Differences
This shows you the differences between two versions of the page.
Both sides previous revisionPrevious revisionNext revision | Previous revision | ||
blocks:server:virtualized [2022-10-20 09:13] – Added note on certbot renew --dry-run admin | blocks:server:virtualized [2025-09-05 20:10] (current) – Deleted admin | ||
---|---|---|---|
Line 1: | Line 1: | ||
- | ======Virtualized Server Image====== | ||
- | While the full Linux-based server image can be installed on a virtual machine, it is not specifically designed for that purpose. Installations that run Blocks in a virtualized environment often have different priorities than those using a stand-alone server. Many of the features included in the full server Linux image are typically managed by other parts of the infrastructure in a virtualized environment. | ||
- | |||
- | :!: This is an advanced guide. If you don't feel at home in a Linux terminal window, you should probably not follow it. | ||
- | |||
- | ===Minimal Server OS=== | ||
- | The full Linux-based server runs an enhanced desktop version of Ubuntu, including a user friendly window-and-mouse based desktop environment. That's suitable for users that prefer such a desktop environment for managing their server. In contrast, the virtual server image discussed here runs on Debian, which is essentially the same operating system core, but a pure server-version, | ||
- | |||
- | ===No Webmin interface=== | ||
- | The user-friendly, | ||
- | |||
- | ===No DHCP server=== | ||
- | There' | ||
- | |||
- | ===No DNS server=== | ||
- | The same applies for the DNS server. While the software is included also in the virtualized server image, it has not been pre-configured and is not enabled. | ||
- | |||
- | =====Virtual Environment===== | ||
- | This image is designed to be used in a virtualized environment. It is distributed as an [[https:// | ||
- | |||
- | * Oracle [[https:// | ||
- | * VMWare' | ||
- | |||
- | After importing the OVA file into your virtualizer of choice, start it up and wait for the login screen to appear. | ||
- | |||
- | =====Users and Passwords===== | ||
- | For full system access, log in with the user name **root**, with password //pixi//. This **root** user can do anything without restrictions, | ||
- | |||
- | User name **blocks**, with default password // | ||
- | |||
- | =====Network Configuration===== | ||
- | On the Host computer, running VirtualBox (or other preferred virtualizer), | ||
- | |||
- | ====Guest Linux OS terminal window==== | ||
- | Find the network interface name and verify connectivity. | ||
- | * Use the command //ip addr// to see all network interfaces with their names. Ignore the //lo// loopback interface. | ||
- | * The name is typically something like //enp0s3//. | ||
- | * If the interface is already UP, and you have internet access, you're done | ||
- | * Verify internet access by using the command //ping 1.1.1.1//, that should show the turn-around time in mS repeatedly if OK. | ||
- | |||
- | ===Verify/ | ||
- | If you didn't automatically get network access, you need to configure networking inside the virtual Blocks server. Settings are specified in the **/ | ||
- | If required, add a file there and name it //primary// (although the actual file name isn't important). Enter the following data into the file. You can do so using the simple terminal text editor //nano//. | ||
- | < | ||
- | auto enp0s3 | ||
- | allow-hotplug enp0s3 | ||
- | iface enp0s3 inet dhcp | ||
- | </ | ||
- | |||
- | Use the actual name of your interface in the file instead of //enp0s3//, if different. | ||
- | These settings result in a dynamic address, suitable for testing purposes. Since the interface is bridged, the virtual machine will get a network address from your local network, assuming there' | ||
- | |||
- | :!: Do not use a wifi network interface, since that will typically not provide a dynamic address to the virtual machine. | ||
- | |||
- | Alternatively, | ||
- | < | ||
- | auto enp0s3 | ||
- | allow-hotplug enp0s3 | ||
- | iface enp0s3 inet static | ||
- | address 192.168.0.31/ | ||
- | gateway 192.168.0.1 | ||
- | dns-nameservers 1.1.1.1 8.8.8.8 | ||
- | </ | ||
- | |||
- | After making changes, restart the virtual machine using //reboot now// or merely restart the networking stack by | ||
- | //systemctl restart networking// | ||
- | |||
- | =====License Access===== | ||
