Ansible + rails + letsencrypt

First, install nginx

roles/nginx/tasks/main.yml

```yml
- name: Install nginx
  apt:
    name: nginx
    state: latest
- name: Disable default nginx config
  file:
    path: /etc/nginx/sites-enabled/default
    state: absent
  notify:
    - Restart nginx
```

roles/nginx/handlers/main.yml


```yml
- name: Restart nginx
  service: name=nginx state=restarted
```

Then, install LetsEncrypt

roles/letsencrypt/tasks/main.yml

```yml
- name: Generate dhparams file
  shell: openssl dhparam -out {{ dhparam_pem_path }} 2048
  args:
    creates: "{{ dhparam_pem_path }}"
- name: Update apt cache
  apt: update_cache=yes cache_valid_time=86400
- name: Install depends
  apt: name={{ item }} state=latest
  with_items:
    - python
    - python-dev
    - gcc
    - dialog
    - libaugeas0
    - augeas-lenses
    - libssl-dev
    - libffi-dev
    - ca-certificates
    - python-pip
    - python-virtualenv
    - git
    - libpython-dev
    - zlib1g-dev
- name: Lets Encrypt client
  git: dest=/opt/certbot clone=yes repo=https://github.com/certbot/certbot force=yes
# Auto-renew certificates and reload nginx
- name: Add crontab to renew certificates
  cron: minute="30" hour="2" weekday="1" job="/opt/certbot/certbot-auto renew >> /var/log/le-renew.log"
- name: Add crontab to reload server
  cron: minute="35" hour="2" weekday="1" job="/etc/init.d/nginx reload"
```


Last, configure service

roles/service/tasks/main.yml

```yml
- name: Add http nginx configuration
  template:
    src: templates/http.conf.j2
    dest: /etc/nginx/sites-available/{{ service_name }}.http.conf
  notify:
    - Restart nginx
- name: Enable nginx config
  file:
    src: /etc/nginx/sites-available/{{ service_name }}.http.conf
    dest: /etc/nginx/sites-enabled/{{ service_name }}.http.conf
    state: link
  notify:
    - Restart nginx
- name: Create letsencrypt certificate
  shell: ./certbot-auto certonly --webroot --email {{ service_admin_email }} --agree-tos --webroot-path=/usr/share/nginx/html -d {{ service_host }};
  args:
    chdir: /opt/certbot
- name: Add https nginx configuration
  template:
    src: templates/https.conf.j2
    dest: /etc/nginx/sites-available/{{ service_name }}.https.conf
  notify:
    - Restart nginx
- name: Add external https nginx symlink
  file:
    src: /etc/nginx/sites-available/{{ service_name }}.https.conf
    dest: /etc/nginx/sites-enabled/{{ service_name }}.https
    state: link
  notify:
    - Restart nginx
```

with nginx http template, this will redirect all http request into https


roles/service/templates/http.conf.j2

```
server {
  listen 80;
  server_name {{ service_host }};

  root /usr/share/nginx/html;

  index index.html index.htm index.nginx-debian.html;

  location ~ /.well-known {
    allow all;
  }

  location / {
    return 301 https://$host$request_uri;
  }
}
```

