Deployment Overview of RabbitMQ on Server¶

Prerequisites and Basic Requirements¶

The application requires an Ubuntu operating system. The following requirements must be met for a successful deployment:

• Privileges: Root or sudo access is required to install packages and manage services.

• Ports:

• 443 (HTTPS) for external access via the proxy.

• 15672 (Internal Management API) used by the local proxy.

• DNS/Network: The server requires outbound internet access to reach DNS servers (1.1.1.1, 8.8.8.8, 9.9.9.9) and to obtain SSL certificates via Certbot.

FQDN of the final panel on the hostkey.in domain¶

The management interface is accessible through a specific subdomain template:

File and Directory Structure¶

The deployment utilizes the following directory structure for configuration and data persistence:

• /etc/rabbitmq: Contains RabbitMQ configuration files (rabbitmq-env.conf, rabbitmq.conf).

• /root/nginx: Contains the Docker Compose file for the Nginx proxy.

• /data/nginx/user_conf.d: Stores Nginx virtual host configurations and proxy settings.

• /data/nginx/nginx-certbot.env: Contains environment variables for the Nginx container.

Application installation process¶

The RabbitMQ application is installed via the system package manager and configured through several steps:

1. System Update: The apt cache is updated to ensure the latest available packages are used.

2. Environment Configuration: A configuration file /etc/rabbitmq/rabbitmq-env.conf is created to pin the RabbitMQ node name to localhost. This ensures stable communication within the server environment.

3. Package Installation: The rabbitmq-server package is installed via apt.

4. Plugin Activation: The rabbitmq_management plugin is enabled to allow access to the web-based management interface.

5. Service Configuration:

6. A configuration file /etc/rabbitmq/rabbitmq.conf is created to restrict the management listener to the local loopback interface (127.0.0.1) on port 15672.

7. The RabbitMQ service is enabled and started via the system service manager.

8. User and Virtual Host Setup:

9. An administrative user is created with administrator privileges.

10. A default virtual host (/) is configured, and the admin user is granted full permissions over it.

Access Rights and Security¶

• Management Interface: The management interface is restricted to 127.0.0.1 (localhost) at the application level, meaning it cannot be accessed directly from the internet via port 15672.

• Proxy Access: External access is provided through an Nginx proxy running in a Docker container, which handles SSL termination and forwards requests to the local RabbitMQ service.

• Permissions: The administrative user is granted full permissions (.* for configuration, .* for write, and .* for read) on the default virtual host.

Databases¶

RabbitMQ does not use an external database; it manages its own internal state and message queues within its service process.

Docker Containers and Their Deployment¶

The deployment includes one application-related container used to manage SSL certificates and reverse proxying:

Nginx Proxy Container

• Image: jonasal/nginx-certbot:latest

• Ports: Uses host network mode (mapping directly to host ports).

• Volumes:

• nginx_secrets:/etc/letsencrypt (External volume for SSL certificates)

• /data/nginx/user_conf.d:/etc/nginx/user_conf.d (Configuration files)

• Environment Variables:

• [email protected]

• Restart Policy: unless-stopped

Application Update Instructions¶

To update the RabbitMQ application, perform the following steps:

1. Update the system package list and upgrade the rabbitmq-server package using the package manager:

   apt update && apt install --only-upgrade rabbitmq-server
   

2. If changes are made to the Docker proxy configuration, restart the Nginx container:

   cd /root/nginx && docker compose up -d
   

Location of configuration files and data¶

• RabbitMQ Environment Config: /etc/rabbitmq/rabbitmq-env.conf

• RabbitMQ Main Config: /etc/rabbitmq/rabbitmq.conf

• Nginx Proxy Configs: /data/nginx/user_conf.d/

• SSL Certificates: Managed via the nginx_secrets Docker volume.

Available ports for connection¶