diff options
Diffstat (limited to 'COMMAND_LOG.md')
| -rw-r--r-- | COMMAND_LOG.md | 595 |
1 files changed, 595 insertions, 0 deletions
diff --git a/COMMAND_LOG.md b/COMMAND_LOG.md new file mode 100644 index 0000000..e386d19 --- /dev/null +++ b/COMMAND_LOG.md @@ -0,0 +1,595 @@ +# Phase 1: Command Execution Log + +**Session Date:** 2026-10-29 +**Target Host:** `root@miguelpedro.xyz.br` + +--- + +## 1. Local Workspace Inspection +**Command:** +```bash +ls -la /home/mpedro/Repos/my-infra +``` +**Output:** +```text +total 8 +drwxr-xr-x 2 mpedro mpedro 4096 Oct 29 11:48 . +drwxr-xr-x 18 mpedro mpedro 4096 Oct 29 11:48 .. +``` + +--- + +## 2. VPS OS & Connectivity Check +**Command:** +```bash +ssh -o BatchMode=yes -o ConnectTimeout=10 root@miguelpedro.xyz.br "uname -a; cat /etc/os-release; uptime" +``` +**Output:** +```text +Linux dd.vps-kinghost.net 6.12.63+deb13-amd64 #1 SMP PREEMPT_DYNAMIC Debian 6.12.63-1 (2025-12-30) x86_64 GNU/Linux +PRETTY_NAME="Debian GNU/Linux 13 (trixie)" +NAME="Debian GNU/Linux" +VERSION_ID="13" +VERSION="13 (trixie)" +VERSION_CODENAME=trixie +DEBIAN_VERSION_FULL=13.7 +ID=debian +HOME_URL="https://www.debian.org/" +SUPPORT_URL="https://www.debian.org/support" +BUG_REPORT="https://bugs.debian.org/" + 11:49:36 up 53 days, 19:30, 2 users, load average: 0.01, 0.01, 0.00 +``` + +--- + +## 3. Nginx Configuration Inspection +**Command:** +```bash +ssh root@miguelpedro.xyz.br ' +echo "=== NGINX FILES ===" +find /etc/nginx -maxdepth 3 -ls +echo "=== NGINX CONF ===" +cat /etc/nginx/nginx.conf +echo "=== NGINX SITES-ENABLED ===" +head -n 200 /etc/nginx/sites-enabled/* /etc/nginx/conf.d/* 2>/dev/null +' +``` +**Output:** +```text +=== NGINX FILES === + 397806 4 drwxr-xr-x 10 root root 4096 Sep 25 22:13 /etc/nginx + 397811 4 -rw-r--r-- 1 root root 2223 Jun 27 17:25 /etc/nginx/koi-win + 397820 4 drwxr-xr-x 2 root root 4096 Sep 25 22:12 /etc/nginx/sites-enabled + 398212 0 lrwxrwxrwx 1 root root 45 Sep 7 22:19 /etc/nginx/sites-enabled/miguelpedro.xyz.br -> /etc/nginx/sites-available/miguelpedro.xyz.br + 397993 0 lrwxrwxrwx 1 root root 34 Sep 7 17:30 /etc/nginx/sites-enabled/default -> /etc/nginx/sites-available/default + 413109 0 lrwxrwxrwx 1 root root 39 Sep 25 19:52 /etc/nginx/sites-enabled/searxng.conf -> /etc/nginx/sites-available/searxng.conf + 397808 4 -rw-r--r-- 1 root root 1125 Jun 27 17:25 /etc/nginx/fastcgi.conf + 397815 4 -rw-r--r-- 1 root root 1545 Jun 27 17:25 /etc/nginx/nginx.conf + 397814 4 drwxr-xr-x 2 root root 4096 Jun 27 17:33 /etc/nginx/modules-enabled + 397821 4 drwxr-xr-x 2 root root 4096 Sep 25 19:28 /etc/nginx/snippets + 397823 4 -rw-r--r-- 1 root root 217 Jun 27 17:25 /etc/nginx/snippets/snakeoil.conf + 397822 4 -rw-r--r-- 1 root root 423 Jun 27 17:25 /etc/nginx/snippets/fastcgi-php.conf + 397812 8 -rw-r--r-- 1 root root 5527 Jun 27 17:25 /etc/nginx/mime.types + 397809 4 -rw-r--r-- 1 root root 2460 Jun 27 17:25 /etc/nginx/fastcgi_params + 413451 4 drwxr-xr-x 2 root root 4096 Sep 25 22:00 /etc/nginx/default.apps-available + 413452 4 -rw-r--r-- 1 root root 647 Sep 25 22:00 /etc/nginx/default.apps-available/searxng.conf + 397810 4 -rw-r--r-- 1 root root 2837 Jun 27 17:25 /etc/nginx/koi-utf + 397813 4 drwxr-xr-x 2 root root 4096 Jun 27 17:33 /etc/nginx/modules-available + 397818 4 drwxr-xr-x 2 root root 4096 Sep 25 22:17 /etc/nginx/sites-available + 398211 4 -rw-r--r-- 1 root root 227 Sep 7 22:18 /etc/nginx/sites-available/miguelpedro.xyz.br + 397819 8 -rw-r--r-- 1 root root 4543 Sep 25 22:11 /etc/nginx/sites-available/default + 413455 4 -rw-r--r-- 1 root root 1570 Oct 27 21:21 /etc/nginx/sites-available/searxng.conf + 413447 8 -rw-r--r-- 1 root root 4432 Sep 25 22:00 /etc/nginx/sites-available/default.bak + 397825 4 -rw-r--r-- 1 root root 3071 Jun 27 17:25 /etc/nginx/win-utf + 397824 4 -rw-r--r-- 1 root root 2067 Jun 27 17:25 /etc/nginx/uwsgi_params + 397816 4 -rw-r--r-- 1 root root 1545 Jun 27 17:25 /etc/nginx/proxy_params + 413453 4 drwxr-xr-x 2 root root 4096 Sep 25 22:00 /etc/nginx/default.d + 413454 0 lrwxrwxrwx 1 root root 46 Sep 25 22:00 /etc/nginx/default.d/searxng.conf -> /etc/nginx/default.apps-available/searxng.conf + 397807 4 drwxr-xr-x 2 root root 4096 Jun 27 17:33 /etc/nginx/conf.d + 397817 4 -rw-r--r-- 1 root root 2038 Jun 27 17:25 /etc/nginx/scgi_params +=== NGINX CONF === +user www-data; +worker_processes auto; +worker_cpu_affinity auto; +pid /run/nginx.pid; +error_log /var/log/nginx/error.log; +include /etc/nginx/modules-enabled/*.conf; + +events { + worker_connections 768; + # multi_accept on; +} + +http { + sendfile on; + tcp_nopush on; + types_hash_max_size 2048; + server_tokens off; + + include /etc/nginx/mime.types; + default_type application/octet-stream; + + ssl_protocols TLSv1.2 TLSv1.3; + ssl_prefer_server_ciphers off; + + access_log /var/log/nginx/access.log; + + gzip on; + + include /etc/nginx/conf.d/*.conf; + include /etc/nginx/sites-enabled/*; +} +=== NGINX SITES-ENABLED === +==> /etc/nginx/sites-enabled/default <== +server { + # Load configuration files for the default server block. + include /etc/nginx/default.d/*.conf; + + listen 80 default_server; + listen [::]:80 default_server; + + root /var/www/html; + index index.html index.htm index.nginx-debian.html; + server_name _; + + location / { + try_files $uri $uri/ =404; + } +} + +server { + root /var/www/html; + index index.html index.htm index.nginx-debian.html; + server_name www.miguelpedro.xyz.br miguelpedro.xyz.br; # managed by Certbot + + location / { + try_files $uri $uri/ =404; + } + + listen 443 ssl; # managed by Certbot + listen [::]:443 ssl ipv6only=on; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/miguelpedro.xyz.br/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/miguelpedro.xyz.br/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot +} +server { + if ($host = www.miguelpedro.xyz.br) { + return 301 https://$host$request_uri; + } # managed by Certbot + + if ($host = miguelpedro.xyz.br) { + return 301 https://$host$request_uri; + } # managed by Certbot + + listen 80 ; + listen [::]:80 ; + server_name www.miguelpedro.xyz.br miguelpedro.xyz.br; + return 404; # managed by Certbot +} + +==> /etc/nginx/sites-enabled/miguelpedro.xyz.br <== +server { + listen 80; + listen [::]:80; + + server_name example.com www.example.com; + + root /var/www/miguelpedro.xyz.br/html; + index index.html