- | Blocks server software requires a license to be operational. Either connect a physical license key to a USB port or request a cloud-based license (requires internet access). A physical license key can be accessed either directly from a USB port attached to the virtual machine or over the local network. | ||
- | |||
- | ====Network Access from Host Computer==== | ||
- | This method provides access to the license key over the network. Assuming both the guest and host operating systems are on the same network (which they will be when using a network adapter in bridge mode), a license key connected to the host computer can be accessed. This assumes network access is allowed in the license keys's settings (more on this below). Thus, the physical USB key can be connected to the host computer and will then be automatically found by Blocks. | ||
- | |||
- | === Host operating system === | ||
- | Verify or adjust the following license key settings in your host computer | ||
- | |||
- | * Open the CodeMeter Control Center. | ||
- | * Click the WebAdmin button, and wait for the web UI to appear. | ||
- | * Select Configuration > Server. | ||
- | * Under Network Server, select Enable. | ||
- | * Click Apply. | ||
- | |||
- | === Guest operating system === | ||
- | The CodeMeter software has been pre-installed, | ||
- | * Start the virtual machine. | ||
- | * Once up, use the command //cmu --list-server --list-content// | ||
- | * This should show your server' | ||
- | |||
- | ==== Connecting the USB License Key to Another Computer ==== | ||
- | In the example above, the license key is physically connected to the host computer, and then accessed over the (host-computer internal) " | ||
- | |||
- | ====Direct USB Access==== | ||
- | If you have physical access to the computer running the virtualizer, | ||
- | |||
- | === Host computer === | ||
- | |||
- | * Connect the license key. The key must be physically connected to a USB port on the host computer. | ||
- | * Do NOT install the CodeMeter driver/ | ||
- | |||
- | :!: The host computer must NOT run the CodeMeter software, since only one driver may access the physical key at a time, and in this case that's is the driver inside the virtual machine. | ||
- | |||
- | ===VirtualBox settings === | ||
- | * Select your guest OS in the list on the left hand side | ||
- | * Select its Details settings pane | ||
- | * Click USB | ||
- | * Make sure " | ||
- | * Add a "USB Device Filter" | ||
- | * Select your CodeMeter device | ||
- | |||
- | To verify license key accesibility: | ||
- | * Start the virtual machine. | ||
- | * Once up, use the command //cmu -x//. | ||
- | * This should show the details of your license key. Look for the text " | ||
- | |||
- | =====Blocks Configuration===== | ||
- | There' | ||
- | |||
- | =====Reverse Proxy Configuration===== | ||
- | |||
- | The server image includes [[http:// | ||
- | |||
- | ===Port Remapping=== | ||
- | The reverse proxy re-maps ports as the traffic flows through it, thereby exposing HTTP to the outside world on the standard port 80, internally passing it on to Blocks on port 8080. Thus, when accessing Blocks from outside the virtual machine, you don't need to specify any port number. | ||
- | |||
- | ===Serving of Static Files=== | ||
- | It serves all static files (those under /public), rather than passing those requests on to Blocks. Offloading such work leaves more headroom in Blocks for dealing with its more advanced functions. | ||
- | |||
- | ====HTTPS, Domain name and Certificate==== | ||
- | The nginx reverse proxy can also manage a secure HTTPS connection, thus offloading also the work of encryption and decryption from Blocks. HTTPS is increasingly a requirement for many advanced web features. This applies also to Blocks, which is entirely web based. For instance, the Camera, QR Scanner and Locator (when using QR Code or GPS) block types may have limited or no functionality unless | ||
- | |||
- | In order to use HTTPS to access Blocks, you need a number of additional things: | ||
- | |||
- | * A //domain name// of your own. | ||
- | * A // | ||
- | * A //DNS provider//, making your domain name available on the internet. | ||
- | * A HTTPS // | ||
- | |||
- | Furthermore, | ||
- | |||
- | ===Obtaining a Certificate=== | ||
- | You must obtain a HTTPS certificate from an accredited // | ||
- | |||
- | - Edit the nginx configuration file to specify your domain name, and restart nginx. | ||
- | - Run Let's Encrypt' | ||
- | |||
- | To edit the nginx configuration file, do as follows: | ||
- | |||
- | * Start the virtual Blocks image. | ||
