Multiwallet/Delegate Server #LISK / #RISE / #DLISK using reverse Proxy from scratch on Debian8

Hi All,
because my rented VPS are running Debian8 by default I had some troubles with LISK/RISE/DLISK Node setup and decided to write the needed steps down.

This way you should be able to install a (delegate) node or online wallet for LIKS/RISE/DLISK from a scratch om a rented LAMP Debain 8 VPS.

These are the Steps :

Check if System is up to date and install needed packages

apt-get update
apt-get upgrade
apt-get install curl build-essential gzip python tar wget libssl-dev libpq-dev git sudo ntp

PostgreSQL

Install

First we need PostgreSQL but we need a newer version (> 9.5.2) as Debian has bundled in their default repository.
source : http://wiki.postgresql.org/wiki/Apt

Add the needed repository as own file

nano /etc/apt/sources.list.d/postgresql.list

add

deb http://apt.postgresql.org/pub/repos/apt/ jessie-pgdg main

save
get the PGP Key for the repository and add it:

wget --quiet -O - https://www.postgresql.org/media/keys/ACCC4CF8.asc |  apt-key add -

Update packagelist and install PSQL
apt-get update
apt-get install postgresql-9.5

after install you can check the version with:

psql --version

psql (PostgreSQL) 9.5.3

Creating Databases and Users

User

sudo -i -u postgres psql -c "CREATE USER lisk WITH PASSWORD 'lisk';"
sudo -i -u postgres psql -c "CREATE USER rise WITH PASSWORD 'rise';"
sudo -i -u postgres psql -c "CREATE USER dlisk WITH PASSWORD 'dlisk';"

Databases

sudo -i -u postgres createdb lisk_main -O lisk
sudo -i -u postgres createdb rise_mainnet -O rise
sudo -i -u postgres createdb dlisk_main -O dlisk

Restrictions

sudo -i -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE lisk_main TO lisk;"
sudo -i -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE rise_mainnet TO rise;"
sudo -i -u postgres psql -c "GRANT ALL PRIVILEGES ON DATABASE dlisk_mainnet TO dlisk;"

Nonprivileged User to Run the Wallets (oner for each Wallet)

The way I prefere it, please check this Post : https://steemit.com/witness/@hagie/howto-create-a-witnessnode-on-a-fresh-rented-debian-8-linux-box

adduser lisk --disabled-login
adduser rise --disabled-login
adduser dlisk --disabled-login

answer all questions and create the user.

NodeJS and Wallets

Next we are going to install NVM and NodeJS in every user for the Wallets. NVM is a lifesaver in situations were you need different versions of nodejs on your system. With NVM you can start applications with a defined version without interfere with other.

This way we are independent of the Node Version the wallet requires.

The easiest Way to install NVM ist via the setup script. But of course you may visit git and download the source there and compile it by hand. https://github.com/creationix/nvm

Taken from the git repository:
To install or update nvm, you can use the install script using cURL (preferred):

    curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.31.4/install.sh | bash

or Wget:

    wget -qO- https://raw.githubusercontent.com/creationix/nvm/v0.31.4/install.sh | bash

The script clones the nvm repository to ~/.nvm and adds the source line to your profile (~/.bash_profile, ~/.zshrc, ~/.profile, or ~/.bashrc).

Now logoff and logon again to your system and check if nvm is installed correctly
Do this step prior to every Wallet installation for the User 'lisk', 'rise' and 'dlisk'

LIKS / RISE / DLISK Wallet

LISK

switch to the #LISK user:

su - lisk

To install the recommended Version of NodeJS use the 0.12 branch

nvm install 0.12
Now using node v0.12.15 (npm v2.15.1)
Creating default alias: default -> 0.12 (-> v0.12.15)

wget https://downloads.lisk.io/lisk/main/lisk-source.tar.gz
tar -zxvf lisk-source.tar.gz
cd lisk-source
npm install --production

We use 'forever' as a background task launcher.

npm install -g forever --no-optional

edit the config.json:

change bind address to 127.0.0.1 (only local loopback)
"address": "127.0.0.1",

and add the database authentication information:
"host": "localhost",
"port": 5432,
"database": "lisk_main",
"user": "lisk",
"password": "lisk",

After saving the config file you can start the wallet with the command

node app.js' in the lisk-source directory.

