support/doc/production.md

   1 # Production guide
   2
   3 ## Installation
   4
   5 ### Dependencies
   6
   7 Follow the steps of the [dependencies guide](dependencies.md).
   8
   9 ### PeerTube user
  10
  11 Create a `peertube` user with `/home/peertube` home:
  12
  13 ```
  14 $ sudo useradd -m -d /home/peertube -s /bin/bash -p peertube peertube
  15 ```
  16
  17 Set its password:
  18 ```
  19 $ sudo passwd peertube
  20 ```
  21
  22 ### Database
  23
  24 Create the production database and a peertube user inside PostgreSQL:
  25
  26 ```
  27 $ sudo -u postgres createuser -P peertube
  28 $ sudo -u postgres createdb -O peertube peertube_prod
  29 ```
  30
  31 ### Prepare PeerTube directory
  32
  33 Fetch the latest tagged version of Peertube
  34 ```
  35 $ VERSION=$(curl -s https://api.github.com/repos/chocobozzz/peertube/releases/latest | grep tag_name | cut -d '"' -f 4) && echo "Latest Peertube version is $VERSION"
  36 ```
  37 Open the peertube directory, create a few required directories
  38 ```
  39     cd /home/peertube && sudo -u peertube mkdir config storage versions && cd versions
  40 ```
  41 Download the latest version of the Peertube client, unzip it and remove the zip
  42 ```
  43     sudo -u peertube wget -q "https://github.com/Chocobozzz/PeerTube/releases/download/${VERSION}/peertube-${VERSION}.zip" && \
  44     sudo -u peertube unzip peertube-${VERSION}.zip && sudo -u peertube rm peertube-${VERSION}.zip
  45 ```
  46 Install Peertube
  47 ```
  48     cd ../ && sudo -u peertube ln -s versions/peertube-${VERSION} ./peertube-latest && \
  49     cd ./peertube-latest && sudo -u peertube yarn install --production --pure-lockfile
  50 ```
  51
  52 ### PeerTube configuration
  53
  54 Copy example configuration:
  55
  56 ```
  57 $ cd /home/peertube && sudo -u peertube cp peertube-latest/config/production.yaml.example config/production.yaml
  58 ```
  59
  60 Then edit the `config/production.yaml` file according to your webserver
  61 configuration.
  62
  63 ### Webserver
  64
  65 Copy the nginx configuration template:
  66
  67 ```
  68 $ sudo cp /home/peertube/peertube-latest/support/nginx/peertube /etc/nginx/sites-available/peertube
  69 ```
  70
  71 Then modify the webserver configuration file. Please pay attention to the `alias` keys of the static locations.
  72 It should correspond to the paths of your storage directories (set in the configuration file inside the `storage` key).
  73
  74 ```
  75 $ sudo vim /etc/nginx/sites-available/peertube
  76 ```
  77
  78 If you want to set https with Let's Encrypt please follow the steps of [this guide](https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-16-04).
  79
  80 An example of the nginx configuration could be:
  81
  82 ```
  83 server {
  84   listen 80;
  85   listen [::]:80;
  86   server_name peertube.example.com;
  87
  88   access_log /var/log/nginx/peertube.example.com.access.log;
  89   error_log /var/log/nginx/peertube.example.com.error.log;
  90
  91   rewrite ^ https://$server_name$request_uri? permanent;
  92 }
  93
  94 server {
  95   listen 443 ssl http2;
  96   listen [::]:443 ssl http2;
  97   server_name peertube.example.com;
  98
  99   # For example with Let's Encrypt
 100   ssl_certificate      /etc/letsencrypt/live/peertube.example.com/fullchain.pem;
 101   ssl_certificate_key  /etc/letsencrypt/live/peertube.example.com/privkey.pem;
 102   ssl_trusted_certificate /etc/letsencrypt/live/peertube.example.com/chain.pem;
 103
 104   access_log /var/log/nginx/peertube.example.com.access.log;
 105   error_log /var/log/nginx/peertube.example.com.error.log;
 106
 107   location ^~ '/.well-known/acme-challenge' {
 108     default_type "text/plain";
 109     root /var/www/certbot;
 110   }
 111
 112   location ~ ^/client/(.*\.(js|css|woff2|otf|ttf|woff|eot))$ {
 113     add_header Cache-Control "public, max-age=31536000, immutable";
 114
 115     alias /home/peertube/peertube-latest/client/dist/$1;
 116   }
 117
 118   location ~ ^/static/(thumbnails|avatars)/(.*)$ {
 119     add_header Cache-Control "public, max-age=31536000, immutable";
 120
 121     alias /home/peertube/storage/$1/$2;
 122   }
 123
 124   location / {
 125     proxy_pass http://localhost:9000;
 126     proxy_set_header X-Real-IP $remote_addr;
 127     proxy_set_header Host $host;
 128     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 129
 130     # For the video upload
 131     client_max_body_size 8G;
 132     proxy_connect_timeout       600;
 133     proxy_send_timeout          600;
 134     proxy_read_timeout          600;
 135     send_timeout                600;
 136   }
 137
 138   # Bypass PeerTube webseed route for better performances
 139   location /static/webseed {
 140     if ($request_method = 'OPTIONS') {
 141       add_header 'Access-Control-Allow-Origin' '*';