also add a https template for rails


roles/service/templates/https.conf.j2

```
upstream app {
  server unix:///home/deploy/apps/waynechu_blog/shared/tmp/sockets/puma.sock fail_timeout=0;
}

server {
  listen 443 ssl;
  server_name {{ service_host }};

  root /home/deploy/apps/{{ service_name }}/current/public;

  try_files $uri/index.html $uri @app;

  ssl_certificate {{ letsencrypt_ssl_dir }}/{{ service_host }}/fullchain.pem;
  ssl_certificate_key {{ letsencrypt_ssl_dir }}/{{ service_host }}/privkey.pem;

  ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
  ssl_prefer_server_ciphers on;
  ssl_dhparam {{ dhparam_pem_path }};
  ssl_ciphers 'ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-AES256-GCM-SHA384:DHE-RSA-AES128-GCM-SHA256:DHE-DSS-AES128-GCM-SHA256:kEDH+AESGCM:ECDHE-RSA-AES128-SHA256:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA:ECDHE-ECDSA-AES128-SHA:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA:ECDHE-ECDSA-AES256-SHA:DHE-RSA-AES128-SHA256:DHE-RSA-AES128-SHA:DHE-DSS-AES128-SHA256:DHE-RSA-AES256-SHA256:DHE-DSS-AES256-SHA:DHE-RSA-AES256-SHA:AES128-GCM-SHA256:AES256-GCM-SHA384:AES128-SHA256:AES256-SHA256:AES128-SHA:AES256-SHA:AES:CAMELLIA:DES-CBC3-SHA:!aNULL:!eNULL:!EXPORT:!DES:!RC4:!MD5:!PSK:!aECDH:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA';
  ssl_session_timeout 1d;
  ssl_session_cache shared:SSL:50m;
  ssl_stapling on;
  ssl_stapling_verify on;

  location @app {
    proxy_pass http://app;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_set_header Host $http_host;
    proxy_redirect off;
  }

  error_page 500 502 503 504 /500.html;
  client_max_body_size 10M;
  keepalive_timeout 10;
}
```

roles/service/handlers/main.yml


```yml
- name: Restart nginx
  service: name=nginx state=restarted
```


At the last, set your own vars

vars/main.yml

```yml
service_host: "example.cc"
service_name: "example"
service_admin_email: "example@gmail.com"
letsencrypt_ssl_dir: "/etc/letsencrypt/live"
dhparam_pem_path: "/home/deploy/dhparams.pem"
```


That's it, now you have a https rails web



References:

https://medium.com/@gmaliar/generating-lets-encrypt-certificates-for-nginx-using-ansible-9fd27b90993a
https://gist.github.com/mattiaslundberg/ba214a35060d3c8603e9b1ec8627d349
https://docs.ansible.com/ansible/2.5/modules/letsencrypt_module.html
https://gorails.com/guides/free-ssl-with-rails-and-nginx-using-let-s-encrypt
https://blog.frost.tw/posts/2018/05/28/Getting-started-deploy-your-Ruby-on-Rails-Part-8/

How to keep forked git repo up to dated?

### 1. Clone your fork:

    git clone git@github.com:YOUR-USERNAME/YOUR-FORKED-REPO.git

### 2. Add remote from original repository in your forked repository:

    cd into/cloned/fork-repo
    git remote add upstream git://github.com/ORIGINAL-DEV-USERNAME/REPO-YOU-FORKED-FROM.git
    git fetch upstream

### 3. Updating your fork from original repo to keep up with their changes:

    git pull upstream master


https://gist.github.com/CristinaSolana/1885435

setup ubuntu with ansible for rails deployment

https://semaphoreci.com/community/tutorials/how-to-deploy-rails-applications-with-ansible-capistrano-and-semaphore

Vue + Webpacker + Rails

https://mkdev.me/en/posts/rails-5-vue-js-how-to-stop-worrying-and-love-the-frontend

Suspender 用 1.46.0 可以使用 rails 5.1.6

ThoughtBot 的 rails bootstraper，現在最新版 default 使用了 rails 5.2 很煩，因為我不喜歡 5.2 的 credential

要使用 5.1.x 版本的話要用 v1.46.0 版本的 Suspender，但 1.46.0 是用 Ruby 版本 2.5.0

所以確切方法是


```
rvm install 2.5.0
rvm use 2.5.0
gem install suspenders -v 1.46.0
suspender your_project_name
```

然後再進去 project 裡面把 Gemfile 和 .ruby-version 裡的 ruby version 改成2.5.1

https://github.com/thoughtbot/suspenders/tree/v1.46.0

skip document installation when gem install

https://stackoverflow.com/questions/1381725/how-to-make-no-ri-no-rdoc-the-default-for-gem-install

1. 加 ~/.gemrc

```
gem: --no-document
```

done

github issue 和 pr 帶不同 params 就有不同功能

潮潮的，可以指定 title, labels, template 和 assignees 之類的


https://help.github.com/articles/about-automation-for-issues-and-pull-requests-with-query-parameters/

