Glen Mazza's Weblog Friday December 08, 2023

Deploying TightBlog on Linode

I've updated the software running this blog to a new version of TightBlog, running on a standalone Tomcat on Ubuntu running on Linode. It's still a SNAPSHOT version with some things to fix. Below are my installation notes. Note many of these instructions hold for deploying any WAR-file in such an environment, so what I've written below may be useful for other apps.

Linode preparation:

  1. Sign up for Linode. Best to first check for special starting credits, usually given at the top of their documentation. I used the $12/month plan providing 2 GB of RAM which has always worked fine for my needs.
  2. For the starting image for my new Linode, I used Ubuntu 22.04 LTS with its default partition of 50688 MB and 512 MB for swap space.
  3. I followed the remainder of the Getting Started Guide and most of the recommendations of the subsequent Securing Your Server guide.
  4. If you don't want the default Linode domain name of (as you probably don't) go to a domain name registrar such as Namecheap or Squarespace to rent your desired domain. I used the latter to obtain and then configured it for my linode following these instructions.
  5. As recommended in the Securing Your Server guide, I used key-based authentication allowing me to easily connect to my linode using "ssh (or sftp)" from a command-line on my home computer. (If you haven't gotten a custom domain name yet, you'll find the default name and IP address in the Public IPs section on the Remote Access tab in the Linode Manager.)
  6. I created a ~/tbfiles folder (owned by a non-root normal user account) as a staging area for files I'm uploading to my linode as well as to hold the TightBlog media file directories and (optionally) Lucene search indexes.

Tomcat preparation:

  1. I installed OpenJDK 17 and then manually Tomcat on my image, using a non-root account. Another option, which I had problems getting to work before switching to the above (probably due to since-learned firewall configuration omissions on my part), is using sudo apt-get install, which if you use requires some extra configuration for it to work with JDK 17.

    Either Tomcat install method above should result in sudo systemctl [start|stop|restart] tomcat (or ...tomcat9) command-line instructions being available for starting and stopping Tomcat. After starting Tomcat, confirm you can access Tomcat's port 8080 from a browser using your linode's IP address.

  2. Create a signed SSL certificate for use with Tomcat. I used Certbot which generates 3-month certificates, which can be configured in your Tomcat server.xml following these instructions. I've not yet configured automatic refresh, so my steps from Linode every three months:
    sudo systemctl stop tomcat
    For housekeeping on key updates, may wish to delete logs at /opt/tomcat/latest/logs 
    sudo -H certbot certonly --standalone -d -d
    (see "Successfully received certificate" feedback indicating Certbot worked.)
    sudo -s
    cd /etc/letsencrypt/live/*
    sudo cp {cert,chain,privkey}.pem /opt/tomcat/latest/conf
    chown tomcat:tomcat /opt/tomcat/latest/conf/*.pem
    sudo systemctl start tomcat
    ...confirm website accessible again at https://..., if not working ensure tomcat dirs all owned by tomcat user & restart
    cd /etc/letsencrypt/live
    sudo rm -r*
  3. Update the Tomcat conf/server.xml file to have HTTP running on port 80 and HTTPS on 443:
    <Connector port="80" protocol="HTTP/1.1"
                   redirectPort="443" />
    <Connector port="443" protocol="org.apache.coyote.http11.Http11NioProtocol"
                   maxThreads="150" SSLEnabled="true">
            <Certificate certificateFile="conf/cert.pem" certificateKeyFile="conf/privkey.pem" certificateChainFile="conf/chain.pem"/>
  4. If you're using a non-root user to run Tomcat as suggested, you'll need to make some changes to allow that user to use privileged ports (ports under 1024, port 80 and port 443 in Tomcat's case). One way this can be done is via authbind. For authbind, first edit the /etc/default/tomcat8 file to activate it and then run a script similar to the following (replace "tomcat8" with the non-root user that is running Tomcat on your linode):
    sudo touch /etc/authbind/byport/80
    sudo chmod 500 /etc/authbind/byport/80
    sudo chown tomcat8 /etc/authbind/byport/80
    sudo touch /etc/authbind/byport/443
    sudo chmod 500 /etc/authbind/byport/443
    sudo chown tomcat8 /etc/authbind/byport/443
  5. Because the Ubuntu Linode I was using was running the UFW firewall by default, I needed further commands to be able to expose 80 and 443 to external browsers:

    sudo ufw allow 80/tcp
    sudo ufw allow 443/tcp

    Use sudo ufw status to confirm the ports are available, for IPv4 you should see:

