También me puse a acomodar un servidor de XMPP el cual, en pocas palabras, es un protocolo de mensajería instantánea (y más) descentralizado, por lo cual cada quien puede hacer una cuenta en el servidor que quiera y conectarse con cuentas creadas en otro servidor… exacto, como con los correos electrónicos. Y esto está perro porque si tú tienes tu propio server, así como con uno de correo electrónico, puedes controlar qué características tiene, quiénes pueden hacer cuenta, si hay end-to-end encryption (o mínimo end-to-server), entre un montón de otras cosas.

Ahorita este server es SUMISO (compliant en español, jeje) para jalar con la app conversations y con la red social movim, pero realmente funcionaría con casi cualquier cliente de XMPP, amenos que ese cliente implemente algo que no tiene mi server. Y también acomodé un server de Matrix que es muy similar pero es bajo otro protocolo y se siente más como un discord/slack (al menos en el element), muy chingón también.

Si bien aún quedan cosas por hacer sobre estos dos servers que me acomodé (además de hacerles unas entradas para documentar cómo lo hice), quiero moverme a otra cosa que sería acomodar una sección de dibujos, lo cual en teoría es bien sencillo, pero como quiero poder automatizar la publicación de estos, quiero modificar un poco el pyssg para que jale chido para este pex.

Ya por último también quiero moverle un poco al CSS, porque lo dejé en un estado muy culerón y quiero meterle/ajustar unas cosas para que quede más limpio y medianamente bonito… dentro de lo que cabe porque evidentemente me vale verga si se ve como una página del 2000.

The solution? Write a new program “from scratch” in pYtHoN. Yes it is bloated, yes it is in its early stages, but it works just as I want it to work, and I’m pretty happy so far with the results and have with even more ideas in mind to “optimize” and generally clean my wOrKfLoW to post new blog entries. I even thought of using it for posting into a “feed” like gallery for drawings or pictures in general.

I called it pyssg, because it sounds nice and it wasn’t taken in the PyPi. It is just a terminal program that reads either a configuration file or the options passed as flags when calling the program.

It still uses Markdown files because I find them very easy to work with. And instead of just having a “header” and a “footer” applied to each parsed entry, you will have templates (generated with the program) for each piece that I thought made sense (idea taken from blogit): the common header and footer, the common header and footer for each entry and, header, footer and list elements for articles and tags. When parsing the Markdown file these templates are applied and stitched together to make a single HTML file. Also generates an RSS feed and the sitemap.xml file, which is nice.

It might sound convoluted, but it works pretty well, with of course room to improve; I’m open to suggestions, issue reporting or direct contributions here. BTW, it only works on Linux for now (and don’t think on making it work on windows, but feel free to do PR for the compatibility).

That’s it for now, the new RSS feed is available here: https://blog.luevano.xyz/rss.xml.

Note that this is mostly for personal use, so there’s no user/authentication control other than that of SSH. Also, most if not all commands here are run as root.

Prerequisites

I might get tired of saying this (it’s just copy paste, basically)… but similar as before (check my website and mail entries):

• (This time, optional) A domain name if you want to have a “front end” to show your repositories. Got mine on Epik (affiliate link, btw).
  • With a CNAME for “git” and (optionally) “www.git”, or some other name for your sub-domains.
• A VPS or somewhere else to host. I’m using Vultr (also an affiliate link).
  • ssh configured.
  • (Optionally, if doing the domain name thingy) With nginx and certbot setup and running.
  • Of course, git already installed (it should be a must have always).

git server

If not installed already, install the git package:

pacman -S git

On Arch Linux, when you install the git package, a git user is automatically created, so all you have to do is decide where you want to store the repositories, for me, I like them to be on /home/git like if git was a “normal” user. So, create the git folder (with corresponding permissions) under /home and set the git user’s home to /home/git:

mkdir /home/git
chown git:git /home/git
usermod -d /home/git git

Also, the git user is “expired” by default and will be locked (needs a password), change that with:

chage -E -1 git
passwd git

Give it a strong one and remember to use PasswordAuthentication no for ssh (as you should). Create the .ssh/authorized_keys for the git user and set the permissions accordingly:

mkdir /home/git/.ssh
chmod 700 /home/git/.ssh
touch /home/git/.ssh/authorized_keys
chmod 600 /home/git/.ssh/authorized_keys
chown -R git:git /home/git

Now is a good idea to copy over your local SSH public keys to this file, to be able to push/pull to the repositories. Do it by either manually copying it or using ssh‘s built in ssh-copy-id (for that you may want to check your ssh configuration in case you don’t let people access your server with user/password).

Next, and almost finally, we need to edit the git-daemon service, located at /usr/lib/systemd/system/ (called git-daemon@.service):

...
ExecStart=-/usr/lib/git-core/git-daemon --inetd --export-all --base-path=/home/git --enable=receive-pack
...

I just appended --enable=receive-pack and note that I also changed the --base-path to reflect where I want to serve my repositories from (has to match what you set when changing git user’s home).

Now, go ahead and start and enable the git-daemon socket:

systemctl start git-daemon.socket
systemctl enable git-daemon.socket

You’re basically done. Now you should be able to push/pull repositories to your server… except, you haven’t created any repository in your server, that’s right, they’re not created automatically when trying to push. To do so, you have to do the following sequence (assuming you’re “cd‘ed” into the /home/git directory):

mkdir {repo_name}.git
cd {repo_name}.git

Those two lines above will need to be run each time you want to add a new repository to your server (yeah, kinda lame… although there are options to “automate” this, I like it this way).

After that you can already push/pull to your repository. I have my repositories (locally) set up so I can push to more than one remote at the same time (my server, GitHub, GitLab, etc.), which is detailed here.

cgit

This bit is optional if you only wanted a git server (really easy to set up), this is so you can have a web application. This is basically a copy paste of Arch Linux Wiki: Cgit so you can go there and get more in-depth configurations.

Install the cgit and fcgiwrap packages:

pacman -S cgit fcgiwrap

Now, just start and enable the fcgiwrap socket:

systemctl start fcgiwrap.socket
systemctl enable fcgiwrap.socket

Next, the way I configure nginx is creating a separate file {module}.conf (git.conf in this case) under /etc/nginx/sites-available and create a symlink to /etc/nginx/sites-enabled as stated in my nginx setup entry. Add the following lines to your git.conf file:

server {
    listen 80;
    listen [::]:80;
    root /usr/share/webapps/cgit;
    server_name {yoursubdomain}.{yourdomain};
    try_files $uri @cgit;

    location @cgit {
        include fastcgi_params;
        fastcgi_param SCRIPT_FILENAME $document_root/cgit.cgi;
        fastcgi_param PATH_INFO $uri;
        fastcgi_param QUERY_STRING $args;
        fastcgi_param HTTP_HOST $server_name;
        fastcgi_pass unix:/run/fcgiwrap.sock;
    }
}

Where the server_name line depends on you, I have mine setup to git.luevano.xyz and www.git.luevano.xyz. Optionally run certbot --nginx to get a certificate for those domains if you don’t have already.

Now, all that’s left is to configure cgit. Create the configuration file /etc/cgitrc with the following content (my personal options, pretty much the default):

css=/cgit.css
source-filter=/usr/lib/cgit/filters/syntax-highlighting-edited.sh
logo=/cgit.png

enable-http-clone=1
# robots=noindex, nofollow
virtual-root=/

repo.url={url}
repo.path={dir_path}
repo.owner={owner}
repo.desc={short_description}

...