使用 Vagrant 練習 chef-solo deployment

每次都自己調 server 太煩了，用 chef-solo 調一次以後一直套用比較方便，可以用 Vagrant 練習會快一點

先安裝 VirtualBox 和 Vagrant

https://www.virtualbox.org/wiki/Downloads
https://www.vagrantup.com/downloads.html

Ubuntu 16.04 的 Vagrant box (Vagrant box 就是包好的環境的意思)

https://app.vagrantup.com/ubuntu/boxes/xenial64

```
➜  Codes mkdir vagrant-test
➜  Codes cd vagrant-test
➜  vagrant-test vagrant init
```

在 Vagrantfile 裡設定

```
Vagrant.configure("2") do |config|
  config.vm.box = "ubuntu/xenial64"
end
```

然後開啟 Vagrant

```
vagrant up
```

然後就可以 ssh 進去玩了

vagrant ssh

//關閉VM
$ vagrant halt

//暫停VM
$ vagrant suspend

//恢復暫停的VM
$ vagrant resume

//重啓VM
$ vagrant reload


## Chef solo

首先要 init 一個 chef-solo 的 project


檢查 vagrant 的 ssh-config

```
➜  vagrant-test git:(master) ✗ vagrant ssh-config
Host default
  HostName 127.0.0.1
  User vagrant
  Port 2222
  UserKnownHostsFile /dev/null
  StrictHostKeyChecking no
  PasswordAuthentication no
  IdentityFile /Users/wayne/Codes/vagrant-test/.vagrant/machines/default/virtualbox/private_key
  IdentitiesOnly yes
  LogLevel FATAL
```

PasswordAuthentication 被設為 no 了所以要嘛去把 local 的 ssh key 加到 vagrant 裡要嘛就把 password 設成 yes，預設 password 是 vagrant


我個人是很懶所以就這樣：

```
ssh-copy-id -i ~/.ssh/id_rsa.pub -p 2222 vagrant@localhost
```
但其實還是有一些其他做法可以參考：

https://github.com/puphpet/puphpet/issues/1253



https://blog.vvtitan.com/2015/10/%E4%BD%BF%E7%94%A8vagrant%E7%B7%B4%E7%BF%92%E4%BD%88%E7%BD%B2%E4%BC%BA%E6%9C%8D%E5%99%A8/
https://medium.com/@brianmayrose/using-vagrant-on-ubuntu-16-04-to-create-a-virtual-machine-c767f6e2d876
https://gist.github.com/nicholasklick/af98d5814d5b8ba6d844

想在 server 上持續性地跑個簡單的 script

screen


進到 screen

```sh
screen
```

Detach (離開 screen, 但是讓 screen 裡面的東西繼續執行)

```
ctrl+a d
```


Re-attach (重回 screen)


```sh
screen -r
```

如果有多個就先 screen -ls 找到 screen id 然後 `screen -r screen_id`, ex:

```sh
pungki@mint ~ $ screen -ls
There are screens on:
7849.pts-0.mint (10/06/2013 01:50:45 PM)        (Detached)
5561.pts-0.mint (10/06/2013 11:12:05 AM)        (Detached)
2 Sockets in /var/run/screen/S-pungki
```

```sh
pungki@mint ~ $ screen -r 7849
```



https://www.tecmint.com/screen-command-examples-to-manage-linux-terminals/
https://stackoverflow.com/questions/4797050/how-to-run-process-as-background-and-never-die

find out bin/setup is quite helpful

https://github.com/ajkamel/cover/blob/master/bin/setup

chmod 改變檔案權限

Linux檔案的基本權限就有九個，分別是owner/group/others三種身份各有自己的read/write/execute權限， 先複習一下剛剛上面提到的資料：檔案的權限字元為：『-rwxrwxrwx』， 這九個權限是三個三個一組的！其中，我們可以使用數字來代表各個權限，各權限的分數對照表如下：

