Deployment Overview of Web-LGSM on Server¶

Prerequisites and Basic Requirements¶

To ensure a successful deployment, the following requirements must be met:

Operating System: Debian or Ubuntu.
Privileges: Sudo access is required for initial setup and package installation.
Domain/FQDN: A domain managed by hostkey.in is required for SSL termination via Nginx.
Network Ports:
443/TCP: External HTTPS traffic.
12357/TCP: Internal backend communication (localhost).

FQDN of the final panel on the hostkey.in domain¶

The application uses a specific subdomain template for access via a web browser:

| Parameter | Value | | Prefix | web-lgsm | | Domain | hostkey.in | | Full template | web-lgsm{Server_ID_from_Invapi}.hostkey.in |

File and Directory Structure¶

The application and its components are organized as follows:

/home/mcbserver/: Home directory for the service user.
/home/mcbserver/web-lgsm/: Main directory for Web-LGSM files.
/root/nginx/: Configuration directory for the Nginx reverse proxy and Docker Compose files.
/data/nginx/user_conf.d/: Directory containing custom Nginx configuration files.
/data/nginx/nginx-certbot.env: Environment file for Certbot/Nginx container.

Application installation process¶

The installation follows a multi-step process involving system preparation, dependency installation, and service setup:

System Preparation: The system is updated via apt-get update. A dedicated user named mcbserver is created with sudo privileges for specific administrative tasks without requiring manual password entry during execution.
Dependency Installation: Several packages are installed to support the environment, including git, python3, python3-venv, jq, unzip, and various 32-bit libraries (lib32gcc-s1, lib32stdc++6) required by game servers.
LGSM Installation: The official LinuxGSM installer script is downloaded to the user's home directory, executed to create the base server environment (named mcbserver), and then removed.
Web-LGSM Installation:
The Web-LGSM repository is cloned from GitHub into /home/mcbserver/web-lgsm.
An installation script (install.sh) located in the repository is executed to configure the web interface.
Reverse Proxy Setup: A Docker container is deployed to handle SSL certificates via Certbot and act as a reverse proxy for the backend.

Access Rights and Security¶

User Isolation: The application runs under a dedicated non-root user mcbserver.
Sudo Configuration: Specific NOPASSWD rules are configured in /etc/sudoers.d/ to allow necessary system commands without interactive prompts, while maintaining strict file permissions (0440) on these configuration files.
Directory Permissions: The /tmp and /var/tmp/. directories are configured with 1777 permissions for proper temporary file handling.

Databases¶

No external database management system is explicitly installed as a standalone service in this deployment; the application relies on local data storage within the user's home directory.

Docker Containers and Their Deployment¶

The deployment utilizes one primary container to manage SSL certificates and web traffic:

Container Name	Image	Ports	Volumes	Restart Policy
`nginx`	`jonasal/nginx-certbot:latest`	Host Network Mode	`- nginx_secrets:/etc/letsencrypt` `- /data/nginx/user_conf.d:/etc/nginx/user_conf.d` `- /home:/home`	`unless-stopped`

Note: The container operates in network_mode: host to facilitate seamless communication with the local backend and SSL management.

Custom Scripts and Additional Setup¶

The following actions are performed during installation to prepare the environment:

Environment Cleanup: A dedicated temporary directory .ansible_tmp is created within the user's home folder to ensure safe execution of installation scripts.
Backend Service Creation: A systemd service unit web-lgsm.service is created to manage the Python backend. This ensures the application starts automatically on boot and restarts if it fails.

Application Update Instructions¶

To update the main Web-LGSM application, perform the following:

Navigate to the application directory:
```
cd /home/mcbserver/web-lgsm
```
Pull the latest changes from the repository or re-run the installation script as per your specific version requirements.

Location of configuration files and data¶

Web-LGSM Backend: /home/mcbserver/web-lgsm
Nginx User Configurations: /data/nginx/user_conf.d
SSL Certificates: Managed via the nginx_secrets Docker volume.

Available ports for connection¶

443 (HTTPS): Primary access port for the web panel.

Starting and Stopping the application¶

The backend service is managed via systemd:

Start the application:
```
sudo systemctl start web-lgsm.service
```
Stop the application:
```
sudo systemctl stop web-lgsm.service
```
Check status:
```
sudo systemctl status web-lgsm.service
```

Proxy Servers (Nginx, Traefik, SSL, custom domains)¶

The deployment uses an Nginx container (jonasal/nginx-certbot) to provide:

SSL Termination: Automated certificate management via Certbot.
Reverse Proxying: Routing incoming HTTPS traffic from port 443 to the internal Python backend running on 127.0.0.1:12357.