Where you can uncomment the robots line to let web crawlers (like Google’s) to index your git web app. And at the end keep all your repositories (the ones you want to make public), for example for my dotfiles I have:

...
repo.url=.dots
repo.path=/home/git/.dots.git
repo.owner=luevano
repo.desc=These are my personal dotfiles.
...

Otherwise you could let cgit to automatically detect your repositories (you have to be careful if you want to keep “private” repos) using the option scan-path and setup .git/description for each repository. I will add more to my actual configuration, but for now it is useful as it is. For more, you can check cgitrc(5).

Finally, if you want further support for highlighting, other compressed snapshots or support for markdown, checkout the optional dependencies for cgit and also the Arch Wiki goes in detail on how to setup highlighting with two different packages.

This configuration works for local users (users that appear in /etc/passwd), and does not use any type of SQL. And note that most if not all commands executed here are run with root privileges.

More in depth configuration is detailed in the Arch Wiki for each package used here.

Prerequisites

Basically the same as with the website with Nginx and Certbot:

• A domain name. Got mine on Epik (affiliate link, btw).
  • Later we’ll be adding some MX and TXT records.
  • You also need a CNAME for “mail” and (optionally) “www.mail”, or whatever you want to call the sub-domains (although the RFC 2181 states that it NEEDS to be an A record, fuck the police), to actually work and to get SSL certificate (you can also use the SSL certificate obtained if you created a website following my other notes on nginx and certbot) with certbot (just create a mail.conf for nginx, similar to how we created it in the website entry).
• A VPS or somewhere else to host. I’m using Vultr (also an affiliate link).
  • ssh configured.
  • Ports 25, 587 (SMTP), 465 (SMTPS), 143 (IMAP) and 993 (IMAPS) open on the firewall (I use ufw).
  • With nginx and certbot setup and running.

Postfix

Postfix is a “mail transfer agent” which is the component of the mail server that receives and sends emails via SMTP.

Install the postfix package:

pacman -S postfix

We have two main files to configure (inside /etc/postfix): master.cf (master(5)) and main.cf (postconf(5)). We’re going to edit main.cf first either by using the command postconf -e 'setting' or by editing the file itself (I prefer to edit the file).

Note that the default file itself has a lot of comments with description on what each thing does (or you can look up the manual, linked above), I used what Luke’s script did plus some other settings that worked for me.

Now, first locate where your website cert is, mine is at the default location /etc/letsencrypt/live/, so my certdir is /etc/letsencrypt/live/luevano.xyz. Given this information, change {yourcertdir} on the corresponding lines. The configuration described below has to be appended in the main.cf configuration file.

Certificates and ciphers to use for authentication and security:

smtpd_tls_key_file = {yourcertdir}/privkey.pem
smtpd_tls_cert_file = {yourcertdir}/fullchain.pem
smtpd_use_tls = yes
smtpd_tls_auth_only = yes
smtp_tls_security_level = may
smtp_tls_loglevel = 1
smtp_tls_CAfile = {yourcertdir}/cert.pem
smtpd_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_mandatory_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtpd_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
smtp_tls_protocols = !SSLv2, !SSLv3, !TLSv1, !TLSv1.1
tls_preempt_cipherlist = yes
smtpd_tls_exclude_ciphers = aNULL, LOW, EXP, MEDIUM, ADH, AECDH, MD5,
                DSS, ECDSA, CAMELLIA128, 3DES, CAMELLIA256,
                RSA+AES, eNULL

smtp_tls_CApath = /etc/ssl/certs
smtpd_tls_CApath = /etc/ssl/certs

smtpd_relay_restrictions = permit_sasl_authenticated, permit_mynetworks, defer_unauth_destination

Also, for the connection with dovecot, append the next few lines (telling postfix that dovecot will use user/password for authentication):

smtpd_sasl_auth_enable = yes
smtpd_sasl_type = dovecot
smtpd_sasl_path = private/auth
smtpd_sasl_security_options = noanonymous, noplaintext
smtpd_sasl_tls_security_options = noanonymous

Specify the mailbox home (this is going to be a directory inside your user’s home):

home_mailbox = Mail/Inbox/

Pre-configuration to work seamlessly with dovecot and opendkim:

myhostname = {yourdomainname}
mydomain = localdomain
mydestination = $myhostname, localhost.$mydomain, localhost

milter_default_action = accept
milter_protocol = 6
smtpd_milters = inet:127.0.0.1:8891
non_smtpd_milters = inet:127.0.0.1:8891
mailbox_command = /usr/lib/dovecot/deliver

Where {yourdomainname} is luevano.xyz in my case, or if you have localhost configured to your domain, then use localhost for myhostname (myhostname = localhost).

Lastly, if you don’t want the sender’s IP and user agent (application used to send the mail), add the following line:

smtp_header_checks = regexp:/etc/postfix/smtp_header_checks

And create the /etc/postfix/smtp_header_checks file with the following content:

/^Received: .*/     IGNORE
/^User-Agent: .*/   IGNORE

That’s it for main.cf, now we have to configure master.cf. This one is a bit more tricky.

First look up lines (they’re uncommented) smtp inet n - n - - smtpd, smtp unix - - n - - smtp and -o syslog_name=postfix/$service_name and either delete or uncomment them… or just run sed -i "/^\s*-o/d;/^\s*submission/d;/\s*smtp/d" /etc/postfix/master.cf as stated in Luke’s script.

Lastly, append the following lines to complete postfix setup and pre-configure for spamassassin.

smtp unix - - n - - smtp
smtp inet n - y - - smtpd
    -o content_filter=spamassassin
submission inet n - y - - smtpd
    -o syslog_name=postfix/submission
    -o smtpd_tls_security_level=encrypt
    -o smtpd_sasl_auth_enable=yes
    -o smtpd_tls_auth_only=yes
smtps inet n - y - - smtpd
    -o syslog_name=postfix/smtps
    -o smtpd_tls_wrappermode=yes
    -o smtpd_sasl_auth_enable=yes
spamassassin unix - n n - - pipe
    user=spamd argv=/usr/bin/vendor_perl/spamc -f -e /usr/sbin/sendmail -oi -f \${sender} \${recipient}

Now, I ran into some problems with postfix, one being smtps: Servname not supported for ai_socktype, to fix it, as Till posted in that site, edit /etc/services and add:

smtps 465/tcp
smtps 465/udp

Before starting the postfix service, you need to run newaliases first (but you can do a bit of configuration beforehand). Edit the file /etc/postfix/aliases and edit accordingly. I only change the root: you line (where you is the account that will be receiving “root” mail). Check the Arch Wiki for more info and other alternatives/options. After you’re done, run:

postalias /etc/postfix/aliases
newaliases

At this point you’re done configuring postfix and you can already start/enable the postfix service:

systemctl start postfix.service
systemctl enable postfix.service

Dovecot

Dovecot is an IMAP and POP3 server, which is what lets an email application retrieve the mail.

