Nginx, node.js, mysql, letsencrypt setup on one lightsails/ec2 machine (Good for dev/ing/staging servers)

full_setup.md

Setup machine and images:

• Create Instance at aws lighsail
• Choose App+OS
• Choose Nginx
• Choose Machine type (e.g. $3.5)
• Set the machine name at Identify your instance
• Create Instance

Setup node.js

https://github.com/nodesource/distributions/blob/master/README.md#installation-instructions

sudo curl -fsSL https://deb.nodesource.com/setup_14.x | sudo -E bash -
sudo apt-get install -y nodejs
sudo npm i -g npm pm2 @adonisjs/cli

nginx

Working Directory for configurations: /opt/bitnami/nginx/conf/server_blocks

Setup default stuffs

cd /opt/bitnami/nginx/html
mv index.html index_1.html
nano 50x.html #paste [50x.html](./nginx/html/50x.html)
nano 404.html #paste [50x.html](./nginx/html/50x.html)
nano index.html #paste [50x.html](./nginx/html/50x.html)

⚠️ disable security on phpmyadmin:

Run $ nano /opt/bitnami/phpmyadmin/config.inc.php

Find line $cfg['Servers'][$i]['host'] = '127.0.0.1';

and comment this line as /*$cfg['Servers'][$i]['host'] = '127.0.0.1';*/

Status/Start/Stop/Restart

https://docs.bitnami.com/aws/infrastructure/nginx/administration/control-services/

sudo /opt/bitnami/ctlscript.sh status
sudo /opt/bitnami/ctlscript.sh start nginx
sudo /opt/bitnami/ctlscript.sh stop nginx
sudo /opt/bitnami/ctlscript.sh restart nginx

See logs and errors of nginx

cat /opt/bitnami/nginx/logs/access.log
# or continue tracking using `tail`
tail /opt/bitnami/nginx/logs/access.log --follow


cat /opt/bitnami/nginx/logs/error.log
# or continue tracking using `tail`
tail /opt/bitnami/nginx/logs/error.log --follow

Some refs:

• https://docs.bitnami.com/aws/apps/dreamfactory/administration/start-nginx-server/

Setup service

Reverse proxy nginx for service

Let the service accessible through public IP

sudo nano /opt/bitnami/nginx/conf/server_blocks/somedomain.com.conf
# paste nginx/somedomain.com.conf to nano and save
sudo /opt/bitnami/ctlscript.sh restart nginx

Add DNS record to point domain to the IP

• Open DNS service of domain e.g. Godaddy DNS setting at https://dcc.godaddy.com/manage/somedomain.com/dns
• If it is only domain name such as somedomain.com
  • Add A Record as:
  • Host: @
  • Points to:
  • TTL: <Default: 0.5hour or Custom>
  • Add CNAME as:
  • Host: www
  • Points to: @
  • TTL: <Default: 0.5hour or Custom>
• If it is subdomain such as service.somedomain.com
  • Add A Record as:
  • Host: service
  • Points to:
  • TTL: <Default: 0.5hour or Custom>

Clone code, install dependencies and run service

One time

cd ~
mkdir codes
cd codes

For Each service

git clone https://<user>:<pwd/pat>@github.com/somedomain/<repo-name>.git
cd <repo-name>
npm i
cp .env.example .env
adonis key:generate
nano .env #set port and other env variables
<adonis db:create>
<adonis migration:run --force>
<adonis seed --force>
pm2 start server.js --name <repo-name>

Fetch new code and redeploy

git pull origin
npm i
<adonis db:drop>
<adonis db:create>
<adonis migration:run --force>
<adonis seed --force>
pm2 restart <repo-name>

See running services:

pm2 status
pm2 monit

⚠️ Stop running service:

pm2 stop <repo-name>

⚠️ Delete/Remove a service fully:

pm2 delete <repo-name>

Serve static files as react.js vue.js builds

# /opt/bitnami/nginx/conf/server_blocks/something.com.conf
server {
  listen 80;
  listen [::]:80;

  server_name something.com www.something.com;

  location / {
    proxy_pass http://localhost:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }

  location /.well-known/acme-challenge {
    proxy_pass http://127.0.0.1:81;
    proxy_set_header Host $host;
  }
}

# /opt/bitnami/nginx/conf/server_blocks/dbs.something.com.conf
server {
  listen 80;
  listen [::]:80;

  server_name dbs.something.com;

  location / {
    root /opt/bitnami/phpmyadmin;

    index  index.php index.html index.htm;

    default_type text/html;

    absolute_redirect off;
    include "/opt/bitnami/nginx/conf/bitnami/protect-hidden-files.conf";
    include "/opt/bitnami/nginx/conf/bitnami/php-fpm.conf";
  }

  location /.well-known/acme-challenge {
    proxy_pass http://127.0.0.1:81;
    proxy_set_header Host $host;
  }
}

Serve static files as react.js vue.js builds

# /opt/bitnami/nginx/conf/server_blocks/dash.something.com.conf
server {
  listen 80;
  listen [::]:80;

  server_name dash.something.com;

  root /home/bitnami/codes/htmlOutput/dash/;
  index  index.html index.htm;

  location / {
         try_files $uri /index.html;
  }

  location /.well-known/acme-challenge {
    proxy_pass http://127.0.0.1:81;
    proxy_set_header Host $host;
  }
}

