I am a Software Engineer from India. I am currently building Daestro. I work in Rust, Javascript and Python. Zola 2025-09-05T00:00:00+00:00 https://vshukla.com/tags/deployment/atom.xml 2025-09-05T00:00:00+00:00 2025-09-05T00:00:00+00:00 Vivek Shukla https://vshukla.com/snippets/cloud-init/

The cloud init script that I use to automatically configure my server with the essentials.

<p>Add this script to Cloud-init field while provisioning your VPS. Most cloud providers support this.</p> <p>This script will do following stuff:</p> <ul> <li>disable the root user</li> <li>disable password authentication for SSH</li> <li>update and upgrade ubuntu packages</li> <li>create a new user named “ubuntu” add given public SSH key as <code>authorized_key</code> for the user</li> <li>Install and setup: <ul> <li>Ufw: a firewall with open ports 22, 80 and 443</li> <li>fail2ban: to protect against brute-force login attempt</li> <li>unattended-upgrades: to upgrade ubuntu packages</li> <li>docker</li> </ul> </li> </ul> <pre class="giallo z-code"><code data-lang="yaml"><span class="giallo-l"><span class="z-comment">#cloud-config</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">disable_root</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">ssh_pwauth</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> false</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">package_update</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">package_upgrade</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag">timezone</span><span class="z-punctuation z-separator">:</span><span class="z-string"> Etc/UTC</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">system_info</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> default_user</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> ssh_authorized_keys</span><span class="z-punctuation z-separator">:</span><span> []</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> lock_passwd</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">packages</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> fail2ban</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> unattended-upgrades</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">runcmd</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> echo $(date) &gt; /start</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> passwd -l root</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> sed -i &#39;s/^PasswordAuthentication yes/PasswordAuthentication no/&#39; /etc/ssh/sshd_config</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> systemctl restart sshd</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw default deny incoming</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw default allow outgoing</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw allow 22/tcp</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw allow 80/tcp</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw allow 443/tcp</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> ufw --force enable</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> systemctl enable fail2ban</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> systemctl start fail2ban</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> unattended-upgrade</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> curl -fsSL https://get.docker.com | sh</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> groupadd docker</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> usermod -aG docker ubuntu</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> echo $(date) &gt; /end</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name z-tag">users</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-entity z-name z-tag"> name</span><span class="z-punctuation z-separator">:</span><span class="z-string"> ubuntu</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> lock_passwd</span><span class="z-punctuation z-separator">:</span><span class="z-constant z-language"> true</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> ssh_authorized_keys</span><span class="z-punctuation z-separator">:</span></span> <span class="giallo-l"><span> -</span><span class="z-string"> YOUR_SSH_PUBLIC_KEY</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> sudo</span><span class="z-punctuation z-separator">:</span><span class="z-string"> ALL=(ALL) NOPASSWD:ALL</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> groups</span><span class="z-punctuation z-separator">:</span><span class="z-string"> sudo</span></span> <span class="giallo-l"><span class="z-entity z-name z-tag"> shell</span><span class="z-punctuation z-separator">:</span><span class="z-string"> /bin/bash</span></span></code></pre> 2025-09-04T00:00:00+00:00 2025-09-04T00:00:00+00:00 Vivek Shukla https://vshukla.com/snippets/systemd-service-nginx-deployment/

A cheatsheet to deploy Systemd service behind Nginx reverse proxy. This approach is very common and used a lot.