Install the dovecot and pigeonhole (sieve for dovecot) packages:

pacman -S dovecot pigeonhole

On arch, by default, there is no /etc/dovecot directory with default configurations set in place, but the package does provide the example configuration files. Create the dovecot directory under /etc and, optionally, copy the dovecot.conf file and conf.d directory under the just created dovecot directory:

mkdir /etc/dovecot
cp /usr/share/doc/dovecot/example-config/dovecot.conf /etc/dovecot/dovecot.conf
cp -r /usr/share/doc/dovecot/example-config/conf.d /etc/dovecot

As Luke stated, dovecot comes with a lot of “modules” (under /etc/dovecot/conf.d/ if you copied that folder) for all sorts of configurations that you can include, but I do as he does and just edits/creates the whole dovecot.conf file; although, I would like to check each of the separate configuration files dovecot provides I think the options Luke provides are more than good enough.

I’m working with an empty dovecot.conf file. Add the following lines for SSL and login configuration (also replace {yourcertdir} with the same certificate directory described in the Postfix section above, note that the < is required):

ssl = required
ssl_cert = <{yourcertdir}/fullchain.pem
ssl_key = <{yourcertdir}/privkey.pem
ssl_min_protocol = TLSv1.2
ssl_cipher_list = ALL:!RSA:!CAMELLIA:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!SHA1:!SHA256:!SHA384:!LOW@STRENGTH
ssl_prefer_server_ciphers = yes
ssl_dh = </etc/dovecot/dh.pem

auth_mechanisms = plain login
auth_username_format = %n
protocols = $protocols imap

You may notice we specify a file we don’t have under /etc/dovecot: dh.pem. We need to create it with openssl (you should already have it installed if you’ve been following this entry and the one for nginx). Just run (might take a few minutes):

openssl dhparam -out /etc/dovecot/dh.pem 4096

After that, the next lines define what a “valid user is” (really just sets the database for users and passwords to be the local users with their password):

userdb {
    driver = passwd
}

passdb {
    driver = pam
}

Next, comes the mail directory structure (has to match the one described in the Postfix section). Here, the LAYOUT option is important so the boxes are .Sent instead of Sent. Add the next lines (plus any you like):

mail_location = maildir:~/Mail:INBOX=~/Mail/Inbox:LAYOUT=fs
namespace inbox {
    inbox = yes

    mailbox Drafts {
        special_use = \Drafts
        auto = subscribe
        }

    mailbox Junk {
        special_use = \Junk
        auto = subscribe
        autoexpunge = 30d
        }

    mailbox Sent {
        special_use = \Sent
        auto = subscribe
        }

    mailbox Trash {
        special_use = \Trash
        }

    mailbox Archive {
        special_use = \Archive
        }
}

Also include this so Postfix can use Dovecot’s authentication system:

service auth {
    unix_listener /var/spool/postfix/private/auth {
        mode = 0660
        user = postfix
        group = postfix
        }
}

Lastly (for dovecot at least), the plugin configuration for sieve (pigeonhole):

protocol lda {
    mail_plugins = $mail_plugins sieve
}

protocol lmtp {
    mail_plugins = $mail_plugins sieve
}

plugin {
    sieve = ~/.dovecot.sieve
    sieve_default = /var/lib/dovecot/sieve/default.sieve
    sieve_dir = ~/.sieve
    sieve_global_dir = /var/lib/dovecot/sieve/

Where /var/lib/dovecot/sieve/default.sieve doesn’t exist yet. Create the folders:

mkdir -p /var/lib/dovecot/sieve

And create the file default.sieve inside that just created folder with the content:

require ["fileinto", "mailbox"];
if header :contains "X-Spam-Flag" "YES" {
    fileinto "Junk";
}

Now, if you don’t have a vmail (virtual mail) user, create one and change the ownership of the /var/lib/dovecot directory to this user:

grep -q "^vmail:" /etc/passwd || useradd -m vmail -s /usr/bin/nologin
chown -R vmail:vmail /var/lib/dovecot

Note that I also changed the shell for vmail to be /usr/bin/nologin. After that, run:

sievec /var/lib/dovecot/sieve/default.sieve

To compile the configuration file (a default.svbin file will be created next to default.sieve).

Next, add the following lines to /etc/pam.d/dovecot if not already present (shouldn’t be there if you’ve been following these notes):

auth required pam_unix.so nullok
account required pam_unix.so

That’s it for dovecot, at this point you can start/enable the dovecot service:

systemctl start dovecot.service
systemctl enable dovecot.service

OpenDKIM

OpenDKIM is needed so services like G**gle (we don’t mention that name here [[[this is a meme]]]) don’t throw the mail to the trash. DKIM stands for “DomainKeys Identified Mail”.

Install the opendkim package:

pacman -S opendkim

Generate the keys for your domain:

opendkim-genkey -D /etc/opendkim -d {yourdomain} -s {yoursubdomain} -r -b 2048

Where you need to change {yourdomain} and {yoursubdomain} (doesn’t really need to be the sub-domain, could be anything that describes your key) accordingly, for me it’s luevano.xyz and mail, respectively. After that, we need to create some files inside the /etc/opendkim directory. First, create the file KeyTable with the content:

{yoursubdomain}._domainkey.{yourdomain} {yourdomain}:{yoursubdomain}:/etc/opendkim/{yoursubdomain}.private

So, for me it would be:

mail._domainkey.luevano.xyz luevano.xyz:mail:/etc/opendkim/mail.private

Next, create the file SigningTable with the content:

*@{yourdomain} {yoursubdomain}._domainkey.{yourdomain}

Again, for me it would be:

*@luevano.xyz mail._domainkey.luevano.xyz

And, lastly create the file TrustedHosts with the content:

127.0.0.1
::1
10.1.0.0/16
1.2.3.4/24
localhost
{yourserverip}
...

And more, make sure to include your server IP and something like subdomain.domainname.

Next, edit /etc/opendkim/opendkim.conf to reflect the changes (or rather, additions) of these files, as well as some other configuration. You can look up the example configuration file located at /usr/share/doc/opendkim/opendkim.conf.sample, but I’m creating a blank one with the contents:

Domain {yourdomain}
Selector {yoursubdomain}

Syslog Yes
UserID opendkim

KeyFile /etc/opendkim/{yoursubdomain}.private
Socket inet:8891@localhost

Now, change the permissions for all the files inside /etc/opendkim:

chown -R root:opendkim /etc/opendkim
chmod g+r /etc/postfix/dkim/*

I’m using root:opendkim so opendkim doesn’t complain about the {yoursubdomani}.private being insecure (you can change that by using the option RequireSafeKeys False in the opendkim.conf file, as stated here).

That’s it for the general configuration, but you could go more in depth and be more secure with some extra configuration as described in the Arch Wiki entry for OpenDKIM.

Now, just start/enable the opendkim service:

systemctl start opendkim.service
systemctl enable opendkim.service

And don’t forget to add the following TXT records on your domain registrar (these examples are for Epik):

1. DKIM entry: look up your {yoursubdomain}.txt file, it should look something like:

{yoursubdomain}._domainkey IN TXT ( "v=DKIM1; k=rsa; s=email; "
    "p=..."
    "..." )  ; ----- DKIM key mail for {yourdomain}

In the TXT record you will place {yoursubdomain}._domainkey as the “Host” and "v=DKIM1; k=rsa; s=email; " "p=..." "..." in the “TXT Value” (replace the dots with the actual value you see in your file).

2. DMARC entry: just _dmarc.{yourdomain} as the “Host” and "v=DMARC1; p=reject; rua=mailto:dmarc@{yourdomain}; fo=1" as the “TXT Value”.

