diff --git a/Caddyfile b/Caddyfile new file mode 100644 index 0000000000..d83cfb3acd --- /dev/null +++ b/Caddyfile @@ -0,0 +1,5 @@ +api-demo.talawa.io { + reverse_proxy talawa-api-dev:4000 { + header_down Strict-Transport-Security max-age=31536000; + } +} diff --git a/Dockerfile.dev b/Dockerfile.dev index 2057c9d6cc..93e0564184 100644 --- a/Dockerfile.dev +++ b/Dockerfile.dev @@ -1,5 +1,5 @@ # Stage 1: Install Dependencies -FROM node:lts AS builder +FROM node:20.10.0 AS builder WORKDIR /usr/src/app @@ -9,13 +9,6 @@ RUN npm install COPY . . -# Stage 2: Final image -FROM node:lts-bookworm-slim - -WORKDIR /usr/src/app - -COPY --from=builder /usr/src/app ./ - EXPOSE 4000 CMD ["npm", "run", "dev"] diff --git a/docker-compose.dev.yaml b/docker-compose.dev.yaml index 02f8cbfa9a..b435a1cb7a 100644 --- a/docker-compose.dev.yaml +++ b/docker-compose.dev.yaml @@ -1,4 +1,4 @@ -version: '3.8' +version: "3.8" services: mongodb: @@ -7,20 +7,18 @@ services: - 27017:27017 volumes: - mongodb-data:/data/db - + redis-stack-server: image: redis/redis-stack-server:latest ports: - 6379:6379 volumes: - - redis-data:/data/redis + - redis-data:/data/redis - talawa-api-dev-container: + talawa-api-dev: build: context: . dockerfile: Dockerfile.dev - ports: - - "${SERVER_PORT:-4000}:${SERVER_PORT:-4000}" volumes: - .:/usr/src/app - /usr/src/app/node_modules @@ -32,6 +30,21 @@ services: - REDIS_HOST=redis-stack-server - REDIS_PORT=6379 + caddy: + image: caddy/caddy:2.2.1-alpine + container_name: caddy-service + restart: unless-stopped + ports: + - "80:80" + - "443:443" + volumes: + - $PWD/Caddyfile:/etc/caddy/Caddyfile + - $PWD/site:/srv + - caddy_data:/data + - caddy_config:/config + volumes: mongodb-data: redis-data: + caddy_data: + caddy_config: diff --git a/scripts/cloud-api-demo/README.md b/scripts/cloud-api-demo/README.md index 4617ad3178..7345054cfe 100644 --- a/scripts/cloud-api-demo/README.md +++ b/scripts/cloud-api-demo/README.md @@ -7,33 +7,26 @@ This guide provides step-by-step instructions for setting up a cloud instance of - You have sudo privileges. - You are executing all commands under the home directory of the 'talawa-api' user. -# Table Of Contents - -- [Talawa API Cloud Instance Setup Guide](#talawa-api-cloud-instance-setup-guide) - - [1. Virtual Private Server (VPS) Setup](#1-virtual-private-server-vps-setup) - - [2. Repository Setup](#2-repository-setup) - - [3. Docker Configuration](#3-docker-configuration) - - [4. Running the Containers](#4-running-the-containers) - - [5. Firewall Setup](#5-firewall-setup) - - [6. NGINX Installation and Configuration](#6-nginx-installation-and-configuration) - - [6.1 Install NGINX and configure it](#61-install-nginx-and-configure-it) - - [6.2 Add the following to the location part of the server block](#62-add-the-following-to-the-location-part-of-the-server-block) - - [6.3 Check the NGINX configuration and restart it](#63-check-the-nginx-configuration-and-restart-it) - - [7. SSL Configuration with LetsEncrypt](#7-ssl-configuration-with-letsencrypt) - - [8. SSH Keys for GitHub Actions](#8-ssh-keys-for-github-actions) - - [9. GitHub Action Setup](#9-github-action-setup) - - [10. Cron Jobs](#10-cron-jobs) - - [10.1 Setting up Scripts](#101-setting-up-scripts) - - [10.1.1 Setting Permissions and Owner for correct_permissions.py](#1011-setting-permissions-and-owner-for-check_permissionssh) - - [10.1.2 Modify sudoers file to allow talawa-api to run chmod and chown without password prompt](#1012-modify-sudoers-file-to-allow-talawa-api-to-run-chmod-and-chown-without-password-prompt) - - [10.1.3 Run correct_permissions.py once to correct permissions for other scripts](#1013-run-check_permissionssh-once-to-correct-permissions-for-other-scripts) - - [10.2 Setting