You will see messages about the creation of the psql database and after same seconds it will start synchronizing the blockchain :

info 2016-08-05 07:43:21 Blockchain ready
info 2016-08-05 07:43:21 Peers ready, stored 5
info 2016-08-05 07:43:22 Checking blockchain on 121.42.181.194:8000
info 2016-08-05 07:43:22 Loading blocks from genesis from 121.42.181.194:8000
info 2016-08-05 07:43:33 Loading 1439 blocks from 121.42.181.194:8000
info 2016-08-05 07:43:33 Block 13332666788283026871 loaded from 121.42.181.194:8000 at 2
info 2016-08-05 07:43:34 Block 7234275607611561282 loaded from 121.42.181.194:8000 at 3

Cancel ctr-c and start it with forever:

forever start app.js

warn: --minUptime not set. Defaulting to: 1000ms
warn: --spinSleepTime not set. Your script will exit if it does not stay up for at least 1000ms
info: Forever processing file: app.js

forever list

info: Forever processes running
data: uid command script forever pid id logfile uptime
data: [0] H9VT /home/lisk/.nvm/versions/node/v0.12.15/bin/node app.js 8750 8753 /home/lisk/.forever/H9VT.log 0:0:1:34.795

with 'forever logs 0 (-f)' you can see the output generated by the wallet.

Now switch to the next user/wallet.

RISE

switch to the #RISE user:

su - rise

To install the recommended Version of NodeJS use the 6.x branch

nvm install 6

Now using node v6.3.1 (npm v3.10.3)
Creating default alias: default -> 6 (-> v6.3.1)

git clone https://bitbucket.org/risevisionfoundation/rise-core.git
cd rise-core
npm install --productive
cd public
npm install --production --no-optional
npm install -g forever --no-optional

change bind address to 127.0.0.1 (only local loopback)
"address": "127.0.0.1",

and add the database authentication information:
"host": "localhost",
"port": 5432,
"database": "rise_mainnet",
"user": "rise",
"password": "rise",

Same procedure like before, test by 'node app.js' and wait for blocksync to begin, ctrl-c and start in background by 'forever start app.js'

DLISK

With to the #DLISK user:

su - dlisk

To install the recommended Version of NodeJS use the 0.12 branch

nvm install 0.12

Now using node v0.12.15 (npm v2.15.1)
Creating default alias: default -> 0.12 (-> v0.12.15)

git clone https://github.com/DLiskProject/dlisk.git
cd dlisk
git submodule init
git submodule update
npm install --productive
npm install grunt-cli -g
npm install bower -g
cd public

For some reason the package.json File contains a ssh link to the git.
To get this running until the bug is fixed change in the public/package.json both occurrences of
"url": "git@github.com:DliskProject/dlisk-ui.git"
to
"url": "https://github.com/DliskProject/dlisk-ui.git"

npm install 
bower install
grunt release
cd ..
npm install -g forever

change bind address to 127.0.0.1 (only local loopback)
"address": "127.0.0.1",

and add the database authentication information:
"host": "localhost",
"port": 5432,
"database": "dlisk_main",
"user": "dlisk",
"password": "dlisk",

Same procedure like before, test by 'node app.js' and wait for blocksyncc to begin, ctrl-c and start in background by 'forever start app.js'

APACHE

Since I was going the lazy way I rented a VPS with LAMP pack.
L- Linux
A- Apache
M- mysql
P- php

In this case we want to use Apache as reverseproxy to our wallets, make the wallets accessible by a unique URL without any ports.
We use the domain delegates.space to map the wallets to the URLS:

https://lisk.delegates.space
https://rise.delegates.space
https://dlisk.delegates.space

since we don't need (in this case>) phpMyAdmin we should completely disable the configuration for it :

    a2disconf phpmyadmin.conf

Virtual Hosts

First we must enable 3 virtual hosts for the Incoming URLS:

Create 3 Files for the virtual hosts for the wallets

nano /etc/apache2/sites-available/lisk.delegates.space.conf

<VirtualHost *:80> 
 ServerAdmin admin@lisk.delegates.space
 ServerName lisk.delegates.space
 DocumentRoot /var/www/lisk.delegates.space/public_html/
 ErrorLog /var/www/lisk.delegates.space/logs/error.log 
 CustomLog /var/www/lisk.delegates.space/logs/access.log combined
</VirtualHost>

sudo mkdir -p /var/www/lisk.delegates.space/public_html
sudo mkdir /var/www/lisk.delegates.space/logs

repeat for rise and dlisk accordingly

enable all sites in apache :

a2ensite lisk.delegates.space.conf
a2ensite dlisk.delegates.space.conf
a2ensite rise.delegates.space.conf

create dummy files to easier test the server

touch /var/www/dlisk.delegates.space/public_html/dlisk
touch /var/www/lisk.delegates.space/public_html/lisk
touch /var/www/rise.delegates.space/public_html/rise

If you restart the apache service 'service apache2 reload' and point your browser to one of the domains/hosts you should see the created dummy file.

