Skip to content

Latest commit

 

History

History
167 lines (107 loc) · 4.38 KB

DEPLOYMENT.md

File metadata and controls

167 lines (107 loc) · 4.38 KB
Raw

Deployment

This document will explain how to get an instance of strfry installed on its own VM, for example on a cloud provider like DigitalOcean, Linode, AWS or Vultr.

Starting & Endpoint

We'll assume you have a running VPS that you have access to:

  • You can ssh to the node
  • You have the IP address of the node
  • You can use some kind of DNS registrar to point some domain at the node

The goal is to have:

  • A running strfry relay
  • With a letsencrypt certificate

Provision your server

The remainder of the document assumes a plain VPS.

Vultr - $12/mo

  • High performance Intel
  • 1 vCPU
  • 2048 MB Ram
  • 50 GB NVMe SSD
  • OS Ubuntu 22.04 LTS
  • Disable automatic backup

Point DNS at your server

While you wait for your server to provision, go to your DNS provider and point an address at it. An A record of relay.yourdomain.com should point to the IP address of your VPS.

Connect to your server

    # Update deps
    sudo apt update

    # Download strfry
    git clone https://github.com/hoytech/strfry.git
    cd strfry

    # Install complication dependencies
    sudo apt install -y git build-essential libyaml-perl libtemplate-perl libregexp-grammars-perl libssl-dev zlib1g-dev liblmdb-dev libflatbuffers-dev libsecp256k1-dev libzstd-dev ufw

    # Build it
    git submodule update --init
    make setup-golpe
    make -j2

    # Go get coffee, this takes a few minutes on a single vCPU

    # Install strfry
    sudo cp strfry /usr/local/bin

    # Install web hosting dependencies
    sudo apt install nginx certbot python3-certbot-nginx

    # Remove the default nginx file
    sudo rm -rf /etc/nginx/sites-available/default

    # Provide the following settings file
    sudo vim /etc/nginx/sites-available/default

    sudo service nginx restart

Note, at this point your nginx will just try to pass all connections to a nonexistent strfry endpoint, get frustrated, and refuse the connection.

Configure Strfry

  • Create user

      sudo useradd -M -s /usr/sbin/nologin strfry

  • Create data directory

      sudo mkdir /var/lib/strfry
  sudo chown strfry:strfry /var/lib/strfry
  sudo chmod 755 /var/lib/strfry

Sample NGINX Starter Config

Note here you'll use the DNS name you configured above

    server{
        server_name relay.yourdomain.com;
        location / {
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header Host $host;
            proxy_pass http://127.0.0.1:7777;
            proxy_http_version 1.1;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection "upgrade";
        }
    }

Install strfry.conf

Edit the db = "./strfry-db/" line to: db = "/var/lib/strfry/"

Check system hard limit ulimit -Hn

If for example 524288 can set this to nofiles = 524288 in strfry.conf (or set to 0)

Copy the strfry.conf file to /etc and change ownership:

    sudo cp strfry.conf /etc/strfry.conf
    sudo chown strfry:strfry /etc/strfry.conf

Install Systemd File

Put the following file at /etc/systemd/system/strfry.service

    [Unit]
    Description=strfry relay service

    [Service]
    User=strfry
    ExecStart=/usr/local/bin/strfry relay
    Restart=on-failure
    RestartSec=5
    ProtectHome=yes
    NoNewPrivileges=yes
    ProtectSystem=full
    LimitCORE=1000000000

    [Install]
    WantedBy=multi-user.target

Now enable this service and start it

    sudo systemctl enable strfry.service
    sudo systemctl start strfry

    sudo systemctl status strfry

You can curl to ensure things are running:

    curl localhost:7777

Tells you that strfry is running

    curl localhost:80

Tells you that nginx is running

Firewall and Certificate

Now let's open the port to the outside world:

    sudo ufw allow 'Nginx Full'
    sudo ufw status
    sudo ufw default deny incoming  
    sudo ufw default allow outgoing
    ufw allow 22/tcp # allow incoming SSH traffic  
    sudo ufw enable

For added security you can sudo apt install -y fail2ban

    sudo certbot --nginx -d relay.yourdomain.com

Next steps

At this point you should have a running relay. Point your client at it, tell a few friends, post some notes, or whatever you want.