index.htm; + + location / { + try_files $uri $uri/ =404; + } +} + +==> /etc/nginx/sites-enabled/searxng.conf <== +server { + server_name searx.miguelpedro.xyz.br; + + # Disable logging for user privacy + access_log /dev/null; + error_log /dev/null; + + # Security headers + add_header X-Frame-Options "SAMEORIGIN" always; + add_header X-Content-Type-Options "nosniff" always; + add_header Referrer-Policy "no-referrer" always; + add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; + + location / { + uwsgi_pass unix:///usr/local/searxng/run/socket; + + include uwsgi_params; + + uwsgi_param HTTP_HOST $host; + uwsgi_param HTTP_CONNECTION $http_connection; + + # see flaskfix.py + uwsgi_param HTTP_X_SCHEME $scheme; + + # see limiter.py + uwsgi_param HTTP_X_REAL_IP $remote_addr; + uwsgi_param HTTP_X_FORWARDED_FOR $proxy_add_x_forwarded_for; + } + + listen 443 ssl; # managed by Certbot + listen [::]:443 ssl; # managed by Certbot + ssl_certificate /etc/letsencrypt/live/searx.miguelpedro.xyz.br/fullchain.pem; # managed by Certbot + ssl_certificate_key /etc/letsencrypt/live/searx.miguelpedro.xyz.br/privkey.pem; # managed by Certbot + include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot + ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot +} + +server { + if ($host = searx.miguelpedro.xyz.br) { + return 301 https://$host$request_uri; + } # managed by Certbot + + listen 80; + listen [::]:80; + server_name searx.miguelpedro.xyz.br; + return 404; # managed by Certbot +} +``` + +--- + +## 4. Containers, Systemd Services, and SearXNG Processes +**Command:** +```bash +ssh root@miguelpedro.xyz.br ' +echo "=== DOCKER / PODMAN ===" +which docker podman 2>&1 +docker ps -a 2>/dev/null || true +podman ps -a 2>/dev/null || true +echo "=== SYSTEMD SERVICES (RUNNING) ===" +systemctl list-units --type=service --state=running --no-pager +echo "=== SEARXNG PROCESSES & USERS ===" +ps aux | grep -iE "searx|uwsgi|gunicorn|valkey|redis|nginx" +grep -i searx /etc/passwd /etc/group 2>/dev/null || true +' +``` +**Output:** +```text +=== DOCKER / PODMAN === +=== SYSTEMD SERVICES (RUNNING) === + UNIT LOAD ACTIVE SUB DESCRIPTION + cron.service loaded active running Regular background program processing daemon + dbus.service loaded active running D-Bus System Message Bus + getty@tty1.service loaded active running Getty on tty1 + nginx.service loaded active running A high performance web server and a reverse proxy server + serial-getty@hvc0.service loaded active running Serial Getty on hvc0 + ssh.service loaded active running OpenBSD Secure Shell server + systemd-journald.service loaded active running Journal Service + systemd-logind.service loaded active running User Login Management + systemd-timesyncd.service loaded active running Network Time Synchronization + systemd-udevd.service loaded active running Rule-based Manager for Device Events and Files + user@0.service loaded active running User Manager for UID 0 + uwsgi.service loaded active running LSB: Start/stop uWSGI server instance(s) + valkey-server.service loaded active running Advanced key-value store + xe-linux-distribution.service loaded active running LSB: Virtual