How to deploy Dolpher

The files in the repository's deploy/ directory run Dolpher on a Linux server under systemd, with Caddy in front for HTTPS. They're set up for dolpher.pbbgaming.com on Ubuntu; change the host name in Caddyfile and dolpher.env for another one.

The server runs as dolpher, a system account with no login shell. Its database is /var/lib/dolpher/dolpher.db, and it listens only on 127.0.0.1:8080. Caddy takes ports 80 and 443, gets the certificate from Let's Encrypt, and redirects HTTP to HTTPS. The firewall must let 80 and 443 in.

The commands below run as root on the server, except where they say "locally".

Build

Locally, from the repository root. The binary is pure Go, so it cross-compiles without cgo:

GOOS=linux GOARCH=amd64 CGO_ENABLED=0 go build -trimpath -o tmp/dolpher-linux-amd64 ./cmd/dolpher
scp tmp/dolpher-linux-amd64 dolpher:/usr/local/bin/dolpher.new

First install

Copy the four files in deploy/ to the server, then:

install -m 0755 /usr/local/bin/dolpher.new /usr/local/bin/dolpher && rm /usr/local/bin/dolpher.new

install -d -m 0755 /etc/sysusers.d
install -m 0644 dolpher.sysusers /etc/sysusers.d/dolpher.conf
systemd-sysusers

install -d -m 0755 /etc/dolpher
install -m 0644 dolpher.env /etc/dolpher/dolpher.env
install -m 0644 dolpher.service /etc/systemd/system/dolpher.service

# The server never creates its database or directory.
install -d -o dolpher -g dolpher -m 0750 /var/lib/dolpher
runuser -u dolpher -- dolpher db init --db /var/lib/dolpher/dolpher.db

systemctl daemon-reload
systemctl enable --now dolpher

Install Caddy from its own apt repository, then the Caddyfile:

apt-get install -y curl gpg
curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/gpg.key | gpg --dearmor -o /usr/share/keyrings/caddy-stable-archive-keyring.gpg
curl -1sLf https://dl.cloudsmith.io/public/caddy/stable/debian.deb.txt > /etc/apt/sources.list.d/caddy-stable.list
chmod o+r /usr/share/keyrings/caddy-stable-archive-keyring.gpg /etc/apt/sources.list.d/caddy-stable.list
apt-get update && apt-get install -y caddy

install -m 0644 Caddyfile /etc/caddy/Caddyfile
systemctl reload caddy

The first admin

Run the CLI as dolpher, so the database stays readable by the server. It prints a single-use link; open it to set a password:

runuser -u dolpher -- dolpher invite --db /var/lib/dolpher/dolpher.db \
    --base-url https://dolpher.pbbgaming.com --admin you@example.com

Later invites and password resets can come from the admin pages.

Updating

After building and copying a new binary:

install -m 0755 /usr/local/bin/dolpher.new /usr/local/bin/dolpher && rm /usr/local/bin/dolpher.new
systemctl restart dolpher

The restart warns the players, reports draining on /health for DOLPHER_DRAIN, then stops. New migrations apply when the server opens the database. Take a backup first if the update has one.

Backups

The backup is safe while the server runs. The target directory must exist, and the file must not:

install -d -o dolpher -g dolpher -m 0750 /var/backups/dolpher
runuser -u dolpher -- dolpher db backup --db /var/lib/dolpher/dolpher.db \
    --to /var/backups/dolpher/dolpher-$(date -u +%Y%m%dT%H%M%SZ).db

Checking on it

systemctl status dolpher caddy
journalctl -u dolpher -f
curl -s -o /dev/null -w '%{http_code}\n' https://dolpher.pbbgaming.com/health