bonfire – part one – ubuntu

set up ubuntu

set hostname

hostnamectl set-hostname host.example.com

add repositories and packages

sudo add-apt-repository ppa:rabbitmq/rabbitmq-erlang && apt update && apt upgrade

apt install nginx just postgresql postgis make gcc build-essential elixir erlang npm yarn certbot fail2ban certbot python3-certbot-nginx mailcap unzip libgpg-error-dev libgcrypt20-dev gettext imagemagick libvips-tools poppler-utils ffmpegthumbnailer ffmpeg 

install mise, globalize yarn

MISE_VERSION=$(curl -s "https://api.github.com/repos/jdx/mise/releases/latest" | grep -Po '"tag_name": "v\K[0-9.]+')

sudo wget -qO /usr/local/bin/mise https://github.com/jdx/mise/releases/latest/download/mise-v$MISE_VERSION-linux-x64

sudo chmod a+x /usr/local/bin/mise

npm install --global yarn

add bonfire user

adduser --disabled-password bonfire

add postgres user and create database

sudo -u postgres psql

  CREATE USER bonfire_dbuser WITH PASSWORD '<strong password>';
  CREATE DATABASE bonfire_db WITH OWNER bonfire_dbuser;
  CREATE EXTENSION IF NOT EXISTS postgis WITH SCHEMA public;

\q

set up meilisearch

curl -L https://install.meilisearch.com | sh
mv ./meilisearch /usr/local/bin/

useradd -d /var/lib/meilisearch -s /bin/false -m -r meilisearch
chown meilisearch:meilisearch /usr/local/bin/meilisearch
mkdir /var/lib/meilisearch/data /var/lib/meilisearch/dumps /var/lib/meilisearch/snapshots
chown -R meilisearch:meilisearch /var/lib/meilisearch

curl https://raw.githubusercontent.com/meilisearch/meilisearch/latest/config.toml > /etc/meilisearch.toml

configure meilisearch

vi /etc/meilisearch.toml

env = "production"
master_key = "<strong password>"
db_path = "/var/lib/meilisearch/data"
dump_dir = "/var/lib/meilisearch/dumps"
snapshot_dir = "/var/lib/meilisearch/snapshots"

set meilisearch as service

vi /etc/systemd/system/meilisearch.service

[Unit]
Description=Meilisearch
After=systemd-user-sessions.service

[Service]
Type=simple
WorkingDirectory=/var/lib/meilisearch
ExecStart=/usr/local/bin/meilisearch --config-file-path /etc/meilisearch.toml
User=meilisearch
Group=meilisearch
Restart=on-failure

[Install]
WantedBy=multi-user.target


systemctl enable meilisearch
systemctl start meilisearch

set up certbot for nginx ssl reverse proxy

vi /etc/nginx/sites-available/host.example.com

server {
   listen 80;
    server_name host.example.com;

    location @app_upstream {
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
 proxy_set_header Host $host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_pass http://127.0.0.1:4000;
        proxy_redirect off;
        proxy_read_timeout 240s;
    }

    location /data/uploads/ {
        root /frontend/;
        try_files $uri $uri/ /index.html @app_upstream;
	add_header Cache-Control "no-store, no-cache, must-revalidate";
    }

    location / {
 root priv/static;
 index index.html;
 try_files $uri $uri.html $uri/index.html @app_upstream;
    }

    location /live/websocket {
 proxy_pass http://127.0.0.1:4000;
    # these configurations are necessary to proxy WebSocket requests
 proxy_http_version 1.1;
 proxy_set_header Upgrade $http_upgrade;
 proxy_set_header Connection "upgrade";
    }
}

link verify nginx.conf and reload

ln -s /etc/nginx/sites-available/host.example.com /etc/nginx/sites-enabled/

nginx -t

systemctl reload nginx

set up certbot

sudo certbot --nginx -d host.example.com

change to bonfire user

su - bonfire