Raspi4 üzerindeki yunohost'u dışarıya açarken yaşadığım sorun

Merhaba, yusuf hocamın videosundan ilham alarak self-host yapmaya karar verdim. Planım raspi4’e kurup daha sonra cloudflare dns kaydını eklemekti ancak muvaffak olamadım. yunohost’un logları bu şekilde

=================================
Base system (basesystem)
=================================

[INFO] Server hardware architecture is bare-metal arm64
  - Server model is Raspberry Pi 4 Model B Rev 1.5

[INFO] Server is running Linux kernel 6.1.21-v8+

[INFO] Server is running Debian 11.10

[INFO] Server is running YunoHost 11.2.8.2 (stable)
  - yunohost version: 11.2.8.2 (stable)
  - yunohost-admin version: 11.2.3 (stable)
  - moulinette version: 11.2 (stable)
  - ssowat version: 11.2 (stable)



=================================
Internet connectivity (ip)
=================================

[SUCCESS] Domain name resolution is working!

[SUCCESS] The server is connected to the Internet through IPv4!
  - Global IP: xx.xx.xx.xx
  - Local IP: 192.168.2.239

[WARNING] The server does not have working IPv6.
  - IPv6 should usually be automatically configured by the system or your provider if it's available. Otherwise, you might need to configure a few things manually as explained in the documentation here: https://yunohost.org/#/ipv6.



=================================
DNS records (dnsrecords)
=================================

[ERROR] Some DNS records are missing or incorrect for domain maindomain.tld (category basic)
  - Please check the documentation at https://yunohost.org/dns_config if you need help configuring DNS records.
  - The following DNS record does not seem to follow the recommended configuration:
    Type: A
    Name: @
    Current value: ['188.114.96.3', '188.114.97.3']
    Expected value: xx.xx.xx.xx
  - The following DNS record does not seem to follow the recommended configuration:
    Type: AAAA
    Name: @
    Current value: ['2a06:98c1:3120::4', '2a06:98c1:3121::4']
    Expected value: None

[WARNING] Some DNS records are missing or incorrect for domain maindomain.tld (category extra)
  - Please check the documentation at https://yunohost.org/dns_config if you need help configuring DNS records.
  - According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: A
    Name: *
    Value: xx.xx.xx.xx
  - According to the recommended DNS configuration, you should add a DNS record with the following info.
    Type: CAA
    Name: @
    Value: 0 issue "letsencrypt.org"

[SUCCESS] Your domains are registered and not going to expire anytime soon.
  - maindomain.tld expires in 362 days.



=================================
Ports exposure (ports)
=================================

[ERROR] Port 22 is not reachable from the outside.
  - Exposing this port is needed for admin features (service ssh)
  - To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[ERROR] Port 25 is not reachable from the outside.
  - Exposing this port is needed for email features (service postfix)
  - To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[ERROR] Port 80 is not reachable from the outside.
  - Exposing this port is needed for web features (service nginx)
  - To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[ERROR] Port 443 is not reachable from the outside.
  - Exposing this port is needed for web features (service nginx)
  - To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[ERROR] Port 587 is not reachable from the outside.
  - Exposing this port is needed for email features (service postfix)
  - To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config

[ERROR] Port 993 is not reachable from the outside.
  - Exposing this port is needed for email features (service dovecot)
  - To fix this issue, you most probably need to configure port forwarding on your internet router as described in https://yunohost.org/isp_box_config



=================================
Web (web)
=================================

[ERROR] Domain maindomain.tld appears unreachable through HTTP from outside the local network.
  - Timed-out while trying to contact your server from the outside. It appears to be unreachable.
    1. The most common cause for this issue is that port 80 (and 443) are not correctly forwarded to your server.
    2. You should also make sure that the service nginx is running
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.



=================================
Email (mail)
=================================

[ERROR] The SMTP mail server cannot send emails to other servers because outgoing port 25 is blocked in IPv4.
  - You should first try to unblock outgoing port 25 in your internet router interface or your hosting provider interface. (Some hosting providers may require you to send them a support ticket for this).
  - Some providers won't let you unblock outgoing port 25 because they don't care about Net Neutrality.
     - Some of them provide the alternative of using a mail server relay though it implies that the relay will be able to spy on your email traffic.
    - A privacy-friendly alternative is to use a VPN *with a dedicated public IP* to bypass these kinds of limits. See https://yunohost.org/#/vpn_advantage
    - You can also consider switching to a more net neutrality-friendly provider

[ERROR] The SMTP mail server is unreachable from the outside on IPv4. It won't be able to receive emails.
  - Could not open a connection on port 25 to your server in IPv4. It appears to be unreachable.
    1. The most common cause for this issue is that port 25 is not correctly forwarded to your server.
    2. You should also make sure that service postfix is running.
    3. On more complex setups: make sure that no firewall or reverse-proxy is interfering.