<h2 id="systemd-service"><a class="zola-anchor" href="#systemd-service" aria-label="Anchor link for: systemd-service">🔗</a>Systemd Service</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/systemd/system/YOUR_SERVICE_NAME.service</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">[Unit]</span></span> <span class="giallo-l"><span class="z-string">Description=YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-string">After=network.target</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Service]</span></span> <span class="giallo-l"><span class="z-string">ExecStart=/executable/location</span></span> <span class="giallo-l"><span class="z-string">WorkingDirectory=/dir/where/program/can/read-write/data</span></span> <span class="giallo-l"><span class="z-string">Restart=on-failure</span></span> <span class="giallo-l"><span class="z-string">RestartSec=5s</span></span> <span class="giallo-l"><span class="z-string">StartLimitIntervalSec=300</span></span> <span class="giallo-l"><span class="z-string">StartLimitBurst=5</span></span> <span class="giallo-l"><span class="z-string">User=ubuntu</span></span> <span class="giallo-l"><span class="z-string">Group=ubuntu</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Install]</span></span> <span class="giallo-l"><span class="z-string">WantedBy=multi-user.target</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Start command:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl daemon-reload</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl enable YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl start YOUR_SERVICE_NAME</span></span></code></pre> <p>Other commands:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-comment"># see logs</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> journalctl</span><span class="z-constant z-other"> -u</span><span class="z-string"> YOUR_SERVICE_NAME</span><span class="z-constant z-other"> -f</span></span> <span class="giallo-l"><span class="z-comment"># restart</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart YOUR_SERVICE_NAME</span></span> <span class="giallo-l"><span class="z-comment"># when service file is updated</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl daemon-reload</span></span></code></pre><h2 id="nginx-reverse-proxy"><a class="zola-anchor" href="#nginx-reverse-proxy" aria-label="Anchor link for: nginx-reverse-proxy">🔗</a>Nginx Reverse Proxy</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/nginx/sites-available/YOUR_DOMAIN</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">map $http_upgrade $connection_upgrade {</span></span> <span class="giallo-l"><span class="z-string"> default upgrade;</span></span> <span class="giallo-l"><span class="z-string"> &#39;&#39; close;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">upstream server_list {</span></span> <span class="giallo-l"><span class="z-string"> server localhost:8000;</span></span> <span class="giallo-l"><span class="z-string"> keepalive 32;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">server {</span></span> <span class="giallo-l"><span class="z-string"> listen 80; # IPv4</span></span> <span class="giallo-l"><span class="z-string"> listen [::]:80; # IPv6</span></span> <span class="giallo-l"><span class="z-string"> server_name YOUR_DOMAIN;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Hide server information headers</span></span> <span class="giallo-l"><span class="z-string"> server_tokens off;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Enable gzip compression</span></span> <span class="giallo-l"><span class="z-string"> gzip on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_disable &quot;msie6&quot;;</span></span> <span class="giallo-l"><span class="z-string"> gzip_vary on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_proxied any;</span></span> <span class="giallo-l"><span class="z-string"> gzip_comp_level 6;</span></span> <span class="giallo-l"><span class="z-string"> gzip_buffers 16 8k;</span></span> <span class="giallo-l"><span class="z-string"> gzip_min_length 1024;</span></span> <span class="giallo-l"><span class="z-string"> gzip_types</span></span> <span class="giallo-l"><span class="z-string"> application/atom+xml</span></span> <span class="giallo-l"><span class="z-string"> application/geo+json</span></span> <span class="giallo-l"><span class="z-string"> application/javascript</span></span> <span class="giallo-l"><span class="z-string"> application/x-javascript</span></span> <span class="giallo-l"><span class="z-string"> application/json</span></span> <span class="giallo-l"><span class="z-string"> application/ld+json</span></span> <span class="giallo-l"><span class="z-string"> application/manifest+json</span></span> <span class="giallo-l"><span class="z-string"> application/rdf+xml</span></span> <span class="giallo-l"><span class="z-string"> application/rss+xml</span></span> <span class="giallo-l"><span class="z-string"> application/xhtml+xml</span></span> <span class="giallo-l"><span class="z-string"> application/xml</span></span> <span class="giallo-l"><span class="z-string"> font/eot</span></span> <span class="giallo-l"><span