### Preliminarily setup up the server environment **Make sure this `127.0.0.1 localhost` is in your /etc/hosts file** Run the following: ``` apt update && apt upgrade -y apt install lsb-release apt-transport-https ca-certificates wget -y wget -O /etc/apt/trusted.gpg.d/php.gpg https://packages.sury.org/php/apt.gpg echo "deb https://packages.sury.org/php/ $(lsb_release -sc) main" | tee /etc/apt/sources.list.d/php.list apt update apt install php8.1-fpm php8.1-cli php8.1-common php8.1-curl php8.1-gd php8.1-intl php8.1-mbstring php8.1-xml php8.1-zip php8.1-pgsql nginx postgresql redis git python3 composer certbot python3-certbot-nginx -y systemctl enable nginx systemctl enable postgresql systemctl enable php8.1-fpm systemctl enable redis-server systemctl start postgresql systemctl start redis-server systemctl start php8.1-fpm mkdir /var/www/html/creatia mkdir /var/www/html/panel ``` ### Generate your key for setting up Creatia `ssh-keygen -t ed25519 -C "jessec@globalsecurelayer.com"` **Make sure to use a password should the server be popped, and further, set this up on GitHub - I'm not going to detail this, if you're setting this up you should be able to figure it out.** Put this in the .ssh/config file ``` Host github.com-creatia-backend Hostname github.com IdentityFile /root/.ssh/id_ed25519 ``` ### Clone the branch Run these: ``` cd /var/www/html git clone git@github.com:globalsecurelayer/Creatia-Backend.git creatia/ chown www-data -R /var/www/html git config --global --add safe.directory /var/www/html/creatia ``` ### Setup the backend itself Run these: ``` composer install touch .env ``` Setup the .env Create a Creatia user in the database, and the database: ``` CREATE DATABASE creatia; CREATE USER creatia WITH PASSWORD 'ISAoas92oLaxxjz9!ksnvoal0LASDi02185JSLmsSIcialcnrpqehxmaozugnc'; GRANT ALL PRIVILEGES ON DATABASE creatia TO creatia; GRANT CREATE ON SCHEMA public TO creatia; GRANT USAGE ON SCHEMA public TO creatia; ``` Setup Redis to use the password - It's in /etc/redis/redis.conf - It'll be under requirepass Run these: ``` php artisan route:cache php artisan migrate ``` ### You will need to setup the nginx configuration With the next block, `nano /etc/nginx/sites-enabled/backend` ``` map $http_upgrade $type { default "web"; websocket "ws"; } server { listen [::]:443 ssl; listen 443 ssl; server_name demo-api.securelayer.com; root /var/www/html/creatia/public/; index index.php; include /etc/nginx/snippets/public-whitelist.conf; access_log /var/log/nginx/demo-api.securelayer.com.access.log; error_log /var/log/nginx/demo-api.securelayer.com.error.log; proxy_read_timeout 300; proxy_connect_timeout 300; proxy_send_timeout 300; location / { deny 45.140.189.195; try_files /nonexistent @$type; } location @web { try_files $uri /index.php?$query_string; } location @ws { proxy_pass http://127.0.0.1:6001; proxy_set_header Host $host; proxy_read_timeout 60; proxy_connect_timeout 60; proxy_redirect off; # Allow the use of websockets proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection 'upgrade'; proxy_set_header Host $host; proxy_cache_bypass $http_upgrade; } location ~ \.php$ { include snippets/fastcgi-php.conf; fastcgi_read_timeout 300; fastcgi_pass unix:/run/php/php8.44-fpm.sock; } location ~ /\.ht { deny all; } location ~ /.well-known { allow all; } ssl_certificate /etc/letsencrypt/live/demo-api.securelayer.com/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/demo-api.securelayer.com/privkey.pem; # managed by Certbot } ``` With the next block, `nano /etc/nginx/sites-enabled/frontend` ``` server { listen [::]:443 ssl; listen 443 ssl; server_name demo.securelayer.com; include /etc/nginx/snippets/public-whitelist.conf; ssl_certificate /etc/letsencrypt/live/demo.securelayer.com/fullchain.pem; ssl_certificate_key /etc/letsencrypt/live/demo.securelayer.com/privkey.pem; root /var/www/html/panel; index index.html index.htm; access_log /var/log/nginx/demo.securelayer.com.access.log; error_log /var/log/nginx/demo.securelayer.com.error.log; location / { try_files $uri /index.html; } } ``` With the next block, `nano /etc/nginx/snippets/public-whitelist.conf` ``` allow all; ``` ### Ensure you've setup your R53 entries before doing certbot - You'll need two certs setup. Run: `certbot certonly` ### Start Nginx `systemctl start nginx` ### Further work There will be additional work required for a functional setup, we've only got a dumb controller installed right now - It does nothing. Things you should consider installing are: - The GoBGP RIB - There's a script detailing build instructions in `sh/setup-gobgp` - Setup the appropriate systemd services and timers - Setup Clickhouse for the reporting system - Setup microservices that will be needed - Setup a firewall: `ufw allow ssh && ufw allow http && ufw allow https && ufw default deny incoming && ufw default allow outgoing && ufw enable` ### Upgrades Obviously since first writing this documentation we've had to upgrade. The documentation was first written for Laravel 8, and now we're working towards Laravel 12. To achieve this, a few things need to be satisfied. - We need to be on the right version of PHP - We need to migrate away from dead packages to more modern ones This of course brings risks, problems, and changes. First, upgrade PHP where possible: ``` sudo apt install -y php8.4-cli php8.4-fpm php8.4-common php8.4-mbstring php8.4-xml php8.4-curl php8.4-zip php8.4-bcmath php8.4-gd php8.4-intl php8.4-pgsql php8.4-redis sudo update-alternatives --set php /usr/bin/php8.4 ``` You'll need to prepare your environment file to use Laravel Reverb instead of Laravel Websockets as well. And the Nginx configuration: Replace the @ws ``` location @ws { proxy_pass http://127.0.0.1:6001; proxy_http_version 1.1; proxy_set_header Upgrade $http_upgrade; proxy_set_header Connection $connection_upgrade; proxy_set_header Host $host; proxy_buffering off; proxy_read_timeout 3600s; proxy_send_timeout 3600s; } ``` Add this at the top: ``` map $http_upgrade $connection_upgrade { default upgrade; '' close; } map $http_upgrade $type { default "web"; "websocket" "ws"; } ``` For the .env, do something like: ``` REVERB_APP_ID= REVERB_APP_KEY=socket REVERB_APP_SECRET= REVERB_SERVER_HOST="127.0.0.1" REVERB_SERVER_PORT=6001 REVERB_HOST="127.0.0.1" REVERB_PORT=6001 REVERB_SCHEME=http REVERB_MAX_REQUEST_SIZE=1000000 VITE_REVERB_APP_KEY="${REVERB_APP_KEY}" VITE_REVERB_HOST="${REVERB_HOST}" VITE_REVERB_PORT="${REVERB_PORT}" VITE_REVERB_SCHEME="${REVERB_SCHEME}" ``` Slack messages change how they work too.