Restart nginx to serve all server on 80

sudo /opt/bitnami/ctlscript.sh restart nginx

https/SSL enable

Follow Below Steps to enable HTTPS Using Let's encrypt on nginx

Prerequisites:

• Let’s Encrypt: https://letsencrypt.org/
• lego: https://github.com/go-acme/lego
• nginx: https://nginx.org/en/

Setup 0: Setup Lego (skip if lego already setup at /opt/bitnami/letsencrypt/lego)

cd /tmp
curl -Ls https://api.github.com/repos/xenolf/lego/releases/latest | grep browser_download_url | grep linux_amd64 | cut -d '"' -f 4 | wget -i -
tar xf lego_vX.Y.Z_linux_amd64.tar.gz
sudo mkdir -p /opt/bitnami/letsencrypt
sudo mv lego /opt/bitnami/letsencrypt/lego

NOTE:

• Tested on lego_v4.3.1_linux_amd64.tar.gz
• https://api.github.com/repos/xenolf/lego renamed to https://api.github.com/repos/go-acme/lego

Step 1. Order the certificate

sudo /opt/bitnami/letsencrypt/lego \
--email="<YOUREMAIL>" \
--domains="somedomain.com" \
--domains="www.somedomain.com" \
--domains="dbs.somedomain.com" \
--domains="dash.somedomain.com" \
--http --http.port :81 --path="/opt/bitnami/letsencrypt" run

Step 2: Update the server

2.1 nano /opt/bitnami/nginx/conf/server_blocks/somedomain.com.conf

2.2

# /opt/bitnami/nginx/conf/server_blocks/somedomain.com.conf
server {
  listen 80;
  listen [::]:80;

  server_name somedomain.com www.somedomain.com;

  location / {
    return 301 https://somedomain.com$request_uri;
  }

  location /.well-known/acme-challenge {
      proxy_pass http://127.0.0.1:81;
      proxy_set_header Host $host;
  }
}

server {
  listen 443 ssl;
  server_name somedomain.com www.somedomain.com;

  ssl_certificate /opt/bitnami/letsencrypt/certificates/somedomain.com.crt;
  ssl_certificate_key /opt/bitnami/letsencrypt/certificates/somedomain.com.key;

  # Other directives
  location / {
    proxy_pass http://localhost:3000;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection 'upgrade';
    proxy_set_header Host $host;
    proxy_cache_bypass $http_upgrade;
  }
}

# /opt/bitnami/nginx/conf/server_blocks/dbs.something.com.conf
server {
  listen 80;
  listen [::]:80;

  server_name dbs.somedomain.com;

  # Other directives
  location / {
    return 301 https://dbs.somedomain.com$request_uri;
  }

  location /.well-known/acme-challenge {
    proxy_pass http://127.0.0.1:81;
    proxy_set_header Host $host;
  }
}

server {
  listen 443 ssl;
  server_name dbs.somedomain.com;

  ssl_certificate /opt/bitnami/letsencrypt/certificates/somedomain.com.crt;
  ssl_certificate_key /opt/bitnami/letsencrypt/certificates/somedomain.com.key;

  # Other directives
  location / {
    root /opt/bitnami/phpmyadmin;

    index  index.php index.html index.htm;

    default_type text/html;

    absolute_redirect off;
    include "/opt/bitnami/nginx/conf/bitnami/protect-hidden-files.conf";
    include "/opt/bitnami/nginx/conf/bitnami/php-fpm.conf";
  }
}

# /opt/bitnami/nginx/conf/server_blocks/dash.something.com.conf
server {
  listen 80;
  listen [::]:80;

  server_name dash.something.com;

  # Other directives
  location / {
    return 301 https://dash.somedomain.com$request_uri;
  }

  location /.well-known/acme-challenge {
    proxy_pass http://127.0.0.1:81;
    proxy_set_header Host $host;
  }
}

server {
  listen 443 ssl;
  server_name dash.somedomain.com;

  ssl_certificate /opt/bitnami/letsencrypt/certificates/somedomain.com.crt;
  ssl_certificate_key /opt/bitnami/letsencrypt/certificates/somedomain.com.key;

  root /home/bitnami/codes/htmlOutput/dash/;
  index  index.html index.htm;

  location / {
         try_files $uri /index.html;
  }
}

2.3 sudo /opt/bitnami/ctlscript.sh restart nginx

Step 3. Renew every 90 days

sudo /opt/bitnami/letsencrypt/lego \
--email="<YOUREMAIL>" \
--domains="somedomain.com" \
--domains="www.somedomain.com" \
--domains="dbs.somedomain.com" \
--domains="dash.somedomain.com" \
--http --http.port :81 --path="/opt/bitnami/letsencrypt" renew --days 90
sudo /opt/bitnami/ctlscript.sh restart nginx

Some refs:

• https://code.kuederle.com/letsencrypt/
• https://docs.bitnami.com/aws/how-to/generate-install-lets-encrypt-ssl/#alternative-approach

It's done, Voila!