Machine daemon providing host integration services + +14 loaded units listed. +=== SEARXNG PROCESSES & USERS === +root 790020 0.0 0.0 7176 2684 ? Ss Sep25 0:00 SCREEN -S searx -- sudo -H -u searxng -i +root 790021 0.0 0.2 22076 9852 pts/1 Ss+ Sep25 0:00 sudo -H -u searxng -i +root 790023 0.0 0.0 22076 2872 pts/2 Ss Sep25 0:00 sudo -H -u searxng -i +searxng 790024 0.0 0.1 9040 6176 pts/2 S+ Sep25 0:00 -bash +valkey 791257 0.2 0.4 82992 17544 ? Ssl Sep25 114:21 /usr/bin/valkey-server 127.0.0.1:6379 +root 792532 0.0 0.2 26324 8596 ? Ss Sep25 0:00 nginx: master process /usr/sbin/nginx -g daemon on; master_process on; +searxng 1976899 0.0 0.3 33392 14516 ? S Oct27 0:07 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/searxng.ini --daemonize /var/log/uwsgi/app/searxng.log +searxng 1976907 0.5 5.7 1120264 230328 ? Sl Oct27 12:41 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/searxng.ini --daemonize /var/log/uwsgi/app/searxng.log +searxng 1976909 0.6 5.3 1177624 215760 ? Sl Oct27 14:07 /usr/bin/uwsgi --ini /usr/share/uwsgi/conf/default.ini --ini /etc/uwsgi/apps-enabled/searxng.ini --daemonize /var/log/uwsgi/app/searxng.log +www-data 1976915 0.0 0.3 30464 15108 ? S Oct27 0:02 nginx: worker process +www-data 1976916 0.0 0.3 30064 14700 ? S Oct27 0:02 nginx: worker process +/etc/passwd:searxng:x:988:988:Privacy-respecting metasearch engine:/usr/local/searxng:/bin/bash +/etc/group:sudo:x:27:searxng +/etc/group:searxng:x:988: +``` + +--- + +## 5. Firewall, Listening Ports, and TLS Certificates +**Command:** +```bash +ssh root@miguelpedro.xyz.br ' +echo "=== UFW / IPTABLES / NFTABLES ===" +which ufw iptables nft 2>&1 +ufw status verbose 2>/dev/null || true +iptables -L -n -v 2>/dev/null || true +nft list ruleset 2>/dev/null || true +echo "=== PORTS LISTENING ===" +ss -tulpn +echo "=== CERTBOT / LETSENCRYPT ===" +which certbot acme.sh 2>&1 +certbot certificates 2>/dev/null || true +ls -la /etc/letsencrypt/live/ 2>/dev/null || true +systemctl list-timers --no-pager +' +``` +**Output:** +```text +=== UFW / IPTABLES / NFTABLES === +/usr/sbin/nft +=== PORTS LISTENING === +Netid State Recv-Q Send-Q Local Address:Port Peer Address:PortProcess +tcp LISTEN 0 511 127.0.0.1:6379 0.0.0.0:* users:(("valkey-server",pid=791257,fd=8)) +tcp LISTEN 0 128 0.0.0.0:22 0.0.0.0:* users:(("sshd",pid=8328,fd=6)) +tcp LISTEN 0 511 0.0.0.0:80 0.0.0.0:* users:(("nginx",pid=1976916,fd=6),("nginx",pid=1976915,fd=6),("nginx",pid=792532,fd=6)) +tcp LISTEN 0 511 0.0.0.0:443 0.0.0.0:* users:(("nginx",pid=1976916,fd=8),("nginx",pid=1976915,fd=8),("nginx",pid=792532,fd=8)) +tcp LISTEN 0 128 [::]:22 [::]:* users:(("sshd",pid=8328,fd=7)) +tcp LISTEN 0 511 [::]:80 [::]:* users:(("nginx",pid=1976916,fd=7),("nginx",pid=1976915,fd=7),("nginx",pid=792532,fd=7)) +tcp LISTEN 0 511 [::]:443 [::]:* users:(("nginx",pid=1976916,fd=9),("nginx",pid=1976915,fd=9),("nginx",pid=792532,fd=9)) +tcp LISTEN 0 511 [::1]:6379 [::]:* users:(("valkey-server",pid=791257,fd=9)) +=== CERTBOT / LETSENCRYPT === +/usr/bin/certbot + +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +Found the following certs: + Certificate Name: miguelpedro.xyz.br + Serial Number: 