r:4
w:2
x:1

每種身份(owner/group/others)各自的三個權限(r/w/x)分數是需要累加的，例如當權限為： [-rwxrwx---] 分數則是：

owner = rwx = 4+2+1 = 7
group = rwx = 4+2+1 = 7
others= --- = 0+0+0 = 0

chmod 777 index.js


http://linux.vbird.org/linux_basic/0210filepermission.php

http://www.macinstruct.com/node/415

Map keyboard mapping software

https://github.com/tekezo/Karabiner-Elements

git ignore globally

➜  ~ touch . gitignore_global
➜  ~ vim . gitignore_global
➜  ~ git config --global core.excludesfile '~/.gitignore_global'


https://gist.github.com/subfuzion/db7f57fff2fb6998a16c

讓 VSCode 識別 .js 成 JavascriptReact jsx 這樣才可以 autocomplete

因為上網找好幾次了很煩，註記一下


在設定裡面加上

```
{
"files.associations": {
"*.js": "javascriptreact"
}
}
```

以 rails + webpacker 為例

```
{
  "files.associations": {
    "**/app/javascript/**/*.js": "javascriptreact"
  }
}
```

https://github.com/Microsoft/vscode/issues/81

Disable 煩人的 zsh 更新檢查

```
vim ~/.zshrc
```

```
DISABLE_AUTO_UPDATE="true"
```

before the source $ZSH/oh-my-zsh.sh



reference: https://stackoverflow.com/questions/11378607/oh-my-zsh-disable-would-you-like-to-check-for-updates-prompt

Capistrano forward agent

Capistrano forward agent 可以讓我們不用把 server 上的key 加到 github 也能拉 private repo


今天遇到 permission deny 的問題，結果是因為 mac 重開機就清空了 ssh agents ，導致沒有 key 可以 forward ，要永久加到 ssh agent 裡面，要執行

```
ssh-add -K ~/.ssh/id_rsa
```

之後再 deploy 就行了

https://chodounsky.net/2015/07/27/forward-ssh-keys-for-capistrano-deploys/

Server 安裝 zsh

不能 sutocomplete 太痛苦了

```
apt-get install zsh
curl -L https://raw.github.com/robbyrussell/oh-my-zsh/master/tools/install.sh | sh
```

然後默認zsh


```
chsh -s /bin/zsh
```


遇到問題：

```
$ chsh -s /bin/zsh
You may not change the shell for 'apps'.
$ which zsh
/usr/bin/zsh
$ chsh -s /usr/bin/zsh
You may not change the shell for 'apps'.
```

切換到 root 後跑

```
$ chsh -s /usr/bin/zsh apps
```

解決

http://blog.poetries.top/2016/06/26/Ubuntu%E4%B8%8B%E5%AE%89%E8%A3%9D-Zsh-%E5%8F%8A-Oh-my-zsh/

rails console 的實用技巧

reload!

app
app.get "/movies"


helper
helper.link_to("Movies", app.movies_path)





https://pragmaticstudio.com/blog/2014/3/11/console-shortcuts-tips-tricks




另外還有最屌的，如果有裝 pry 的話，在 home 目錄下的 `.pryrc` 加上

```ruby
def me
  @me ||= User.find_by_email("wayne.5540@gmail.com")
  @me
end
```

就可以一開啟 console 直接打 `me` 找到自己了！

用 nvm 裝 nodejs

裝 nvm
curl -o- https://raw.githubusercontent.com/creationix/nvm/v0.33.5/install.sh | bash

nvm install v8.7.0

npm install pm2 -g

學習使用 tmux

tmux 搭配 vim 似乎是很好的組合，為了強迫自己使用 vim 並同時保有高效率開發，先來研究一下。

http://www.hamvocke.com/blog/a-quick-and-easy-guide-to-tmux/

更正，先學 vim 比較實際ＸＤ

tmux 比較適合長期連 ssh 或是開 rails server 之類

搭配 https://github.com/tmuxinator/tmuxinator 就可以一鍵開啟想要的東西，視窗都切割好