Glen Mazza's Weblog

Steps I followed to deploy TightBlog on Linode:

Linode preparation:

1. Sign up for Linode. You may wish to check for any Linode promotion codes for starting credit. I used the $10/month plan providing 2 GB of RAM which seems plenty for my Tomcat & MySQL setup.
2. For the starting image for my new Linode, I used Ubuntu 16.04 LTS, partitioning 30208 MB for it and 512 MB for a separate swap image.
3. I followed the remainder of the Getting Started Guide and most of the recommendations of the subsequent Securing Your Server guide.
4. If you don't want the default Linode domain name of lixxxx-yy.members.linode.com (as you probably don't) go to a domain name registrar such as Namecheap or Google Domains to rent your desired domain. I used the latter to obtain glenmazza.net and then configured it for my linode following these instructions.
5. As recommended in the Securing Your Server guide, I used key-based authentication allowing me to easily connect to my linode using "ssh (or sftp) glenmazza.net" from a command-line on my home computer. (If you haven't gotten a custom domain name yet, you'll find the default name and IP address in the Public IPs section on the Remote Access tab in the Linode Manager.)
6. I created a ~/tbfiles folder (owned by a non-root normal user account) as a staging area for files I'm uploading to my linode as well as to hold the TightBlog media file directories and (if desired) Lucene blog entry search indexes.

Tomcat preparation:

1. I installed Java and then Tomcat on my image. It is recommended not to install Tomcat under the root user, but while using a non-root account. The Debian install package results in sudo systemctl [start|stop|restart] tomcat8 command-line commands being available for starting and stopping Tomcat. After starting Tomcat, confirm you can access Tomcat's port 8080 from a browser using your linode's domain name or IP address.
2. In my ~/.bashrc file, I added the following constants:

   export CATALINA_HOME=/usr/share/tomcat8
   export CATALINA_BASE=/var/lib/tomcat8
   

3. Create a signed SSL certificate for use with Tomcat. I used Let's Encrypt which generates 3-month certificates, and these instructions for placing the key Let's Encrypt generates in a Java keystore that can be read by Tomcat. My steps from Linode every three months:

   sudo systemctl stop tomcat8
   For housekeeping on key updates, may wish to delete logs at /var/log/tomcat8 
   cd /opt/letsencrypt
   sudo -H ./letsencrypt-auto certonly --standalone -d glenmazza.net -d www.glenmazza.net
   (see "Congratulations!" feedback indicating Let's Encrypt worked.  Any problem running?  Try this)
   cd /etc/letsencrypt/live/glenmazza.net*
   sudo openssl pkcs12 -export -in cert.pem -inkey privkey.pem -out cert_and_key.p12 -name tomcat -CAfile chain.pem -caname root
   -- The above command will prompt you for a password for the temporary cert_and_key.p12 file.
   -- Choose what you wish but remember for the next command ("abc" in the command below.) 
   -- The next command has placeholders for the Java key and keystore password (both necessary).  Choose what you wish but as I understand
   -- Tomcat expects the two to be the same (can see previous password via sudo more /var/lib/tomcat8/conf/server.xml) 
   sudo keytool -importkeystore -destkeystore MyDSKeyStore.jks -srckeystore cert_and_key.p12 -srcstorepass abc -srcstoretype PKCS12 -alias tomcat -deststorepass <changeit> -destkeypass <changeit>
   sudo cp MyDSKeyStore.jks /var/lib/tomcat8
   sudo systemctl start tomcat8
   ...confirm website accessible again at https://..., if not working ensure tomcat dirs all owned by tomcat user & restart
   cd /etc/letsencrypt/live
   sudo rm -r glenmazza.net*
   

   The Java keystore password you chose above will need to be placed in the tomcat/conf/server.xml file as shown in the next step.

   Note: Ivan Tichy has a blog post on how to automate requesting new certificates from LE every three months and updating Tomcat's keystore with them.)