up Cronjobs](#102-setting-up-cronjobs) - - [10.2.1 Cron job to run correct_permissions.py](#1021-cron-job-to-run-check_permissionssh) - - [10.2.2 Cron job to run renew_certificates.py](#1022-cron-job-to-run-cert_renewsh) - - [10.2.3 Cron job to run eset_database.py](#1023-cron-job-to-run-reset_mongosh) - - [10.3 Logging for cron jobs](#103-logging-for-cron-jobs) - -## 1. Virtual Private Server (VPS) Setup +## Table Of Contents + +- [1. Virtual Private Server (VPS) Setup](#1-virtual-private-server-vps-setup) +- [2. Repository Setup](#2-repository-setup) +- [3. Docker Configuration](#3-docker-configuration) +- [4. Running the Containers](#4-running-the-containers) +- [5. Firewall Setup](#5-firewall-setup) +- [6. SSH Keys for GitHub Actions](#6-ssh-keys-for-github-actions) +- [7. GitHub Action Setup](#7-github-action-setup) +- [8. Cron Jobs](#8-cron-jobs) + - [8.1 Setting up Scripts](#81-setting-up-scripts) + - [8.1.1 Setting Permissions and Owner for correct_permissions.py](#811-setting-permissions-and-owner-for-correct_permissionspy) + - [8.1.2 Modify sudoers file to allow talawa-api to run chmod and chown without password prompt](#812-modify-sudoers-file-to-allow-talawa-api-to-run-chmod-and-chown-without-password-prompt) + - [8.1.3 Run correct_permissions.py once to correct permissions for other scripts](#813-run-correct_permissionspy-once-to-correct-permissions-for-other-scripts) + - [8.2 Setting up Cronjobs](#82-setting-up-cronjobs) + - [8.2.1 Cron job to run correct_permissions.py](#821-cron-job-to-run-correct_permissionspy) + - [8.2.3 Cron job to run reset_database.py](#823-cron-job-to-run-reset_databasepy) + - [8.3 Logging for cron jobs](#83-logging-for-cron-jobs) + +### 1. Virtual Private Server (VPS) Setup First, update your package lists and upgrade the system: @@ -44,33 +37,33 @@ sudo apt-get update && sudo apt-get upgrade Next, install curl: ```bash -sudo apt-get install curl +sudo apt-get install curl ``` Then, install Node Version Manager (nvm): ```bash -sudo curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash +sudo curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.38.0/install.sh | bash -source ~/.bashrc +source ~/.bashrc -nvm install --lts +nvm install --lts ``` -## 2. Repository Setup +### 2. Repository Setup Create a new directory and clone the Talawa API repository: ```bash -mkdir develop -cd develop git clone https://github.com/PalisadoesFoundation/talawa-api.git . +cd talawa-api npm install +npm run setup ``` -## 3. Docker Configuration +### 3. Docker Configuration -After that, to setup docker first remove all the conflicting packages: +After that, to setup docker, first remove all the conflicting packages: ```bash for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker containerd runc; do sudo apt-get remove $pkg; done @@ -78,9 +71,9 @@ for pkg in docker.io docker-doc docker-compose docker-compose-v2 podman-docker c Before you install Docker Engine for the first time on a new host machine, you need to set up the Docker repository. Afterward, you can install and update Docker from the repository. -### 3.1 Set up docker's repository: +#### 3.1 Set up docker's repository: -#### 3.1.1 Add Docker's official GPG key: +##### 3.1.1 Add Docker's official GPG key: ```bash sudo apt-get update @@ -90,7 +83,7 @@ sudo curl -fsSL https://download.docker.com/linux/ubuntu/gpg -o /etc/apt/keyring sudo chmod a+r /etc/apt/keyrings/docker.asc ``` -#### 3.1.2 Add the repository to apt sources: +##### 3.1.2 Add the repository to apt sources: ```bash echo \ @@ -101,31 +94,30 @@ echo \ sudo apt-get update ``` -### 3.2 Install the Docker packages: +#### 3.2 Install the Docker packages: ```bash sudo apt-get install docker-ce docker-ce-cli containerd.io