 142       add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
 143       add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
 144       add_header 'Access-Control-Max-Age' 1728000;
 145       add_header 'Content-Type' 'text/plain charset=UTF-8';
 146       add_header 'Content-Length' 0;
 147       return 204;
 148     }
 149
 150     if ($request_method = 'GET') {
 151       add_header 'Access-Control-Allow-Origin' '*';
 152       add_header 'Access-Control-Allow-Methods' 'GET, OPTIONS';
 153       add_header 'Access-Control-Allow-Headers' 'Range,DNT,X-CustomHeader,Keep-Alive,User-Agent,X-Requested-With,If-Modified-Since,Cache-Control,Content-Type';
 154
 155       # Don't spam access log file with byte range requests
 156       access_log off;
 157     }
 158
 159     alias /home/peertube/storage/videos;
 160   }
 161
 162   # Websocket tracker
 163   location /tracker/socket {
 164     # Peers send a message to the tracker every 15 minutes
 165     # Don't close the websocket before this time
 166     proxy_read_timeout 1200s;
 167     proxy_set_header Upgrade $http_upgrade;
 168     proxy_set_header Connection "upgrade";
 169     proxy_http_version 1.1;
 170     proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 171     proxy_set_header Host $host;
 172     proxy_pass http://localhost:9000;
 173   }
 174 }
 175 ```
 176
 177
 178 Activate the configuration file:
 179
 180 ```
 181 $ sudo ln -s /etc/nginx/sites-available/peertube /etc/nginx/sites-enabled/peertube
 182 $ sudo systemctl reload nginx
 183 ```
 184
 185 ### Systemd
 186
 187 Copy the nginx configuration template:
 188
 189 ```
 190 $ sudo cp /home/peertube/peertube-latest/support/systemd/peertube.service /etc/systemd/system/
 191 ```
 192
 193 Update the service file:
 194
 195 ```
 196 $ sudo vim /etc/systemd/system/peertube.service
 197 ```
 198
 199 It should look like this:
 200
 201 ```
 202 [Unit]
 203 Description=PeerTube daemon
 204 After=network.target
 205
 206 [Service]
 207 Type=simple
 208 Environment=NODE_ENV=production
 209 Environment=NODE_CONFIG_DIR=/home/peertube/config
 210 User=peertube
 211 Group=peertube
 212 ExecStart=/usr/bin/npm start
 213 WorkingDirectory=/home/peertube/peertube-latest
 214 StandardOutput=syslog
 215 StandardError=syslog
 216 SyslogIdentifier=peertube
 217 Restart=always
 218
 219 [Install]
 220 WantedBy=multi-user.target
 221 ```
 222
 223
 224 Tell systemd to reload its config:
 225
 226 ```
 227 $ sudo systemctl daemon-reload
 228 ```
 229
 230 If you want to start PeerTube on boot:
 231
 232 ```
 233 $ sudo systemctl enable peertube
 234 ```
 235
 236 ### Run
 237
 238 ```
 239 $ sudo systemctl start peertube
 240 $ sudo journalctl -feu peertube
 241 ```
 242
 243 ### Administrator
 244
 245 The administrator password is automatically generated and can be found in the
 246 logs. You can set another password with:
 247
 248 ```
 249 $ cd /home/peertube/peertube-latest && NODE_CONFIG_DIR=/home/peertube/config NODE_ENV=production npm run reset-password -- -u root
 250 ```
 251
 252 ## Upgrade
 253
 254 Make a SQL backup:
 255
 256 ```
 257 $ SQL_BACKUP_PATH="backup/sql-peertube_prod-$(date -Im).bak" && \
 258     cd /home/peertube && sudo -u peertube mkdir -p backup && \
 259     sudo pg_dump -U peertube -W -h localhost -F c peertube_prod -f "$SQL_BACKUP_PATH"
 260 ```
 261
 262 Update your configuration file. **If some keys are missing, your upgraded PeerTube won't start!**
 263
 264 ```
 265 $ diff <(curl -s https://raw.githubusercontent.com/Chocobozzz/PeerTube/develop/config/production.yaml.example) /home/peertube/config/production.yaml
 266 ```
 267
 268 Upgrade PeerTube:
 269
 270 ```
 271 $ VERSION=$(curl -s https://api.github.com/repos/chocobozzz/peertube/releases/latest | grep tag_name | cut -d '"' -f 4) && \
 272     cd /home/peertube/versions && \
 273     sudo -u peertube wget -q "https://github.com/Chocobozzz/PeerTube/releases/download/${VERSION}/peertube-${VERSION}.zip" && \
 274     sudo -u peertube unzip -o peertube-${VERSION}.zip && sudo -u peertube rm peertube-${VERSION}.zip && \
 275     cd ../ && sudo rm ./peertube-latest && sudo -u peertube ln -s versions/peertube-${VERSION} ./peertube-latest && \
 276     cd ./peertube-latest && sudo -u peertube yarn install --production --pure-lockfile && \
 277     sudo systemctl restart peertube
 278 ```
 279
 280 Things went wrong? Change `peertube-latest` destination to the previous version and restore your SQL backup:
 281
 282 ```
 283 $ OLD_VERSION="v0.42.42" && SQL_BACKUP_PATH="backup/sql-peertube_prod-2018-01-19T10:18+01:00.bak" && \
 284     cd /home/peertube && rm ./peertube-latest && \
 285     sudo -u peertube ln -s "versions/peertube-$OLD_VERSION" peertube-latest && \
 286     pg_restore -U peertube -c -d peertube_prod "$SQL_BACKUP_PATH"
 287     sudo systemctl restart peertube
 288 ```