4. Update the Tomcat conf/server.xml file to have HTTP running on port 80 and HTTPS on 443:

       <Connector port="80" protocol="HTTP/1.1"
                  connectionTimeout="20000"
                  URIEncoding="UTF-8"
                  redirectPort="443" />
   
       <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
                  maxThreads="150" SSLEnabled="true" scheme="https" secure="true"
                  clientAuth="false" sslProtocol="TLS" 
       keystoreFile="MyTomcatKeystore.jks" keystorePass="?????"/>
   

   The keystore file referenced above would need to be placed in Tomcat's root directory, if you use another location be sure to update the keystoreFile value to include the path to the file.

5. If you're using a non-root user to run Tomcat as suggested, you'll need to make some changes to allow that user to use privileged ports (ports under 1024, port 80 and port 443 in Tomcat's case). This can be done by either firewalls and authbind, I chose the latter. For authbind, first edit the /etc/default/tomcat8 file to activate it and then run a script similar to the following (replace "tomcat8" with the non-root user that is running Tomcat on your linode):

   sudo touch /etc/authbind/byport/80
   sudo chmod 500 /etc/authbind/byport/80
   sudo chown tomcat8 /etc/authbind/byport/80
   sudo touch /etc/authbind/byport/443
   sudo chmod 500 /etc/authbind/byport/443
   sudo chown tomcat8 /etc/authbind/byport/443
   

   An alternative option is to have Tomcat continue to use its default (and non-privileged) 8080 and 8443 ports in its server.xml but use iptable rerouting to redirect those ports to 80 and 443. If you go this route, no authbind configuration is necessary.

6. Check the README at /usr/share/doc/tomcat8-common/README.Debian for more information, including running with a Java security manager if desired.

MySQL preparation:

1. Install MySQL on your linode.
2. As explained in the TightBlog wiki, create the database that will hold the TightBlog data. Be sure to save someplace the MySQL administrator (root) username and password as well as the MySQL user account who will have ownership of the TightBlog database.
3. (Optional) To connect to the MySQL database on your linode using SquirrelSQL or another SQL client running on your local computer, these instructions will help.

TightBlog deployment:

1. I built the TightBlog war following these instructions and renamed it to ROOT.war so it will be Tomcat's default application (i.e., have a shorter URL, https://yourdomain.com/ instead of https://yourdomain.com/tightblog). The WAR file will need to be placed in the Tomcat webapps folder as usual.
2. There are three files that need to be uploaded to the Tomcat /lib folder, as explained on the Deploy to Tomcat page on the wiki: slf4j-api-1.7.25.jar, your JDBC driver (mysql-connector-java-X.X.X-bin.jar for MySQL), and the tightblog-custom.properties file. Create or download these as appropriate.
3. For uploading files from your computer to your linode, see the scp or sftp commands, for example: scp ROOT.war myaccount@glenmazza.net:~/tbfiles. However, I prefer "sftp glenmazza.net", navigating to desired folders, and using "put" or "get" to upload or download respectively.
4. After uploading the files and placing them in their proper locations, restart Tomcat and start the TightBlog application install process at https://yourdomain.com[/tightblog].

   Troubleshooting: if accessing https://yourdomain.com[/tightblog] from a browser returns 404's while you can still ping the domain, check to see if you can access that URL from a terminal window that is SSH'ed into your Linode using the command-line Lynx browser. If you can, that would mean Tomcat is running properly but there is most likely a problem with the authbind or iptable rerouting preventing external access. If you can't, Tomcat configuration should be looked at first.

5. Best to create a test blog entry, and create a database backup and restore process and confirm it is working with your database instance (e.g., add a blog entry after the backup, restore the backup and confirm the new entry disappears, or delete a blog entry after a backup and confirm the restore returns it.) Simple commands for MySQL would be as follows (see here for more details on available commands):

   Export to a file:
   mysqldump -u root -p tightblogdb > db_backup_YYYYMMDD.sql
   Import into the database to restore it:
   mysql -u root tightblogdb < db_backup_YYYYMMDD.sql
   

   Best to save the backup copy outside of the linode (e.g., on your local machine) and create a regular backup routine.

6. Soon after the blog is up, good to check if the emailing is working by sending yourself a comment for a blog entry. If no email is received, check the tightblog.log in the Tomcat logs folder for any mail sending exceptions. If you're using GMail and there is an authorization problem, the error logs may provide you a precise link at accounts.google.com where you can authorize TightBlog to use the email account.