3. SPF entry: just @ as the “Host” and "v=spf1 mx a:{yoursubdomain}.{yourdomain} - all" as the “TXT Value”.

And at this point you could test your mail for spoofing and more, but you don’t know -yet- how to login (it’s really easy, but I’m gonna state that at the end of this entry).

SpamAssassin

SpamAssassin is just a mail filter to identify spam.

Install the spamassassin package (which will install a bunch of ugly perl packages…):

pacman -S spamassassin

For some reason, the permissions on all spamassassin stuff are all over the place. First, change owner of the executables, and directories:

chown spamd:spamd /usr/bin/vendor_perl/sa-*
chown spamd:spamd /usr/bin/vendor_perl/spam*
chwown -R spamd:spamd /etc/mail/spamassassin

Then, you can edit local.cf (located in /etc/mail/spamassassin) to fit your needs (I only uncommented the rewrite_header Subject ... line). And then you can run the following command to update the patterns and compile them:

sudo -u spamd sa-update
sudo -u spamd sa-compile

And since this should be run periodically, create the service spamassassin-update.service under /etc/systemd/system with the following content:

[Unit]
Description=SpamAssassin housekeeping
After=network.target

[Service]
User=spamd
Group=spamd
Type=oneshot

ExecStart=/usr/bin/vendor_perl/sa-update --allowplugins
SuccessExitStatus=1
ExecStart=/usr/bin/vendor_perl/sa-compile
ExecStart=/usr/bin/systemctl -q --no-block try-restart spamassassin.service

And you could also execute sa-learn to train spamassassin‘s bayes filter, but this works for me. Then create the timer spamassassin-update.timer under the same directory, with the content:

[Unit]
Description=SpamAssassin housekeeping

[Timer]
OnCalendar=daily
Persistent=true

[Install]
WantedBy=timers.target

You can now start/enable the spamassassin-update timer:

systemctl start spamassassin-update.timer
systemctl enable spamassassin-update.timer

Next, you may want to edit the spamassassin service before starting and enabling it, because by default, it could spawn a lot of “childs” eating a lot of resources and you really only need one child. Append --max-children=1 to the line ExecStart=... in /usr/bin/systemd/system/spamassassin.service:

...
ExecStart=/usr/bin/vendor_perl/spamd -x -u spamd -g spamd --listen=/run/spamd/spamd.sock --listen=localhost --max-children=1
...

Finally, start and enable the spamassassin service:

systemctl start spamassassin.service
systemctl enable spamassassin.service

Wrapping up

We should have a working mail server by now. Before continuing check your journal logs (journalctl -xe --unit={unit}, where {unit} could be spamassassin.servicefor example) to see if there was any error whatsoever and try to debug it, it should be a typo somewhere (the logs are generally really descriptive) because all the settings and steps detailed here just (literally just finished doing everything on a new server as of the writing of this text) worked (((it just werks on my machine))).

Now, to actually use the mail service: first of all, you need a normal account (don’t use root) that belongs to the mail group (gpasswd -a user group to add a user user to group group) and that has a password.

Next, to actually login into a mail app/program/whateveryouwanttocallit, you will use the following settings, at least for thunderdbird(I tested in windows default mail app and you don’t need a lot of settings):

• * server: subdomain.domain (mail.luevano.xyz in my case)
• SMTP port: 587
• SMTPS port: 465 (I use this one)
• IMAP port: 143
• IMAPS port: 993 (again, I use this one)
• Connection/security: SSL/TLS
• Authentication method: Normal password
• Username: just your user, not the whole email (david in my case)
• Password: your user password (as in the password you use to login to the server with that user)

All that’s left to do is test your mail server for spoofing, and to see if everything is setup correctly. Go to DKIM Test and follow the instructions (basically click next, and send an email with whatever content to the email that they provide). After you send the email, you should see something like:

(Yes, I blurred a lot in the picture just to be sure, either way what’s important is the list on the bottom part of the image)

Finally, that’s actually it for this entry, if you have any problem whatsoever you have my info down below.

As a side note, (((i use arch btw))) so everything here es aimed at an Arch Linux distro, and I’m doing everything on a VPS. Also note that most if not all commands here are executed with root privileges.

Prerequisites

You will need two things:

• A domain name (duh!). I got mine on Epik (affiliate link, btw).
  • With the corresponding A and AAA records pointing to the VPS’ IPs (“A” record points to the ipv4 address and “AAA” to the ipv6, basically). I have three records for each type: empty one, “www” and “*” for a wildcard, that way “domain.name”, “www.domain.name”, “anythingelse.domain.name” point to the same VPS (meaning that you can have several VPS for different sub-domains).
• A VPS or somewhere else to host it. I’m using Vultr (also an affiliate link).
  • With ssh already configured both on the local machine and on the remote machine.
  • Firewall already configured to allow ports 80 (HTTP) and 443 (HTTPS). I use ufw so it’s just a matter of doing ufw allow 80,443/tcp as root and you’re golden.
  • cron installed if you follow along (you could use systemd timers, or some other method you prefer to automate running commands every X time).

Nginx

You have two options: nginx and nginx-mainline. I prefer nginx-mainline because it’s the “up to date” package even though nginx is labeled to be the “stable” version. Install the package and enable/start the service:

pacman -S nginx-mainline
systemctl enable nginx.service
systemctl start nginx.service

And that’s it, at this point you can already look at the default initial page of nginx if you enter the ip of your server in a web browser. You should see something like this:

As stated in the welcome page, configuration is needed, head to the directory of nginx:

cd /etc/nginx

Here you have several files, the important one is nginx.conf, which as its name implies, contains general configuration of the web server. If you peek into the file, you will see that it contains around 120 lines, most of which are commented out and contains the welcome page server block. While you can configure a website in this file, it’s common practice to do it on a separate file (so you can scale really easily if needed for mor websites or sub-domains).

Inside the nginx.conf file, delete the server blocks and add the lines include sites-enabled/*; (to look into individual server configuration files) and types_hash_max_size 4096; (to get rid of an ugly warning that will keep appearing) somewhere inside the http block. The final nginx.conf file would look something like (ignoring the comments just for clarity, but you can keep them as side notes):

worker_processes 1;

events {
    worker_connections 1024;
}

http {
    include sites-enabled/*;
    include mime.types;
    default_type application/octet-stream;

    sendfile on;

    keepalive_timeout 65;

    types_hash_max_size 4096;
}

Next, inside the directory /etc/nginx/ create the sites-available and sites-enabled, and go into the sites-available one:

mkdir sites-available
mkdir sites-enabled
cd sites-available

Here, create a new .conf file for your website and add the following lines (this is just the sample content more or less):

server {
    listen 80;
    listen [::]:80;

    root /path/to/root/directory;
    server_name domain.name another.domain.name;
    index index.html anotherindex.otherextension;

    location /{
        try_files $uri $uri/ =404;
    }
}

Note several things:

• listen: we’re telling nginx which port to listen to (ipv4 and ipv6, respectively).
• root: the root directory of where the website files (.html, .css, .js, etc. files) are located. I followed Luke’s directory path /var/www/some_folder.
• server_name: the actual domain to “listen” to (for my website it is: server_name luevano.xyz www.luevano.xyz; and for this blog is: server_name blog.luevano.xyz www.blog.luevano.xyz).
• index: what file to serve as the index (could be any .html, .htm, .php, etc. file) when just entering the website.
• location: used in case of different configurations across different URL paths.
  • try_files: tells what files to look for, don’t look into this too much for now.

