conf: added the rest of server configuration

README-flask_skeleton.md

@@ -1,223 +0,0 @@
-Flask Skeleton
-===============
-
-You make lots of simple Flask CRUD apps. You want deployment to be super easy.
-
-What is this?
--------------
-
-A template to get your [Flask](http://flask.pocoo.org/) app running anywhere as fast as possible.
-For added convenience, the templates use [Twitter's Bootstrap
-project](http://twitter.github.com/bootstrap/) to help reduce the amount
-of time it's takes you as a developer to go from an idea to a working
-site.
-
-Uses [Vagrant](http://www.vagrantup.com/) for development
-so everyone on your team has the exact same environment.
-
-[Ansible](http://www.ansibleworks.com/docs/) to provision
-Vagrant and other environments.
-
-[Flask-SQLAlchemy](http://pythonhosted.org/Flask-SQLAlchemy/)
-is also included to handle all database (PostgresSQL) interactions.
-
-The skeleton is engineered to run on any Debian/Ubuntu based system,
-while remaining compatible with Heroku. It splits up its web and database
-components allowing you to scale up with ease.
-
-Really Quick Start
--------------------
-
-Make sure you have Vagrant and Ansible installed.
-
-Get a development environment running:
-
-	$ vagrant up web
-	$ vagrant ssh
-	$ cd /srv/flask_skeleton && python main.py
-	Open http://192.168.100.10
-
-Put it in production:
-
-	Edit ops/vars.yml
-	Edit ops/hosts
-	$ ./deploy.sh
-
-Or deploy to Heroku as you normally would.
-
-
-Instructions
-------------
-
-First, you'll need to clone the repo.
-
-    $ git clone https://github.com/nickhs/flask_skeleton.git
-    $ cd flask_skeleton
-
-Then you'll need to downloand and install [Vagrant](http://www.vagrantup.com/)
-if you don't have it already. You'll also need [VirtualBox](https://www.virtualbox.org/wiki/Downloads)
-or an alternative Vagrant provider.
-
-   http://downloads.vagrantup.com/
-
-You'll also need to have [Ansbile](http://www.ansibleworks.com/docs/gettingstarted.html)
-(the provisioning mechanism) installed. The easiest method is to do:
-
-	$ sudo pip install ansible
-
-Don't have pip? You can grab it with:
-
-	$ sudo easy_install pip
-
-Finally let Vagrant do the rest. Don't worry if it seems noisy:
-
-	$ vagrant up db
-	$ vagrant up web
-	$ vagrant ssh web
-	$ cd /srv/flask_skeleton
-	$ python main.py
-
-Visit the site at [192.168.100.10](http://192.168.100.10).
-
-Deploying to a box
--------------------
-
-Deploying your application to your
-EC2/Linode/DigitalOcean/server somewhere is a cinch.
-
-If you don't already have Ansbile, the provisioning system,
-you'll need to [download it](http://www.ansibleworks.com/docs/gettingstarted.html#getting-ansible).
-
-Your easiest bet is to install it via `pip`:
-
-	$ sudo pip install ansible
-
-Make sure you edit the `ops/vars.yml` file to specify the application name,
-repository location and generate secret keys and database passwords.
-
-Add the server(s) in `ops/hosts`, note this is an
-[Ansible hosts file](http://www.ansibleworks.com/docs/patterns.html/#list-of-reserved-inventory-parameters)
-and you can pass the relevant parameters accordingly.
-
-For example your hosts file could look like this:
-
-	# Production webservers go here
-	[webservers]
-	web1.server.com ansible_ssh_user=ubuntu ansible_ssh_private_key_file=~/secrets/main.pem
-
-	# Production databases go here
-	# Want just one box? Make them the same
-	[dbservers]
-	db.server.com ansible_ssh_user=ubuntu ansible_ssh_private_key_file=~/secrets/main.pem
-
-	[production:children]
-	dbservers
-	webservers
-
-If you want everything on the same box just enter the same host under both sections. Don't want a database? Leave the dbservers
-section blank.
-
-Once you're done defining your hosts do:
-
-    $ ./deploy.sh
-
-Note: `./deploy.sh` is idempotent, don't be afraid to run it over and over again.
-
-From then on out to just update the code you can do:
-
-    $ ./deploy.sh --fast
-
-Deploying to Heroku
--------------------
-
-Make sure you have the [`heroku`
-Ruby gem](http://devcenter.heroku.com/articles/using-the-cli) installed.
-
-If you haven't [signed up for Heroku](https://api.heroku.com/signup), go
-ahead and do that. You should then be able to [add your SSH key to
-Heroku](http://devcenter.heroku.com/articles/quickstart), and also
-`heroku login` from the commandline.
-
-Now, to upload your application, you'll first need to do the
-following -- and obviously change `app_name` to the name of your
-application:
-
-    $ heroku create app_name -s cedar
-
-And, then you can push your application up to Heroku.
-
-    $ git push heroku master
-    $ heroku scale web=1
-
-Finally, we can make sure the application is up and running.
-
-    $ heroku ps
-
-Now, we can view the application in our web browser.
-
-    $ heroku open
-
-
-Next Steps
-----------
-
-After you've got your application up and running, there a couple next
-steps you should consider following.
-
-1. Create a new `README.md` file.
-2. Add your Google Analytics ID to the `base.html` template.
-3. Adjust the `author` and `description` `<meta>` tags in the
-   `base.html` template.
-4. Change the `humans.txt` and `favicon.ico` files in the `static`
-   directory.
-5. Change the `apple-touch` icons in the `static` directory.
-
-
-Heroku Custom Domains
---------------
-
-If your account is verified -- and your credit card is on file -- you
-can also easily add a custom domain to your application.
-
-    $ heroku addons:add custom_domains
-    $ heroku domains:add www.mydomainname.com
-
-You can add a [naked domain
-name](http://devcenter.heroku.com/articles/custom-domains), too.
-
-    $ heroku domains:add mydomainname.com
-
-Lastly, add the following A records to your DNS management tool.
-
-    75.101.163.44
-    75.101.145.87
-    174.129.212.2
-
-Shout Outs
------------
-
-Based on the amazing work of both https://github.com/zachwill/flask_heroku
-and https://github.com/mattupstate/vagrant-ansible-tutorial
-
-LICENSE
----------
-
-The MIT License
-
-Permission is hereby granted, free of charge, to any person obtaining a copy
-of this software and associated documentation files (the "Software"), to deal
-in the Software without restriction, including without limitation the rights
-to use, copy, modify, merge, publish, distribute, sublicense, and/or sell
-copies of the Software, and to permit persons to whom the Software is
-furnished to do so, subject to the following conditions:
-
-The above copyright notice and this permission notice shall be included in
-all copies or substantial portions of the Software.
-
-THE SOFTWARE IS PROVIDED "AS IS", WITHOUT WARRANTY OF ANY KIND, EXPRESS OR
-IMPLIED, INCLUDING BUT NOT LIMITED TO THE WARRANTIES OF MERCHANTABILITY,
-FITNESS FOR A PARTICULAR PURPOSE AND NONINFRINGEMENT. IN NO EVENT SHALL THE
-AUTHORS OR COPYRIGHT HOLDERS BE LIABLE FOR ANY CLAIM, DAMAGES OR OTHER
-LIABILITY, WHETHER IN AN ACTION OF CONTRACT, TORT OR OTHERWISE, ARISING FROM,
-OUT OF OR IN CONNECTION WITH THE SOFTWARE OR THE USE OR OTHER DEALINGS IN
-THE SOFTWARE.

