[web] KATLAS server

SSH

• Staging

  • rosrlkatlas1.mdanderson.edu

  • 10.68.4.119

• Production

  • roprlkatlas1.mdanderson.edu

  • 10.68.3.119

To connect

ssh 10.68.4.119  # staging
ssh 10.68.3.119  # production

Service Unit

vim /etc/systemd/system/fasthtml.service with:

[Unit]
Description=FastHTML KATLAS Application
After=network.target
OnFailure=fasthtml-alert@%n.service

[Service]
Type=simple
User=icai
WorkingDirectory=/home/icai/katlas-web
ExecStart=/usr/local/bin/uv run uvicorn main:app --host 127.0.0.1 --port 8000 --workers 6
Environment=UV_PROJECT_ENV=1
LimitNOFILE=65535
ExecStopPost=/usr/local/bin/fasthtml_alert.sh
Restart=on-failure
RestartSec=5

[Install]
WantedBy=multi-user.target

第一次新建enable它

sudo systemctl daemon-reload
sudo systemctl enable --now fasthtml
sudo systemctl start fasthtml

修改之后 reload

sudo systemctl daemon-reload
sudo systemctl enable --now fasthtml
sudo systemctl start fasthtml

查看status

sudo systemctl status fasthtml

查看日志

sudo journalctl -u fasthtml -f

查看网络是否accessible （127.0.0.1和 0.0.0.0 的任何人访问不同，类似 local host，只能本地访问，所以只能用 curl,网页的话不会显示。想要chrome 网页显示，用 0000）

curl http://127.0.0.1:8000

Nginx

把port push到域名上

Enable Nginx

sudo yum install nginx -y 
sudo systemctl enable nginx 
sudo systemctl start nginx

Change nginx file

sudo vim /etc/nginx/conf.d/fasthtml.conf

server {
    listen 80;
    server_name katlas.mdanderson.org;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name Katlas.mdanderson.org;

    ssl_certificate /etc/nginx/ssl/katlas_cert.pem;
    ssl_certificate_key /etc/nginx/ssl/Katlas.key;
   #  ssl_trusted_certificate /etc/nginx/ssl/katlas_chain.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
	proxy_set_header X-Forwarded-Proto $scheme;
    }
}

重启nginx

sudo nginx -t
sudo systemctl restart nginx

设置firewall

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

HTTPS

用production server 生成CSR

openssl req -new -newkey rsa:2048 -nodes -keyout Katlas.key -out Katlas.csr

填入信息

Country Name (2 letter code) [XX]: US
State or Province Name (full name) [Default]: Texas
Locality Name (e.g., city) [Default]: Houston
Organization Name (e.g., company) [Default]: MD Anderson
Organizational Unit Name (e.g., department) [Default]: IT
Common Name (e.g., your domain) [Default]: Katlas.mdanderson.org
Email Address [Default]: your-email@example.com

会有一个.csr 和 .key文件。

打开本机的 terminal（不是 ssh上），scp这两个文件到local

scp username@your-server-ip:/path/to/Katlas.csr ~/Downloads

提交csr文件到IT，获得一些certificates，下载Certificate (w/ issuer after)

check .key秘钥和certificate是否match

openssl x509 -noout -modulus -in org.pem| openssl md5
openssl rsa -noout -modulus -in Katlas.key | openssl md5

之后scp certificate 到 user@ip_server，这里是

scp katlas_mdanderson_org.pem icai@10.68.3.119:katlas_cert.pem   

创建装它们的文件夹

sudo mkdir -p /etc/nginx/ssl
sudo mv katlas_cert.pem /etc/nginx/ssl/
sudo mv Katlas.key /etc/nginx/ssl/

如果后面报错，也有可能文件权限没给全

ls -l /etc/nginx/ssl/Katlas.key
sudo chown root:nginx /etc/nginx/ssl/Katlas.key
sudo chmod 640 /etc/nginx/ssl/Katlas.key

然后sudo nano /etc/nginx/conf.d/fasthtml.conf

server {
    listen 80;
    server_name katlas.mdanderson.org;
    return 301 https://$host$request_uri;  # Redirect HTTP to HTTPS
}

server {
    listen 443 ssl;
    server_name katlas.mdanderson.org;

    ssl_certificate /etc/nginx/ssl/katlas_cert.pem;
    ssl_certificate_key /etc/nginx/ssl/Katlas.key;
    # ssl_trusted_certificate /etc/nginx/ssl/katlas_chain.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;
    ssl_prefer_server_ciphers on;
    ssl_session_cache shared:SSL:10m;
    ssl_session_timeout 10m;

    location / {
        proxy_pass http://127.0.0.1:8000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

重启

sudo nginx -t
sudo systemctl restart nginx

设置firewall

sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload

最后查看

curl https://katlas.mdanderson.org

每年certificate更新，都需要重新设置。

日志查询

# 1. 实时看 nginx 错误
sudo tail -f /var/log/nginx/error.log

# 2. 实时看访问
sudo tail -f /var/log/nginx/access.log

# 3. 看 FastHTML 后端
sudo journalctl -u fasthtml -f

# 4. TLS 验证
curl -Iv https://webaddress.org