path: root/www/posts/gemini/atom.xml

<?xml version="1.0" encoding="utf-8"?>
<feed xmlns="http://www.w3.org/2005/Atom">
    <title type="text">The Home of David T. Sadler - All Posts About Gemini</title>
    <id>https://davidtsadler.com/posts/gemini/atom.xml</id>
    <link rel="alternate" type="text/html" href="https://davidtsadler.com/posts/gemini/index.html"/>
    <link rel="self" type="application/atom+xml" href="https://davidtsadler.com/posts/gemini/atom.xml"/>
    <updated>2021-02-08T12:00:00Z</updated>
    <entry>
    <title type="text">How to Host Your Own Gemini Site in the Cloud</title>
    <id>https://davidtsadler.com/posts/gemini/2021-02-08/how-to-host-your-own-gemini-site-in-the-cloud/index.html</id>
    <link rel="alternate" type="text/html" href="https://davidtsadler.com/posts/gemini/2021-02-08/how-to-host-your-own-gemini-site-in-the-cloud/index.html"/>
    <author><name>David T. Sadler.</name></author>
    <published>2021-02-08T12:00:00Z</published>
    <updated>2021-02-08T12:00:00Z</updated>
    <content type="html">&lt;h1&gt;How to Host Your Own Gemini Site in the Cloud&lt;/h1&gt;&lt;blockquote&gt;Mon 8th February 2021 By David T. Sadler.&lt;/blockquote&gt;&lt;p&gt;So I have a Gemini site over at gemini://davidtsadler.co.uk and I thought I'd write up how I achieved this in case anyone was interested in doing the same.&lt;/p&gt;&lt;p&gt;I would say that from purchasing the domain name to having a complete server hosting the site took about 30 minutes in total.&lt;/p&gt;&lt;h2&gt;Purchasing a Domain Name&lt;/h2&gt;&lt;p&gt;I decided that for the moment I would keep my traditional &amp;quot;Big Web&amp;quot; content hosted at davidtsadler.com and use a different domain name for my new Gemini site. Since this meant purchasing a new one I popped over to Gandi.net to acquire davidtsadler.co.uk. Side note: I used to own this but decided not to renew it for some crazy reason.&lt;/p&gt;&lt;h2&gt;Creating a cloud sever&lt;/h2&gt;&lt;p&gt;My cloud provider of choice is Hetzner and creating a new server is done in eight steps.&lt;/p&gt;&lt;h3&gt;1. Location&lt;/h3&gt;&lt;p&gt;Hetzner provide a few locations in Europe as to where the server is hosted. For this server I chose Helsinki.&lt;/p&gt;&lt;h3&gt;2. Image&lt;/h3&gt;&lt;p&gt;I chose Ubuntu 20.04 as the operating system as this is the one I'm most familiar with.&lt;/p&gt;&lt;h3&gt;3. Type&lt;/h3&gt;&lt;p&gt;As this server is only going to a host a Gemini site I don't need a overly powerful system so I chose their most basic CX11 configuration. For €2.99 a month this gives me:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;1 virtual CPU.&lt;/li&gt;&lt;li&gt;2GB ram.&lt;/li&gt;&lt;li&gt;20GB SSD .&lt;/li&gt;&lt;li&gt;20 TB of network traffic a month.&lt;/li&gt;&lt;/ul&gt;&lt;h3&gt;4. Volume&lt;/h3&gt;&lt;p&gt;You have the option of attaching additional storage to the server. I skipped this step as for the time been the 20GB SSD that comes with the server should be enough for my needs.&lt;/p&gt;&lt;h3&gt;5. Network.&lt;/h3&gt;&lt;p&gt;I skipped this step as its not needed.&lt;/p&gt;&lt;h3&gt;6. Additional features&lt;/h3&gt;&lt;p&gt;Again I skipped this step but select any if you believe that you will need them.&lt;/p&gt;&lt;h3&gt;7. SSH Key&lt;/h3&gt;&lt;p&gt;When a server is created a root user is added and a password is emailed to you so that you can login. However if you provide a SSH key it will be installed on the server instead of creating a password.&lt;/p&gt;&lt;p&gt;I like to use separate keys for each server that I manage so I tend store the them in a directory named after the hostname.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ mkdir ~/.ssh/davidtsadler.co.uk