    Status: active
    To                         Action      From
    --                         ------      ----
    OpenSSH                    ALLOW       Anywhere                  
    3306                       ALLOW       Anywhere                  
    8080/tcp                   ALLOW       Anywhere                  
    80/tcp                     ALLOW       Anywhere                  
    443/tcp                    ALLOW       Anywhere       

MySQL preparation:

  1. Install MySQL on your linode.
  2. As explained in the TightBlog wiki, create the database that will hold the TightBlog data.
  3. (Optional) To connect to the MySQL database on your linode using SquirrelSQL or another SQL client running on your local computer, these instructions will help.

TightBlog deployment:

  1. I built the TightBlog war following these instructions and renamed it to ROOT.war so it will be Tomcat's default application (i.e., have a shorter URL, instead of The WAR file will need to be placed in the Tomcat webapps folder as usual.
  2. There are three files that need to be uploaded to the Tomcat /lib folder, as explained on the Deploy to Tomcat page on the wiki: slf4j-api-1.7.25.jar, your JDBC driver (mysql-connector-java-X.X.X-bin.jar for MySQL), and the file (sample). Create or download these as appropriate.
  3. The makes reference to folders used for storing media files and search index information, for example /home/gmazza/tbfiles/mediafiles. Note for Tomcat to be able to read and write from these folders, the leaf folder (here, mediafiles should have the ownership of the user account running Tomcat (e.g. tomcat:tomcat), and that user must have execute permissions for every parent folder.
  4. For uploading files from your computer to your linode, see the scp or sftp commands, for example: scp ROOT.war However, I prefer "sftp", navigating to desired folders, and using "put" or "get" to upload or download respectively.
  5. After uploading the files and placing them in their proper locations, restart Tomcat and start the TightBlog application install process at[/tightblog].

    Troubleshooting: if accessing[/tightblog] from a browser returns 404's while you can still ping the domain, check to see if you can access that URL from a terminal window that is SSH'ed into your Linode using the command-line Lynx browser. If you can, that would mean Tomcat is running properly but there is most likely a problem with the authbind or iptable rerouting preventing external access. If you can't, Tomcat configuration should be looked at first.

  6. Best to create a test blog entry, and create a database backup and restore process and confirm it is working with your database instance (e.g., add a blog entry after the backup, restore the backup and confirm the new entry disappears, or delete a blog entry after a backup and confirm the restore returns it.) Simple commands for MySQL would be as follows (see here for more details on available commands):
    Export to a file:
    sudo mysqldump tightblogdb > db_backup_YYYYMMDD.sql
    Import into the database to restore it:
    mysql -u root tightblogdb < db_backup_YYYYMMDD.sql

    Best to save the backup copy outside of the linode (e.g., on your local machine) and create a regular backup routine.

  7. Soon after the blog is up, good to check if the emailing is working by sending yourself a comment for a blog entry. If no email is received, check the tightblog.log in the Tomcat logs folder for any mail sending exceptions. If you're using GMail and there is an authorization problem, the error logs may provide you a precise link at where you can authorize TightBlog to use the email account.

Posted by Glen Mazza in Programming at 07:00AM Dec 08, 2023 | Comments[2]


Glad to see your personal domain name. Good decision to migrate from OpenShift to Linode.

Posted by Anant Jaynarayana at 03:14AM Nov 13, 2017

I follow Roller and I will follow Tightblog too. Lot of good changes and documentation about all changes you did. 1

Posted by Nitin Lokhande at 02:07PM Nov 02, 2019

Post a Comment:

« July 2024
Sun Mon Tue Wed Thu Fri Sat
About Me
Java Software Engineer
TightBlog project maintainer
Arlington, Virginia USA
glen.mazza at pm dot me
GitHub profile for Glen Mazza at Stack Overflow, Q&A for professional and enthusiast programmers
Blog Search

Blog article index
About Blog
Blog software: TightBlog 4.0.0
Application Server: Tomcat
Database: MySQL
Hosted on: Linode
SSL Certificate: Let's Encrypt
Installation Instructions