Digital Ocean on My Notes

DigitialOcean: Droplet

Mon, 01 Jan 0001 00:00:00 +0000

Droplet#

DigitalOcean Droplets are Linux-based virtual machines (VMs) that run on top of virtualized hardware. Each Droplet you create is a new server you can use, either standalone or as part of a larger, cloud-based infrastructure.

Prerequisite#

Prepare a bank account or credit card
Signup DigitalOcean account and activate it
Create a new prject

OS Options#

Ubuntu
FreeBSD
Fedora
Debian
CentOS

Plans and Pricing#

We offer four different kinds of Droplet plans: one shared CPU plan and three dedicated CPU plans.

DigitialOcean: Get Started

Mon, 01 Jan 0001 00:00:00 +0000

User Setup#

Create a new admin user#

Add a new user#

# Add new user 
# set password
adduser <admin_user>

# user to sudo group
usermod -aG sudo <admin_user>

Set SSH access for new user#

# Switch session to new user 
su - <admin_user>

# navigate to user home 
cd

# Prepare ssh directory
mkdir .ssh
chmod 700 ~/.ssh

# Copy root key
sudo cp /root/.ssh/authorized_keys ~/.ssh/authorized_keys
chmod 644 /home/<admin_user>/.ssh/authorized_keys
sudo chown -R <admin_user>:<admin_user> ~/

ssh -i ~/.ssh/<your_droplet_rsa> <admin_user>@<your_droplet_ip>

Set root password & disable SSH#

sudo passwd

# rename key file
sudo mv /root/.ssh/authorized_keys /root/.ssh/disabled_authorized_keys

Security Update#

# Update only for security
sudo apt-get install unattended-upgrades

# Update security packages
sudo unattended-upgrade -d --dry-run
sudo unattended-upgrade -d

# Update quietly
sudo unattended-upgrade

Tagging & Cloud Firewall#

Tags are custom labels you apply to Droplets that have multiple uses
- Add tags to your droplet. e.g. my-web-server
DigitalOcean Cloud Firewalls are a free, network-based, stateful firewall service for your DigitalOcean Droplets. They block all traffic that isn’t expressly permitted by a rule. You can define the Droplets protected by a firewall individually or by using tags.
Always setup Firewall for your droplets
- Set SSH permission for only given IP address
- Set HTTP for port 80
- Set HTTPS for port 443

Other Features#

Floating IPs#

DigitalOcean Floating IPs are publicly-accessible static IP addresses that you can assign to Droplets. A floating IP provides an additional static address you can use to access a Droplet without replacing or changing the Droplet’s original public IP address.

DigitialOcean: First Web Host

Mon, 01 Jan 0001 00:00:00 +0000

Here I contineu to setup SSL certificates for all sites on my web host

UFW#

UFW, or Uncomplicated Firewall, is a front-end to iptables. Its main goal is to make managing your firewall drop-dead simple and to provide an easy-to-use interface.

DO NOT Enable UFW

DO NOT enable UFW without reading through the instructions

Enable IP V6#

Open the UFW configuration with vi:

sudo vi /etc/default/ufw

Make sure “IPV6” is set to “yes”, like so:

...
IPV6=yes
...

Set default rules#

sudo ufw deny incoming
sudo ufw allow outgoing

Allow SSH / OpenSSH#

Check app list & enable OpenSSH

# List applications
sudo ufw app list

# Allow SSH
sudo ufw allow OpenSSH

Directly allow port 22 or other SSH port, e.g. 2222

sudo ufw allow 22

Enable UFW#

sudo ufw enable
sudo ufw sattus verbose

Nginx#

Install Nginx#

sudo apt install ngix

Set UFW#

# show applications 
sudo ufw app list

# Allow Nginx 
sudo ufw allow 'Nginx Full'
sudo ufw reload

Build Web Host Block#

Create the Directory Structure#

The document root is the directory where the website files for a domain name are stored and served in response to requests. You can set the document root to any location you want.

DigitialOcean: Lets Encrypt

Mon, 01 Jan 0001 00:00:00 +0000

Here I continue to finish the web host setup. The last step of web host setup is to add SSL certificate for each site

Lets Encrypt#

To enable HTTPS on your website, you need to get a certificate (a type of file) from a Certificate Authority (CA). Let’s Encrypt is a CA. In order to get a certificate for your website’s domain from Let’s Encrypt, you have to demonstrate control over the domain. With Let’s Encrypt, you do this using software that uses the ACME protocol, which typically runs on your web host.

Digital Ocean on My Notes

DigitialOcean: Droplet

Droplet#

Prerequisite#

OS Options#

Plans and Pricing#

DigitialOcean: Get Started

User Setup#

Create a new admin user#

Add a new user#

Set SSH access for new user#

Login as new user via SSH#

Set root password & disable SSH#

Security Update#

Tagging & Cloud Firewall#

Other Features#

Floating IPs#

DigitialOcean: First Web Host

UFW#

Enable IP V6#

Set default rules#

Allow SSH / OpenSSH#

Enable UFW#

Nginx#

Install Nginx#

Set UFW#

Build Web Host Block#

Create the Directory Structure#

DigitialOcean: Lets Encrypt

Lets Encrypt#