Setting Up Domain with HTTPS

Follow these steps to set up Nginx as a reverse proxy for QGato with HTTPS using Certbot.

This guide assumes you are using Debian/Ubuntu.

For more detailed or alternative Nginx setups, search online for platform-specific guides.

Also this guide never shows how to set Firewall, create users, set correct permissions etc. It's just the most basic guide to get your own QGato instance running.

---

Prerequisites

• A domain name (e.g., example.com), with A records pointing to your server IP.
• QGato running on a server (e.g., localhost:5000).
• Virtual Private Server running with public IP.

Nginx insttall

• Connect to your server and install Nginx & Certbot using thease commands:

  sudo apt update
  sudo apt install -y nginx certbot python3-certbot-nginx
  

---

Nginx Configuration

1. Create a new Nginx configuration file:

   sudo nano /etc/nginx/sites-available/qgato
   

2. Add the following configuration:

   server {
       listen 80;
       server_name example.com; # !!! Replace with your domain
   
       location / {
           proxy_pass http://localhost:5000; # !!! You need to have QGato running on this machine with port 5000, or change this to correct IP/port.
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
       }
   }
   

3. Enable the configuration:

   sudo ln -s /etc/nginx/sites-available/qgato /etc/nginx/sites-enabled/
   nginx -t && nginx -s reload
   

---

Enable HTTPS with Certbot

1. Obtain an SSL certificate for your domain:

   sudo certbot --nginx -d example.com
   

2. Update the Nginx configuration to redirect HTTP to HTTPS and listen on port 443. Edit the configuration file:

   sudo nano /etc/nginx/sites-available/qgato
   

   Add this to configuration:

   # This redirects 80 (HTTP) -> 443 (HTTPS)
   server {
       listen 80;
       server_name example.com; # You meed to change this to your domain
       return 301 https://$host$request_uri;
   }
   
   server {
       listen 443 ssl;
       server_name example.com; # Again, you need to add your domain
   
      # !!! This needs to match paths to certs generated by certbot, they should be generated automatically so don't just blindly override them.
       ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
       ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
   
       location / {
           proxy_pass http://localhost:5000; # You need to change this, so it points to QGato
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
       }
   }
   

3. Reload Nginx to apply changes:

   nginx -t && nginx -s reload
   

---

Renew SSL Certificates Automatically

Certbot should automatically sets up a cron job for certificate renewal. To ensure it works correctly:

Test the renewal process:

sudo certbot renew --dry-run

---

Final Steps

• Access QGato at: https://example.com
• Ensure Nginx and Certbot are working and that automated certificate renew is running.
• Secure the server with correct permissions, Firewall, Fail2ban etc. Securing the server is not a part of this guide, please do your own research regarding this.

That's it! Your QGato instance is now running behind Nginx with HTTPS.