# arches-via-docker
SPRPCB es un desarrollo de [ArchesProject](https://www.archesproject.org/) empleando el modelo de implementación de [OpenContext](https://github.com/opencontext/arches-via-docker)


# Implementación en servidor web público Arches versión 7.6.x

El propósito principal de este repositorio es desplegar el sistema SPRPCB en el servidor del Plan Moxos. Por el momento solo está disponible la versión de producción del sistema SPRPCB migrado de la implementación de la nube de ENTEL.

En un tiempo breve se habilitará una actualización para implementar una versión de desarrollo en la última versión de ArchesProject
   ```bash
   git checkout origin/pmoxos-local
   ```

# Nginx y Let’s Encrypt con Docker Compose

Este enfoque obtiene y renueva automáticamente los certificados TLS [Let's Encrypt](https://letsencrypt.org/) y configura HTTPS en Nginx para su dominio utilizando docker compose.

La idea es simple. Hay 3 contenedores que trabajan así:

* Nginx, generates self-signed "dummy" certificates to pass ACME challenge for obtaining Let's Encrypt certificates
* Certbot - for obtaining and renewing certificates, waits for Nginx to become ready and obtains certificates
* Cron - for triggering certificates renewal once a day, triggers Certbot to try to renew certificates and Nginx to reload configuration on a daily basis
* The Nginx container uses updates symbolic links that point to either "dummy" certificates or Let's Encrypt certificates.

# Personalización 1: Agregar webapp adicional
Utilizando la función proxy_pass de la aplicación de nginx, se agrega servidores adicionales para complementar el proyecto con aplicaciones web (dominios) adicionales: Secuencia del procedimiento:

* Agregar el certificado SSL/TLS correspondiente a la aplicación adicional. Ej. `webapp1.dominio.com`
``` comando docker compose

```
* Crear el archivo de configuración [docker_compose_dir]/nginx/webapp1.conf
```
server {
    listen       443 ssl;

    server_name webapp1.dominio.com;
    ssl_certificate     /etc/letsencrypt/live/webapp1.dominio.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/webapp1.dominio.com/privkey.pem;

    location / {
        proxy_pass http://[IP_Local]:[Puerto]/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

}
```
* Modificar el archivo [docker_compose_dir]/nginx/Dockerfile
```diff
...
COPY default.conf /etc/nginx/conf.d/default.conf
+ COPY webapp1.conf /etc/nginx/conf.d/webapp1.conf # Línea añadida
COPY options-ssl-nginx.conf /etc/nginx/
...
```
# The directories and files
The following lists some information about the contents of this repo and how they fit together:

* `docker-compose.yml`
* `.env` - specifies `COMPOSE_PROJECT_NAME` to make container names independent from the base directory name. specifies project configuration, e.g. domain names, emails, database connection details, etc. This file contains sensitive information.
* `arches/`
    * `Dockerfile`
    * `arches_data` - A directory on your host machine that gets attached to the Arches container. This makes it convenient to pass data (like packages or exports) in and out of your Arches container.
    * `conf.d/` - A directory of Supervisord configurations for the celery worker and celery beat processes. This gets copied into the Arches container.
    * `celery.py` - Editable file if you want to modify your Arches project use of celery
    * `arches_proj-supervisor.conf` - Supervisord configurations for the celery worker and celery beat processes
    * `entrypoint.sh` - entrypoint script. This has some handy utility functions for some routine administration of the Arches container.
    * `settings_local.py` - Editable python file to define project specific settings for your Arches instance. Many of the environment variables that you assign in your `.env` file
    * `settings_local.py` - Editable python file configuring URLs in your Arches instance
* `certbot/`
    * `Dockerfile`
    * `certbot.sh` - entrypoint script
* `cron/`
    * `Dockerfile`
    * `renew_certs.sh` - script executed on a daily basis to try to renew certificates
* `html/` - directory mounted as `root` for Nginx
    * `index.html`
* `nginx/`
    * `Dockerfile`
    * `nginx.sh` - entrypoint script. This script will update where symbolic links will resolve (either to the dummy self-assigned certificates or to the Let's Encrypt obtained certificates)
    * `hsts.conf` - HTTP Strict Transport Security (HSTS) policy
    * `options-ssl-nginx.conf` - SSL related configurations
    * `default.conf` - Nginx configuration for your domain. Contains a configuration to get A+ rating at [SSL Server Test](https://www.ssllabs.com/ssltest/). This configuration also asks Nginx to gzip compress certain text-based static files (especially CSS and Javascript) which should help with performance. This config uses symbolic links to specify the path to SSL certificates.
    * `default.conf` - Nginx server configuration. It loads the Perl language module to simplify passing environment variables to your Nginx domain configuration.
* `webpack/`
    * `Dockerfile`
    * `webpack_entrypoint.sh` - The `webpack` container is a minimalist container that invokes a docker command on the `arches` container. This command prepares static assets for the Arches frontend by running webpack and collectstatic.

