scriptremote

<!DOCTYPE html> <html> <body> <div align="right"> <a href="/">Home</a> </div> <h2> Installation On Generic Private Server </h2> This method assumes that browser or script clients that are outside the private network will access the server using an existing VPN gateway. <ol> <li> Install MEAN-stack components nodejs/npm and mongodb on the server <a href="https://nodejs.org/en">nodejs</a> <a href="https://docs.mongodb.com/master/administration/install-community">Install MongoDB Community Edition</a> Installation may require root access. If the ScriptRemote server needs to use an existing, networked MongoDB service then the procedure below needs to be slightly modified. You will need to set the <code>MONGO_URL</code> or <code>MONGO_HOST_PORT</code> environment variable (see config/env/production.js) and you may need to add MongoDB credentials to the .env file. </li> <li> Install ScriptRemote Login as a non-root user <pre> >$ cd ~ (or your preferred install location) >$ npm install scriptremote --production >$ mv node_modules/scriptremote . </pre> </li> <li> Set up credentials/secrets First set up an email forwarding account. This will be used to send security-related messages and user notifications. Rather than using an existing account, you may want to create one just for this purpose. Then copy the sample credentials file and substitue your values for the MAILER dummy values: <pr >$ cd ~/scriptremote e >$ cp credentials.env .env >$ chmod 600 .env >$ vim .env </pre> Some services are stricter than others about relaying mail. To help ensure that mail can be sent choose the same provider as expected for registered user emails, and set MAILER_FROM to the same address as MAILER_EMAIL_ID. If users will have a variety of email providers then consider using a service like mailgun. Any mailing errors will be logged to the console. If there is a problem it will probably first show up when registering the admin user below. Second, generate a random string for the session middleware. For example: <pre> >$ openssl rand -base64 32 </pre> Substitute the result for the SESSION_SECRET value in .env </li> <li> Make it possible to run node as non-root Skip this if root access is not possible <pre> sudo setcap 'cap_net_bind_service=+ep' /usr/local/bin/node </pre> </li> <li> Start the server <pre> >$ cd ~/scriptremote </pre> If root access is possible: <pre> >$ npm run production </pre> This should start the server listening on port 80. If root access is not possible: <pre> >$ export SRPORT=3000 >$ npm run production </pre> This should start the server listening on port 3000, which normally does not require root access. </li> <li> Register the admin user Connect to the server in your browser. Select Login/Register on the home screen and then Register Here on the login screen. The registration screen should display a message that the admin account is being registered. Continue the registration by entering at least an email and password, and by selecting one of the options for registration of other users. The default is to allow other users to register themselves. You can also select a timeout for idle sessions. A confirmation email should be sent to the registered address. Complete the registration by submitting the token value from the email into the form displayed when attempting to login. Return to the home page and login using the admin account. Get script credentials by selecting Settings in menu bar and then selecting Generate in the API Credentials section. The User Id and Token values will be needed to authenticate messages to the server from scripts. </li> <li> Check that the server can be reached from the private network Copy the API credentials obtained above to a test machine in the private network. Get the bash utility script <code>scriptremote/public/dist/srio.sh</code> from the local scriptremote installation. Set <code>SRSERVER</code> to the IP address and port or url of your server, by editing the script or as an environment variables. The protocol should be <code>http</code>. If there is a web proxy between the script and your server it may also be necesary to set the <code>http_proxy</code> environment variable. <pre> >$ export SRSERVER=<your-url> </pre> Create a simple test: <pre> >$ cat > test.sh #!/bin/bash . ./srio.sh SR_start ${SRUSER} ${SRTOKEN} 'myproject' 'myjob' SR_set 'msg1' 'Hello World' 'False' SR_send 'mylocation' SR_end </pre> Export the API credentials to the test script and run it: <pre> >$ export SRUSER=<your-userid> >$ export SRTOKEN=<your-token> >$ bash test.sh </pre> Check that the test message can be viewed in the browser by selecting Projects in the menu bar. </li> <li> Optional: Create non-admin user Since the admin has elevated priviledges to do things like viewing user details and registering new users, it is best for security purposes to minimize use of that account. Instead register as a normal user for actual projects. </li> <li> Optional: Enable MongoDB authentication If the ScriptRemote server is a shared system you may want to enable authentication for MongoDB. Without authentication anyone with user access to the system can also access the database. MongoDB supports elaborate authentication/authorization schemes but for simplicity the following just sets up a "root" user with all access. Create the user in the mongo shell: <pre> >$mongo > use admin > db.createUser( > { > user: "<mongo-user>", > pwd: "<mongo-password>", > roles: [ "root" ] > } >) >exit </pre> Then enable authentication in the mongo config file, which is often located at /etc/mongod.conf. Depending on the file format add either: <pre> security: authorization: enabled </pre> or <pre> auth = true </pre> Then restart mongod: <pre> >$ sudo restart mongod </pre> Check that the credentials work in the mongo shell: <pre> >$ mongo -u "mongo-user" -p "mongo-password" --authenticationDatabase "admin" </pre> Edit the ~/scriptremote/.env file to uncomment the mongo credentials and substitute your values, then restart the ScriptRemote server. </li> <li> Optional: Enable project data limits You may want to enable limits on the amount of message data that can be sent to the server, for example to help protect against scripting errors that could produce very large or very many messages. The available limits are defined in <pre>config/env/all.js</pre> Any of them may be set as environment variables or added to the .env file prior to starting the server. </li> </ol> Additional References: <a href="https://www.sitepoint.com/introduction-mean-stack">An Introduction To The MEAN Stack</a> <a href="http://meanjs.org">MEAN.JS</a> <a href="http://mean.io">MEAN.IO</a> </body> </html>