frauzufall/Nightscout on DigitalOcean Server.md

## Nightscout on DigitalOcean Server.md

      
    Raw
  

              Nightscout on DigitalOcean Server.md
            
          
    Installing Nightscout on DigitalOcean Server

Why?


You have full SSH access to your server
Creating a server takes a minute
You can choose from various places on earth where the server should be located
You can make a backup / snapshot of the server in order to delete and later restore it (saves money if you don't need it for a while)
You pay per hour, the $5 / month version should be sufficient
Loads of documentation on how to install things
Control and track the server via the DigitalOcean control panel website

Step-by-Step

Create Droplet


Sign up or login at DigitalOcean
Click Create > Droplets
Under Choose an image, select the Tab One-click apps and click on MongoDB 3.4.7 on 16.04
Under Choose a size, the smallest 5$ version should be fine. But I only installed it and have not used it for long, so I don't know if this is sufficient for a long time.
The rest is up to you. Click Create to finish the process.

Login to your Droplet

Open a Terminal or whatever you use to get SSH access to a Server.
Use the provided Login data you got sent via Mail to connect to the Droplet (I'll use 23.456.789.123 as a replacement for the actual IP of your Droplet):
ssh root@123.456.789.123
// enter password when asked for it

Setup MongoDB

MongoDB is already installed, but has to beconfigured to be (a) secured and (b) provide the database for Nightscout.
Secure MongoDB (src)

mongo --port 27017

You should have entered the mongo shell. We now create an admin user, remember what you picked for ADMIN_NAME and ADMIN_PASSWORD. Type the following (just press Enter before inserting the next line, copy-paste should work as well):
use admin
db.createUser(
  {
    user: "ADMIN_NAME",
    pwd: "ADMIN_PASSWORD",
    roles: [ { role: "userAdminAnyDatabase", db: "admin" } ]
  }
)

The shell should return this code and Successfully added user.
Exit the Mongo shell (STRG+C) and type:
sudo nano /etc/mongod.conf

Find the line where it says:
#security:

remove the # and change it to
security:
  authorization: "enabled"

(Save and exit a file that you opened with nano by STRG+O, Enter, STRG+X)
Restart Mongo:
sudo service mongod restart

Create database for Nightscout (src)

Now we log back into the Mongo shell as admin and create our Nightscout database where MONGO_NS_DB is the name for the database we create, MONGO_NS_USER is the user who can access this database and MONGO_NS_PASSWORD is his password:
mongo -u ADMIN_NAME -p --authenticationDatabase admin
// enter ADMIN_PASSWORD

In the Mongo shell enter the following:
use MONGO_NS_DB
db.createUser(
  {
    user: "MONGO_NS_USER",
    pwd: "MONGO_NS_PASSWORD",
    roles: [
       { role: "readWrite", db: "MONGO_NS_DB" }
    ]
  }
)

The shell should return Successfully added user. Exit the Mongo shell again via CTRL+C.
Login as the user you just created:
mongo -u MONGO_NS_USER -p --authenticationDatabase MONGO_NS_DB
// enter MONGO_NS_PASSWORD

In the Mongo shell enter the following:
use MONGO_NS_DB
db.createCollection("entries")

It should return { "ok" : 1 }. Exit the Mongo shell via CTRL+C.
Install Nightscout

Install nodejs:
curl -sL https://deb.nodesource.com/setup_6.x | sudo -E bash -
sudo apt-get install nodejs

Clone Nightscout and checkout dev (optional):
git clone https://github.com/nightscout/cgm-remote-monitor.git
cd cgm-remote-monitor
git checkout dev

Now install Nightscout:
npm install

If you chose the $5/month plan for the Droplet, this will possibly fail with the message killed. The reason is missing RAM. One way to avoid this is to add a swap buffer to the server (follow this How-To), but since DigitalOcean is using SSDs, they ask you to not use swap and rather update your plan. We can do that temporarily just to install Nightscout.

