2ac8608 · urbit.org · git.iko.soy

git.iko.soy/urbit.org

on master help sign in

Remove Nginx

2ac8608Zach Alberico6 years ago

content/using/operations/hosting.md+10−95

compare with master

unifiedsplit

@@ -85,13 +85,10 @@ Continuing to follow the DO docs we're going to configure the ufw firewall.

85 ```

86 $ sudo ufw app list

87 ```

88− - Next we'll configure ufw to allow connections via ssh when the firewall is enabled.

88+ - Next we'll configure ufw to allow connections via ssh and to allow Urbit to use the standard web port when the firewall is enabled.

89 ```

90 $ sudo ufw allow OpenSSH

91− ```

92− - This command will allow UDP connections on a port that we'll later tell Urbit to use for Ames (the Urbit to Urbit communication protocol)

93− ```

94− $ sudo ufw allow 32123/udp

91+ $ sudo ufw allow www

95 ```

92 ```

96 - Next we'll turn on the firewall.

93 - Next we'll turn on the firewall.

97 ```

94 ```

@@ -102,104 +99,17 @@ Continuing to follow the DO docs we're going to configure the ufw firewall.

102 $ sudo ufw status

99 $ sudo ufw status

103 ```

100 ```

104

101

105−## Installing Nginx

106−Nginx is a webserver we're going to use as a reverse proxy. All incoming traffic to our Digital Ocean droplet will pass through Nginx and from there to Urbit. This allows us to lock everything else down and secure just that entry point.

107− - First we need to update available packages and install Nginx.

108− ```

109− $ sudo apt update

110− $ sudo apt install nginx

111− ```

112− - Now that we've installed Nginx we have to update the firewall settings:

113− ```

114− $ sudo ufw allow 'Nginx Full'

115− ```

116− - You can verify this change with:

117− ```

118− $ sudo ufw status

119− ```

120− - Nginx should automatically be started after installation, you can confirm this with:

121− ```

122− $ systemctl status nginx

123− ```

124− - You can also confirm that it's up by going to your droplet's IP address, you should see a "Welcome to nginx!" message.

125− - You can start/stop/restart Nginx with commands like the following:

126− ```

127− $ sudo systemctl restart nginx

128− ```

129− - You can also reload config without restarting with:

130− ```

131− $ sudo systemctl reload nginx

132− ```

133−

134−## Configuring Nginx

135−Now we're going to configure Nginx so it serves up your Urbit traffic securely.

136− - Navigate to the `sites-available` directory:

137− ```

138− $ cd /etc/nginx/sites-available

139− ```

140− - Create a new file for your domain:

141− ```

142− $ sudo vim your_domain

143− ```

144− - Add the following config (putting your domain in the **your_domain** location):

145− ```

146− server {

147− server_name your_domain;

148−

149− location / {

150− proxy_pass http://localhost:8080;

151− proxy_set_header Forwarded for=$remote_addr;

152− proxy_set_header Connection '';

153− proxy_http_version 1.1;

154− chunked_transfer_encoding off;

155− proxy_buffering off;

156− proxy_cache off;

157− }

158− }

159− ```

160− *Note*: **your_domain** should be of the form `example.com` without www or https.

161− - Next we're going to create a symlink to enable this in `sites-enabled` for Nginx:

162− ```

163− $ sudo ln -s /etc/nginx/sites-available/your_domain /etc/nginx/sites-enabled/your_domain

164− ```

165− - Now reload the Nginx config:

166− ```

167− $ sudo nginx -s reload

168− ```

169−

170−## Configuring Let's Encrypt secure certificate

171−Now that we've got the Nginx reverse proxy installed we're going to get a Let's Encrypt SSL cert for it and configure it to automatically renew.

172− - We're going to do this with certbot, first we have to add the up to date repository:

173− ```

174− $ sudo add-apt-repository ppa:certbot/certbot

175− ```

176− - Next we're going to install the package:

177− ```

178− $ sudo apt install python-certbot-nginx

179− ```

180− - Next we're going to request a cert from certbot:

181− ```

182− $ sudo certbot --nginx -d your_domain

183− ```

184− - You'll have to agree to the TOS and then it'll run a test to verify that you control the domain you're requesting a cert for.

