Do not use this in production; it is for testing purposes only.

Schools usually run a KMS Server as an activation method for volume licensing of Windows and Office. Here are a few open-source projects you can use for testing:

• vlmcsd - written in C (it includes a Docker deployment method)
• Py-KMS-Organization/py-kms - written in Python

Py-KMS-Organization/py-kms is a fork of SystemRage/py-kms that is still being actively maintained.

You can also spin it up easily with docker:

docker run -d --name py-kms --restart always -p 1688:1688 ghcr.io/py-kms-organization/py-kms

Use the GVLK Keys list together with the KMS server to activate Windows and Office. For a detailed walkthrough see py-kms: Activation Procedure.

It works for a NAS, a Git server, a Virtual Machine Manager, and more on your LAN.

Gitea

Gitea is much lighter than GitLab. Using mirroring to back up projects on GitHub that might disappear at any time is very handy.

For installing with docker, see https://docs.gitea.io/en-us/install-with-docker/.

Here are some config options I personally use:

• Let gitea search code easily

[indexer]
REPO_INDEXER_ENABLED = true

• Customize the URL and listen port shown on the page. For the landing page, if the visitor isn’t logged in you can point them straight to the login page on open, instead of Gitea’s home page.

[server]
PROTOCOL         = https
DOMAIN           = git.test.tw
SSH_DOMAIN       = git-ssh.test.tw
SSH_LISTEN_PORT  = 11022
HTTP_PORT        = 3000
ROOT_URL         = https://git.test.tw
ENABLE_GZIP      = true
LANDING_PAGE     = login

• Remove the footer info, version and load time from the page

[other]
SHOW_FOOTER_BRANDING = false
SHOW_FOOTER_VERSION = false
SHOW_FOOTER_TEMPLATE_LOAD_TIME = false

For detailed settings see the Gitea Configuration Cheat Sheet and customize as you like.

Setup Cloudflare Tunnel

Run Cloudflared Service

First you need a domain hosted on Cloudflare. Find Zero Trust in the sidebar.

Once opened, find Tunnel.

After naming it, you can choose the platform on which to run the tunnel service. I like running it on docker — just paste the command, and you can add --restart=always and -d flags as you prefer.

docker run --restart=always -d cloudflare/cloudflared:latest tunnel --no-autoupdate run --token [your_token_here]

For synology, you can specify the command in the advanced settings — just paste in the string after the image.

If it succeeds, you should see the Status on the Tunnels page turn a green ACTIVE.

Add Tunnel

Fill in the subdomain and pick which service to forward below. There are many protocols to choose from, e.g. https, http, ssh, RDP; the URL after it takes the internal host and port.

If you want to git ssh clone, choose SSH as the protocol and follow it with ip:port.

Note: if you have a private HTTPS certificate, you can select No TLS Verify so Cloudflare Tunnel can connect smoothly.

Once added successfully, you should see a CNAME automatically added to the domain’s DNS.

At this point just try connecting and it should work.

Auth

Some services may be inconvenient with Auth attached, so adjust as you see fit. I haven’t tested Gitea’s web with it — you can experiment; I’m not sure whether https clone will have issues.

With the setup above, http/https services are now reachable from outside. If you want to add another layer of protection, you can use the Access - Application feature: add a Self-hosted Application and set the subdomain.

Then add a policy. Under Configure rules you can add the rules you want within this application’s scope (subdomain). Choosing email will prompt you for an OTP on the verification page before you can log in; there are also IP range, Country and Token methods — lots of ways to freely combine rules.

Finally, when you access it, you should see the page asking for email authentication.

Git ssh

After the tunnel setup, going into Gitea you should see a clean clone address:

via https
https://git.test.tw/mirror/Windows-Exploit-Suggester.git

via ssh
git@git-ssh.test.tw:mirror/Windows-Exploit-Suggester.git

No more ugly IPs or port numbers.

Note that because SSH is being forwarded, you need some extra config in your local ssh config. On the client machine, install cloudflared, which you can install easily with homebrew or scoop.

Edit ~/.ssh/config in your home directory and add a ProxyCommand that chains to cloudflared; then ssh clone will work normally:

Host git.test.com
  ProxyCommand cloudflared access ssh --hostname %h

If you hit snags along the way, you can also refer to Cloudflare’s official docs Zero Trust GitLab SSH & HTTP

In The End

Cloudflare Tunnel can forward many internal services without opening port forwarding — a great thing. Paired with the Zero Trust concept to protect your assets, important services on your home NAS can be both protected and conveniently accessible.

There are tons more ways to use it, such as opening a web terminal to access an internal SSH service. See the YouTube video HOW TO: Remote access a Raspberry Pi using a Cloudflare tunnel (node-red and ssh).

