Production deployment about belenios

[glondu]

this is the correct way to deploy a production server ?

Yes, you can build on that (there is not "one" way). But a Belenios instance should always be protected by HTTPS.

do you have any snippet for a systemd config file ? I've some trouble to deal with env variables and user path (default directory where Belenios is).

Yes, this is what I use at belenios.loria.fr:

[Unit]
Description=Belenios election server at belenios.loria.fr
After=network.target

[Service]
ExecStart=/srv/belenios.loria.fr/run-server.sh
ExecStop=/srv/belenios.loria.fr/stop-server.sh
TimeoutStopSec=15
User=www-belenios

[Install]
WantedBy=multi-user.target

where the run-server.sh script is a proxy script that sources env.sh, cd-s to Belenios sources, then exec-s demo/run-server.sh, and stop-server.sh is the following:

#!/bin/sh

echo shutdown 10 > $(dirname $0)/var/run/ocsigenserver_command

Can I restrict ocsigenserver on localhost only (127.0.0.1:8001) and use a reverse proxy safely (nginx) to deal with Let's Encrypt ?

Absolutely.

[rmylb]

Thank you 🙏
It works like a charm !

[rmylb]

For the stop command, I've an error.
I have try to put the path instead (/home/myuser/.belenios/opam/4.08.1/lib/ocsigenserver/var/run/ocsigenserver_command) but same error.

myuser@belenios:/srv/belenios$ sudo systemctl stop belenios
myuser@belenios:/srv/belenios$ sudo systemctl status belenios
● belenios.service - Belenios election server
   Loaded: loaded (/etc/systemd/system/belenios.service; disabled; vendor preset: enabled)
   Active: failed (Result: timeout) since Mon 2020-11-09 14:20:46 CET; 10s ago
  Process: 9083 ExecStart=/srv/belenios/run-server.sh (code=killed, signal=TERM)
  Process: 9108 ExecStop=/srv/belenios/stop-server.sh (code=killed, signal=TERM)
 Main PID: 9083 (code=killed, signal=TERM)

nov. 09 14:20:11 belenios systemd[1]: Started Belenios election server.
nov. 09 14:20:30 belenios systemd[1]: Stopping Belenios election server...
nov. 09 14:20:46 belenios systemd[1]: belenios.service: Stopping timed out. Terminating.
nov. 09 14:20:46 belenios systemd[1]: belenios.service: Main process exited, code=killed, status=15/TERM
nov. 09 14:20:46 belenios systemd[1]: belenios.service: Control process exited, code=killed, status=15/TERM
nov. 09 14:20:46 belenios systemd[1]: belenios.service: Failed with result 'timeout'.
nov. 09 14:20:46 belenios systemd[1]: Stopped Belenios election server.

I'm not really confortable with OcsigenServer, any tips ?
Thank you!

[glondu]

Is the path to ocsigenserver_command the same in stop-server.sh and ocsigenserver.conf.in?