Deployment

Folder Preparation

Log in to our Docker image repository:

docker login gitea.entorno.es:3000

Clone the repository:

git clone https://gitea.entorno.es:3000/CertGuardian/certguardian-docker-images

Enter the repository folder:

cd certguardian-docker-images

Subdomain Preparation

Prepare 3 subdomains pointing to the server's IP:

• backoffice.your-domain.com
• backend.your-domain.com
• reverb.your-domain.com

Backoffice Configuration (leave as default)

cp backoffice/config.js.example backoffice/config.js

vi backoffice/config.js

Fill in the necessary configuration values in the config.js file:

• API_BASE_URL: Enter the backend URL including https and add "/api" at the end. If the backend subdomain is: backend.your-domain.com, then the configuration would be: "https://backend.your-domain.com/api",
• LOGIN_ROUTE: (leave as default)
• REVERB_HOST: Enter the reverb.your-domain.com subdomain, without any protocol.
• REVERB_PORT: (leave as default)
• REVERB_KEY: Generate a key with openssl rand -hex 16, save it for later

Backend and database Configuration

cp docker-compose.yml.example docker-compose.yml

vi docker-compose.yml

Fill in these variables in the environment section of the certguardian service in docker-compose:

      - BACKOFFICE_URL="https://backoffice.your-domain.com" // Backoffice URL
      - CERTBOT_MAIL="mail@your-domain.com" // Certbot notification email https://community.letsencrypt.org/t/what-is-the-email-used-for-when-i-run-certbot-at-the-first-time/119911/2
      - CERTBOT_MAIL_PRIORITY=1
      - DAYS_EXPIRY_RENEW=5 // Number of days before certificate expiration for certguardian to start renewal
      - DB_USERNAME=root
      - DB_PASSWORD=password // generate one with 'tr -cd [:graph:] < /dev/random | head -c15'
      - APP_KEY=base64:<output of 'openssl rand -base64 32'>  # Prefix the generated value with 'base64:'
      - REVERB_APP_ID=12345
      - REVERB_APP_KEY=xxxxx // Use the REVERB_KEY value you generated earlier
      - REVERB_APP_SECRET=xxxxx_secret // generate it with 'openssl rand -hex 32'
      - MAIL_ADDRESS_FOR_NOTIFICATIONS="mail@your-domain.com" // Email address that will receive application error notifications (issuance errors, certificate installation errors...)
      // Configuration for the email account that will send application emails (email hooks and application error notifications)
      - MAIL_DRIVER=smtp
      - MAIL_MAILER=smtp
      - MAIL_SCHEME=smtp
      - MAIL_HOST=mail.your-domain.com
      - MAIL_PORT=587
      - MAIL_USERNAME=mail@your-domain.com
      - MAIL_PASSWORD="xxxxx"
      - MAIL_FROM_ADDRESS="mail@your-domain.com"

Then, go to the db service and fill the MYSQL_ROOT_PASSWORD in the enviroment section with the value of the previous step.

  db:
    image: mysql:8.0
    container_name: certguardian_db
    restart: unless-stopped
    ports:
        - "3306:3306"
    environment:
      MYSQL_ROOT_PASSWORD: certguardian // <---- here
      MYSQL_DATABASE: certguardian
      MYSQL_ROOT_HOST: '%'

NGINX Configuration

Create a copy of the nginx configuration file:

cp nginx/conf.d/nginx.conf.example nginx/conf.d/nginx.conf

And replace the subdomains with the ones you created:

sed -i \
-e 's/backend\.dominio\.es/backend.your-domain.com/g' \
-e 's/reverb\.dominio\.es/reverb.your-domain.com/g' \
-e 's/backoffice\.dominio\.es/backoffice.your-domain.com/g' \
nginx/conf.d/nginx.conf

Replace "your-domain.com" with the domain you want to use. And backend, reverb, and backoffice with the subdomains you created.

If the above command doesn't work, you can manually edit the nginx.conf file and replace occurrences of backend.dominio.es, reverb.dominio.es, and backoffice.dominio.es.

vi nginx/conf.d/nginx.conf

Copy your domain certificates to the nginx/certs folder:

cp /your-certificate-path/fullchain nginx/certs/fullchain.pem

cp /your-certificate-path/privkey.pem nginx/certs/privkey.pem

Start Containers

Start the containers:

docker compose up -d

Enter the backend container:

docker compose exec certguardian bash

If it fails, you can check the container name with docker ps

Generate SSH Keys

Create the SSH keys for the SSH hook. Inside the container, execute:

ssh-keygen -t rsa -b 4096 -f /var/www/certguardian/ssh-keys/id_rsa

Generate the SSH keys without a passphrase.

Make sure to set the correct permissions once the SSH keys are created:

chown www-data:www-data /var/www/certguardian/ssh-keys/
chown www-data:www-data /var/www/certguardian/ssh-keys/*
chmod 700 /var/www/certguardian/ssh-keys
ls -la /var/www/certguardian/ssh-keys/

Create Administrator User

Head to <your-backoffice-url>/register and fill the form to create an administrator user:

After the user is created, you will be logged in automatically.

Next steps

• Configure your first CA.