$ ssh-keygen -t rsa -b 4096 -f ~/.ssh/davidtsadler.co.uk/id_rsa&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The SSH key is added by clicking + ADD SSH KEY and then copying and pasting the contents of the id_rsa.pub file.&lt;/p&gt;&lt;h3&gt;8. Name&lt;/h3&gt;&lt;p&gt;I name my servers after the hostname so for this I called it davidtsadler.co.uk. I then created the server by clicking CREATE &amp;amp; BUY NOW.&lt;/p&gt;&lt;h2&gt;SSH&lt;/h2&gt;&lt;p&gt;Once the server was created I took the allocated IP address and ensured that I could access it via SSH using the key that I had provided.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ ssh root@135.181.201.71 -i ~/.ssh/davidtsadler.co.uk/id_rsa&lt;/code&gt;&lt;/pre&gt;&lt;h2&gt;Resolve the Domain Name to the Server&lt;/h2&gt;&lt;p&gt;In my Gandi.net account I went to the DNS Records section for the domain name I had purchased. There I deleted everything except for the @ (A) and www (CNAME) records which was configured as follows:&lt;/p&gt;&lt;ul&gt;&lt;li&gt;@ (A) 135.181.201.71&lt;/li&gt;&lt;li&gt;www (CNAME) davidtsadler.co.uk.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;The A record is configured with the IPv4 address of my new server and the CNAME with the domain name. Note that the CNAME must end with a period!&lt;/p&gt;&lt;p&gt;After saving the changes it was just a matter of waiting for it to propagate through the DNS system. At which point I could use the domain name when logging in via SSH.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ ssh root@davidtsadler.co.uk -i ~/.ssh/davidtsadler.co.uk/id_rsa&lt;/code&gt;&lt;/pre&gt;&lt;h2&gt;Securing the Server&lt;/h2&gt;&lt;p&gt;At a bare minimum I setup a firewall and harden SSH. I may at a later date go further, such as installing fail2ban.&lt;/p&gt;&lt;h3&gt;Configure a Firewall&lt;/h3&gt;&lt;p&gt;This setup will deny any incoming requests unless they were first initiated by a request from the server. Since I need to be able to access the server I allow SSH. The Gemini protocol uses port 1965 so that is also allowed.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ ufw default allow outgoing
$ ufw default deny incoming
$ ufw allow OpenSSH
$ ufw allow 1965
$ ufw enable&lt;/code&gt;&lt;/pre&gt;&lt;h3&gt;Harden SSH&lt;/h3&gt;&lt;p&gt;I edited the /etc/ssh/sshd_config file.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ vim /etc/ssh/sshd_config&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;I added the two below options so that the root user is not allowed to access the sever via SSH and other users may only access using keys.&lt;/p&gt;&lt;pre&gt;PermitRootLogin no
PasswordAuthentication no&lt;/pre&gt;&lt;p&gt;Since I'd made changes to the configuration I needed to restart the SSH service.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ service sshd restart&lt;/code&gt;&lt;/pre&gt;&lt;h3&gt;Create non-root User&lt;/h3&gt;&lt;p&gt;Whenever I access a server I like to login as a non-root user that is able to run sudo on the system.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ adduser gemini

$ usermod -aG sudo gemini&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;As the SSH key is already on the server I can copy it to the non-root user account.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ rsync --archive --chown=gemini:gemini ~/.ssh /home/gemini&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;On my local system I confirm that I can log in as the new user without a password.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ ssh gemini@davidtsadler.co.uk -i ~/.ssh/davidtsadler.co.uk/id_rsa&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;I also confirm that I have sudo access.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ sudo ls&lt;/code&gt;&lt;/pre&gt;&lt;h2&gt;Installing a Gemini Site and Server&lt;/h2&gt;&lt;h3&gt;Directory structure&lt;/h3&gt;&lt;p&gt;I decided to go with a very simple directory structure. Each site will be a sub-directory in ~/sites that will be named after the domain name. Then each site will have the following sub-directories. The idea is that I may want to host more than one site in the future.&lt;/p&gt;&lt;ul&gt;&lt;li&gt;bin This will contain the Gemini server binary.&lt;/li&gt;&lt;li&gt;certs TLS certificates for the site are kept here.&lt;/li&gt;&lt;li&gt;public This will contain the .gmi files of the site.&lt;/li&gt;&lt;li&gt;scripts Contains scripts used to start the Gemini server.&lt;/li&gt;&lt;/ul&gt;&lt;p&gt;I created the directory structure with the below command.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ mkdir -p ~/sites/davidtsadler.co.uk/{bin,certs,public,scripts}&lt;/code&gt;&lt;/pre&gt;&lt;h3&gt;Install certificates&lt;/h3&gt;&lt;p&gt;Sine the Gemini protocol encourages using a self-signed certificate I installed one with the openssl command.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ openssl req -x509 \
    -newkey rsa:4096 \
    -keyout ~/sites/davidtsadler.co.uk/certs/key.rsa \
    -out ~/sites/davidtsadler.co.uk/certs/cert.pem \
    -days 3650 \
    -nodes \
    -subj &amp;quot;/CN=davidtsadler.co.uk&amp;quot;&lt;/code&gt;&lt;/pre&gt;&lt;h3&gt;Create Some Test Content&lt;/h3&gt;&lt;p&gt;I created a very simple index.gmi file purely for testing.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ cat &amp;lt;&amp;lt; EOF &amp;gt; ~/sites/davidtsadler.co.uk/public/index.gmi
# Welcome

