Skip to content

Linode Server Setup

Jump to bottom
firepick1 edited this page Dec 31, 2023 · 21 revisions

Step 1. Create Firewall

If you haven't already done so, configure a new Linode Firewall for the new Linode server

  • name: api_sc-voice_net
  • default: DROP
  • add: accept-inbound-SSH allow SSH admin access
  • add: accept-inbound-HTTP allow certbot renewal
  • add: accept-inbound-HTTPS allow normal web traffic
  • Edit the accept-inbound-SSH rule to allow IP addresses of Voice admins.

Save firewall. We will use this firewall instead of creating a individual firewall for each Linode server.

Step 2. Create Linode

Configure new Linode:

  • Operating System: Debian 12
  • Region: Fremont
  • Shared CPU
  • Nanode 1GB ($5/month)
  • Linode Label: XXX.api.sc-voice.net (where XXX is the language/function for that server)
  • Add Tag: api.sc-voice.net
  • Root Password: (generate and store in a safe place)
  • Add SSH Keys: (add at least one)
  • Firewall: api_sc-voice_net
  • VLAN: (ignore)
  • Backups: (ignore)
  • Private IP: (ignore)

Click Create Linode

Step 3. Update DNS record

Add a DNS A record to the Google Domains control panet for sc-voice.net.

  • Set the name of the new record to XXX.api, where XXX is the language/function for the server.
  • Set the value of the new record to the public IPV4 address of the new server.

Step 4. Set hostname

SSH into Linode server as root

Set the hostname to XXX.api.sc-voice.net, where XXX is the language/function for the server.

hostnamectl set-hostname XX.api.sc-voice.net
hostname

Setting the hostname will help reduce confusion when administering servers.

Step 5. Create unroot user

The unroot user is standard user who can sudo when needed.

SSH into Linode server as root and create user unroot with a strong password:

sudo adduser unroot
sudo usermod -aG sudo unroot
sudo visudo

Append the following line to the end of the sudoers file to not require unroot password for sudo command:

unroot  ALL=(ALL) NOPASSWD: ALL

Create a .ssh folder for user unroot:

mkdir ~/.ssh
chmod 700 ~/.ssh
echo > ~/.ssh/authorized_keys
chmod 600 ~/.ssh/authorized_keys

To expedite logging into the server as unroot, add the public SSH keys for any admins to /home/unroot/.ssh/authorized_keys.

Step 6. Secure root user

Test unroot setup

  1. Add administrator public keys to /home/unroot/.ssh/authorized_keys.
  2. Logout of server
  3. Login to server as unroot
  4. Verify that sudo works

Secure root user

sudo vim /etc/ssh/sshd_config
  1. Uncomment the PermitRootLogin line and set the value to no.
  2. Append the line AllowUsers root unroot
  3. Save and exit vim.
  4. Restart ssh daemon.
sudo systemctl restart sshd
  • Verify that SSH root login is no longer possible.
  • Verify that unroot login is still possible and has sudo permissions

Step 7. Install NGinX

SSH to Linode server as unroot.

Install git and load server source.

sudo apt-get update && sudo apt-get upgrade -y
sudo apt install git -y
git clone https://github.com/sc-voice/api_sc-voice_net.git

Install NGinX and UFW firewall

cd ~/api.sc-voice.net/linode/bookworm
./01-install-nginx.sh
./02-configure-nginx.sh

Check NGinX status

systemctl status nginx

It necessary, start it:

systemctl enable --now nginx

Verify that NGinX is running with a browser using the HTTP protocol (e.g., http://XXX.api.sc-voice.net)

sudo systemctl enable --now nginx

You should see "An error occurred. ... Faithfully yours, nginx".

Step 7.1 o(OPTIONAL) Install firewall

It's best to rely on the firewall provided by the cloud hosting service (See Step 1).

The following script will create a firewall on the actual server. You should only need to do this if the cloud hosting service does not have a firewall for customers.

If you have created a firewall in Step 1, skip this step.

./03-ufw-firewall.sh

Step 8. Install Docker Engine

SSH to Linode server as unroot.

cd ~/api.sc-voice.net/linode/bookworm
./04-install-docker.sh

Log out and log in again as unroot. Verify that Docker is available.

docker images

Step 9. Launch server

Install credentials and launch Docker container. You will be prompted for:

  • your admin email
  • servername (use the hostname, i.e. XXX.api.sc-voice.net)
  • share your email (your choice)
./05-certbot.sh

Verify that SSL is running with a browser using the HTTPS protocol (e.g., https://XXX.api.sc-voice.net)

./06-aws-creds.sh
./07-configure-docker.sh

Test with browser using HTTPS.

Step 10. Set up scheduled tasks

./08-cron.sh

That's it!

Clone this wiki locally