Then, make a symbolic from this config file to the sites-enabled directory:

ln -s /etc/nginx/sites-available/your_config_file.conf /etc/nginx/sites-enabled

This is so the nginx.conf file can look up the newly created server config. With this method of having each server configuration file separate you can easily “deactivate” any website by just deleting the symbolic link in sites-enabled and you’re good, or just add new configuration files and keep everything nice and tidy.

All you have to do now is restart (or enable and start if you haven’t already) the nginx service (and optionally test the configuration):

nginx -t
systemctl restart nginx

If everything goes correctly, you can now go to your website by typing “domain.name” on a web browser. But you will see a “404 Not Found” page like the following (maybe with different nginx version):

That’s no problem, because it means that the web server it’s actually working. Just add an index.html file with something simple to see it in action. If you keep seeing the 404 page make sure your root line is correct and that the directory/index file exists.

I like to remove the .html and trailing / on the URLs of my website, for that you need to add the following rewrite lines and modify the try_files line (for more: Sean C. Davis: Remove HTML Extension And Trailing Slash In Nginx Config):

server {
    ...
    rewrite ^(/.*)\.html(\?.*)?$ $1$2 permanent;
    rewrite ^/(.*)/$ /$1 permanent;
    ...
    try_files $uri/index.html $uri.html $uri/ $uri =404;
    ...

For more: Arch Linux Wiki: nginx.

Certbot

The only “bad” (bloated) thing about certbot, is that it uses python, but for me it doesn’t matter too much. You may want to look up another alternative if you prefer. Install the packages certbot and certbot-nginx:

pacman -S certbot certbot-nginx

After that, all you have to do now is run certbot and follow the instructions given by the tool:

certbot --nginx

It will ask you for some information, for you to accept some agreements and the names to activate https for. Also, you will want to “say yes” to the redirection from http to https. And that’s it, you can now go to your website and see that you have https active.

Now, the certificate given by certbot expires every 3 months or something like that, so you want to renew this certificate every once in a while. Using cron, you can do this by running:

crontab -e

And a file will be opened where you need to add a new rule for certbot, just append the line: 1 1 1 * * certbot renew (renew on the first day of every month) and you’re good. Alternatively use systemd timers as stated in the Arch Linux Wiki.

For more: Arch Linux Wiki: Certbot.

That’s it, you now have a website with SSL certificate.

Ya lo único que queda es cambiar un poco el formato del blog (y de la página en general), porque en un momento de desesperación puse todo el texto en justificado y pues no se ve chido siempre, entonces queda corregir eso. Y aunque me tomó más tiempo del que quisiera, así nomás quedó, diría un cierto personaje.

El ssg modificado está en mis dotfiles (o directamente aquí).

Por último, también quité las extensiones .html de las URLs, porque se veía bien pitero, pero igual los links con .html al final redirigen a su link sin .html, así que no hay rollo alguno.

Basic concepts

A shell it’s an interface between the user and the kernel. While the kernel it’s the layer that interacts between the shell and the hardware. And you access the shell either via a terminal, or executing a shell script. Note that if you’re using a GUI environment, you need a terminal emulator to actually use a terminal (most Linux distros come with everything needed, so no need to worry).

When using a terminal a blank screen with some text and a cursor that shows you where to type will appear and depending on the shell being used (sh, dash, ksh, bash, zsh, fish, etc.) the prompt will be different. The most common one being of the form user@host:~$, which tells that the user is using host machine and the current working directory is ~ (can be /any/path/ too), and lastly, the $ shows the current privileges of the shell/user using the shell (a $ for normal user and # for root access).

To clear the screen use command clear or simply do Ctrl + l (most terminals let you do this) and to cancel or create a new prompt do Ctrl + c, this also cancels any running program that’s using the terminal (typing q when a program is running also stops the process, sometimes).

Also there are POSIX (portable operating system interface) compliant shells like sh, dash, ksh, etc., that have a standard syntax and are portable to any Unix system. Non POSIX compliant shells (or not necessary fully POSIX compliant) are bash, zsh, fish, etc., that provide a more modern syntax but lack speed on executing scripts.

Common commands/programs

A list of common commands or programs with a short description (for more, do man command or command -h or command --help):

• man: an interface to the system reference manuals.
• pwd: print name of current/working directory.
• cd: change the working directory.
• ls: list directory contents.
• echo: display a line of text. Also, see escape sequences (Bash Prompt HOWTO: Chapter 2. Bash and Bash Prompts: 2.5. Bash Prompt Escape Sequences).
• mkdir: make directories.
• touch: change file timestamps (if no file exists, creates a new blank one).
• cat: concatenate files and print on the standard output.
• mv: move (rename) files.
• rm: remove files or directories.
• rmdir: remove empty directories.
• cp: copy files and directories.
• ln: make links between files (hard or soft, also known as symbolic).
• umask: get or set the file mode creation mask.
• chmod: change file mode bits (change file permissions).
• chown: change file owner and group.
• wc: print newline, word, and byte counts for each file.
• file: determine file type.
• sort: sort lines of text files.
• cut: remove sections from each line of files.
• dd: convert and copy a file (mostly used to make bootable USBs).
• compress: compress data.
• gzip, gunzip, zcat: compress or expand files.
• uname: print system information.
• cal: display a calendar.
• date: print or set the system date and time.
• read: read from standard input into shell variables (also used to read from a file).
• tr: translate or delete characters.
• readonly: set the readonly attribute for variables.
• set: set or unset options and positional parameters.
• unset: unset values and attributes of variables and functions.
• expr: evaluate expressions.
• tput, reset: initialize a terminal or query terminfo database (used for more complex terminal output).
• grep, egrep, fgrep: print lines that match patterns (usually used to find text in a file or some text).
• sleep: delay for a specified amount of time.
• break: exit from for, while, or until loop.
• continue: continue for, while, or until loop.
• logname: print user’s login name.
• write: send a message to another user.
• mesg: display (or do not display) messages from other users.
• return: return from a function or dot script.
• exit: cause the sell to exit.

And some special “commands” or “operators” (for more: gnu: 3.6 Redirections):

• | (pipe): used between two commands and the output from the command from the left serves as input to the command from the right.
• >: redirects output to a file, overwriting the file (or creating a new file).
• >>: redirects output to a file, appending to the file (or creating a new file).

Shell scripting

A shell script is nothing more but a file that contains commands in it; they’re executed in the same order they are present in the file. A shell script file is usually terminated with a .sh extension, independently of the shell being used, but it’s not 100% necessary as in Unix systems, an extension mean nothing, other than distinction (visually) between files. Then one can just have an extension-less file as a script. The script must have execution permissions (chmod +x file), unless shell script is executed in the terminal, where shell could be sh, bash, etc. Comments are created by prepending # to whatever the text should be a comment.

It’s common practice to have the first line as a she-bang (#!), which is just a comment telling the interpreter which shell to execute the script with (usable when having the script in your PATH so you only call the name of the script like any other command/program). A she-bang has the syntax #!/path/to/shell some_other_options, the most common she-bangs being: #!/bin/sh, #!/bin/bash, #!/usr/bin/python, etc.

Also, some people argue that you shouldn’t use absolute paths, since not all Unix operating systems have the same directory structure, or not all programs are going to be installed in the same folder. So a portable she-bang can be made by prepending /usr/bin/env and the specify the program to run, for example: #!/usr/bin/env bash.

Like always… the basic “Hello, world!” script:

#!/bin/sh
echo "Hello, world!"

