Merge pull request #722 from iamdoubz/develop
Create self hosting documentation
This commit is contained in:
Karishma Shukla
92
docs/nginx.conf
Normal file
92
docs/nginx.conf
Normal file
@@ -0,0 +1,92 @@
|
||||
# Robust maxun nginx config file
|
||||
# DO NOT uncomment commented lines unless YOU know what they mean and YOU know what YOU are doing!
|
||||
### HTTP server block ###
|
||||
server {
|
||||
server_name maxun.my.domain;
|
||||
root /usr/share/nginx/html;
|
||||
listen 80;
|
||||
server_tokens off;
|
||||
return 301 https://$server_name$request_uri;
|
||||
}
|
||||
### HTTPS server block ###
|
||||
server {
|
||||
### Default config ###
|
||||
server_name maxun.my.domain;
|
||||
root /usr/share/nginx/html;
|
||||
access_log /var/log/nginx/maxun_access.log;
|
||||
error_log /var/log/nginx/maxun_error.log info;
|
||||
listen 443 ssl;
|
||||
http2 on;
|
||||
server_tokens off;
|
||||
### SSL config ###
|
||||
ssl_certificate /etc/letsencrypt/live/my.domain/fullchain.pem;
|
||||
ssl_certificate_key /etc/letsencrypt/live/my.domain/privkey.pem;
|
||||
ssl_trusted_certificate /etc/letsencrypt/live/my.domain/chain.pem;
|
||||
ssl_protocols TLSv1.2 TLSv1.3;
|
||||
#ssl_ecdh_curve X25519MLKEM768:X25519:prime256v1:secp384r1;
|
||||
ssl_ecdh_curve X25519:prime256v1:secp384r1;
|
||||
ssl_prefer_server_ciphers off;
|
||||
ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-CHACHA20-POLY1305;
|
||||
ssl_stapling off;
|
||||
ssl_stapling_verify off;
|
||||
ssl_session_cache shared:MozSSL:10m;
|
||||
ssl_session_tickets off;
|
||||
ssl_session_timeout 1d;
|
||||
ssl_dhparam dh.pem;
|
||||
#ssl_conf_command Options KTLS;
|
||||
### Performance tuning config ###
|
||||
client_max_body_size 512M;
|
||||
client_body_timeout 300s;
|
||||
client_body_buffer_size 256k;
|
||||
#pagespeed off;
|
||||
### Compression ###
|
||||
## gzip ##
|
||||
gzip on;
|
||||
gzip_vary on;
|
||||
gzip_comp_level 5;
|
||||
gzip_min_length 256;
|
||||
gzip_disable msie6;
|
||||
gzip_proxied expired no-cache no-store private no_last_modified no_etag auth;
|
||||
gzip_buffers 16 8k;
|
||||
gzip_types application/atom+xml text/javascript application/javascript application/json application/ld+json application/manifest+json application/rss+xml application/vnd.geo+json application/vnd.ms-fontobject application/wasm application/x-font-ttf application/x-web-app-manifest+json application/xhtml+xml application/xml font/opentype image/bmp image/svg+xml image/x-icon text/cache-manifest text/css text/plain text/vcard text/vnd.rim.location.xloc text/vtt text/x-component text/x-cross-domain-policy;
|
||||
## brotli: enable only if you have compiled nginx with brotli support!!! ##
|
||||
#brotli on;
|
||||
#brotli_static on;
|
||||
#brotli_comp_level 6;
|
||||
#brotli_types application/atom+xml application/javascript application/json application/rss+xml
|
||||
# application/vnd.ms-fontobject application/x-font-opentype application/x-font-truetype
|
||||
# application/x-font-ttf application/x-javascript application/xhtml+xml application/xml
|
||||
# font/eot font/opentype font/otf font/truetype image/svg+xml image/vnd.microsoft.icon
|
||||
# image/x-icon image/x-win-bitmap text/css text/javascript text/plain text/xml;
|
||||
