继续折腾 NanoPC-T4之 私有云部署

前言

自从360 等各大云盘开始收费， 莆田系各种恶心限速以来，一直想搭建一个自己的私有云服务器。以满足手机/PC等个机器之间的文件同步（中间用GIT替代过一段时间）. 虽然强大 但各种不方便。在尝试了 seafile、owncloud等后，发现这些东东都不能满足在树莓派嵌入式单板机器上的使用要求。于是转而寻求一个适合嵌入式机器使用的私有云软件。syncthing 出现了。

经过一段时间的折腾测试。目前已经成功部署且工作良好。

syncthing 总共分为三个组件。

1. syncthing 同步软件 用于文件夹变动监视、同步。
2. stdiscosrv 发现服务器 用户各机器之间发现对方。
3. strelaysrv 中转服务器 针对一些特殊网络环境无公网IP的宽带。或者路由器不止UPNP映射的环境通过 relay服务器中转同步

接下来一步步部署这三个软件

部署

还是直接整理成安装脚本吧. 方便大家直接使用

#!/bin/bash
arch=$(dpkg --print-architecture)

########################## 安装发现服务器 ################################
wget https://github.com/syncthing/discosrv/releases/download/v1.0.1/stdiscosrv-linux-$arch-v1.0.1.tar.gz
tar -xvf stdiscosrv-linux-$arch-v1.0.1.tar.gz -C /usr/local
mv /usr/local/stdiscosrv-linux-$arch-v1.0.1 /usr/local/stdiscosrv
groupadd syncthing
useradd -M  -s /usr/sbin/nologin -G syncthing stdiscosrv
chown -R stdiscosrv:syncthing /usr/local/stdiscosrv

cat > /lib/systemd/system/stdiscosrv.service << EOF
[Unit]
Description=Syncthing Discovery server
After=network.target

[Service]
User=stdiscosrv
Group=syncthing
ExecStart=/usr/local/stdiscosrv/stdiscosrv -cert "/usr/local/stdiscosrv/cert.pem" -key "/usr/local/stdiscosrv/privkey.pem" -db-dir "/usr/local/stdiscosrv/discovery.db" -listen "0.0.0.0:8443" 1
Restart=on-failure
WorkingDirectory=/usr/local/syncthing
Nice=15

PrivateTmp=yes
ReadOnlyPaths=/
ReadWritePaths=/usr/local/syncthing/
NoNewPrivileges=true


# Hardening
ProtectSystem=full
PrivateTmp=true
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target
EOF
systemctl enable stdiscosrv.service
systemctl start stdiscosrv.service

########################## 安装中转服务器 ################################
wget https://github.com/syncthing/relaysrv/releases/download/v1.0.1/strelaysrv-linux-$arch-v1.0.1.tar.gz
tar -xvf strelaysrv-linux-$arch-v1.0.1.tar.gz -C /usr/local
mv /usr/local/strelaysrv-linux-$arch-v1.0.1 /usr/local/strelaysrv

useradd -M  -s /usr/sbin/nologin -G syncthing relaysrv
chown -R stdiscosrv:syncthing /usr/local/stdiscosrv

cat > /lib/systemd/system/strelaysrv.service  << EOF
[Unit]
Description=Syncthing relay server
After=network.target

[Service]
User=strelaysrv
Group=syncthing
ExecStart=/usr/local/strelaysrv/strelaysrv -listen=":22067" -pools="" -protocol="tcp4"
Restart=on-failure
WorkingDirectory=/usr/local/strelaysrv
Nice=15

PrivateTmp=yes
ReadOnlyPaths=/
ReadWritePaths=/usr/local/strelaysrv
NoNewPrivileges=true

# Hardening
ProtectSystem=full
PrivateTmp=true
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
NoNewPrivileges=true

[Install]
WantedBy=multi-user.target
EOF
systemctl enable strelaysrv.service
systemctl start strelaysrv.service

########################## 安装同步软件 ################################
wget https://github.com/syncthing/syncthing/releases/download/v1.1.3/syncthing-linux-$arch-v1.1.3.tar.gz
tar -xvf syncthing-linux-$arch-v1.1.3.tar.gz -C /usr/local
mv /usr/local/syncthing-linux-$arch-v1.1.3 /usr/local/syncthing
useradd -M  -s /usr/sbin/nologin -G syncthing syncthing
chown -R syncthing:syncthing /usr/local/syncthing

cat > /lib/systemd/system/syncthing.service << EOF
[Unit]
Description=Syncthing - Open Source Continuous File Synchronization
Documentation=man:syncthing(1)

[Service]
User=syncthing
Group=syncthing
ExecStart=/usr/local/syncthing/syncthing -allow-newer-config -no-restart -logflags=0
Restart=on-failure
SuccessExitStatus=3 4
RestartForceExitStatus=3 4

# Hardening
ProtectSystem=full
PrivateTmp=true
SystemCallArchitectures=native
MemoryDenyWriteExecute=true
NoNewPrivileges=true

[Install]
WantedBy=default.target

EOF

systemctl enabled syncthing.service 
systemctl start synctihg.syncthing