README.md

@@ -16,4 +16,3 @@ Then use the script in `bin` folder to run it:
     ./bin/run.sh
 
 After that you can access the website at http://localhost:8000
-

conf/nginx/enabled-site

@@ -0,0 +1,61 @@
+upstream app_server {
+    server unix:/home/phosic/gunicorn_flask.sock fail_timeout=0;
+}
+
+server {
+    listen 80 default;
+    listen   [::]:80 default_server ipv6only=on;
+    location / {
+       rewrite ^(.*) https://phosic.com permanent;
+    }
+}
+
+server {
+    listen 443;
+
+    ssl on;
+    ssl_certificate /etc/ssl/private/phosic.com.crt;
+    ssl_certificate_key /etc/ssl/private/phosic.com.key;
+
+    ssl_session_timeout 5m;
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
+    ssl_prefer_server_ciphers on;
+
+    server_name  www.phosic.com;
+    rewrite ^(.*) https://phosic.com$1 permanent;
+}
+
+server {
+    listen 443;
+    server_name phosic.com;
+
+    client_max_body_size 20M;
+
+    ssl on;
+    ssl_certificate /etc/ssl/private/phosic.com.crt;
+    ssl_certificate_key /etc/ssl/private/phosic.com.key;
+
+    ssl_session_timeout 5m;
+    ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
+    ssl_ciphers 'ECDHE-RSA-AES256-GCM-SHA384:ECDHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-SHA384:ECDHE-RSA-AES128-SHA256:ECDHE-RSA-AES256-SHA:ECDHE-RSA-AES128-SHA:DHE-RSA-AES256-SHA256:DHE-RSA-AES128-SHA256:DHE-RSA-AES256-SHA:DHE-RSA-AES128-SHA:ECDHE-RSA-DES-CBC3-SHA:EDH-RSA-DES-CBC3-SHA:AES256-GCM-SHA384:AES128-GCM-SHA256:AES256-SHA256:AES128-SHA256:AES256-SHA:AES128-SHA:DES-CBC3-SHA:HIGH:!aNULL:!eNULL:!EXPORT:!CAMELLIA:!DES:!MD5:!PSK:!RC4';
+    ssl_prefer_server_ciphers on;
+
+    location /munin/ {
+        auth_basic            "Restricted";
+        # Create the htpasswd file with the htpasswd tool.
+        auth_basic_user_file  /etc/nginx/admin-munin-htpasswd;
+
+        alias /var/cache/munin/www/;
+        expires modified +310s;
+    }
+
+    location / {
+        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header X-Forwarded-Ssl on;
+        proxy_set_header Host $http_host;
+        proxy_redirect off;
+
+        proxy_pass http://app_server;
+    }
+}