### Default headers ###
|
||||
add_header Referrer-Policy "no-referrer" always;
|
||||
add_header X-Content-Type-Options "nosniff" always;
|
||||
add_header X-Frame-Options "SAMEORIGIN" always;
|
||||
add_header X-Permitted-Cross-Domain-Policies "none" always;
|
||||
add_header X-Robots-Tag "noindex, nofollow" always;
|
||||
add_header X-XSS-Protection "1; mode=block" always;
|
||||
add_header Permissions-Policy "geolocation=(self), midi=(self), sync-xhr=(self), microphone=(self), camera=(self), magnetometer=(self), gyroscope=(self), fullscreen=(self), payment=(self), interest-cohort=()";
|
||||
### Proxy rules ###
|
||||
# Backend web traffic and websockets
|
||||
location ~ ^/(auth|storage|record|workflow|robot|proxy|api-docs|api|webhook|socket.io)(/|$) {
|
||||
proxy_pass http://localhost:8080; #Change the port number to match .env file BACKEND_PORT variable
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
# Frontend web traffic
|
||||
location / {
|
||||
proxy_pass http://localhost:5173; #Change the port number to match .env file FRONTEND_PORT variable
|
||||
proxy_http_version 1.1;
|
||||
proxy_set_header Upgrade $http_upgrade;
|
||||
proxy_set_header Connection 'upgrade';
|
||||
proxy_set_header Host $host;
|
||||
proxy_set_header X-Real-IP $remote_addr;
|
||||
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
||||
proxy_set_header X-Forwarded-Proto $scheme;
|
||||
}
|
||||
}
|
||||
134
docs/self-hosting-docker.md
Normal file
134
docs/self-hosting-docker.md
Normal file
@@ -0,0 +1,134 @@
|
||||
# Self hosting docker guide
|
||||
|
||||
So you want to create a bot? Let's get you started!
|
||||
|
||||
## Requirements (not covered)
|
||||
- Webserver (Apache2, nginx, etc.)
|
||||
- SSL Certificates (letsencrypt, zerossl, etc)
|
||||
- A sub-domain to host maxun i.e. maxun.my.domain
|
||||
- Docker
|
||||
- Docker compose
|
||||
- Probably others...
|
||||
|
||||
## Guide
|
||||
For this guide, we assume that before you start, you have a dedicated docker folder to house config files and everything else we need for persistence between docker container reboots and updates. The path in this guide is `/home/$USER/Docker/maxun`.
|
||||
1. Change directory into your docker folder `cd /home/$USER/Docker/`
|
||||
2. Create a new directory for maxun and all the required sub-folders for our docker services `mkdir -p maxun/{db,minio,redis}`
|
||||
3. Change directory to enter the newly created folder `cd maxun`
|
||||
4. Create an environment file to save your variables `nano .env` with the following contents:
|
||||
```
|
||||
NODE_ENV=production
|
||||
JWT_SECRET=openssl rand -base64 48
|
||||
DB_NAME=maxun
|
||||
DB_USER=postgres
|
||||
DB_PASSWORD=openssl rand -base64 24
|
||||
DB_HOST=postgres
|
||||
DB_PORT=5432
|
||||
ENCRYPTION_KEY=openssl rand -base64 64
|
||||
SESSION_SECRET=openssl rand -base64 48
|
||||
MINIO_ENDPOINT=minio
|
||||
MINIO_PORT=9000
|
||||
MINIO_CONSOLE_PORT=9001
|
||||
MINIO_ACCESS_KEY=minio
|
||||
MINIO_SECRET_KEY=openssl rand -base64 24
|
||||
REDIS_HOST=maxun-redis
|
||||
REDIS_PORT=6379
|
||||
REDIS_PASSWORD=
|
||||
BACKEND_PORT=8080
|
||||
FRONTEND_PORT=5173
|
||||
BACKEND_URL=https://maxun.my.domain
|
||||
PUBLIC_URL=https://maxun.my.domain
|
||||
