cmc/cleberg.net

  1#+date:        [2023-10-17 Tue 00:00:00]
  2#+title:       Self-Hosting Guide: AnonymousOverflow
  3#+description: How to self-host AnonymousOverflow with Docker Compose and Nginx.
  4#+slug:        self-hosting-anonymousoverflow
  5#+filetags:    :linux:self-hosting:
  6
  7* Overview
  8
  9I recently launched an instance of AnonymousOverflow at
 10=ao.cleberg.net= and wanted to write a brief
 11post on how easy it is to install with Docker Compose and Nginx.
 12
 13This guide uses Ubuntu server, Docker Compose, and Nginx as a reverse
 14proxy.
 15
 16* Installation
 17
 18** Docker Compose
 19
 20To install AnonymousOverflow, start by creating a directory for the
 21application and create its =docker-compose.yml= file.
 22
 23#+begin_src sh
 24mkdir ~/anonymousoverflow && cd ~/anonymousoverflow
 25nano docker-compose.yml
 26#+end_src
 27
 28Within this file, paste the following information. Be sure to change the
 29=APP_URL=, =JWT_SIGNING_SECRET=, and =ports= to match your needs.
 30
 31#+begin_src yaml
 32version: "3"
 33
 34services:
 35    anonymousoverflow:
 36        container_name: "app"
 37        image: "ghcr.io/httpjamesm/anonymousoverflow:release"
 38        environment:
 39            - APP_URL=https://ao.example.com
 40            - JWT_SIGNING_SECRET=secret #pwgen 40 1
 41        ports:
 42            - "9380:8080"
 43        restart: "always"
 44#+end_src
 45
 46Save and exit the file when complete. You can now launch the container
 47and access it via your local network.
 48
 49#+begin_src sh
 50sudo docker-compose up -d
 51#+end_src
 52
 53** Nginx Reverse Proxy
 54
 55If you want to access this service outside the local network, I
 56recommend using Nginx as a reverse proxy.
 57
 58Let's start by creating a configuration file.
 59
 60#+begin_src sh
 61sudo nano /etc/nginx/sites-available/ao
 62#+end_src
 63
 64Within this file, paste the following content and replace
 65=ao.example.com= with your URL. You may need to update the SSL
 66certificate statements if your certificates are in a different location.
 67
 68#+begin_src conf
 69server {
 70    if ($host ~ ^[^.]+\.cleberg\.net$) {
 71        return 301 https://$host$request_uri;
 72    }
 73
 74    listen [::]:80;
 75    listen 80;
 76    server_name ao.example.com;
 77    return 404;
 78}
 79
 80server {
 81    listen [::]:443 ssl http2;
 82    listen 443 ssl http2;
 83    server_name ao.example.com;
 84    access_log  /var/log/nginx/ao.access.log;
 85    error_log   /var/log/nginx/ao.error.log;
 86
 87    add_header X-Content-Type-Options "nosniff";
 88    add_header X-XSS-Protection "1; mode=block";
 89    add_header X-Frame-Options "DENY";
 90    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains";
 91    add_header Referrer-Policy "no-referrer";
 92
 93    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
 94    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
 95    include /etc/letsencrypt/options-ssl-nginx.conf;
 96    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem;
 97
 98    location / {
 99        set $upstream_ao http://127.0.0.1:9380;
100        proxy_pass $upstream_ao;
101
102        proxy_set_header Host $host;
103        proxy_set_header Upgrade $http_upgrade;
104        proxy_set_header Connection upgrade;
105        proxy_set_header Accept-Encoding gzip;
106        proxy_set_header X-Real-IP $remote_addr;
107        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
108        proxy_set_header X-Forwarded-Proto $scheme;
109        proxy_set_header X-Forwarded-Host $http_host;
110        proxy_set_header X-Forwarded-Uri $request_uri;
111        proxy_set_header X-Forwarded-Ssl on;
112        proxy_redirect  http://  $scheme://;
113        proxy_http_version 1.1;
114        proxy_set_header Connection "";
115        proxy_cache_bypass $cookie_session;
116        proxy_no_cache $cookie_session;
117        proxy_buffers 64 256k;
118    }
119}
120#+end_src
121
122Save and exit the file when complete. On Ubuntu, you will need to
123symlink the configuration file before it will be recognized by Nginx.
124Once complete, simply restart the web server.
125
126#+begin_src sh
127sudo ln -s /etc/nginx/sites-available/ao /etc/nginx/sites-enabled/ao
128sudo systemctl restart nginx.service
129#+end_src
130
131The website will now be available publicly.