class="z-string"> font/otf</span></span> <span class="giallo-l"><span class="z-string"> font/ttf</span></span> <span class="giallo-l"><span class="z-string"> image/svg+xml</span></span> <span class="giallo-l"><span class="z-string"> text/css</span></span> <span class="giallo-l"><span class="z-string"> text/javascript</span></span> <span class="giallo-l"><span class="z-string"> text/plain</span></span> <span class="giallo-l"><span class="z-string"> text/xml;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Buffer size optimization</span></span> <span class="giallo-l"><span class="z-string"> client_body_buffer_size 32k;</span></span> <span class="giallo-l"><span class="z-string"> client_header_buffer_size 2k;</span></span> <span class="giallo-l"><span class="z-string"> client_max_body_size 10M;</span></span> <span class="giallo-l"><span class="z-string"> large_client_header_buffers 4 2k;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Timeouts</span></span> <span class="giallo-l"><span class="z-string"> client_body_timeout 20;</span></span> <span class="giallo-l"><span class="z-string"> client_header_timeout 20;</span></span> <span class="giallo-l"><span class="z-string"> keepalive_timeout 65;</span></span> <span class="giallo-l"><span class="z-string"> send_timeout 20;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Proxy settings</span></span> <span class="giallo-l"><span class="z-string"> location / {</span></span> <span class="giallo-l"><span class="z-string"> include proxy_params;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Upgrade $http_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Connection $connection_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_redirect off;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffering on;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffer_size 16k;</span></span> <span class="giallo-l"><span class="z-string"> proxy_buffers 8 16k;</span></span> <span class="giallo-l"><span class="z-string"> proxy_pass http://server_list;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Additional proxy timeouts</span></span> <span class="giallo-l"><span class="z-string"> proxy_connect_timeout 60s;</span></span> <span class="giallo-l"><span class="z-string"> proxy_send_timeout 120s;</span></span> <span class="giallo-l"><span class="z-string"> proxy_read_timeout 120s;</span></span> <span class="giallo-l"><span class="z-string"> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Security headers</span></span> <span class="giallo-l"><span class="z-string"> add_header X-Content-Type-Options &quot;nosniff&quot; always;</span></span> <span class="giallo-l"><span class="z-string"> add_header Strict-Transport-Security &quot;max-age=31536000; includeSubDomains; preload&quot; always;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Create Symlink</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /etc/nginx/sites-available/YOUR_DOMAIN /etc/nginx/sites-enabled/</span></span></code></pre> <p>Checks Nginx configuration</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> nginx</span><span class="z-constant z-other"> -t</span></span></code></pre> <p>Restart Nginx</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart nginx</span></span></code></pre><h2 id="letsencrypt-ssl"><a class="zola-anchor" href="#letsencrypt-ssl" aria-label="Anchor link for: letsencrypt-ssl">🔗</a>Letsencrypt SSL</h2> <p>Installing <code>certbot</code> to install TLS certificate</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> apt remove certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install core</span><span class="z-punctuation z-terminator">;</span><span class="z-entity z-name"> sudo</span><span class="z-string"> snap refresh core</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install</span><span class="z-constant z-other"> --classic</span><span class="z-string"> certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /snap/bin/certbot /usr/bin/certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> certbot</span><span class="z-constant z-other"> --nginx -d</span><span class="z-string"> YOUR_DOMAIN</span></span></code></pre> 2025-06-09T00:00:00+00:00 2025-06-09T00:00:00+00:00 Vivek Shukla https://vshukla.com/snippets/deploy-openobserve-binary/ <p><a rel="noopener external" target="_blank" href="https://openobserve.ai/docs/quickstart/">Quickstart guide</a> by OpenObserve.</p> <h2 id="installing-openobserve"><a class="zola-anchor" href="#installing-openobserve" aria-label="Anchor link for: installing-openobserve">🔗</a>Installing OpenObserve</h2> <p>Download binary:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">mkdir</span><span class="z-string"> ~/openobserve</span><span class="z-punctuation z-separator"> &amp;&amp;</span><span class="z-support z-function"> cd</span><span class="z-variable z-language"> $_</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">curl</span><span class="z-constant z-other"> -L</span><span class="z-string"> https://raw.githubusercontent.com/openobserve/openobserve/main/download.sh</span><span class="z-keyword z-operator"> |</span><span class="z-entity z-name"> sh</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">chmod</span><span class="z-string"> +x openobserve</span></span></code></pre> <p>Create Environment file</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">tee</span><span class="z-string"> openobserve.env</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string"># Data directory for OpenObserve. This is crucial for local storage.