6a472cb5bc749aaaee4dfa3e4c3b0853061 + Key Type: ECDSA + Domains: miguelpedro.xyz.br www.miguelpedro.xyz.br + Expiry Date: 2026-12-07 00:29:40+00:00 (VALID: 38 days) + Certificate Path: /etc/letsencrypt/live/miguelpedro.xyz.br/fullchain.pem + Private Key Path: /etc/letsencrypt/live/miguelpedro.xyz.br/privkey.pem + Certificate Name: searx.miguelpedro.xyz.br + Serial Number: 56f57df7717f294cc377199fce636ebca33 + Key Type: ECDSA + Domains: searx.miguelpedro.xyz.br + Expiry Date: 2026-12-25 00:14:43+00:00 (VALID: 56 days) + Certificate Path: /etc/letsencrypt/live/searx.miguelpedro.xyz.br/fullchain.pem + Private Key Path: /etc/letsencrypt/live/searx.miguelpedro.xyz.br/privkey.pem +- - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - - +total 20 +drwx------ 4 root root 4096 Sep 25 22:13 . +drwxr-xr-x 7 root root 4096 Oct 29 11:49 .. +drwxr-xr-x 2 root root 4096 Sep 7 22:28 miguelpedro.xyz.br +-rw-r--r-- 1 root root 740 Sep 7 22:28 README +drwxr-xr-x 2 root root 4096 Sep 25 22:13 searx.miguelpedro.xyz.br +NEXT LEFT LAST PASSED UNIT ACTIVATES +Thu 2026-10-29 14:22:48 -03 2h 32min Thu 2026-10-29 05:12:54 -03 6h ago apt-daily.timer apt-daily.service +Thu 2026-10-29 16:25:12 -03 4h 35min Thu 2026-10-29 01:34:23 -03 10h ago certbot.timer certbot.service +Thu 2026-10-29 16:47:14 -03 4h 57min Wed 2026-10-28 16:47:14 -03 19h ago systemd-tmpfiles-clean.timer systemd-tmpfiles-clean.service +Fri 2026-10-30 00:00:00 -03 12h Thu 2026-10-29 00:00:11 -03 11h ago dpkg-db-backup.timer dpkg-db-backup.service +Fri 2026-10-30 00:25:43 -03 12h Thu 2026-10-29 00:13:23 -03 11h ago logrotate.timer logrotate.service +Fri 2026-10-30 06:02:52 -03 18h Thu 2026-10-29 06:28:46 -03 5h 21min ago apt-daily-upgrade.timer apt-daily-upgrade.service +Fri 2026-10-30 11:09:18 -03 23h Thu 2026-10-29 10:31:41 -03 1h 18min ago man-db.timer man-db.service +Sun 2026-11-01 03:10:31 -03 2 days Sun 2026-10-25 03:10:14 -03 4 days ago e2scrub_all.timer e2scrub_all.service +Mon 2026-11-02 00:12:12 -03 3 days Mon 2026-10-26 01:17:14 -03 3 days ago fstrim.timer fstrim.service +``` + +--- + +## 6. SearXNG, uWSGI, and Git Installation Details +**Command:** +```bash +ssh root@miguelpedro.xyz.br ' +echo "=== /etc/nginx/default.apps-available/searxng.conf ===" +cat /etc/nginx/default.apps-available/searxng.conf +echo "=== /etc/searxng ===" +ls -la /etc/searxng 2>/dev/null || true +cat /etc/searxng/* 2>/dev/null || true +echo "=== /etc/uwsgi ===" +find /etc/uwsgi -ls 2>/dev/null || true +cat /etc/uwsgi/apps-available/* /etc/uwsgi/apps-enabled/* 2>/dev/null || true +echo "=== /usr/local/searxng ===" +ls -la /usr/local/searxng /usr/local/searxng/* 2>/dev/null || true +echo "=== SEARXNG GIT INFO ===" +git -C /usr/local/searxng/searxng-src status 2>/dev/null || true +git -C /usr/local/searxng/searxng-src remote -v 2>/dev/null || true +git -C /usr/local/searxng/searxng-src log -n 1 2>/dev/null || true +' +``` +**Output:** +```text +=== /etc/nginx/default.apps-available/searxng.conf === +location /searxng { + + uwsgi_pass unix:///usr/local/searxng/run/socket; + + include uwsgi_params; + + uwsgi_param HTTP_HOST $host; + uwsgi_param HTTP_CONNECTION $http_connection; + + # see flaskfix.py + uwsgi_param HTTP_X_FORWARDED_PROTO $scheme; + uwsgi_param HTTP_X_SCRIPT_NAME /searxng; + + # see botdetection/trusted_proxies.py + uwsgi_param HTTP_X_REAL_IP $remote_addr; + uwsgi_param HTTP_X_FORWARDED_FOR $proxy_add_x_forwarded_for; +} + +=== /etc/searxng === +total 16 +drwxr-xr-x 2 root root 4096 Oct 27 21:21 . +drwxr-xr-x 78 root root 4096 Sep 25 22:00 .. +-rw-r--r-- 1 searxng searxng 1458 Oct 27 21:21 limiter.toml +-rw-r----- 1 searxng searxng 486 Oct 27 21:21 settings.yml + +# limiter.toml: +[botdetection] +ipv4_prefix = 32 +ipv6_prefix = 48 +trusted_proxies = [ + '127.0.0.0/8', + '::1', +] +[botdetection.ip_limit] +filter_link_local = false +link_token = false +[botdetection.ip_lists] +block_ip = [] +pass_ip = [] +pass_searxng_org = true + +# settings.yml: +use_default_settings: true + +general: + debug: false + instance_name: "SearXNG" + +search: + safe_search: 0 + autocomplete: "duckduckgo" + formats: + - html + - json + +server: + # Is overwritten by ${SEARXNG_SECRET} + secret_key: "5e12306a0b0172e7b1c417f0b65320ac" + limiter: true + image_proxy: true + base_url: https://searx.miguelpedro.xyz.br/ + +valkey: + # URL to connect valkey database. Is overwritten by ${SEARXNG_VALKEY_URL}. + url: valkey://localhost:6379/0 + +=== /etc/uwsgi === +/etc/uwsgi/apps-enabled/searxng.ini -> /etc/uwsgi/apps-available/searxng.ini +[uwsgi] +uid = searxng +gid = searxng +env = LANG=C.UTF-8 +env = LANGUAGE=C.UTF-8 +env = LC_ALL=C.UTF-8 +chdir = /usr/local/searxng/searxng-src/searx +env = SEARXNG_SETTINGS_PATH=/etc/searxng/settings.yml +disable-logging = true +chmod-socket = 666 +single-interpreter = true +master = true +lazy-apps = true +plugin = python3,http +enable-threads = true +workers = %k +threads = 4 +module = searx.webapp +virtualenv = /usr/local/searxng/searx-pyenv +pythonpath = /usr/local/searxng/searxng-src +socket = /usr/local/searxng/run/socket +buffer-size = 8192 +offload-threads = %k + +=== /usr/local/searxng === +drwxr-xr-x 2 searxng searxng 4096 Oct 27 21:21 run (contains srw-rw-rw- 1 www-data root 0 socket) +drwxrwxr-x 15 searxng searxng 4096 Oct 27 21:20 searxng-src +drwxrwxr-x 5 searxng searxng 4096 Sep 25 21:58 searx-pyenv + +=== SEARXNG GIT INFO === +On branch master (origin: https://github.com/searxng/searxng) +commit b5ed73fcb6c6bda5d4e8b13d1472aa3917f784dc (Tue Oct 27 21:33:35 2026 +0100) +``` + +--- + +## 7. Valkey, Web Roots, Certbot Renewal, Systemd Units, and Packages +**Command:** +```bash +ssh root@miguelpedro.xyz.br ' +echo "=== VALKEY CONFIG ===" +grep -vE "^#|^$" /etc/valkey/valkey.conf 2>/dev/null || true +echo "=== /var/www ===" +find /var/www -maxdepth 3 -ls 2>/dev/null || true +echo "=== /etc/letsencrypt/renewal ===" +head -n 100 /etc/letsencrypt/renewal/* /etc/letsencrypt/options-ssl-nginx.conf 2>/dev/null || true +echo "=== CRONTABS & SYSTEMD CUSTOM UNITS ===" +crontab -l 2>/dev/null || true +ls -la /etc/cron* /var/spool/cron/crontabs 2>/dev/null || true +find /etc/systemd/system -maxdepth 2 -ls 2>/dev/null || true +echo "=== APT MANUAL PACKAGES ===" +apt-mark showmanual +' +``` +**Output:** +```text +=== VALKEY CONFIG === +bind 127.0.0.1 -::1 +protected-mode yes +port 6379 +daemonize yes +pidfile /run/valkey/valkey-server.pid +logfile /var/log/valkey/valkey-server.log +dir /var/lib/valkey +(standard Debian Valkey configuration) + +=== /var/www === + 1922 4 drwxr-xr-x 4 root root 4096 Sep 7 22:19 /var/www + 805 4 drwxr-xr-x 3 root root 4096 Sep 7 22:19 /var/www/miguelpedro.xyz.br + 888 4 drwxr-sr-x 2 root www-data 4096 Sep 7 22:19 /var/www/miguelpedro.xyz.br/html + 1925 4 drwxr-xr-x 2 root root 4096 Sep 7 17:30 /var/www/html + 1928 4 -rw-r--r-- 1 root root 615 Sep 7 17:30 /var/www/html/index.nginx-debian.html + +=== /etc/letsencrypt/renewal === +- miguelpedro.xyz.br.conf (authenticator = nginx, installer = nginx, key_type = ecdsa) +- searx.miguelpedro.xyz.br.conf (authenticator = nginx, installer = nginx, key_type = ecdsa) + +=== APT MANUAL PACKAGES (Key Non-Base Packages) === +build-essential, certbot, git, libffi-dev, libssl-dev, libxslt1-dev, nftables, nginx, +python-is-python3, python3, python3-babel, python3-certbot-nginx, python3-dev, +python3-venv, screen, shellcheck, uwsgi, uwsgi-plugin-python3, valkey-server, zlib1g-dev +``` + +--- + +## 8. Nftables, Web Root Files, uWSGI Defaults, and Sudoers +**Command:** +```bash +ssh root@miguelpedro.xyz.br ' +echo "=== /etc/nftables.conf ===" +cat /etc/nftables.conf 2>/dev/null || true +systemctl status nftables 2>/dev/null || true +echo "=== /var/www files ===" +head -n 50 /var/www/html/* /var/www/miguelpedro.xyz.br/html/* 2>/dev/null || true +echo "=== /etc/default/uwsgi ===" +cat /etc/default/uwsgi 2>/dev/null || true +echo "=== /usr/local/searxng/.profile ===" +cat /usr/local/searxng/.profile 2>/dev/null || true +echo "=== /etc/sudoers.d ===" +ls -la /etc/sudoers.d/ +cat /etc/sudoers.d/* 2>/dev/null || true +' +``` +**Output:** +```text +=== /etc/nftables.conf === +Default empty filter chains (input, forward, output). +nftables.service is loaded but inactive (dead). + +=== /var/www files === +/var/www/html/index.nginx-debian.html (standard Nginx welcome page) +/var/www/miguelpedro.xyz.br/html (empty directory) + +=== /etc/default/uwsgi === +VERBOSE=yes +PRINT_CONFNAMES_IN_INITD_SCRIPT_OUTPUT=no +INHERITED_CONFIG=/usr/share/uwsgi/conf/default.ini + +=== /usr/local/searxng/.profile === +Standard ~/.profile with `source /usr/local/searxng/searx-pyenv/bin/activate` appended at the end. + +=== /etc/sudoers.d === +Only README present. +``` + + +--- + +## 9. Phase 3: Ansible IaC Verification Dry-Run (`--check --diff`) +**Command:** +```bash +.venv/bin/ansible-playbook site.yml --check --diff +``` +**Output Summary:** +```text +PLAY RECAP ********************************************************************* +vps : ok=28 changed=3 unreachable=0 failed=0 skipped=6 rescued=0 ignored=0 +``` +- **Verified 1:1 match (`ok`):** `common` packages, `certbot` timer & certs, `valkey` service, `searxng` user/group/dirs/git/settings.yml/limiter.toml/uwsgi.ini, `nginx.conf`, `default.apps-available/searxng.conf`, and `sites-available/searxng.conf`. +- **Expected cleanups flagged (`changed`):** Removing unused `/etc/nginx/sites-enabled/miguelpedro.xyz.br` stub symlink (`example.com`) and trailing blank lines in `/etc/nginx/sites-available/default`. |