workshop

#!/bin/bash

#Create two amazon instances
    #https://aws.amazon.com/getting-started/tutorials/launch-a-virtual-machine/
    #login with “ubuntu” user
    #ssh -i ~/Downloads/pvtinstance.pem  [email protected]
#setup ubuntu 16 on both of them
locale
locale-gen en_US.UTF-8
dpkg-reconfigure locales
apt-get -y install build-essential git screen wget vim less bash-completion figlet mc gawk

#secure them
apt-get -y install --no-install-recommends unattended-upgrades chkrootkit rkhunter fail2ban ufw
ufw logging on
ufw default deny
ufw allow ssh/tcp
ufw limit ssh/tcp
ufw allow http
ufw allow https
ufw --force enable
ufw status numbered

#- [ ] setup repos for nginx, nodejs
curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
curl http://nginx.org/keys/nginx_signing.key | apt-key add -

touch /etc/apt/sources.list.d/nginx.list
echo "deb http://nginx.org/packages/mainline/ubuntu/ xenial nginx" | tee /etc/apt/sources.list.d/nginx.list

curl -sS https://dl.yarnpkg.com/debian/pubkey.gpg | apt-key add -
touch  /etc/apt/sources.list.d/yarn.list
echo "deb https://dl.yarnpkg.com/debian/ stable main" | tee /etc/apt/sources.list.d/yarn.list
apt-get update


apt-get -y install nginx nodejs yarn
npm -g install forever

apt-get -y install mongodb-server

#prepare nodejs sample app
cd /opt
#git clone [email protected]:cornelone/node-tutorial-2-restful-app.git
wget https://github.com/cornelone/node-tutorial-2-restful-app/archive/master.zip
unzip master.zip
cd /opt/node-tutorial-2-restful-app-master/
npm install

#start forever
/usr/bin/forever --uid=node-rest-app -l /var/log/node-tutorial-2-restful-app-master.log  --workingDir /opt/node-tutorial-2-restful-app-master -a --minUptime 5000 --spinSleepTime 10000 start bin/www

#setup forever systemd service for single thread process nodejs app
cat << EOT >  /etc/systemd/system/node-rest-app.service
[Unit]
Description=Systemd script for node demo app worker process
After=network.target local-fs.target

[Service]
Type=forking

LimitNOFILE=65536
WorkingDirectory=/opt/node-tutorial-2-restful-app-master

Environment=FOREVER_UID=node-rest-app
Environment=NODE_BIN_DIR=/usr/bin
Environment=NODE_PATH=/usr/lib/node_modules
Environment=APPLICATION_START=bin/www
Environment=APPLICATION_DIRECTORY=/opt/node-tutorial-2-restful-app-master
Environment=NODE_ENV=prod

ExecStart=/usr/bin/forever --uid=\${FOREVER_UID} -l /var/log/node-tutorial-2-restful-app-master.log  --workingDir /opt/node-tutorial-2-restful-app-master -a --minUptime 5000 --spinSleepTime 10000 start \${APPLICATION_START}

ExecStop=/usr/bin/forever stop \${FOREVER_UID}

[Install]
WantedBy=multi-user.target
EOT
systemctl start node-rest-app.service
systemctl enable node-rest-app.service

#setup nginx conf site
mkdir -p /etc/nginx/sites-available
mkdir -p /etc/nginx/sites-enabled
mv /etc/nginx/conf.d/default.conf /etc/nginx/sites-available/

cd /etc/nginx/sites-enabled
ln -s ../sites-available/demo.moqups.pro.conf
sed '$iinclude /etc/nginx/sites-enabled/*.conf;' /etc/nginx/nginx.conf
systemctl restart nginx

cat << EOT > /etc/nginx/sites-available/demo.moqups.pro.conf

upstream node_server {
    server localhost:3000 max_fails=5 fail_timeout=90s;
}

# http .:. redirect to https
server {
    access_log  /var/log/nginx/demo_access.log main;
    error_log   /var/log/nginx/demo_error.log info;
    server_name demo.moqups.pro;
    expires     max;
    listen      0.0.0.0:80;

    return 301 https://demo.moqups.pro\$request_uri;
}
server {
    access_log  /var/log/nginx/demo_access.log main;
    error_log   /var/log/nginx/demo_error.log info;
    listen      443 ssl http2;
    root        /opt/node;
    server_name demo.moqups.pro;

    proxy_set_header   Host             \$host;
    proxy_set_header   X-Forwarded-Host \$host;
    proxy_set_header   X-Forwarded-Server \$host;
    proxy_set_header   X-Real-IP        \$remote_addr;
    proxy_set_header   X-Forwarded-For  \$proxy_add_x_forwarded_for;

    location / {
        proxy_pass http://node_server;
        proxy_next_upstream     error timeout invalid_header http_503;
        proxy_connect_timeout   2s;
    }
}
EOT
cd /etc/nginx/sites-enabled
ln -s ../sites-available/demo.moqups.pro.conf
systemctl restart nginx.service

#letsencrypt
apt-get install software-properties-common
add-apt-repository ppa:certbot/certbot
apt-get install python-certbot-nginx
certbot --nginx

#https://certbot.eff.org/lets-encrypt/ubuntuxenial-nginx

#dns failover (or lb maybe)

#-setup forever systemd service for multi thread process nodejs app
cat << EOT > /etc/systemd/system/node-rest-app-cluster.target
[Install]
WantedBy=multi-user.target
EOT

cat << EOT > /etc/systemd/system/[email protected]
##################
# Enable them with  systemctl enable node-rest-app@<instance number>
# Then start node-rest-app-cluster.target in order to start them all: systemctl start node-rest-app-cluster.target
# Also, enable node-rest-app-cluster.target, for autostart at boot time: systemctl enable node-rest-app-cluster.target
#
##################
[Unit]
Description=Systemd script for node demo app worker process
After=network.target local-fs.target

[Service]
Type=forking

LimitNOFILE=65536
WorkingDirectory=/opt/node-tutorial-2-restful-app-master

Environment=FOREVER_UID=node-rest-app
Environment=NODE_BIN_DIR=/usr/bin
Environment=NODE_PATH=/usr/lib/node_modules
Environment=APPLICATION_START=bin/www
Environment=APPLICATION_DIRECTORY=/opt/node-tutorial-2-restful-app-master
Environment=NODE_ENV=prod
Environment=NODE_APP_INSTANCE=%I
Environment=PORT=%I

ExecStart=/usr/bin/forever --uid=\${FOREVER_UID}-\${NODE_APP_INSTANCE} -l /var/log/node-tutorial-2-restful-app-master.log  --workingDir /opt/node-tutorial-2-restful-app-master -a --minUptime 5000 --spinSleepTime 10000 start \${APPLICATION_START}

ExecStop=/usr/bin/forever stop \${FOREVER_UID}-\${NODE_APP_INSTANCE}

[Install]
WantedBy=node-rest-app-cluster.target


EOT

#logrotate
cat << EOT > /etc/logrotate.d/node-rest-app
/var/log/node-tutorial-2-restful-app-master.log{
  weekly
  rotate 30
  missingok
  notifempty
  compress
  sharedscripts
  copytruncate
  dateext
  dateformat %Y-%m-%d
}
EOT
#monitoring
#backup(s)