selfprivacy.org/content/en/docs/Getting started/_index.md at f9f136f11a6693014e2aac7fa3c915735bf5ef49

mirror of https://git.selfprivacy.org/SelfPrivacy/selfprivacy.org.git synced 2024-10-31 22:17:36 +00:00

Inex Code 8ec04fbf06 docs(en): Localize bad passwords

2023-01-20 17:14:38 +03:00

9.4 KiB

Raw Blame History

Accounts registration

For stability, SelfPrivacy needs many accounts. We don't want to trust all the data to one company, so we'd rather distribute parts of the system to different places.

{{% alert title="Protecting accounts" color="warning" %}} Systems are hacked through the weakest link. To prevent accounts from being such a link, passwords must be different for each account and must be complex. Qwerty123 or VerySecurePassw0rd are very bad passwords. An example of a good password is a passphrase:

expert repose postwar anytime glimpse freestyle liability effects

}Rj;EtG:,M!bc4/|

How can you remember such a complicated password? Absolutely not! Passwords do not need to be remembered, they need to be created and stored in a password manager. However, you'll need to remember at least one — password from the password manager.

Accounts to create:

Hetzner or DigitalOcean — virtual hosting servers. Whichever one you choose, your data and SelfPrivacy services will live on it.
NameCheap, Porkbun or any other registrar, to purchase your personal address on the Internet — the domain that will point to the server.
CloudFlare is a DNS server, where your personal address (domain) works.
Backblaze is an IaaS, that provides free storage for your encrypted backups.

Registration is trivial, but sometimes account activation can take up to several days or require additional documents. Therefore, use real documents and fill everything out carefully. Providers protect themselves from spam this way. Nothing personal :)

Be sure to enable additional account protection — the second factor (MFA, 2FA). Without this simple step, your data will not be safe.

I know it was hard, but now your data is better protected than 95% of users. You should be proud of yourself! I'm proud of you 🤗

Purchasing a domain

Enabled 2FA? Then let's get to the most interesting part!

Domain — it's a piece of the Internet, that you can name like your home pet. The potential for creativity is enormous. Your only limitations are 63 character length + .com .org .icu or other domain zones. Feel free to choose from hundreds of others. You can choose your last name as a domain, like this: jackson.live or carson.health, or it can be something creative, like: unicorn-land.shop

Advice:

Be sure to look at the annual renewal price, it can be many times the purchase price.
Normal domain price is $8-10 per year. The cheapest are Chinese .icu and .cyou - $4-6.

When registering a domain, make sure you enter your real email address, otherwise your registration may be cancelled. And if you can't renew the domain, the system won't work as intended.

A good name comes in handy, both on the phone to dictate, and on your business card.
Did I mention the 2FA?

Connecting Domain to DNS Server

Once purchased, add your domain to CloudFlare:

Using ruleit.stream as an example, we chose the free service plan and got nameservers: gail.ns.cloudflare.com and mattns.cloudflare.com, which need to be registered with our registrar. For example, with NameCheap:

At the same time, we check that we include auto-renewal and personal data protection — WhoisGuard. After a few minutes or, in the worst case, up to 2 days, the settings will be applied.

Generating tokens

API tokens are almost the same as login and password, only for a program, not a person. SelfPrivacy application uses them to manage services in all accounts instead of you. Convenient!

We do not need a token for your domain registrar. But we will need one for the CloudFlare to use it for domain management.

How to get Cloudflare API Token

{{< video src="Cloudflare" muted="true" autoplay="true" autoplay="true" loop="true" >}}

Visit the following link and log in to the account you created earlier.
Click on the profile icon in the upper right corner (for the mobile version of the site: click on the menu button with three horizontal bars in the upper left corner). From the menu that appears, click My Profile.

We have four configuration categories to choose from: Preferences, Authentication, API Tokens and Sessions. Select API Tokens.
The first item we see is the Create Token button. Click it.
Scroll down until you see the Create Custom Token field and the Get Started button on the right side. Press it.
In the Token Name field, give your token a name. You can create your own name and treat it like a pet name :)
Next, we have Permissions. In the first field, choose Zone. In the second field, in the middle, select DNS. In the last field, select Edit.
Click on the blue label at the bottom + Add more (just below the left field that we filled in earlier). Voila, we have new fields. Let's fill them in the same way as in the previous section, in the first field we choose Zone, in the second one also Zone. And in the third one we press Read. Let's check what we have:

{{< imgproc cloudflare-permissions Fill "628x203">}} Your selection must look like this. {{< /imgproc >}}

Next, look at Zone Resources. Below this heading there is a line with two fields. The first should be Include, and the second should be Specific Zone. Once you select Specific Zone, another field will appear on the right. Here you select our domain.
Scroll to the bottom and click the blue button Continue to Summary.
Check that you have selected everything correctly. You should see a line like this: your.domain - DNS:Edit, Zone:Read.
Press Create Token.
Copy the created token.

How to get server provider token

{{< alert title="Don't keep your eggs in one basket" color="warning" >}} If you are planning to use DigitalOcean to handle both server and DNS (which is not recommended), you must use a separate project for DNS records.

DigitalOcean only gives tokens that provide full access to everything in the project. While server provider token stays on your device, the token for DNS management will be stored on your new server. This way, if your server is compromised, the attacker will be able to do more harm than just change your DNS records.

Note: using DigitalOcean as DNS provider is not yet released, but already available on nightly channel. {{< /alert >}} {{< tabpane text=true >}}

Visit the following link. Authorize the account you created earlier.
Open the project you created. If none exists, create one.
Point the mouse at the side panel. It should open and show you menu items. We are interested in the last one — Security (with a key icon).
Next, at the top of the interface we see something like the following list: SSH Keys, API Tokens, Certificates, Members. We need the API Tokens. Click on it.
On the right side of the interface you will see the Generate API token button. If you are using the mobile version of the site — in the lower right corner you will see a red plus button. Press it.
In the Description field, give your token a name (this can be any name that you like, it does not change anything in essence).
Under Description, select permissions. Select Read & Write.
Click Generate API Token.
Сopy the token {{% /tab %}}

{{< video src="do" muted="true" autoplay="true" autoplay="true" loop="true" >}}

Follow this link and log in to the previously created account.
In the left menu look for API — the last item at the bottom.
Click Generate New Token in Personal Access Tokens menu.
Copy the token.

How to get Backblaze token

{{< video src="Backblaze" muted="true" autoplay="true" autoplay="true" loop="true" >}}

Visit the following link and log in to the previously created account.
On the left side of the interface, select App Keys in the B2 Cloud Storage subcategory.
Click on the blue Generate New Master Application Key button.
In the appeared pop-up window confirm the generation.
Copy keyID and applicationKey.

🎉 Congratulations! Now you are ready to use private services.

9.4 KiB Raw Blame History Unescape Escape