Reverse Proxy

For Apache to act as a reverseproxy we have to enable additional modules:

a2enmod proxy_http

Considering dependency proxy for proxy_http:
Enabling module proxy.
Enabling module proxy_http.
To activate the new configuration, you need to run:
service apache2 restart

Now add two additional lines to the vhost configuration files which redirect traffic from the vhost to the wallet daemon on the system. For example LISK:

<VirtualHost *:80> 
 ServerAdmin admin@lisk.delegates.space
 ServerName lisk.delegates.space
 DocumentRoot /var/www/lisk.delegates.space/public_html/
 ErrorLog /var/www/lisk.delegates.space/logs/error.log 
 CustomLog /var/www/lisk.delegates.space/logs/access.log combined
 **ProxyPass / http://127.0.0.1:8000/**
 **ProxyPassReverse / http://127.0.0.1:8000/**
</VirtualHost>

If you now point your browser to http://liks.delegates.sapce your liskwallet should appaer.

Do the same accordingly for RISE and DLISK.

RISE: (for some strange reason the configured port (4242) is not used - istead 4444)
ProxyPass / http://127.0.0.1:4444/
ProxyPassReverse / http://127.0.0.1:4444/

DLIKS:
ProxyPass / http://127.0.0.1:8050/
ProxyPassReverse / http://127.0.0.1:8050/

SSL

To secure the System and encrypt traffic from outside to the wallets we have to enable SSL on the apache System.

We use letsencrypt free ssl certificates to accomplish that.
Go the their website @ https://letsencrypt.org/ read and maybe sponsor their project.
From there go to https://certbot.eff.org/ and choose Apache and Debian 8 and follow the instructions:
Switch to root if not already.
First add this line
deb http://ftp.debian.org/debian jessie-backports main
to your sources.list in /etc/apt/

apt-get update
apt-get install python-certbot-apache -t jessie-backports
certbot --apache

and follow the Instructions in the GUI
Choose the Names you want a cerificate for:

Enter email and accept term (go and read them !!)

Choose the secure way with redirect to "https://"

THAT'S IT !!!!
Optional you could create a portal page on the host name (http://delegate.space) which kicks in every time a HOST is entered which is not configured. At the moment there should appear the default apache page.

Using your favorite firewall to close all ports except 80 & 443 for http/https

HINTS & TIPPS

Stuck Blockchain

It may happen that the blockchain stuck and isn't downloaded anymore. First you should try to restart the wallet.
If this doesn't help you may have to drop (delete) the content of the database and let the blockchain do a fresh sync.
Drop a database after stooping the wallet with the following command :
dropdb dbname from root and then recreate it as stated above under -> Creating Databases and Users

Control access and forging

there is a section in the config.json to controll who is allowed to use the wallet:

"api": {
        "access": {
            "whiteList": []
        }

If this is empty everyone may access the wallet. if it is filled with ip's you can controll who is allowed to access it.

Additional there is a forging section:

 "forging": {
        "secret": [],
        "access": {
            "whiteList": [
                "127.0.0.1",
                "192.168.1.2"
            ]
        }
    },

In this section you allow to switch the node in forging mode. Since only one account should forge on one node this should only be one person.
If you restart the node you have to restart forging from the GUI.
If you like to start forging automatically you can also put the private key (password / secret) into the secret field.

Thanks

That's all. Thanks for reading. if you have questions I like to answer. Leave comments or contact me here or over at BTCT.
If you like it or it helps you in any way please upvote.
If you still have room on your voting list I would be happy to receive your vote as witness.
See here my application as witneess : https://steemit.com/witness-category/@hagie/witness-application-hagie
or go directly to https://steemit.com/~witnesses and hit the up arrow in front of my name (currently #49).