freepoteries-doc/content/new_vh.rst

new virtual host
################

:date: 2019-09-09 00:00
:modified: 2019-09-09 00:00
:tags: infra
:category: documentation
:slug: create_vh
:authors: Ms.Leave-A-Mix
:summary: How-To install a new virtual host to the webserver

This article will explain how to deploy a new service within your web server.
The service (framadate), is hosted on the same machine than the webserver
(nginx). You may like to create a new machine, to use the self-included
webserver of your programming language (php, python, ruby...), as the goal of
having one webserver is to save time by configuring only one monitoring system
and security system for many apps.

-------------
The Webserver
-------------

We use NGINX as a webserver. It is modular and aimed to be as small and
efficient as possible. Since then, it doesn't include the necessary programs to
run your scripts. You need to have another program to launch and manages your
processes. For our example, this will be php-fpm_. If you also use `Alpine
Linux`_ you can follow `this tutorial
<https://wiki.alpinelinux.org/wiki/Nginx_with_PHP#PHP7_Installation>`__.

------
System
------

I will use the commands with the default Alpine Linux tools, that are not like
Debian or Arch ones. Adapt this if you use another distro.

I suggest that the webserver is already installed, and is working for serving
php scripts.

We will create a new user that has access to the git repository of your program,
so you can update it's code easily, without having to re-upload at each
modification.

.. code-block:: bash

    useradd -rm www-git

Create an passwordless ssh key for this user :

.. code-block:: bash

    su www-git
    ssh-keygen`

If you need the git authentication (i.e. because your repo is private), do as
usual.

--------
Database
--------

Freepoteries uses one server to handle all database stuff. We will assume in
this documentation that the DB software is MariaDB_ (ver. 10.1.38, debian).

Your DB server needs to be accessible by the webserver machine, you can test
this on the webserver host by launching the following command :

.. code-block:: bash

    nc db.server db.port

If it gives you the MariaDB version, you're ok to go with this.

You need to have an administrator access to the MariaDB server. On the DB
server, try this by launching the following commands :

.. code-block:: bash

    mariadb -u root

If this connects you to the MariaDB prompt, you're ok.
Now, in this prompt, create the user for our app. It will own a database and all
the rights on it.

.. code-block:: MySQL

    CREATE DATABASE framadate;
    CREATE USER 'framadate'@'www.freepoteries.fr' identified by '7VDYMDXJXHTC107Z61OWCVTWM';
    GRANT ALL PRIVILEGES ON framadate TO 'framadate'@'www.freepoteries.fr';

-----------
Application
-----------

On the webserver, we just need a running php-fpm socket (tcp or unix), that we
will use to run the php scripts.

The following commands are to execute as the www-git user:

.. code-block:: bash

    git clone ssh://git@git.yannweb.net:2222/maxime-alves/framadate.git
    cd framadate
    composer install
    cd /var/www
    ln -s /home/www-git/framadate poll

Then, as root, edit **/etc/nginx/conf.d/poll** and put in the following:

.. code-block:: nginx

    server {
        listen 80;
        root /var/www/poll;

        keepalive_timeout 70;

        index index.php index.html index.htm index.nginx-debian.html;

        server_name poll.freepoteries.fr;

        location / {
            try_files $uri $uri/ =404;
        }

        location ~ \.php$ {
            ## you can put the settings for app/inc/config.php as
            ## fastcgi_param VAR value
            fastcgi_pass unix:/var/run/php/php7.0-fpm.sock;
        }
    }


Test your config with :code:`nginx -T`, and if no error occurs (it should print
your whole configuration), restart the webserver with :code:`service nginx
reload` .

---------------
External Access
---------------

This part will only focus on external access using the standard server
configuration, hostnames, and domains. It should be noted that you don't need to
configure this for a testing server that is limited to internal network access
(or tunnelling).

Since the reverse proxy (article required) receives all external contact coming
from HTTP and HTTPS, we just need to indicate it to contact the right ip with
the right port. You can do this by adding this virtualhost to
**/etc/nginx/conf.d/reverse-proxy**.

.. code-block:: nginx

    # Framadate
    # HTTP
    server {
        include /etc/nginx/bots.d/blockbots.conf;
        include /etc/nginx/bots.d/ddos.conf;

        listen 80;
        listen [::]:80;

        server_name poll.freepoteries.fr;
        access_log /var/log/nginx/access.poll.log combined;

        location / {
            add_header          X-Robots-Tag "noindex, nofollow, nosnippet, noarchive";
            proxy_set_header    X-Forwarded-Proto $schme;
            proxy_set_header    X-Forwarded-For $remote_addr;
            proxy_set_header    Host    $host;
            proxy_pass          http://www2.freepoteries.fr;
        }
        location = /robots.txt { return 200 "User-agent: *\nDisallow: /\n"; }
    }

---
SSL
---

In the case of SSL, you do **not** need to have the certificates on the
application server. You may store them only on the reverse-proxy server, that
will then communicate with your application host via HTTP.

So, in the right server block of **/etc/nginx/conf.d/reverse-proxy**, just add
the following:

.. code-block:: nginx

    listen 443 ssl;
    listen [::]:443 ssl;
    ssl_certificate /etc/ssl/certs/poll_crt.pem;
    ssl_certificate_key /etc/ssl/private/poll_key.pem;


.. _php-fpm: https://php-fpm.org/
.. _Alpine Linux: https://alpinelinux.org/
.. _MariaDB: https://mariadb.org/