via SSH, type shutdown now to turn off the Droplet
On the DigitalOcean website, go to Droplets
Open your Nightscout Droplet
Go to Resize (menu on the left side)
Click on the $10 plan and wait until the process is done
On the top right corner, there is a slider saying Off, click on the slider to turn the Droplet on
Login again via SSH and repeat these steps:

cd cgm-remote-monitor
npm install

Afterwards you can turn the Droplet off again, go back to the DigitalOcean site and revert the plan (select the $5 plan, turn the Droplet on, reconnect via SSH).
You can also add swap and later remove it or keep it, follow the guide linked above.
Configure

Edit the config file:
nano my.env

Insert the following (this is specific to what you want to do, this is my config to use it with OpenAPS):
MONGO_CONNECTION=mongodb://MONGO_NS_USER:MONGO_NS_PASSWORD@127.0.0.1:27017/MONGO_NS_DB
DISPLAY_UNITS=mmol
BASE_URL=http://123.456.789.123:1337
DEVICESTATUS_ADVANCED="true"
mongo_collection="entries"
API_SECRET=NIGHTSCOUT_API_SECRET
ENABLE=careportal%20openaps%20iob%20bwp%20sage%20cage%20basal%20pump%20maker

NIGHTSCOUT_API_SECRET is something long you can pick yourself.
The BASE_URL consists of the Droplet IP and the Port 1337 on which the Nightscout app runs (= make sure to attach :1337 to your IP there).
Save and close again (STRG+ O, Enter, STRG+ X).
Startup

The following steps executed via SSH make Nightscout start and also restart every time the server reboots.
sudo npm install pm2 -g
sudo env PATH=$PATH:/usr/local/bin pm2 startup -u root
npm update-buster
node bin/generateCacheBuster.js >tmp/cacheBusterToken
npm run-script q
sudo ufw allow 1337
env $(cat my.env) PORT=1337 node server.js
pm2 start server

Nightscout can now be started, stopped and restarted like this (you don't have to do this now):
pm2 start server
pm2 stop server
pm2 restart server

Test Nightscout

You should now be able to use Nightscout. This is the URL (same as BASE_URL in my.env):
http://123.456.789.123:1337

Setup secure connection (SSL / HTTPS) (src1, src2)

Since it is very recommended to not use HTTP, but HTTPS for your Nightscout instance, I add the steps to get a HTTPS address. You need a domain for this - domains are only a few dollars a year - or you use a subdomain of a domain you already own. This is what I did. To attach the domain to your Droplet, follow the DigitalOcean guides on How to setup Domain, How to setup a subdomain, or How to add Domains from common registrars to Droplet.
Test if Nightscout already works with your domain MYDOMAIN.COM (unsecured):
http://MYDOMAIN.COM:1377

To secure the site, install nginx:
sudo add-apt-repository ppa:certbot/certbot
sudo apt-get update
sudo apt-get install python-certbot-nginx

Configure nginx to use your domain:
sudo nano /etc/nginx/sites-available/default

This is how the file should look:
server {
    listen 80;

    server_name MYDOMAIN.COM;

    location / {
        proxy_pass http://127.0.0.1:1337;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
    }
}

Test if the configuration file is valid via sudo nginx -t. Afterwards, restart nginx:
sudo service nginx restart

.. and configure the firewall ufw to open the neccessary ports (use sudo ufw app list to check that nginx is visible to ufw as an app):
sudo ufw allow 'Nginx Full'
sudo ufw delete allow 'Nginx HTTP'
sudo ufw delete allow 80
sudo service nginx restart

Obtaining an SSL Certificate with this command (it will ask a few question you have to answer):
sudo certbot --nginx -d MYDOMAIN.COM

improve SSL security by generating a strong Diffie-Hellman group (src):
sudo openssl dhparam -out /etc/ssl/certs/dhparam.pem 2048

Make sure certbot takes care of renewing your certificate:
sudo certbot renew --dry-run

Restart the service:
sudo service nginx restart

You can check how secure your site is via https://www.ssllabs.com/ssltest/index.html.
Nightscout should now be accessible via
https://MYDOMAIN.COM