tube-docs/docs/Installing CloudTube.md

Installing CloudTube

System dependencies

• node.js (v12+)
• nginx (needed for public instances only)

Prepare

Install NewLeaf first.

→ Installing NewLeaf

Change to the CloudTube user you created before:

# su cloudtube

Installing

Clone the repo:

$ git clone https://git.sr.ht/~cadence/cloudtube
$ cd cloudtube

Install dependencies:

$ npm install

Set up the configuration. Configuration is read from the filename config/config.js. Copy the sample file to that name, then edit it.

You must set the setting for the default instance. You should write an address that is reachable from the machine running CloudTube. Hint: If CloudTube and NewLeaf are on the same machine, you can write http://localhost:3000.

$ pushd config
$ cp config.sample.js config.js
$ $EDITOR config.js
$ popd

All done! Start CloudTube:

$ npm run start

In the future, from a new terminal session, CloudTube can be started with:

$ cd [installation directory]
$ npm run start

systemd service

If you want to control the services with systemd, you can use these files. This is optional.

This service should be run as the cloudtube user rather than as the system.

You may need to adjust the paths in these files.

If you find that these processes terminate when you log out, see the documentation for libpam-systemd and logind.conf.

[Unit]
Description=cloudtube website

[Service]
Type=simple
ExecStart=/usr/local/bin/node /home/cloudtube/cloudtube/server.js
WorkingDirectory=/home/cloudtube/cloudtube

# Restart timing
Restart=always
RestartSec=60

SyslogIdentifier=cloudtube

[Install]
WantedBy=default.target

Save it to ~/.config/systemd/user/cloudtube.service, then issue these commands:

$ systemctl daemon-reload
$ systemctl start cloudtube

...and if all is successful...

$ systemctl enable cloudtube

nginx reverse proxy

This will allow people to access CloudTube over HTTPS and without having to enter a port into the browser's address bar.

It's highly recommended for public instances, but if this installation is for a test or for your personal use, you don't need it.

SSL options are from Mozilla's SSL configuration generator.

Download dhparam.pem: (Why?)

# mkdir -p /etc/nginx/ssl
# wget https://ssl-config.mozilla.org/ffdhe2048.txt -O /etc/nginx/ssl/dhparam.pem

Then create a file inside the directory /etc/nginx/sites-available (suggested name: cloudtube-proxy) with contents like this:

server {
    listen 80;
    listen [::]:80;
    server_name cloudtube.example.com; # [1]

    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name cloudtube.example.com; # [1]

    ssl_certificate /etc/letsencrypt/live/cloudtube.example.com/fullchain.pem; # [2]
    ssl_certificate_key /etc/letsencrypt/live/cloudtube.example.com/privkey.pem; # [2]
    ssl_session_timeout 1d;
    ssl_session_cache shared:MozSSL:10m;
    ssl_session_tickets off;

    ssl_dhparam /etc/nginx/ssl/dhparam; # [3]

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:DHE-RSA-AES128-GCM-SHA256:DHE-RSA-AES256-GCM-SHA384;
    ssl_prefer_server_ciphers off;

    location / {
        proxy_pass http://127.0.0.1:10412;
    }
}

• [1] Write your actual domain here in place of cloudtube.example.com, without capital letters.
• [2] Write your actual domain here in place of cloudtube.example.com. If your certificate is not from Let's Encrypt, you'll have to replace the entire path.
• [3] More information.

Set the configuration as enabled:

# cd /etc/nginx/sites-enabled
# ln -sv ../sites-available/cloudtube-proxy .

And delete the default "it works" server that comes with nginx:

# rm default

Check your configuration. If there are errors, find them and fix them. This sample config should be good on its own.

# nginx -t

Once there are no errors in the configuration, start nginx:

# systemctl start nginx

Enable the nginx service to automatically start nginx after a machine reboot:

# systemctl enable nginx

If nginx is already running, you only have to reload the configuration:

# systemctl reload nginx

Now set up CAA for your DNS. You must set up DNS before you can do this. (Why is CAA important?)

1. First, go to the SSLMate CAA record generator.
2. Enter your domain name, then press "auto-generate policy".
3. Scroll the list and make sure all boxes are unchecked except for the one that has your certificate authority.
4. If it's all good, go down to the "publish your CAA policy" section and examine the first code block. You need to create a DNS record with this information on your domain.

Once you've set everything up, open your domain (ex: https://cloudtube.example.com) in your browser and check that:

1. The CloudTube home page appears
2. You are connected over HTTPS

Now that that works, run the Qualys SSL Labs server test to make sure your configuration is secure. The test will take a few minutes to run.