Hello world!
EOF&lt;/code&gt;&lt;/pre&gt;&lt;h3&gt;Install the Gemini Server Binary&lt;/h3&gt;&lt;p&gt;I decided to go with agate as the Gemini server as its very simple to install and configure. Installing it was a matter of downloading the binary archive into the bin directory and setting the executable permission on it.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ cd ~/sites/davidtsadler.co.uk/bin

$ wget https://github.com/mbrubeck/agate/releases/download/v2.3.0/agate.x86_64-unknown-linux-gnu.gz

$ gunzip agate.x86_64-unknown-linux-gnu.gz

$ mv agate.x86_64-unknown-linux-gnu agate

$ chmod u+x agate&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;I wrote a very simple bash script to run agate and have it serve the site.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ cat &amp;lt;&amp;lt; EOF &amp;gt; ~/sites/davidtsadler.co.uk/scripts/start
#!/bin/bash

/home/gemini/sites/davidtsadler.co.uk/bin/agate \
    --content /home/gemini/sites/davidtsadler.co.uk/public/ \
    --key /home/gemini/sites/davidtsadler.co.uk/certs/key.rsa \
    --cert /home/gemini/sites/davidtsadler.co.uk/certs/cert.pem \
    --addr [::]:1965 \
    --addr 0.0.0.0:1965 \
    --hostname davidtsadler.co.uk \
    --lang en-GB
EOF

$ chmod u+x ~/sites/davidtsadler.co.uk/scripts/start&lt;/code&gt;&lt;/pre&gt;&lt;h3&gt;Testing the Site&lt;/h3&gt;&lt;p&gt;At this point I have the Gemini server installed and a site available for testing.&lt;/p&gt;&lt;p&gt;I first started agate with the bash script.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ ~/sites/davidtsadler.co.uk/scripts/start

[2021-02-05T17:26:56Z INFO  agate] Listening on [[::]:1965, 0.0.0.0:1965]...&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;With agate up and running I pointed my Gemini client to gemini://davidtsadler.co.uk and confirmed I was able to access the site before entering Ctrl-C to halt agate.&lt;/p&gt;&lt;h3&gt;Configure Systemd&lt;/h3&gt;&lt;p&gt;Since I was happy that agate was able to serve my new site I created a systemd unit to ensure that agate was started whenever the system was rebooted.&lt;/p&gt;&lt;pre&gt;&lt;code class=&quot;shell&quot;&gt;$ sudo vim /etc/systemd/system/agate.service&lt;/code&gt;&lt;/pre&gt;&lt;p&gt;The unit is very simple and just runs the bash script to start agate once the network is available.&lt;/p&gt;&lt;pre&gt;[Unit]
Description=Agate Gemini Server
After=network.target

[Service]
Type=simple
User=gemini
Group=gemini
ExecStart=/home/gemini/sites/davidtsadler.co.uk/scripts/start

[Install]
WantedBy=default.target&lt;/pre&gt;&lt;p&gt;I then started this service and confirmed it was working.&lt;/p&gt;&lt;pre&gt;$ sudo systemctl start agate.service

$ sudo systemctl status agate.service

Active: active (running)&lt;/pre&gt;&lt;p&gt;The final step was to have this service start when the system is rebooted.&lt;/p&gt;&lt;pre&gt;$ sudo systemctl enable agate.service&lt;/pre&gt;&lt;h2&gt;Conclusion&lt;/h2&gt;&lt;p&gt;Setting up a Gemini site was easy to do and I hope this guide shows it. I have several ideas about how I'm going to use this new site and I'm excited to see where this leads to.&lt;/p&gt;&lt;h3&gt;Links&lt;/h3&gt;&lt;a href=&quot;https://www.gandi.net/&quot;&gt;Gandi.net - My domain registrar of choice.&lt;/a&gt;&lt;a href=&quot;https://hetzner.cloud/?ref=Gf3UFbRaixBK&quot;&gt;Hetzner - My cloud server provider.&lt;/a&gt;&lt;a href=&quot;https://github.com/mbrubeck/agate/&quot;&gt;Agate - A simple Gemini server.&lt;/a&gt;&lt;a href=&quot;gemini://davidtsadler.co.uk/&quot;&gt;davidtsadler.co.uk - My Gemini site.&lt;/a&gt;&lt;a href=&quot;/posts/gemini/&quot;&gt;Gemini - Read More Posts.&lt;/a&gt;&lt;p&gt;I don't have comments as I don't want to manage them. You can however contact me at the below address if you want to.&lt;/p&gt;&lt;a href=&quot;mailto:david@davidtsadler.com&quot;&gt;Email david@davidtsadler.com&lt;/a&gt;&lt;h3&gt;License&lt;/h3&gt;&lt;a href=&quot;https://creativecommons.org/licenses/by-sa/4.0/&quot;&gt;The contents of this site is licensed under a Creative Commons Attribution-ShareAlike 4.0 International License.&lt;/a&gt;&lt;p&gt;Copyright © 2021 David T. Sadler.&lt;/p&gt;&lt;a href=&quot;/&quot;&gt;Return to Homepage.&lt;/a&gt;</content>
</entry>
</feed>