First set the timezone to Taipei:

sudo timedatectl set-timezone Asia/Taipei

Add the cleanup and schedule flags:

docker run -d --restart=always \
--name watchtower \
-v /var/run/docker.sock:/var/run/docker.sock \
-v /etc/localtime:/etc/localtime:ro \
containrrr/watchtower \
--cleanup \
--schedule "0 0 4 * * *"

More flags can be found here: https://containrrr.dev/watchtower/arguments/

Installation

On Unix-like systems you can install it in one line:

curl -s -S -L https://raw.githubusercontent.com/AdguardTeam/AdGuardHome/master/scripts/install.sh | sh -s -- -v

You can also refer to the official github and the wiki; it can be installed on docker, a Raspberry Pi, and more.

Here, since I run an LXC on proxmox and it has its own IP, I just install it as a regular machine.

address already in use

During installation you may hit the 0.0.0.0:53: bind: address already in use error. You can solve it with these steps:

First stop the resolve service:

systemctl stop systemd-resolved

Edit /etc/systemd/resolved.conf:

[Resolve]
DNS=127.0.0.1
DNSStubListener=no

Re-link it and restart the service:

sudo ln -sf /run/systemd/resolve/resolv.conf /etc/resolv.conf
systemctl restart systemd-resolved

DNS settings

For upstream DNS you can set servers from Google, HiNet, Cloudflare and TWNIC:

8.8.8.8
8.8.4.4
168.95.1.1
168.95.192.1
1.1.1.1
1.0.0.1
101.101.101.101
101.102.103.104

Blocklists

You can add your own by referring to https://firebog.net/; there are also some built-in ones you can import.

DNS rewrite

If you have services on your LAN, you can use rewrite to set your own domain for easy access.

config file

The whole configuration lives in /opt/AdGuardHome/AdGuardHome.yaml; you can back it up regularly for easier future deployments.

root@ad-guard:~# ls /opt/AdGuardHome/
AdGuardHome  AdGuardHome.sig  AdGuardHome.yaml  CHANGELOG.md  LICENSE.txt  README.md  data

A similar service is NextDNS, also worth a look.

Raspberry Pi Setting

Flash lite x64 with the official tool and drop in an ssh file so the SSH server starts automatically:

scoop install raspberry-pi-imager

A round of updates:

sudo apt-get update
sudo apt-get dist-upgrade
sudo apt-get autoremove
sudo apt-get autoclean

Use raspi-config to update the hostname, password + expand filesystem + time zone:

sudo raspi-config

Update the firmware:

sudo rpi-update

Install PiVPN

Install pivpn and choose WireGuard as the VPN server. Just fill in the prompts; for DNS you can set a custom IP. I use AdGuard Home for DNS rewrites of my internal services, so I fill in AdGuard’s IP.

curl -L https://install.pivpn.io | bash

Here you can check whether the service and the port you configured are up:

$ sudo wg

interface: wg0
  public key: ***********
  private key: (hidden)
  listening port: 5487

$ sudo netstat -tunlp

udp        0      0 0.0.0.0:5487           0.0.0.0:*                           -
udp6       0      0 :::5487                :::*                                -

To add a user, just run pivpn -a -n <name>:

$ pivpn -a -n test
::: Client Keys generated
::: Client config generated
::: Updated server config
::: WireGuard reloaded
======================================================================
::: Done! test.conf successfully created!
::: test.conf was copied to /home/pi/configs for easy transfer.
::: Please use this profile only on one device and create additional
::: profiles for other devices. You can also use pivpn -qr
::: to generate a QR Code you can scan with the mobile app.
======================================================================

For more commands and usage see the pivpn docs https://docs.pivpn.io/wireguard/, which cover removing, disabling and listing users, backup and restore, and other settings — for example how to configure it if you also have Pi-hole installed.

pivpn -qr shows a QR code in the terminal that you can scan with your phone; on a computer you can just copy the config file under configs and feed it to the computer’s client.

$ pivpn -qr
::  Client list  ::
1) test
Please enter the Index/Name of the Client to show: 1
::: Showing client test below
=====================================================================

For the WireGuard client, see the official site https://www.wireguard.com/install/ to download the right one.

If you use port forwarding, remember to open the UDP port and configure it.

Once everything is set up you should see the connected devices:

 $ pivpn -c
::: Connected Clients List :::
Name      Remote IP                 Virtual IP      Bytes Received      Bytes Sent      Last Seen
zet       114.136.***.**:35713      10.6.0.2        5.4MiB              36MiB           Apr 03 2022 - 17:57:05

Misc

A few files you may need to modify:

• /etc/wireguard/wg0.conf stores settings like PrivateKey and ListenPort; if you need to change the port or add other settings later, edit it here
• /etc/pivpn/wireguard/setupVars.conf holds settings such as port, dns and host addr, mainly the extra values used when generating configs and QR codes