canopy

Table of Contents

Step-by-step procedure for Setting up a fresh install of Canopy over Debian 12 Bookworm:
Installation
Canopy as a System Service Setup
SSL Setup
Reverse-Proxy Setup
Server-Hardening
Admin Account Setup

title
Setting up a fresh install of Canopy over Debian 12 Bookworm

Step-by-step procedure for Setting up a fresh install of Canopy over Debian 12 Bookworm:

Before installing make sure you have already prepped your database.

Installation

Install node.js and NPM sudo apt install nodejs npm
Yoink a copy of canopy `git clone https://gitlab.com/rainbownapkin/canopy.git && cd canopy'
Install dependencies from NPM npm install
Copy a new config file off of the included reference cp config.example.json config.json
Fill out the newly copied config with a text editor, don't forget to set your DB password or make up a sessionSecret!
Run npm run start, or npm run start:dev if you want it to auto-restart on file save (requires nodemon installed via npm)
The server is now installed, and ready for basic development/testing use! See the Admin Account Setup section for account setup.

Canopy as a System Service Setup

Create a user named 'canopy' and move the production canopy folder to it's home dir, making sure to give it ownership and exclusive permissions
Create a new file at /etc/systemd/system/canopy.service, and add:

[Unit]
Description=canopy
After=network.target

[Service]
User=canopy
WorkingDirectory=/home/canopy/canopy/
ExecStart=node /home/canopy/canopy/src/server.js
Restart=always

[Install]
WantedBy=multi-user.target

Run sudo systemctl enable --now canopy to run canopy in the background as a system service now, and automagically on application crash or system boot

SSL Setup

Ignore the EFF's instruction like an asshole, and install certbot through apt sudo apt install certbot.
^{Snap is garbage and pip is weird on Debian 12. Was having issues with pulling it over pipx.}
Run sudo cerbot certonly --webroot to initiate the certificate challenge
Accept the ToS and make decisions about your email address usage.
Enter your instance domain name
Enter your webroot location (such as '/home/canopy/canopy/www')
Hand the certs over to the 'canopy' user sudo chown canopy:canopy -R /etc/letsencrypt/live
Add the new cert and key file to your config, and set protocol to HTTPS

Reverse-Proxy Setup

Install NGINX sudo apt install nginx

Server-Hardening

###This will be documented once we start public testing, for now development boxes don't need this.

###At some point we will document basic server hardening for canopy such as proper SSH configurations, and firewall rules.

Admin Account Setup

Start-up canopy npm run start
Navigate to your servers ip/domain name in your web-browser. (including port if it's set to non-standard w/o a reverse-proxy in-front of it.)
Create a new user account (don't log in yet, if you do log-out so you won't have a stale session hanging around.)
Drop into a mongosh under the canopy user mongosh --authenticationDatabase "canopy" -u "canopy"
Switch over to the canopy database use canopy
Update the user document 'rank' property to 'admin': db.users.updateOne({user:'USER_NAME'},{$set: {rank:'admin'}})

You may now log-in to your spanky-new canopy instance with your fresh admin account. You are ready to start making channels and taking tokes!