[ERROR] No reverse DNS is defined in IPv4. Some emails may fail to get delivered or be flagged as spam.
  - You should first try to configure reverse DNS with maindomain.tld in your internet router interface or your hosting provider interface. (Some hosting providers may require you to send them a support ticket for this).
  - Some providers won't let you configure your reverse DNS (or their feature might be broken...). If you are experiencing issues because of this, consider the following solutions:
     - Some ISP provide the alternative of using a mail server relay though it implies that the relay will be able to spy on your email traffic.
    - A privacy-friendly alternative is to use a VPN *with a dedicated public IP* to bypass this kind of limits. See https://yunohost.org/#/vpn_advantage
    - Or it's possible to switch to a different provider

[ERROR] Your IP or domain xx.xx.xx.xx is blacklisted on Spamhaus ZEN
  - The blacklist reason is: "Listed by PBL, see https://check.spamhaus.org/query/ip/xx.xx.xx.xx"
  - After identifying why you are listed and fixing it, feel free to ask for your IP or domain to be removed on https://www.spamhaus.org/zen/

[ERROR] Your IP or domain xx.xx.xx.xx is blacklisted on Barracuda Reputation Block List
  - After identifying why you are listed and fixing it, feel free to ask for your IP or domain to be removed on https://barracudacentral.org/rbl/

[ERROR] Your IP or domain xx.xx.xx.xx is blacklisted on SpamRATS! all
  - The blacklist reason is: "SPAMRATS IP Addresses See: http://www.spamrats.com/bl?xx.xx.xx.xx"
  - After identifying why you are listed and fixing it, feel free to ask for your IP or domain to be removed on http://www.spamrats.com/

[ERROR] Your IP or domain xx.xx.xx.xx is blacklisted on SenderScore Blacklist
  - The blacklist reason is: "Excessive Number of Queries | https://knowledge.validity.com/hc/en-us/articles/20961730681243"
  - After identifying why you are listed and fixing it, feel free to ask for your IP or domain to be removed on https://senderscore.com

[SUCCESS] 0 pending emails in the mail queues



=================================
Services status check (services)
=================================

[SUCCESS] Service dnsmasq is running!

[SUCCESS] Service dovecot is running!

[SUCCESS] Service fail2ban is running!

[SUCCESS] Service mysql is running!

[SUCCESS] Service nginx is running!

[SUCCESS] Service php7.4-fpm is running!

[SUCCESS] Service postfix is running!

[SUCCESS] Service redis-server is running!

[SUCCESS] Service rspamd is running!

[SUCCESS] Service slapd is running!

[SUCCESS] Service ssh is running!

[SUCCESS] Service yunohost-api is running!

[SUCCESS] Service yunohost-firewall is running!

[SUCCESS] Service yunomdns is running!



=================================
System resources (systemresources)
=================================

[SUCCESS] The system still has 7.1 GiB (93%) RAM available out of 7.6 GiB.

[INFO] The system has only 100 MiB swap. You should consider having at least 512 MiB to avoid situations where the system runs out of memory.
  - Please be careful and aware that if the server is hosting swap on an SD card or SSD storage, it may drastically reduce the life expectancy of the device.

[SUCCESS] Storage / (on device /dev/root) still has 24 GiB (90.8%) space left (out of 27 GiB)!

[SUCCESS] Storage /boot (on device /dev/mmcblk0p1) still has 224 MiB (88%) space left (out of 255 MiB)!



=================================
System configurations (regenconf)
=================================

[SUCCESS] All configuration files are in line with the recommended configuration!



=================================
Applications (apps)
=================================

[SUCCESS] All installed apps respect basic packaging practices




A kaydinda neden 2 farkli ip var? CAA kaydinda ben de sorun yasadim bu arada. xx.xx.xx.xx seklinde olan ipleri sen gizlemek mi istedin yoksa cikti boyle mi?

Yunohost + Cloudflare olunca böyle sorunlar çıkıyor. IPV4/6 olarak görünen IP’ler maalesef sunucuya ait değil. Cloudflarenin o anki proxy sunucusuna ait. Ayrıca mail ile ilgili şeyleri de “Proxied” iken çözülmeyecektir. O yüzden Cloudflare’i “DNS Only” modda kullanmak veya hiç kullanmamak lazım.

Olmaması gereken örnek görüntü:

her şeyi komut satırından yaparak öğrenmek istiyorum. yunohost vs. yazılımlara bağlı kalmak istemiyorum. tecrübeniz varsa önerebileceğiniz birşey varmı?

Günün sonunda (yunohost özelinde demiyorum) size bir arayüz sağlayan yardımcı araçlar güzel olabiliyor. Geçtiğimiz seneye kadar salt nginx kullanıyor ve ihtiyacıma göre reverse proxy olarak veya farklı konfigürasyonlarda kullanıyordum. Fakat self-hosted olarak kullanacağım neredeyse tüm uygulamaların docker olarak kullanılabileceğini görünce fikrim bir miktar değişti. Totalde 2 adet araç kullanmış oldum. Dockerları yönetmek için Portainer ve internete arzu ettiğim şekilde açmak, sub-/domainleri yönetmek ve gerektiğinde acces rule koymak için nginx proxy manager aracı.

Eğer yine de her şeyi bu şekilde yapmak isterseniz (güncelleme tercihinize göre) nginx’i stable veya mainline olarak kurup sonra nginx config dosyası düzenlemeye bakacak. Bu konuda da direkt en iyi ve optimal sonucu internette arayıp onu copy+paste yapmak yerine ev inşa eder gibi en basit halinden başlayıp ihtiyaç duyduğunuz şeyleri tek tek eklemenizi tavsiye ederim. Mesela Header’lar ne işe yarıyor, Cloudflare kullandığınızda Real-IP nerden geliyor, moduller ne işi yarıyor, yanına modsecurity kurmak ne kadar etkili vs vs.

3 Likes