docker-buildx-plugin docker-compose-plugin ``` -### 3.3 Allow docker to run without sudo +#### 3.3 Allow docker to run without sudo ```bash sudo groupadd docker sudo usermod -aG docker $USER ``` -- **Note : Reboot the machine to apply the changes** - -## 4. Running the Containers +### 4. Running the Containers Start the containers and import sample data: ```bash -docker-compose up -d --build -npm run import:sample-data +cd ~/talawa-api/ +docker compose -f docker-compose.dev.yaml up -d +npm run import:sample-data ``` -## 5. Firewall Setup +### 5. Firewall Setup Enable the firewall and allow SSH, HTTP, and HTTPS: @@ -137,49 +129,7 @@ sudo ufw enable sudo ufw status ``` -## 6. NGINX Installation and Configuration - -### 6.1 Install NGINX and configure it: - -```bash -sudo apt install nginx -sudo vi /etc/nginx/sites-available/default -``` - -### 6.2 Add the following to the location part of the server block: - -```bash -server_name yourdomain.com www.yourdomain.com; - -location / { - proxy_pass http://localhost:4000; - proxy_http_version 1.1; - proxy_set_header Upgrade $http_upgrade; - proxy_set_header Connection 'upgrade'; - proxy_set_header Host $host; - proxy_cache_bypass $http_upgrade; -} -``` - -### 6.3 Check the NGINX configuration and restart it: - -```bash -sudo nginx -t -sudo nginx -s reload -``` - -## 7. SSL Configuration with LetsEncrypt - -Add SSL with LetsEncrypt: - -``` -sudo add-apt-repository ppa:certbot/certbot -sudo apt-get update -sudo apt-get install python3-certbot-nginx -sudo certbot --nginx -d yourdomain.com -d www.yourdomain.com -``` - -## 8. SSH Keys for GitHub Actions +### 6. SSH Keys for GitHub Actions For secure communication between GitHub Actions and the API VPS, you'll need to generate SSH keys and add the public key to the authorized keys on your VPS. Here's how you can do it: @@ -205,7 +155,7 @@ For secure communication between GitHub Actions and the API VPS, you'll need to cat ~/.ssh/id_ed25519 ``` -## 9. GitHub Action Setup +### 7. GitHub Action Setup To enable continuous integration with GitHub Actions, you need to set up the necessary secrets for the workflow. These secrets allow secure communication between the GitHub Actions workflow and your VPS. Here are the steps to set up the required secrets: @@ -229,9 +179,9 @@ Please replace the example values with your actual values. These secrets are crucial for the GitHub Actions workflow to connect securely to your VPS and deploy the Talawa API. -## 10. Cron Jobs +### 8. Cron Jobs -### 10.1 Setting up Scripts: +#### 8.1 Setting up Scripts: Copy the following scripts from **/home/talawa-api/develop/talawa-api/scripts/cloud-api-demo** to **/usr/local/bin/scripts**: `renew_certificates.py` @@ -240,14 +190,14 @@ Copy the following scripts from **/home/talawa-api/develop/talawa-api/scripts/cl `reset_database.py` `create_env.py` -#### 10.1.1 Setting Permissions and Owner for correct_permissions.py: +##### 8.1.1 Setting Permissions and Owner for correct_permissions.py: ```bash sudo chmod 700 /usr/local/bin/scripts/correct_permissions.py sudo chown talawa-api /usr/local/bin/scripts/correct_permissions.py ``` -#### 10.1.2 Modify sudoers file to allow talawa-api to run chmod and chown without password prompt: +##### 8.1.2 Modify sudoers file to allow talawa-api to run chmod and chown without password prompt: - Open sudoers file with sudo visudo. - Add the following line: @@ -258,7 +208,7 @@ talawa-api ALL=(ALL) NOPASSWD: /bin/chmod, /bin/chown - Save and exit the editor -#### 10.1.3 Run `correct_permissions.py` once to correct permissions for other scripts: +##### 8.1.3 Run `correct_permissions.py` once to correct permissions for other scripts: ```bash python3 correct_permissions.py --user talawa-api --files /usr/local/bin/scripts/deploy.py /usr/local/bin/scripts/reset_database.py /usr/local/bin/scripts/renew_certificates.py /usr/local/bin/scripts/create_env.py @@ -266,9 +216,9 @@ python3 correct_permissions.py --user talawa-api --files /usr/local/bin/scripts/ Executing `correct_permissions.py` once will ensure that the correct permissions are applied to the other scripts in the specified directory. -### 10.2 Setting up Cronjobs: +#### 8.2 Setting up Cronjobs: -#### 10.2.1 Cron job to run correct_permissions.py +##### 8.2.1 Cron job to run correct_permissions.py This cron job will execute correct_permissions.py every midnight, ensuring that the correct permissions are maintained for the scripts : @@ -276,15 +226,7 @@ This cron job will execute correct_permissions.py every midnight, ensuring that echo "0 0 * * * talawa-api python3 correct_permissions.py --user talawa-api --files /usr/local/bin/scripts/deploy.py /usr/local/bin/scripts/reset_database.py /usr/local/bin/scripts/renew_certificates.py /usr/local/bin/scripts/create_env.py" | sudo tee /etc/cron.d/check_permissions ``` -#### 10.2.2 Cron job to run renew_certificates.py - -This cron job will execute `renew_certificates.py` every 90 days, ensuring that the certificates are renewed in a timely manner: - -```bash -echo "0 0 * * * talawa-api python3 renew_certificates.py --config-dir ~/.certbot/config --logs-dir ~/.certbot/logs --work-dir ~/.certbot/work" | sudo tee /etc/cron.d/cert_renew -``` - -#### 10.2.3 Cron job to run reset_database.py +##### 8.2.3 Cron job to run reset_database.py This cron job will execute `reset_database.py` every 24 hours, ensuring that the MongoDB is reset on a daily basis: @@ -292,55 +234,7 @@ This cron job will execute `reset_database.py` every 24 hours, ensuring that the echo "0 * * * * talawa-api python3 reset_database.py --mongo-container develop-mongodb-1 --mongo-db talawa-api --repo-dir /home/talawa-api/develop" | sudo tee /etc/cron.d/reset_mongo ``` -#### 10.3 Logging for cron jobs - -1. **Create the logrotate configuration file:** - -```bash -sudo nano /etc/logrotate.d/talawa-api-cron -sudo mkdir -p /var/log/talawa-api/ -sudo chown talawa-api /var/log/talawa-api/ -``` - -2. **Add the following content to the file:** - -```log -/var/log/talawa-api/cron.log { - rotate 7 - daily - missingok - notifempty - compress - delaycompress - create 640 talawa-api - sharedscripts - postrotate - systemctl restart cron - endscript -} -``` - -**Explanation:** - -- `rotate 7`: Retains the last 7 rotated log files. -- `daily`: Rotates the log file daily. -- `missingok`: Ignores errors if the log file is missing. -- `notifempty`: Does not rotate the log file if it is empty. -- `compress`: Compresses rotated log files. -- `delaycompress`: Delays compression until the next rotation cycle. -- `create 640 talawa-api`: Creates new log files with the specified permissions and ownership. In this case, the owner is set to talawa-api. -- `sharedscripts`: Runs the `postrotate` script only once even if multiple log files are rotated. -- `postrotate` ... endscript: Defines the actions to be taken after log rotation, in this case, restarting the cron service. - -3. **Save and exit the text editor (Ctrl + X, then Y, then Enter in nano).** - -4. **Restart Cron Service:** - Apply the logrotate changes by restarting the cron service: - -```bash -sudo systemctl restart cron -``` - -Now, the cron job output will be logged to `/var/log/talawa-api/cron.log`, and log rotation will be managed by logrotate according to the specified configuration. Adjust the log rotation parameters in the logrotate configuration file as needed. +### 8.3 Logging for cron jobs This will set up logging for the cron jobs and manage log rotation using logrotate. +