</span></span> <span class="giallo-l"><span class="z-string">ZO_DATA_DIR=&quot;/home/ubuntu/openobserve/data&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"># The port OpenObserve will listen on (default is 5080)</span></span> <span class="giallo-l"><span class="z-string">ZO_PORT=5080</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"># The root user email and password for initial login.</span></span> <span class="giallo-l"><span class="z-string"># CHANGE THESE TO SECURE VALUES!</span></span> <span class="giallo-l"><span class="z-string">ZO_ROOT_USER_EMAIL=&quot;admin@example.com&quot;</span></span> <span class="giallo-l"><span class="z-string">ZO_ROOT_USER_PASSWORD=&quot;SecurePassword123&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">ZO_META_STORE=&quot;sqlite&quot;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">ZO_WEB_URL=&quot;https://your-domain</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"># disabling OpenObserve&#39;s telemetry to their server</span></span> <span class="giallo-l"><span class="z-string">ZO_TELEMETRY=false</span></span> <span class="giallo-l"><span>EOF</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> chmod</span><span class="z-constant z-numeric"> 600</span><span class="z-string"> openobserve.env</span></span></code></pre> <p>Creating systemd service</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/systemd/system/openobserve.service</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">[Unit]</span></span> <span class="giallo-l"><span class="z-string">Description=OpenObserve Observability Platform</span></span> <span class="giallo-l"><span class="z-string">After=network-online.target</span></span> <span class="giallo-l"><span class="z-string">Wants=network-online.target</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Service]</span></span> <span class="giallo-l"><span class="z-string"># Service type: &#39;simple&#39; means the process will be the main process</span></span> <span class="giallo-l"><span class="z-string">Type=simple</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">User=ubuntu</span></span> <span class="giallo-l"><span class="z-string">Group=ubuntu</span></span> <span class="giallo-l"><span class="z-string">WorkingDirectory=/home/ubuntu/openobserve</span></span> <span class="giallo-l"><span class="z-string">EnvironmentFile=/home/ubuntu/openobserve/openobserve.env</span></span> <span class="giallo-l"><span class="z-string">ExecStart=/home/ubuntu/openobserve/openobserve</span></span> <span class="giallo-l"><span class="z-string">Restart=on-failure</span></span> <span class="giallo-l"><span class="z-string">RestartSec=5s</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"># Limit the number of open file descriptors, important for high-concurrency apps.</span></span> <span class="giallo-l"><span class="z-string"># Adjust as needed based on your expected load.</span></span> <span class="giallo-l"><span class="z-string">LimitNOFILE=65536</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"># Redirect standard output and error to systemd journal.</span></span> <span class="giallo-l"><span class="z-string">StandardOutput=journal</span></span> <span class="giallo-l"><span class="z-string">StandardError=journal</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"># How long to wait before forcefully terminating the service on stop.</span></span> <span class="giallo-l"><span class="z-string">TimeoutStopSec=30s</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">[Install]</span></span> <span class="giallo-l"><span class="z-string"># This unit should be enabled for multi-user systems.</span></span> <span class="giallo-l"><span class="z-string"># Allows it to start automatically on boot.</span></span> <span class="giallo-l"><span class="z-string">WantedBy=multi-user.target</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre> <p>Start service</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-comment"># Reload systemd daemon to pick up the new service file</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl daemon-reload</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-comment"># Enable the service to start on boot</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl enable openobserve</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-comment"># Start the OpenObserve service</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl start openobserve</span></span></code></pre> <p>Check the service status and logs</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-comment"># Check service status</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl status openobserve</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-comment"># View logs</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> journalctl</span><span class="z-constant z-other"> -u</span><span