Three ways of executing this script (assuming the file name is hw):

1. Type in terminal sh hw.
2. Type in terminal ./hw. Requires the file to have execute permissions.
3. Type in terminal hw. Requires the file to have execute permissions. Requires the file to be in your PATH.

Variables

Variables are case sensitive, meaning that my_var and MY_VAR are different and a variable name can only contain letters and numbers (a-z, A-Z and 0-9) or the underscore character _. Can’t contain a space. Variables are called by prepending $ to the variable name.

Like in most programming languages, there are some reserved words like if, select, then, until, while, etc., that can’t be used as variables or as values of variables. For more: D.2 Index of Shell Reserved Words.

There is no need to specify a variable type. Anything surrounded by " will be treated as text. You can use booleans, numbers, text and arrays (the implementation of arrays depends on the shell being used). Make a variable readonly by calling readonly variable_name. Basic syntax:

• Text variables: var="my var".
• Numeric variables: var=123.
• Boolean variables: var=true and var=false.
• Arrays (assuming bash is the shell):
  • var[0]=value1, var[...]=..., var[n]=valuen, etc.
  • var=(value1 ... valuen)
  • Access single values with ${var[index]} and all values with ${var[*]} or ${var[@]}.

There are special variables (for more. tutorialspoint: Unix / Linux - Special Variables):

• $: represents the process ID number, or PID, of the current shell.
• 0: the filename of the current script.
• n: where n can be any whole number, correspond to arguments passed to the script (command arg1 arg2 arg3 argn).
• #: number of arguments supplied to the script.
• *: all the arguments are double quoted.
• @: all the arguments are individually double quoted.
• ?: exit status of the last command executed.
• !: process number of the last background command.

When calling a script, you can pass optional (or required) positional arguments like: command arg1 arg2 arg3 argn.

Note that a variable can also take the output of another command, one common way to do this is using $(command) or `command`, for example: var="$(echo 'this is a command being executed inside the definition of a variable')" which, since the echo command is being run, var="this is a command being executed inside the definition of a variable", which doesn’t seem like much, but there could be any command inside $() or `command`. Note that this is not special to defining variables, could also be used as arguments of another command.

Internal Field Separator (IFS)

This is used by the shell to determine how to do word splitting (how to recognize word boundaries). The default value for IFS consists of whitespace characters (space, tab and newline). This value can ve overridden by setting the variable IFS to something like, for example, :.

Conditionals

Exit status

Any command being run has an exit status, either 0 or 1, if the command has been executed successfully or otherwise (an error), respectively.

if statement

Pretty similar to other programming languages, evaluates an expression to a true or false and executes code as specified. if statements can be nested, and follow normal rules of logical operations. Basic syntax is:

#!/bin/sh
if expression
then
do_something
elif another_expression
then
do_another_thing
else
do_something_else
fi

The expression is usually wrapped around [] or [[]], the first being POSIX compliant and the second bash-specific (and other shells).

Also, some operators to compare things use == for “equals” and > for “greater than”, for example; while in a POSIX compliant shell, = for “equals” and -gt for “greater than” has to be used. For more operators: tutorialspoint: Unix / Linux - Shell Basic Operators (this also covers logical operators and file test operators).

Case statement

A common good alternative to multilevel if statements, enables you to match several values against one variable. Basic syntax is:

case $var in
    pattern1)
        do_something1
        ;;
    pattern2)
        subpattern1)
            do_subsomething1
            ;;
        subpattern2)
            do_subsomething2
            ;;
        *)
    pattern3|pattern4|...|patternN)
        do_something3
        ;;
    patternM)
        do_somethingM
        ;;
    *)
        do_something_default
        ;;
esac

Where the * pattern is not necessary but serves the same purpose as a “default” case.

Loops

Loops enable execution of a set of commands repeatedly. Loops, naturally, can be nested. expression here (in the basic syntax examples) work the same as mentioned in the “if statement” section. For more: tutorialspoint: Unix / Linux - Shell Loop Types.

Loop control

Similar than other programming languages, there are loop controls to interrupt or continue a loop:

* `break` statement.
* `continue` statement.

These statements accept an argument that specify from which loop to exit/continue.

while loop

Enables to execute a set of commands repeatedly until some condition occurs. Basic syntax:

#!/bin/sh
while expression
do
    do_something
done

until loop

Similar to the while loop, the difference is that the while loop is executed as long as a condition is true, but the until loop… until a condition is true. Basic syntax (similar to while loop):

#!/bin/sh
until expression
do
    do_something
done

for loop

Operates on lists of items. It repeats a set of commands for every item in a list. Basic syntax:

#!/bin/sh
for var in word1 word2 ... wordN
do
    do_something_with_var
done

Where var is the current value (word1, word2, etc.) in the loop and the expression after for can refer to an array, or the output of a command that outputs a list of things, etc.

select loop

Provides an easy way to create a numbered menu from which users can select options. Basic syntax (similar to for loop):

select var in word1 word2 ... wordN
do
    do_something_with_var
done

Meta characters

Meta characters are used to execute several commands on a single line (depending on what it’s needed). The most used meta characters to accomplish this are semi-colon ;, double ampersand && and double “pipe” ||.

• ;: is used to finish one command (similar to some programming languages), after the command on the left of ; is finished (whatever the exit code is), the command on the right will be executed.
• &&: similar to ;, but only if the command on the left exits with code 0 (success).
• ||: similar to &&, but for exit code 1(error).

Functions

Enable to break down the overall functionality of a script into smaller, logical subsections, which can then be called upon to perform their individual tasks when needed (like in any other programming language…). For more: tutorialspoint: Unix / Linux - Shell Functions. Basic syntax:

#!/bin/sh
function_name () {
    do_something
}

Functions can also take arguments and can access their individual arguments (each function will have a different “storage” for their arguments). Functions can also be nested. Here exit will not only will finish the function code, but also the shell script that called it, instead use return plus an exit code to just exit the function.

(Basic) commands

A list of basic commands and small explanation (note that options are started with either - or --, depending on the program, but most of the time - is used for letter options and -- for word options, -l vs --list for example):

• pwd: “print working directory”, full absolute path to the current directory.
• cd: “change directory”, followed by the absolute or relative path of the directory to change to.
  • Absolute path is started with /, while a relative path is started with ./ or just the name of the folder.
  • Use .. (two dots) to go up one directory.
  • An abbreviation of /home/username is ~ (tilde).
• ls: “list” files and directories in current directory, or specify a directory from which to show the list after typing ls. Has many options, the most common ones being:
  • l: use long listing format.
  • r or reverse: reverse order while sorting.
  • s: sort by file size, largest first.
  • a or all: do not ignore entries starting with ..
• mkdir: “make directory”, create a new directory with specified name.
• touch: create new (empty) files.
• cp: “copy” files or directories (using option r for recursive). Requires file/directory to copy and destination, separated by space.
• mv: “move” files or directories, also requires file/directory to copy and destination, separated by space. This is also used to rename files/directories.
• rm: “remove”, followed by a file to remove it.
• rmdir: “remove empty directory”, followed by a directory to remove it. If the directory is not empty, use rm -r on the directory (“remove recursive”).
• su: “switch user”, by default to root user, but another one can be specified.
• sudo: “switch user, do”, similar to su, but only to execute a command as root or the specified user.
• clear: clear the terminal window, a (common) keyboard shortcut is Ctrl + l.
• find: search for files/directories matching a pattern or all contents of a directory (using .).
• grep: comes from the ed command “g/re/p”, for searching plain-text for lines that match a regular expression (regex).
• top: a task manager program, shows currently running commands and gives important info such as PID (process ID), user who is running that command, command name, cpu and ram usage, etc.. Some useful commands to manage programs running are:
  • pgrep: get the PID of a running process, or a list in chronological order.
  • kill or pkill: kill a running process either by PID or by name.
  • killall: similar to pkill.
• ssh: “secure shell” is a remote login client used to connect into a remote machine and executing commands remotely, basically taking control of the remote machine. Widely used when managing servers.
• ftp or sftp: “(secure) file transfer protocol” used to transfer files from one machine to another one (usually a server). It’s recommended to use sftp instead of ftp because anyone can look through the packages if it’s not secured (encrypted).

