib.rs/install/dns2socks
https://gist.github.com/yougg/5d2b3353fc5e197a0917aae0b3287d64

# dns2socks
wget https://github.com/tun2proxy/dns2socks/releases/download/v0.2.0/dns2socks-x86_64-unknown-linux-gnu.zip
dns2socks --socks5-settings socks5://localhost:1080 --force-tcp

OpenStack create VM from ISO image

# create image from iso
openstack image create --file /tmp/ubuntu-24.04.1-live-server-amd64.iso --disk-format iso --progress ubuntu-24.04.1-live-server-amd64.iso

# create volume for the final VM
openstack volume create test-vm1-vol1 --size 10 --bootable

# create temporary installation VM
openstack server create test-vm1-inst --image ubuntu-24.04.1-live-server-amd64.iso --flavor m1.small --key-name test-keypair --network test-network

# attach volume to temporary VM
openstack server add volume test-vm1-inst test-vm1-vol1

# show console url from temporary VM
openstack console url show -c url -f value test-vm1-inst

# install OS in console

# delete temporary VM
openstack server stop test-vm1-inst
openstack server delete test-vm1-inst

# create final VM
openstack server create test-vm1 --volume test-vm1-vol1 --flavor m1.small --key-name test-keypair --network test-network
openstack console url show -c url -f value test-vm1

# remove iso imagge
openstack image delete ubuntu-24.04.1-live-server-amd64.iso

Links
https://openmetal.io/docs/manuals/tutorials/understanding-iso-images