class="z-string"> openobserve</span><span class="z-constant z-other"> -f</span></span></code></pre><h2 id="reverse-proxy-nginx"><a class="zola-anchor" href="#reverse-proxy-nginx" aria-label="Anchor link for: reverse-proxy-nginx">🔗</a>Reverse Proxy - Nginx</h2> <p>Install Nginx</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> apt</span><span class="z-constant z-other"> -y</span><span class="z-string"> install nginx</span></span></code></pre><pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> tee /etc/nginx/sites-available/openobserve</span><span class="z-keyword z-operator"> &lt;&lt;</span><span> &#39;EOF&#39;</span></span> <span class="giallo-l"><span class="z-string">map $http_upgrade $connection_upgrade {</span></span> <span class="giallo-l"><span class="z-string"> default upgrade;</span></span> <span class="giallo-l"><span class="z-string"> &#39;&#39; close;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string">server {</span></span> <span class="giallo-l"><span class="z-string"> listen 80; # IPv4</span></span> <span class="giallo-l"><span class="z-string"> listen [::]:80; # IPv6</span></span> <span class="giallo-l"><span class="z-string"> server_name your-domain;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Hide server information headers</span></span> <span class="giallo-l"><span class="z-string"> server_tokens off;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Enable gzip compression</span></span> <span class="giallo-l"><span class="z-string"> gzip on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_vary on;</span></span> <span class="giallo-l"><span class="z-string"> gzip_proxied any;</span></span> <span class="giallo-l"><span class="z-string"> gzip_comp_level 6;</span></span> <span class="giallo-l"><span class="z-string"> gzip_min_length 1024; # Only gzip if size is at least 1KB</span></span> <span class="giallo-l"><span class="z-string"> gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Proxy settings</span></span> <span class="giallo-l"><span class="z-string"> location / {</span></span> <span class="giallo-l"><span class="z-string"> include proxy_params;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Upgrade $http_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_set_header Connection $connection_upgrade;</span></span> <span class="giallo-l"><span class="z-string"> proxy_redirect off;</span></span> <span class="giallo-l"><span class="z-string"> proxy_pass http://localhost:5080;</span></span> <span class="giallo-l"><span class="z-string"> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> location /metrics {</span></span> <span class="giallo-l"><span class="z-string"> # allow 192.168.1.100; # &lt;--- REPLACE WITH YOUR MONITORING SERVER&#39;S IP</span></span> <span class="giallo-l"><span class="z-string"> deny all;</span></span> <span class="giallo-l"><span class="z-string"> }</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-string"> # Security headers</span></span> <span class="giallo-l"><span class="z-string"> add_header X-Content-Type-Options &quot;nosniff&quot; always;</span></span> <span class="giallo-l"><span class="z-string"> add_header Strict-Transport-Security &quot;max-age=31536000; includeSubDomains; preload&quot; always;</span></span> <span class="giallo-l"><span class="z-string">}</span></span> <span class="giallo-l"><span>EOF</span></span></code></pre><pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /etc/nginx/sites-available/openobserve /etc/nginx/sites-enabled/</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-comment"># test nginx conf</span></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> nginx</span><span class="z-constant z-other"> -t</span></span></code></pre><pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> systemctl restart nginx</span></span></code></pre> <p>Afterwards, to gracefully restart nginx, do this:</p> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> nginx</span><span class="z-constant z-other"> -s</span><span class="z-string"> reload</span><span class="z-comment"> # OR sudo systemctl reload nginx</span></span></code></pre><h2 id="tls-installation"><a class="zola-anchor" href="#tls-installation" aria-label="Anchor link for: tls-installation">🔗</a>TLS Installation</h2> <pre class="giallo z-code"><code data-lang="shellscript"><span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install core</span><span class="z-punctuation z-terminator">;</span><span class="z-entity z-name"> sudo</span><span class="z-string"> snap refresh core</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> apt remove certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> snap install</span><span class="z-constant z-other"> --classic</span><span class="z-string"> certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> ln</span><span class="z-constant z-other"> -s</span><span class="z-string"> /snap/bin/certbot /usr/bin/certbot</span></span> <span class="giallo-l"></span> <span class="giallo-l"><span class="z-entity z-name">sudo</span><span class="z-string"> certbot</span><span class="z-constant z-other"> --nginx -d</span><span class="z-string"> your-domain</span></span></code></pre>