I host everything on Hetzner. Here is a script to turn a fresh Hetzner Debian
cloud image into a Nim host (somewhat shortened).
sed -i 's/main contrib$/\0 universe/' /etc/apt/sources.list
# automatic security updates (see
https://wiki.debian.org/UnattendedUpgrades for details)
apt -y install unattended-upgrades apt-listchanges
if [ ! -f /etc/apt/apt.conf.d/20auto-upgrades ]; then
echo unattended-upgrades unattended-upgrades/enable_auto_updates boolean
true | debconf-set-selections
dpkg-reconfigure -f noninteractive unattended-upgrades
fi
apt -y install fail2ban
apt -y install nginx
# for each app:
echo "
server {
# add another file for each subdomain
server_name myapp.mydomain.com;
# let certbot enable ssl
listen 80;
listen [::]:80;
location / {
proxy_set_header Host $http_host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
# add these if you use websockets
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection $connection_upgrade;
# chose different ports if you have more than one service
proxy_pass http://127.0.0.1:5678
}
}
" > /etc/nginx/sites-available/mydomain.conf
ln -s ../sites-available/mydomain.conf
/etc/nginx/sites-enabled/myapp.mydomain.com.conf
certbot --nginx --noninteractive --agree-tos
--register-unsafely-without-email -d myapp.mydomain.com
echo "
[Unit]
Description=myapp
After=network.target httpd.service
Wants=network-online.target
[Service]
DynamicUser=True
ExecStart=myapp --host:127.0.0.1 --port:5678
KiillMode=mixed
KillSignal=SIGTERM
# if you write to files
Environment=%S/myapp
WorkingDirectory=%S/myapp
StateDirectory=myapp
Restart=always
LimitNOFILE=65536
NoNewPrivileges=yes
PrivateDevices=yes
PrivateTmp=yes
ProtectHome=yes
ProtectSystem=full
StandardOutput=syslog+console
StandardError=syslog+console
ReadWriteDirectories=/proc/self
ReadWriteDirectories=-/var/run
ReadWriteDirectories=-%S/myapp
[Install]
WantedBy=multi-user.target
" > /etc/systemd/myapp.service
# place your binary in /usr/local/bin
systemctl start myapp.service
systemctl enable myapp.service
# should work
curl https://myapp.mydomain.com
# troubleshoot return status
systemctl status myapp
# show logs
systemctl -u myapp -n5000
# show logs live ("tail")
systemctl -fu myapp -n5000
Run