To adapt the example to your domain names you need to change only `.env`:

```properties
DOMAINS=teach-with-arches.org
CERTBOT_EMAILS=info@teach-with-arches.org info@teach2.with.arches.org
CERTBOT_TEST_CERT=0
CERTBOT_RSA_KEY_SIZE=4096
```

Configuration parameters:

* `DOMAINS` - a space separated list of domains to manage certificates for
* `CERTBOT_EMAILS` - a space separated list of email for corresponding domains. If not specified, certificates will be obtained with `--register-unsafely-without-email`
* `CERTBOT_TEST_CERT` - use Let's Encrypt staging server (`--test-cert`)

Let's Encrypt has rate limits. So, while testing it's better to use staging server by setting `CERTBOT_TEST_CERT=1` (default value).
When you are ready to use production Let's Encrypt server, set `CERTBOT_TEST_CERT=0`.

## Prerequisites

1. [Docker](https://docs.docker.com/engine/install/) and [Docker Compose](https://docs.docker.com/compose/install/) are installed.
2. You have a domain name
3. You have a server with a publicly routable IP address
4. You have cloned this repository
   ```bash
   git clone https://github.com/opencontext/arches-via-docker.git
   ```

### Note:
This approach will setup the most current stable version of Arches (now v7.6.x). If you want to deploy Arches version 6 (specifically stable version 6.2), please switch to the `v6` branch of this repo, with:
   ```bash
   git checkout origin/v6
   ```


## Step 0 - Point your domain to server with DNS A records

For all domain names configure DNS A records to point to a server where Docker containers will be running.

## Step 1 - Edit domain names, emails and other variables in the configuration

Specify you domain names and contact emails for these domains in the `edit_dot_env` file and then save this file as `.env`:

First make an `.env` file
```bash
cp edit_dot_env .env
```

Now edit `.env` file to change your settings.
```bash
nano .env
```

Here are properties to change based on your specific Web domain. Please note, for now this only supports one domain specified by the `DOMAINS` variable (the plural is asperational..).

```properties
DOMAINS=teach-with-arches.org
CERTBOT_EMAILS=info@teach-with-arches.org
```

### Note: Non-Standard Port (8004, not 8000)
Below are properties to edit to change how Arches deploy. If you want to deploy this on your own machine (localhost), setting `DJANGO_DEBUG=True` is useful to see and diagnose useful error messages in the Arches Django application, but be sure to set `DJANGO_DEBUG=False` for deployments on the public Web. *NOTE* if you run this on your localhost, this Docker build will currently make your Arches application available to your browser via [http://127.0.0.1:8004/](http://127.0.0.1:8004/) *on port 8004*, not the usual 8000. This nonstandard port was chosen in case your local host has other applications already running on port 8000.


```properties
DJANGO_MODE=DEV
DJANGO_DEBUG=False
...
BUILD_PRODUCTION=False
```



## Step 2 - Create named Docker volumes for dummy and Let's Encrypt TLS certificates

```bash
docker volume create --name=logs_nginx
docker volume create --name=nginx_ssl
docker volume create --name=certbot_certs
docker volume create --name=arches_certbot
```

## Step 3 - Use Valid Let's Encrypt Certificates
Configure to use production Let's Encrypt server in `.env`:

```properties
CERTBOT_TEST_CERT=0
```

## Step 4 - Build images and start containers

```bash
docker compose up --build
```

## Config Changes? - Replace volumes etc to implement changes

Stop the containers:

```bash
docker compose down
```

Re-create the volume for Let's Encrypt certificates:

```bash
docker volume rm certbot_certs
docker volume rm arches_certbot
docker volume create --name=certbot_certs
docker volume create --name=arches_certbot
```

Start the containers:

```bash
docker compose up
```

## How to Make Arches (administrative) Management Commands
Besides setting up HTTPS and Nginx, this repo deploys an instance of Arches. Currently this will setup an "empty" Arches instance. You'll need to load it with your own data by loading a package or some other approach. Once you deploy Arches, you can use normal Arches management commands as so:

```bash
docker exec -it arches python3 manage.py [Arches management commands and arguments here]
```



## NOTE
You may run into weirdness permissions issues restarting the docker container. I solved it with:
```
sudo chmod 666 /var/run/docker.sock

```


# BACKGROUND AND CREDIT
This repo will hopefully streamline deployment of Arches for use on the Web. Eventually, we hope to use this as the basis for deploying instances of Arches for use in archaeological teaching and learning applications.

None of this code is very original. This repo started by forking:
https://github.com/evgeniy-khist/letsencrypt-docker-compose

Some elements of this repo are also derived from:
https://github.com/opencontext/oc-docker

and

https://github.com/archesproject/arches-for-science-prj

and

https://github.com/archesproject/arches-dependency-containers

and finally

https://github.com/archesproject/arches-her