Deployment Overview of Curiosity on Server¶

Prerequisites and Basic Requirements¶

The application requires a server running a Debian or Ubuntu-based operating system. The following prerequisites must be met for a successful deployment:

Privileges: Root or sudo access is required to install packages and manage Docker containers.
System Packages: The installation process ensures the presence of wget, curl, libc-dev, and libsnappy1v5.
Network Ports:
Port 443 (HTTPS) must be open for external traffic.
Port 8080 is used internally by the application container.

FQDN of the final panel on the hostkey.in domain¶

The application is accessible via a specific subdomain generated based on the server ID.

Parameter	Value
Prefix	`curiosity`
Domain	`hostkey.in`
Full template	`curiosity{Server_ID_from_Invapi}.hostkey.in`

File and Directory Structure¶

The deployment utilizes specific directories on the host system to manage configuration and data:

/root/nginx: Contains the Nginx reverse proxy configuration files (compose.yml).
/root/curiosity: Contains the application orchestration files (compose.yml).
/data/nginx/user_conf.d: Directory for custom Nginx user configurations.
/data/nginx/nginx-certbot.env: Environment file used by the proxy service.

Application Installation Process¶

The installation is performed through a multi-stage process:

System Preparation: The package manager updates the APT cache and upgrades existing packages to ensure system stability. Necessary dependencies such as libc-dev and libsnappy1v5 are installed via apt.
Docker Environment Setup: Docker is installed on the host, and a reverse proxy environment is prepared to handle SSL certificates.
Proxy Configuration: An Nginx container is deployed using Docker Compose in /root/nginx to manage incoming HTTPS traffic and SSL termination.
Application Deployment: The Curiosity application is deployed via Docker Compose located in /root/curiosity.

Access Rights and Security¶

Firewall: Only port 443 is exposed to the public internet for secure access.
Internal Networking: The application container binds to 127.0.0.1:8080, ensuring that the application service is not directly accessible from outside the host, only through the Nginx proxy.
SSL/TLS: SSL certificates are managed via Certbot and integrated into the Nginx reverse proxy configuration.

Docker Containers and Their Deployment¶

The deployment consists of two primary container services:

Nginx Proxy Container¶

Image: jonasal/nginx-certbot:latest
Network Mode: host
Volumes:
nginx_secrets:/etc/letsencrypt (External volume for SSL certificates)
/data/nginx/user_conf.d:/etc/nginx/user_conf.d
Environment Variables:
CERTBOT_EMAIL: Configured via the system environment to manage certificate renewals.

Curiosity Application Container¶

Image: curiosityai/curiosity:70130
Container Name: curiosity
Restart Policy: unless-stopped
Ports: 127.0.0.1:8080 -> 8080
Volumes:
curiosity-data:/data (Named volume for persistent application data)
Environment Variables:
MSK_GRAPH_STORAGE: /data/curiosity
MSK_PUBLIC_ADDRESS: The full FQDN of the server.
MSK_ADMIN_USER: Set to admin.
MSK_ADMIN_EMAIL: Configured via system settings.
MSK_ADMIN_PASSWORD: System-generated credentials.

Application Update Instructions¶

To update the Curiosity application, navigate to the application directory and pull the latest image:

cd /root/curiosity
docker compose pull && docker compose up -d