185− - Certbot will then ask if you want to redirect all traffic to HTTPS. You should select yes for this (option 2).

186− - Certbot will automatically update your Nginx config with the settings it needs. It'll also automatically renew before cert expiration.

187− - You can now verify your site is working properly by going to `https://your_domain`, you should see a secure certificate.

188− - To confirm that certbot will renew properly you can run the following command:

189− ```

190− $ sudo certbot renew --dry-run

191− ```

192−

193## Installing Urbit

102## Installing Urbit

194Finally we're ready to install Urbit on your very own server. This part is actually pretty easy, if you haven't installed Urbit locally then the instructions are the exact same as the ones in the Urbit [install doc][Urbit Install]. If you have a local ship already, we're going to install Urbit on the server and then send your local ship up.

103Finally we're ready to install Urbit on your very own server. This part is actually pretty easy, if you haven't installed Urbit locally then the instructions are the exact same as the ones in the Urbit [install doc][Urbit Install]. If you have a local ship already, we're going to install Urbit on the server and then send your local ship up.

195 - **WARN**: Since Urbit is p2p you don't want to ever run two copies of your ship simultaneously. This is because other nodes that interact with each of your copies will be confused by which one is the most up to date. If you end up accidentally doing this you'll have to do a 'personal breach' described in the Urbit docs to fix things.

104 - **WARN**: Since Urbit is p2p you don't want to ever run two copies of your ship simultaneously. This is because other nodes that interact with each of your copies will be confused by which one is the most up to date. If you end up accidentally doing this you'll have to do a 'personal breach' described in the Urbit docs to fix things.

196 - The first thing you're going to want to do is shut down your local ship, either with control-d or `|exit` in dojo.

105 - The first thing you're going to want to do is shut down your local ship, either with control-d or `|exit` in dojo.

197− - Next we're going to install Urbit on the server:

106+ - Next we're going to install Urbit on the server and permit it to bind to the web port:

198 ```

107 ```

199 $ ssh your_user@your_domain

108 $ ssh your_user@your_domain

200 $ curl -O https://bootstrap.urbit.org/urbit-v0.10.8-linux64.tgz

109 $ curl -O https://bootstrap.urbit.org/urbit-v0.10.8-linux64.tgz

201 $ tar xzf urbit-v0.10.8-linux64.tgz

110 $ tar xzf urbit-v0.10.8-linux64.tgz

202 $ cd urbit-v0.10.8-linux64

111 $ cd urbit-v0.10.8-linux64

112+ $ sudo setcap 'cap_net_bind_service=+ep' urbit

203 ```

113 ```

204 - Now we're going to tar up your local ship and send it to your server, from your local machine's urbit directory:

114 - Now we're going to tar up your local ship and send it to your server, from your local machine's urbit directory:

205 ```

115 ```

@@ -211,7 +121,12 @@ Finally we're ready to install Urbit on your very own server. This part is actua

211 $ ssh your_user@your_domain

121 $ ssh your_user@your_domain

212 $ cd urbit-v0.10.8-linux64

122 $ cd urbit-v0.10.8-linux64

213 $ tar -zxvf <ship_dir_name>.tar.gz

123 $ tar -zxvf <ship_dir_name>.tar.gz

214− $ ./urbit -p 32123 <ship_dir_name>

124+ $ ./urbit <ship_dir_name>

125+ ```

126+ - Now we run a few commands in Dojo to request a Let’s Encrypt cert for your domain (replace `tld` with whatever your top-level domain is e.g. `com` in `example.com`:

127+ ```

128+ ~sampel-palnet:dojo> |start %acme

129+ ~sampel-palnet:dojo> :acme &path /tld/your_domain

215 ```

130 ```

216 - Your ship should now be sailing on the digital ocean. Check `https://your_domain`, if everything is working properly you should see a login page.

131 - Your ship should now be sailing on the digital ocean. Check `https://your_domain`, if everything is working properly you should see a login page.

217 - Log in with the code from `+code` in dojo like normal and you should see all of your applications.

132 - Log in with the code from `+code` in dojo like normal and you should see all of your applications.