Hosting Overhaul

[glitchedmob]

A few months ago our Heroku account was shut down. We need to look at putting this site on a new host. Here's ideally how it would work

• We fully dockerize this application using https://github.com/Open-SGF/invisiblemanleadership.org as an example
• We configure an Ubuntu VM from a cloud provider (e.g. Digital Ocean)
• We lock down that VM. No password login, proper firewall rules etc
• We deploy our dockerized application to that VM
• For SSL we either A) figure out how to do Let's Encrypt inside of the docker containers or B) we install nginx (through docker as a standalone container or natively) and use it as a reverse proxy for the docker compose

[ethanzitting]

From in person discussion: document precise steps for the setup of this hosting.

[ethanzitting]

• [x] Get a caddy server docker container working
• [x] Host it in a digital ocean droplet
• [x] Get another project running in the droplet
• [x] Configure caddy to route traffic to that project
• [ ] Perform a final refactor of the caddy container source code to ease addition of more sites.

[ezmidwestern]

Possibly relevant: https://stackoverflow.com/questions/27879713/is-it-ok-to-run-docker-from-inside-docker#:~:text=It's%20OK%20to%20run%20Docker,not%20be%20a%20viable%20alternative.

[ethanzitting]

Highly Relevant: host.docker.internal.

[ethanzitting]

• [ ] Make the site resistant to hard server reboots

[ethanzitting]

Server setup:

I select SSH key authentication method instead of password authentication method.

I have digital ocean automatically enable access with my main ssh key.

I decline automatic disk backups.

The droplet is created.

I open a terminal and ssh in as the root user.

I update the known package versions with apt-get update

I update Ubuntu packages with apt-get upgrade with the following complications:

• Updating brings up a dialog about telling me that there is a new version of my /etc/ssh/sshd_config but the version installed has been locally modified.
• I think the local modifications relate to Digital Ocean automatically adding my ssh key for access.
• I’ll try installing the package managers version and then altering it myself to recreate digital oceans changes.
• I select install the package manager’s version.
• It asks me which services to restart after these options. I select all available options.

I create a non-root user with adduser ethan

I give the user sudo access with usermod -aG sudo ethan

I enable ssh access as this user by doing the following:

• I change to ethan with su ethan
• I create ~/.ssh/authorized_keys
• I past my public ssh key there

I set up the port firewall by doing the following:

• sudo ufw default deny incoming
• sudo ufw default allow outgoing
• sudo ufw allow ssh
• sudo ufw allow http
• sudo ufw allow https
• sudo ufw enable

I set up github access from my droplet by doing the following:

• ssh-keygen -t ed25519 -C "ethan@ethanzitting.com"

• I enter the public key into my github.

I make sure password access to the server is disabled by ensuring that “PasswordAuthentication” is set to no in /etc/ssh/sshd_config. It already is.