3

I want to run my own public nxt / ardor node, but I also want https (letsencrypt). I have a ubuntu server with apache 2.4 installed already. What are the steps to get this setup?

3

As stated here: https://nxtforum.org/public-nodes-vpss/method-to-configure-https-for-nxt-public-nodes/

Requirements

1) A Linux server running Nxt, and configured for public API access. This should only require creating a nxt.properties under nxt/conf similar to this:

nxt.apiServerCORS=true
nxt.uiServerCORS=true
nxt.myAddress=SERVER_IP_ADDRESS
nxt.allowedBotHosts=*
nxt.allowedUserHosts=127.0.0.1; localhost; SERVER_IP_ADDRESS; 0:0:0:0:0:0:0:1;
nxt.enableAPIserver=true
nxt.apiServerHost=0.0.0.0

2) A subdomain (or domain) to access your node. This is required to use an SSL certificate. The subdomain should be included in the domain nameservers configuration as an A record pointing to your server IP.


Procedure

In this example, setup was done using root account. If you're using a non-root account, it needs to be in the sudo group and commands need to be run using sudo.

1) *Turn off Apache if you have it installed already first* Install letsencrypt (certbot) and generate the SSL certificate for your (sub)domain.

wget https://dl.eff.org/certbot-auto
chmod a+x ./certbot-auto
./certbot-auto certonly --standalone --email admin@example.com -d sub.example.com

2) Install apache webserver if you dont have it already and enable the modules for ssl and reverse proxy. If you have it installed, just enable proxy_http

apt-get install apache2
a2enmod ssl proxy_http

3) Configure the default apache configuration file.

nano /etc/apache2/sites-available/000-default.conf

Replace the default configuration lines with the following, replacing the strings in red with your (sub)domain. Just comment out the existing one and copy the entire thing below and adjust to your site/directories:

<VirtualHost *:80>
        ServerName sub.example.com
        Redirect permanent / https://sub.example.com/
</VirtualHost>
<IfModule mod_ssl.c>
<VirtualHost *:443>
        ServerName sub.example.com
        SSLEngine on
        SSLCertificateFile /etc/letsencrypt/live/sub.example.com/cert.pem
        SSLCertificateKeyFile /etc/letsencrypt/live/sub.example.com/privkey.pem
        SSLCertificateChainFile /etc/letsencrypt/live/sub.example.com/chain.pem
        SSLProxyEngine On
        ProxyPreserveHost On
        ProxyRequests Off
        ProxyPass / http://localhost:7876/
        ProxyPassReverse / http://localhost:7876/
</VirtualHost>
</IfModule>

4) Finally, restart the apache webserver.

service apache2 restart

If you run into 404 errors during install, you'll have to remove those packages like this: https://askubuntu.com/questions/896603/trying-to-install-letsencrypt-on-ubuntu-12-04-using-certbot-auto-program-but-ge/896614#896614

Remember to change your port if your going to use testnet 6876 or mainnet 7876.

Also be sure to open up your ports 7874 for peer connetions.

Ardor ports are testnet 26876 and live 27876


The above also works when making a public Ardor node.

Below is the output after a successful certbot-auto download:

MAKE SURE YOU TURN OFF APACHE BEFORE YOU DO THIS


root@localh:~# ./certbot-auto certonly --standalone --email info@xxxx.com -d ardor.xxxxx.com
Saving debug log to /var/log/letsencrypt/letsencrypt.log
Obtaining a new certificate
Performing the following challenges:
tls-sni-01 challenge for ardor.xxxx.com
Waiting for verification...
Cleaning up challenges

IMPORTANT NOTES:
 - Congratulations! Your certificate and chain have been saved at
   /etc/letsencrypt/live/ardor.xxxx.com/fullchain.pem. Your
   cert will expire on 2017-09-20. To obtain a new or tweaked version
   of this certificate in the future, simply run certbot-auto again.
   To non-interactively renew *all* of your certificates, run
   "certbot-auto renew"
 - If you like Certbot, please consider supporting our work by:

   Donating to ISRG / Let's Encrypt:   https://letsencrypt.org/donate
   Donating to EFF:                    https://eff.org/donate-le
  • Tried this again with Ardor 2.0.3e and ran into some issues on my ubuntu server. I had apache installed and running already. When running certbot-auto it would error out at ERROR BINDING TO PORT 443 . Reason is because apache was still on. Make sure you turn it off first. Overall this is a very easy setup, max 10 minutes if everything goes smoothly. – Patoshi パトシ Jun 22 '17 at 2:55
  • To renew your SSL cert just find the letscrypt command and just do a ./letsencrypt renew -- See: pastebin.com/jAUJZLwT – Patoshi パトシ Jun 24 '17 at 21:26
  • Ran into another issue with a keystore issue. Check your nxt.properties and delete your keystore line. – Patoshi パトシ Aug 9 '17 at 16:45
  • updated again smoothly: prntscr.com/gl57qv – Patoshi パトシ Sep 14 '17 at 16:05
  • For this to work for me with an Ardor node (without typing in the port manually each visit) I had to set ProxyPass / http://localhost:27876/ ProxyPassReverse / http://localhost:27876/ to ProxyPass / https://localhost:27876/ ProxyPassReverse / https://localhost:27876/ notice https instead of http. But other than that, great answer! – Will Tate Aug 18 '18 at 23:25

Your Answer

By clicking “Post Your Answer”, you agree to our terms of service, privacy policy and cookie policy

Not the answer you're looking for? Browse other questions tagged or ask your own question.