sudo apt update && sudo apt upgrade
sudo apt install iptables-persistent  mysql-client mysql-client-core-5.7 awscli jq git libmysqlclient-dev subversion 

# localインターフェースはすべて許可
sudo iptables -A INPUT -i lo -j ACCEPT
sudo iptables -A OUTPUT -o lo -j ACCEPT

# 自サーバから外向きのsmtp,dns,http,httpsとその戻り通信を許可
sudo iptables -A INPUT  -i eth0 -m state --state ESTABLISHED,RELATED      -m multiport -p tcp --sports 25,53,80,443 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED  -m multiport -p tcp --dports 25,53,80,443 -j ACCEPT

# 自サーバから外向きのdnsを許可
sudo iptables -A INPUT  -i eth0 -m state --state ESTABLISHED,RELATED      -m multiport -p udp --sports 53 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -m state --state NEW,ESTABLISHED,RELATED  -m multiport -p udp --dports 53 -j ACCEPT

# 自サーバへあててのhttp,httpsを許可
sudo iptables -A INPUT  -i eth0 -m state --state NEW,ESTABLISHED,RELATED  -m multiport -p tcp --ports  80,443 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED      -m multiport -p tcp --sports 80,443 -j ACCEPT

自サーバへ向けてのSSHを許可
sudo iptables -A INPUT  -i eth0 -m state --state NEW,ESTABLISHED,RELATED  -m multiport -p tcp --dports 22 -j ACCEPT
sudo iptables -A OUTPUT -o eth0 -m state --state ESTABLISHED,RELATED      -m multiport -p tcp --sports 22 -j ACCEPT

# 明示的に許可していない通信はすべてDROP
sudo iptables -P FORWARD DROP
sudo iptables -P INPUT DROP
sudo iptables -P OUTPUT DROP
sudo /etc/init.d/netfilter-persistent save

# ipv6はすべて拒否
sudo ip6tables -P INPUT  DROP
sudo ip6tables -P OUTPUT  DROP
sudo ip6tables -P FORWARD  DROP
sudo /etc/init.d/netfilter-persistent save

sudo reboot

# 数分後に再度sshログインした後に以下を実行し、iptablesのルールが登録されていることを確認する
sudo iptables -L -n -v
sudo ip6tables -L -n -v

sudo apt install -y curl gnupg build-essential gnupg2

# 以下コマンドは失敗することがある。その場合、その代わりに実行するやり方がコマンド戻り値で明示される。
sudo gpg --keyserver hkp://pool.sks-keyservers.net:80 --recv-keys 409B6B1796C275462A1703113804BB82D39DC0E3 7D2BAF1CF37B13E2069D6956105BD0E739499BDB
curl -sSL https://get.rvm.io | sudo bash -s stable
sudo usermod -a -G rvm `whoami`

exit

# 一度sudoしてパスワードを叩いておきます。コマンドは何でもいいです。
sudo ls

rvm install ruby
rvm --default use ruby

gem install bundler

sudo apt install -y nodejs &&
sudo ln -sf /usr/bin/nodejs /usr/local/bin/node

sudo apt install -y dirmngr gnupg
sudo apt-key adv --keyserver hkp://keyserver.ubuntu.com:80 --recv-keys 561F9B9CAC40B2F7
sudo apt install -y apt-transport-https ca-certificates

sudo sh -c 'echo deb https://oss-binaries.phusionpassenger.com/apt/passenger bionic main > /etc/apt/sources.list.d/passenger.list'
sudo apt update

sudo apt install -y nginx nginx-core libnginx-mod-http-passenger

if [ ! -f /etc/nginx/modules-enabled/50-mod-http-passenger.conf ]; then sudo ln -s /usr/share/nginx/modules-available/mod-http-passenger.load /etc/nginx/modules-enabled/50-mod-http-passenger.conf ; fi
sudo ls /etc/nginx/conf.d/mod-http-passenger.conf

sudo service nginx restart

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | sudo apt-key add -
echo "deb https://dl.yarnpkg.com/debian/ stable main" | sudo tee /etc/apt/sources.list.d/yarn.list
sudo apt update && sudo apt install yarn

export MY_DOMAIN_NAME=redmine.yourdomain

cd /var/www
sudo svn checkout http://svn.redmine.org/redmine/trunk/ ${MY_DOMAIN_NAME}
sudo chown `whoami` -R ${MY_DOMAIN_NAME}

sudo apt install -y build-essential zlib1g-dev libssl-dev libreadline-dev libyaml-dev libcurl4-openssl-dev libffi-dev \
 autoconf bison build-essential libssl-dev libyaml-dev libreadline-dev zlib1g-dev \
 libncurses5-dev libffi-dev libgdbm-dev sqlite3 libsqlite3-dev mysql-server \
 mysql-client libmysqlclient-dev nodejs yarn \
 imagemagick libmagick++-dev fonts-takao-pgothic

sudo mysql
create database redmine DEFAULT CHARACTER SET utf8;
CREATE USER 'redmine'@'localhost' IDENTIFIED BY 'x9ds09SD90dcsad#DS?D9x90a';
GRANT ALL ON redmine.* TO 'redmine'@'localhost';
flush privileges;
exit

cd /var/www/${MY_DOMAIN_NAME}/config
sudo mv database.yml.example database.yml

sudo sed -i 's/ *username: root/  username: redmine/g' database.yml
sudo sed -i 's/ *password: ""/  password: "x9ds09SD90dcsad#DS?D9x90a"/g' database.yml

cd ../

bundle install  --without development test --path vendor/bundle

セッション改ざん防止用秘密鍵の作成
bundle exec rake generate_secret_token

データベースの作成と初期データ登録
RAILS_ENV=production bundle exec rake db:migrate
RAILS_ENV=production REDMINE_LANG=ja bundle exec rake redmine:load_default_data

# メール設定
cd /var/www/${MY_DOMAIN_NAME}/config
sudo mv configuration.yml.example configuration.yml
sudo vi configuration.yml

default:

    email_delivery:
      delivery_method: :sendmail

cd /etc/nginx/sites-enabled/

export RUBYPATH=`passenger-config about ruby-command | grep 'To use in Nginx : passenger_ruby' | rev |  cut -d " " -f 1 | rev`
echo ${RUBYPATH}

sudo sh -c "cat << 'EOF' > ../sites-available/${MY_DOMAIN_NAME}
server {
    listen 80;
    server_name ${MY_DOMAIN_NAME};

    passenger_enabled on;
    passenger_ruby ${RUBYPATH};

    access_log  /var/log/nginx/${MY_DOMAIN_NAME}.access.log;
    error_log  /var/log/nginx/${MY_DOMAIN_NAME}.error.log;

    root /var/www/${MY_DOMAIN_NAME}/public;
}
EOF"


sudo cat ../sites-available/${MY_DOMAIN_NAME}
sudo ln -s ../sites-available/${MY_DOMAIN_NAME} ${MY_DOMAIN_NAME}

sudo service nginx restart

# 以下にアクセスします。初期ユーザー名、パスワードはadmin/adminです。
echo "https://${MY_DOMAIN_NAME}"

sudo reboot