VITE_BACKEND_URL=https://maxun.my.domain
|
||||
VITE_PUBLIC_URL=https://maxun.my.domain
|
||||
GOOGLE_CLIENT_ID=
|
||||
GOOGLE_CLIENT_SECRET=
|
||||
GOOGLE_REDIRECT_URI=
|
||||
AIRTABLE_CLIENT_ID=
|
||||
AIRTABLE_REDIRECT_URI=
|
||||
MAXUN_TELEMETRY=true
|
||||
```
|
||||
5. Ctrl + x, Y, Enter will save your changes
|
||||
6. Please be sure to READ this file and change the variables to match your environment!!! i.e. BACKEND_PORT=30000
|
||||
7. Create a file for docker compose `nano docker-compose.yml` with the following contents:
|
||||
```yml
|
||||
services:
|
||||
postgres:
|
||||
image: postgres:17
|
||||
container_name: maxun-postgres
|
||||
mem_limit: 512M
|
||||
environment:
|
||||
POSTGRES_USER: ${DB_USER}
|
||||
POSTGRES_PASSWORD: ${DB_PASSWORD}
|
||||
POSTGRES_DB: ${DB_NAME}
|
||||
volumes:
|
||||
- /home/$USER/Docker/maxun/db:/var/lib/postgresql/data
|
||||
healthcheck:
|
||||
test: ["CMD-SHELL", "pg_isready -U postgres"]
|
||||
interval: 10s
|
||||
timeout: 5s
|
||||
retries: 5
|
||||
|
||||
redis:
|
||||
image: docker.io/library/redis:7
|
||||
container_name: maxun-redis
|
||||
restart: always
|
||||
mem_limit: 128M
|
||||
volumes:
|
||||
- /home/$USER/Docker/maxun/redis:/data
|
||||
|
||||
minio:
|
||||
image: minio/minio
|
||||
container_name: maxun-minio
|
||||
mem_limit: 512M
|
||||
environment:
|
||||
MINIO_ROOT_USER: ${MINIO_ACCESS_KEY}
|
||||
MINIO_ROOT_PASSWORD: ${MINIO_SECRET_KEY}
|
||||
command: server /data --console-address :${MINIO_CONSOLE_PORT:-9001}
|
||||
volumes:
|
||||
- /home/$USER/Docker/maxun/minio:/data
|
||||
|
||||
backend:
|
||||
image: getmaxun/maxun-backend:latest
|
||||
container_name: maxun-backend
|
||||
ports:
|
||||
- "127.0.0.1:${BACKEND_PORT:-8080}:${BACKEND_PORT:-8080}"
|
||||
env_file: .env
|
||||
environment:
|
||||
BACKEND_URL: ${BACKEND_URL}
|
||||
PLAYWRIGHT_BROWSERS_PATH: /ms-playwright
|
||||
PLAYWRIGHT_SKIP_BROWSER_DOWNLOAD: 0
|
||||
# DEBUG: pw:api
|
||||
# PWDEBUG: 1 # Enables debugging
|
||||
CHROMIUM_FLAGS: '--disable-gpu --no-sandbox --headless=new'
|
||||
security_opt:
|
||||
- seccomp=unconfined # This might help with browser sandbox issues
|
||||
shm_size: '2gb'
|
||||
mem_limit: 4g
|
||||
depends_on:
|
||||
- postgres
|
||||
- minio
|
||||
volumes:
|
||||
- /var/run/dbus:/var/run/dbus
|
||||
|
||||
frontend:
|
||||
image: getmaxun/maxun-frontend:latest
|
||||
container_name: maxun-frontend
|
||||
mem_limit: 512M
|
||||
ports:
|
||||
- "127.0.0.1:${FRONTEND_PORT:-5173}:5173"
|
||||
env_file: .env
|
||||
environment:
|
||||
PUBLIC_URL: ${PUBLIC_URL}
|
||||
BACKEND_URL: ${BACKEND_URL}
|
||||
depends_on:
|
||||
- backend
|
||||
```
|
||||
8. Ctrl + x, Y, Enter will save your changes
|
||||
9. This particular setup is "production ready" meaning that maxun is only accessible from localhost. You must configure a reverse proxy to access it!
|
||||
10. Start maxun `sudo docker compose up -d` or `sudo docker-compose up -d`
|
||||
11. Wait 30 seconds for everything to come up
|
||||
12. Access your maxun instance at http://localhost:5173 if using defaults
|
||||
|
||||
## Next steps
|
||||
You will want to configure a reverse proxy. Click on a link below to check out some examples.
|
||||
- [Nginx](nginx.conf)
|
||||
Reference in New Issue
Block a user