And in general, to see the options supported by almost any command, use command -h or command --help, for a quick explanation. IMPORTANT: Most programs have man (manual) pages; to access them do man command, this is a very powerful tool to use.

Commands can be redirected to other commands (the output), which is powerful to create mini scripts or to achieve a goal in a single command. Most of the time the redirection can be done with the special characters >, < and most powerful, the | (pipe). Also, some commands accept an option to execute another command, but this depends on a command to command basis (exec option for find, for example).

Most terminal programs accept Ctrl-c or just q to exit the program.

File permissions and ownership

When listing files with ls -l, an output with file attributes (permissions) and ownership is shown, such as drwxr-xr-x 2 user group 4096 Jul 5 21:03 Desktop, where the first part are the attributes, and user and group the ownership info (all other info is irrelevant for now).

File attributes (drwxr-xr-x in the example above) are specified by 10 (sometimes 11) characters, and can be break into 4 parts (or 5):

• The first character is just the file type, typically d for directories or just - for files. There is l too, which is for symlinks.
• The next 3 characters represent the permissions that the owner has over the file.
• Next 3 the permissions that the group has over the file.
• Next 3 the permissions everyone else (others) have over the file.
• An optional + character that specifies whether an alternate access method applies to the file. When the character is a space, there is no alterante access method.

Each of the three permission triads (rwx) can be:

• - or r, for the first character, if the file can be read or directory’s content can be shown.
• - or w, for the second character, if the file can be modified or the directory’s content can be modified (create new files or folders or rename existing files or folders).
• - or x, for the third character, if the file can be executed or the directory can be accessed with cd. Other characters can be present, like s, S, t and T (for more: Arch Linux Wiki: File permissions and attributes).

To change attributes or ownership use chmod and chown, respectively.

Services

Special type of linux process (think of a program or set of programs that run in the background waiting to be used, or doing essential tasks). There are many ways to manage (start, stop, restart, enable, disable, etc.) services, the most common way (if using systemd) is to just use systemctl. Basic usage of systemctl is systemctl verb service, where verb could be start, enable, stop, disable, restart, etc. Also, to get a general system status run systemctl status or just systemctl for a list of running units (a unit is an instance of a service, or a mount point or even a device or a socket). For more: Arch Linux Wiki: systemd.

systemd also provides a way to do tasks based on a timer, where you can schedule from the second to the year. One could also use cron (using crontab with option e) to do this. These timers provide support for calendar time events, monotonic time events, and can be run asynchronously.

User and group management

Most mainstream linux distributions come with a Graphic User Interface (GUI) to manage users and groups on the system. For a Command-Line Interface (CLI) just use useradd (with passwd to create a password for a given user) and groupadd. Also, other useful commands are usermod, userdel, groups, gpasswd, groupdel and more, each used for a basic management of users/groups like modification, deletion, listing (of all existing users/groups), etc.. For more: Arch Linux Wiki: Users and groups.

Networking

Hosts file

Located at /etc/hosts, serves as a translator from hostname (web addresses or URLs) into IP addresses (think of DNS records), meaning that any URL can be overridden to make it point to whatever IP address it’s specified (only locally on the machine affected). The syntax of the file is pretty simple: first column for IP, second for hostname (URL) and third+ for aliases.

(Some) commands

These commands serve the sole purpose of showing information about the network and stuff related to it:

• ping: gives information about latency to a given ip/domain.
• ifconfig: gives similar information to ipconfig on windows, general info of physical network devices with their addresses and properties. An alternative could be ip addr, depending on the linux distribution being used and programs installed.
• tcpdump: “transmission control protocol dump” gives information on all “packets” being sent and received through the network.
• netstat: “network statistics” general statistics about network devices usage, display connections to the machine and more.
• traceroute: shows the route that the packets go through (how the packets jump from one server to another one) when trying to access an IP (or, for example, a website).
• nmap: “network mapper” explore network available hosts, opened ports, reverse DNS names, can guess the operating system of the device, it’s type, MAC address and more.

What is a database (DB)?

Any collection of related information, such as a phone book, a shopping list, Facebook’s user base, etc.. It can be stored in different ways: on paper, on a computer, in your mind, etc..

Database Management Systems (DBMS)

A special software program that helps users create and maintain a database that makes it easy to manage large amounts of information, handles security, backups and can connect to programming languages for automation.

CRUD

The four main operations that a DBMS will do: create, read, update and delete.

Two types of databases

• Relational (SQL)
  • Organize data into one or more tables.
  • Each table has columns and rows.
  • A unique key identifies each row.
• Non-relational (noSQL/not just SQL)
  • Key-value stores.
  • Documents (JSON, XML, etc).
  • Graphs.
  • Flexible tables.

Relational databases (RDB) (SQL)

When we want to create a RDB we need a Relational Database Management System (RDBMS) that uses Structured Query Language (SQL) which is a standardized language for interacting with RDBMS and it’s used to perform CRUD operations (and other administrative tasks).

Non-relational databases (NRDB) (noSQL/not just SQL)

Anything that’s not relational, stores data in anything but static tables. Could be a document (JSON, XML, etc.), graph (relational nodes), key-value hash (strings, json, etc.), etc.

NRDB also require a Non-Relational Database Management System (NRDBMS) to maintain a database. But it doesn’t have a standardized language for performing CRUD and administrative operations like how RDB have.

Database queries

A DB query is a request that is made to the (R/NR)DBMS for a specific information. A google search is a query, for example.

Tables and keys

A table is composed of columns, rows and a primary key. The primary key is unique and identifies one specific row. Columns and rows are trivial, a column identifies a field and has a specific data type (name, email, birth) and a row identifies a table entry (person that contains a name, email and birth).

Also, there are foreign keys, it’s purpose is to relate to another database table; this foreign key is unique in it’s own table, but can be repeated where you use it as a foreign key.

It’s possible to use the same table keys as foreign keys to make relations inside the same table.

SQL basics

It’s actually a hybrid language, basically 4 types of languages in one:

• Data Query Language (DQL)
  • Used to query the database for information.
  • Get information that is already stored there.
• Data Definition Language (DDL)
  • Used for defining database schemas.
• Data Control Language (DCL)
  • Used for controlling access to the data in the database.
  • User and permissions management.
• Data Manipulation Language (DML)
  • Used for inserting, updating and deleting data from a database.

Queries

A set of instructions given to the RDBMS (written in SQL) that tell the RDBMS what information you want it to retrieve. Instead of getting the whole database, retrieve only a bit of information that you need.

Also, SQL keywords can be either lower or upper case, but it’s convention to use upper case. And queries are ended by a semi-colon.