conf/supervisord/celery.conf

@@ -0,0 +1,8 @@
+[program:celery]
+environment=CONFIG="/home/phosic/phosic-web/conf/production.cfg"
+command=/usr/local/bin/celery -A phosic.tasks -b "redis://localhost:6379/0" worker --loglevel=info --beat
+directory=/home/phosic/phosic-web
+user=phosic
+autostart=true
+autorestart=true
+redirect_stderr=true

conf/supervisord/gunicorn.conf

@@ -0,0 +1,8 @@
+[program:gunicorn]
+environment=CONFIG="/home/phosic/phosic-web/conf/production.cfg"
+command=/usr/local/bin/gunicorn --bind unix:/home/phosic/gunicorn_flask.sock --log-file /home/phosic/logs/error.log --access-logfile /home/phosic/logs/access.log -w 3 main:app
+directory=/home/phosic/phosic-web
+user=phosic
+autostart=true
+autorestart=true
+redirect_stderr=true

conf/ufw/user.rules

@@ -0,0 +1,47 @@
+*filter
+:ufw-user-input - [0:0]
+:ufw-user-output - [0:0]
+:ufw-user-forward - [0:0]
+:ufw-before-logging-input - [0:0]
+:ufw-before-logging-output - [0:0]
+:ufw-before-logging-forward - [0:0]
+:ufw-user-logging-input - [0:0]
+:ufw-user-logging-output - [0:0]
+:ufw-user-logging-forward - [0:0]
+:ufw-after-logging-input - [0:0]
+:ufw-after-logging-output - [0:0]
+:ufw-after-logging-forward - [0:0]
+:ufw-logging-deny - [0:0]
+:ufw-logging-allow - [0:0]
+:ufw-user-limit - [0:0]
+:ufw-user-limit-accept - [0:0]
+### RULES ###
+
+### tuple ### allow any 22 0.0.0.0/0 any 0.0.0.0/0 in
+-A ufw-user-input -p tcp --dport 22 -j ACCEPT
+-A ufw-user-input -p udp --dport 22 -j ACCEPT
+
+### tuple ### allow any 80 0.0.0.0/0 any 0.0.0.0/0 in
+-A ufw-user-input -p tcp --dport 80 -j ACCEPT
+-A ufw-user-input -p udp --dport 80 -j ACCEPT
+
+### tuple ### allow any 443 0.0.0.0/0 any 0.0.0.0/0 in
+-A ufw-user-input -p tcp --dport 443 -j ACCEPT
+-A ufw-user-input -p udp --dport 443 -j ACCEPT
+
+### END RULES ###
+
+### LOGGING ###
+-A ufw-after-logging-input -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
+-A ufw-after-logging-forward -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
+-I ufw-logging-deny -m state --state INVALID -j RETURN -m limit --limit 3/min --limit-burst 10
+-A ufw-logging-deny -j LOG --log-prefix "[UFW BLOCK] " -m limit --limit 3/min --limit-burst 10
+-A ufw-logging-allow -j LOG --log-prefix "[UFW ALLOW] " -m limit --limit 3/min --limit-burst 10
+### END LOGGING ###
+
+### RATE LIMITING ###
+-A ufw-user-limit -m limit --limit 3/minute -j LOG --log-prefix "[UFW LIMIT BLOCK] "
+-A ufw-user-limit -j REJECT
+-A ufw-user-limit-accept -j ACCEPT
+### END RATE LIMITING ###
+COMMIT