Skip to content

Latest commit

 

History

History
192 lines (135 loc) · 6.85 KB

aws.md

File metadata and controls

192 lines (135 loc) · 6.85 KB
Raw
description
Deploying Rocket.Chat on Amazon Web Services

AWS

{% hint style="info" %} 👉 Trouble installing or deploying Rocket.Chat? Join our Weekly Technical Helpline to get real-time help from our team! {% endhint %}

This guide covers the following:

  • Hosting Rocket.Chat on an Amazon EC2 instance
  • Hosting a domain name with Amazon Route 53
  • Securing your server with a free SSL certificate from Let's Encrypt

Launch an EC2 Instance

{% hint style="info" %} The minimum requirement to run Rocket.Chat successfully is 2Gb 2 cores.

It is not recommended to use this method for large production. Instead, check how to deploy on helm.md. {% endhint %}

To create a new EC2 instance:

  • Log into your AWS Console, and open the EC2 Service.
  • From the sidebar, click Instances. Then**,** click Launch Instances to set up a new EC2 instance.
  • Set the instance name and select at least Ubuntu Server 18.04 LTS" with "64-bit (x86) architecture as the OS image.
  • Select an instance type of your choice according to our recommendation above.
  • Choose an existing key pair or create a new one for SSH connections.
  • Adjust the instance details as needed or keep the defaults.
  • Adjust the storage size and configuration as required.
  • Make sure to add a tag called Name and assign a value.
  • Allow SSH, HTTP, and HTTPS in the security group configuration, and proceed with Review and Launch.
  • After confirming your instance configuration, Launch Instance.

Allocate an Elastic IP

To allocate an elastic IP,

  • From the EC2 Service dashboard, click Elastic IPs.
  • Click Allocate Elastic IP address.
  • Select Amazon's pool of IPv4 addresses, and click Allocate.
  • Click and open the newly created IP address and select Associate Elastic IP address.
  • Select your instance and click Associate.
  • In the details below, copy the Public DNS. You will need it to configure the DNS step. The format looks like this: ec2-18-XXX-XXX-XXX.eu-central-1.compute.amazonaws.com

Configure DNS w/ AWS Route 53

  • Open the Route 53 service dashboard and navigate to Hosted Zones.
  • Click Create Hosted Zone.
  • Enter your domain name and select Public Hosted Zone as the type. Click the Create hosted zone button**.**
  • Select your newly created zone and click Create Record Set.
  • Enter "www" as a subdomain (if desired), select Type CNAME, enter the Public DNS name you copied from the elastic IP to the value field, and click "Create."

Get an SSL Certificate from Let's Encrypt

We use Let's Encrypt to get a free & open-source SSL certificate:

  • SSH to your instance.
ssh -i <path_to_key_file.pem> ubuntu@<public_ip_address>

{% hint style="info" %} If your DNS has resolved, you may replace it with your domain name. {% endhint %}

  • Install certbot using apt:
sudo apt update
sudo apt install certbot
  • Obtain a certificate from Let's Encrypt:
sudo certbot certonly --standalone --email <emailaddress@email.com> -d <domain.com> -d <subdomain.domain.com>

Note: Second (or more) domain is optional.

{% hint style="info" %} [Optional] Restrict access using security groups.

If you want to restrict traffic to your AWS instance, you may adjust the security groups again. Make sure you allow "TCP/22" from your current location for the SSH connection, as well as "TCP/443" from the location you wish to use to access from. {% endhint %}

Configure Nginx Web Server with TLS/SSL

  • Install Nginx web server:
 sudo apt-get install nginx
  • Backup the default config file for reference:
 cd /etc/nginx/sites-available
 sudo mv default default.reference
  • Create a new site configuration for Rocket.Chat:
 sudo nano /etc/nginx/sites-available/default
 server {
     listen 443 ssl;

     server_name <ABC.DOMAIN.COM>;

     ssl_certificate /etc/letsencrypt/live/<ABC.DOMAIN.COM>/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/<ABC.DOMAIN.COM>/privkey.pem;
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_prefer_server_ciphers on;
     ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

     root /usr/share/nginx/html;
     index index.html index.htm;

     # Make site accessible from http://localhost/
     server_name localhost;

     location / {
         proxy_pass http://localhost:3000/;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
         proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto http;
         proxy_set_header X-Nginx-Proxy true;
         proxy_redirect off;
     }
 }

 server {
     listen 80;

     server_name <ABC.DOMAIN.COM>;

     return 301 https://$host$request_uri;
 }

{% hint style="info" %} Ensure to update ABC.DOMAIN.COM with your domain name. Update it in the path to your key files as well. {% endhint %}

  • Test the Nginx configuration to make sure there are no syntax errors
sudo nginx -t
  • If the syntax test went successful, restart Nginx:
sudo systemctl restart nginx

Confirm it is running properly by opening a web browser and going to your domain name. A "502 Bad Gateway" page is expected since the Rocket.Chat backend is not yet running. Ensure the SSL connection is working properly by clicking the lock icon next to the address bar. Confirm it's valid and issued by "Let's Encrypt Authority X3".

Install Rocket.Chat

To install Rocket.Chat,

{% content-ref url="../rapid-deployment-methods/docker-and-docker-compose/" %} docker-and-docker-compose {% endcontent-ref %}

Use it

Log in to your site at https://ABC.DOMAIN.COM.

{% hint style="info" %} The first user to log in will be an administrator user. {% endhint %}