- | * Log in as the root user (either in the virtualizers terminal window or over ssh and then switch to the root user using **su**). | ||
- | * Open the editor using the command **nano / | ||
- | |||
- | The //nano// command opens a text editor, showing the configuration, | ||
- | |||
- | < | ||
- | include / | ||
- | server { | ||
- | server_name _; | ||
- | </ | ||
- | |||
- | Replace the underscore character after // | ||
- | |||
- | < | ||
- | include / | ||
- | server { | ||
- | server_name mydomain.com; | ||
- | </ | ||
- | |||
- | Make sure to keep the space after // | ||
- | |||
- | In the same way, edit the file at **/ | ||
- | |||
- | < | ||
- | # This file is included inside the main server directive, in the main nginx.con$ | ||
- | |||
- | # Allow large uploads (e.g., huge video files) through the proxy | ||
- | client_max_body_size 0; | ||
- | |||
- | # Add our own mime type for our JSON-like serialization files | ||
- | types { | ||
- | application/ | ||
- | } | ||
- | |||
- | # Redirect ALL http request to https | ||
- | server { | ||
- | listen 80 default_server; | ||
- | server_name _; | ||
- | return 301 https:// | ||
- | } | ||
- | </ | ||
- | |||
- | Save and exit //nano// again. | ||
- | |||
- | Make sure you've set good, strong passwords on all your Blocks users. Finally, while still as the //root// user, run the following commands, pressing enter after each. The first of these commands checks your new nginx configuration for errors. Pay close attention to any error messages that may appear. | ||
- | |||
- | < | ||
- | /sbin/nginx -t | ||
- | systemctl restart nginx | ||
- | certbot --nginx | ||
- | </ | ||
- | |||
- | If the test is successful, then run the second command which restarts //nginx// to pick up the changed configuration. Finally, the last command tells certbot to do its thing – obtaining a certificate for your domain, integrating it with nginx, etc. If all goes well, you should then be able to access your server from the internet using a URL like this (again using your own domain name): | ||
- | |||
- | < | ||
- | https:// | ||
- | </ | ||
- | |||
- | Certbot will renew your certificate automatically before it expires. You can test automatic renewal for your certificates by running this command: | ||
- | |||
- | < | ||
- | certbot renew --dry-run | ||
- | </ | ||
- | |||
- | If you get stuck, and need more details, follow the official //certbot// guide found [[https:// | ||
- | |||
- | ===Using Local Wifi=== | ||
- | |||
- | While you may use a local wifi network instead of making your Blocks server internet accessible, this adds more complexity for visitors in connecting to your system, since they must first connect to your local wifi and then to your blocks server. Both of these actions can be done from most modern smartphones using QR codes – but you will need two of those, and they need to be scanned in the right order. You of course also need to provide a wifi network with adequate performance and coverage. Thus, for most visitor-facing Blocks applications, | ||
- | |||
- | If you do opt for a local wifi network, your method for setting up HTTPS also becomes a bit more complicated: | ||
- | |||
- | - You must provide internet access to your visitors through your local wifi. This is required both to expedite the wifi connection (many phones will refuse to connect to a wifi that doesn' | ||
- | - Your DNS entry must point to the IP address of your intranet Blocks server, now (hopefully) accessible through your wifi. That means that any attempts to access it from the internet will fail (since it's only available while on the in-house wifi). An " | ||
- | - You can't use the automatic " | ||
- | |||
- | |||
- | =====Security Considerations===== | ||
- | This section describes some security considerations. You don't need to do any of this to get a functioning Blocks system. | ||
- | |||
- | ===Secure Shell Remote Access (SSH)=== | ||
- | Secure Shell is not enabled in the VM image. SSH may be useful for many system configuration and remote access purposes. If desired, enable SSH in the VM's console window using the command //systemctl enable ssh// while running as the root user. Before enabling SSH, set a strong password for the blocks user account. The root account is not enabled for SSH access. This can be changed in the file / | ||
- | |||
- | ===Firewall=== | ||
- | The firewall is not enabled in the VM image. Very few services are enabled, so you may not need a firewall since only the required ports are exposed. Feel free to [[https:// | ||