Data types

Just some SQL data types (for more: MySQL 8.0 Reference Manual: Chapter 11 Data Types, the notation is DATATYPE(SIZE(,SIZE)):

• INT: integer numbers.
• DECIMAL(M,N): decimal numbers.
• VARCHAR(N): string of text of length N.
• BLOB: Binary Large Object, stores large data.
• DATE: YYYY-MM-DD.
• TIMESTAMP: YYYY-MM-DD HH:MM:SS.

Basic management of tables

To create a table, the basic syntax is CREATE TABLE tablename (column1 datatype constraint, column2 datatype constraint, ...), where a constraint could be (for more: MySQL 8.0 Reference Manual: 13.1.20 CREATE TABLE Statement):

• NOT NULL: can’t have a NULL value.
• UNIQUE: all values are unique.
• PRIMARY KEY: uniquely identifies each row.
• FOREIGN KEY: uniquely identifies a row in another table.
• CHECK expresion: satisfy a special condition (expresion).
• DEFAULT value: if no value is specified use value value.
• INDEX: to create and retrieve data from the database very quickly.

Get the table structure with DESCRIBE tablename and delete it with DROP TABLE tablename. Add columns to the table with ALTER TABLE tablename ADD column DATATYPE(N,M), similar syntax to delete a specific column ALTER TABLE tablename DRORP COLUMN column.

Add entries to the table with INSERT INTO tablename VALUES(value1, value2, ...) where all the fields must be specified, or INSERT INTO tablename(column1, column2) VALUES(value1, value2) to just add some fields to the new entry. While at it, (all) the table content can be fetched with SELECT * FROM tablename.

Basic Updating of entries with UPDATE tablename SET expression1 WHERE expression2, where expression1 could be column = value2 and expression2 could be column = value1, meaning that the value of column will be changed from value1 to value2. Note that the expressions are not limited by column = value, and that the column has to be the same, it would be any expression. Also, this is really extensive as SET can set multiple variables and WHERE take more than one condition by chaining conditions with AND, OR and NOT keywords, for example.

ON DELETE statement

When an entry needs to be updated somehow based on a modification on a foreign key. If two tables are related to each other, if something is deleted on one end, update the other end in some way.

For example on creation of a table, on the specification of a foreign key: CREATE TABLE tablename (..., FOREIGN KEY(column) REFERENCES othertable(othertablecolumn) ON DELETE something). That something could be SET NULL, CASCADE, etc..

SELECT queries

Instead of doing SELECT * FROM tablename, which gets all the data from a table, more complex SELECT queries can be implemented, such as SELECT column FROM tablename to only get all data from one column of the table. Append LIMIT N to limit the query to N entries. Append WHERE condition to meet a custom condition.

Other statements that can be used in conjunction with SELECT are ORDER BY column ASC|DESC, SELECT DISTINCT, MIN(column), MAX(column), COUNT(column), AVG(column), SUM(column), LIKE and more. For more, visit MySQL 8.0 Reference Manual: 13.2.10 SELECT Statement.

MySQL uses regular expressions (regex) like pattern matching, some wildcards that can be used with the LIKE statement are:

• %: zero or more characters.
• _: a single character.
• []: any single character within the brackets.
• ^: any character not in the brackets.
• -: a range of characters.

An extended regex can be used with the statement REGEX_LIKE(expression); REGEXP and RLIKE are synonyms for REGEX_LIKE. For more: MySQL 8.0 Reference Manual: 3.3.4.7 Pattern Matching.

Unions

A specialized SQL operator that is used to combine multiple SELECT statements into one. The basic syntax is SELECT ... UNION SELECT ..., where ... is a whole SELECT statement; there can be any amount of unions. There are some rules that apply when doing unions, such as having the same amount of columns on both statements and being of the same data type.

Joins

Used to combine rows from two or more tables based on a related column between them. Basic syntax is SELECT table1.column1, ..., table2.column1, ... FROM table(1|2) JOIN table(1|2) ON table1.common_column = table2.common_column, where the table specified in the FROM statement is called the “left” table, where the one in the JOIN statement is the “right” table. For more: MySQL 8.0 Reference Manual: 13.2.10.2 JOIN Clause.

There are different types of SQL JOINs:

• (INNER) JOIN: returns records that have matching values in both tables.
• LEFT (OUTER) JOIN: returns all records from the left table, and the matched records from the right table.
• RIGHT (OUTER) JOIN: returns all records from the right table, and the matched records from the left table.
• FULL (OUTER) JOIN: returns all records when there is a match in either left or right table.

Nested queries

A query composed of multiple select statements to get a specific piece of information. This is self explanatory, you do a SELECT query somewhere inside another one, for example SELECT ... IN (SELECT ...), where the nesting is occurring inside the parenthesis after the IN statement.

A nesting isn’t constrained to the IN statement, it can appear anywhere, for example in a WHERE statement: SELECT ... WHERE something = (SELECT ...).

Triggers

A block of SQL code that will define a certain action that will happen when a specific operation is performed on the database. It is recommended to change the DELIMITER temporarily from semi-colon to something else (since we need to use semi-colon to end the trigger) while the trigger is created. The basic syntax is CREATE TRIGGER trigername triggertime triggerevent ON tablename FOR EACH ROW triggerorder triggerbody. For more: MySQL 8.0 Reference Manual: 13.1.22 CREATE TRIGGER Statement and MySQL 8.0 Reference Manual: 25.3.1 Trigger Syntax and Examples.

Entity Relationship Diagrams (ERD)

When designing a database it’s important to define a database schema which is just a definition of all the different tables and their attributes that are going to live inside the database. So, basically, an ERD diagram is a diagram that consists of text, symbols and shapes that are combined to create a relationship model.

The diagram consists of:

• Entity: a square with the name of the entity inside it.
• Attributes: ovals with the name of the attributes inside it; an attribute defines specific pieces of information about an entity (columns).
• Primary key: same as with attributes but with name underlined; the primary key uniquely identifies the entity.
• Composite attribute: an attribute that consists on one or more (sub-)attributes.
• Multi-valued attribute: oval with another oval inside it and the name of the attribute.
• Derived attribute: dotted oval; this attribute can be derived from other attributes from the entity.
• Relationship: a diamond with the relationship name in it, for the connections a single line (partial participation) or a doubled line (total participation); it denotes how two or more attributes are related to each other; all members must participate in the relationship.
• Relationship attribute: denoted like a normal attribute, but it’s child of a relationship; it defines what attributes exists because of the relationship, it’s not stored in any of the entities related, but on the relationship object itself.
• Relationship cardinality: denoted with a number on the line connecting the relationship to the entity; detones the number of instances of an entity from a relation that can be associated with the relation.
• Weak entity: rectangle inside a rectangle with its name inside; it cannot be uniquely identified by its attributes alone.
• Weak entity’s primary key: oval with its text underlined, but the line is dotted.
• Identifying relationship: a diamond inside a diamond with its name inside; a relationship that serves to uniquely identify the weak entity.

At the moment, I’m not satisfied because there’s no automatic date insertion into the 1) html file, 2) the blog post itself and 3) the listing system in the blog homepage (and there’s also the problem with the ordering of the entries…). And all of this just because I didn’t want to use Luke’s solution (don’t really like that much how he handles the scripts… but they just work).

Hopefully, for tomorrow all of this will be sorted out and I’ll have a working blog system.