Tutorial Deploy Ignite

Deploy with Ignite

Deploy your Enferno app to production with one command. Automatic SSL, Redis, systemd services, and security hardening.

Time: ~5 minutes (plus DNS propagation)

---

What You Get

• Automatic HTTPS via Caddy (Let's Encrypt)
• Python 3.13 + uv package manager
• Redis for sessions and Celery
• systemd services with auto-restart
• UFW firewall (ports 22, 80, 443)
• Security headers (HSTS, X-Frame-Options, etc.)
• Structured JSON logging

---

Prerequisites

• Ubuntu 22.04 or 24.04 VPS
• Domain pointing to server IP
• SSH access with root privileges

---

Step 1: Point Your Domain

Add an A record in your DNS:

Type: A
Name: @ (or subdomain like "app")
Value: your.server.ip.address
TTL: 300

Wait for DNS propagation (usually 5-15 minutes).

---

Step 2: Deploy

SSH into your server and run:

curl -sSL https://raw.githubusercontent.com/level09/ignite/main/ignite.sh | sudo DOMAIN=app.example.com bash

That's it. Ignite will:

1. Install system dependencies
2. Set up Python 3.13 with uv
3. Clone your repo
4. Configure Redis
5. Set up Caddy with automatic SSL
6. Create systemd services
7. Configure firewall
8. Generate admin credentials

---

Step 3: Get Your Credentials

After deployment, credentials are saved to (username is derived from domain):

# For app.example.com, username is "app"
cat /home/app/.credentials

Contains:

• Admin email
• Admin password
• Database URL
• Secret key

---

Configuration Options

Customize the deployment:

# PostgreSQL instead of SQLite
DOMAIN=app.example.com DB=postgres ./ignite.sh

# Custom admin email
DOMAIN=app.example.com ADMIN_EMAIL=me@example.com ./ignite.sh

# Deploy a fork or different branch
DOMAIN=app.example.com REPO=youruser/enferno BRANCH=develop ./ignite.sh

# Local testing without SSL
DOMAIN=localhost SKIP_SSL=true ./ignite.sh

Variable	Default	Description
DOMAIN	required	Your domain name
REPO	level09/enferno	GitHub repository
BRANCH	master	Git branch
DB	sqlite	sqlite or postgres
ADMIN_EMAIL	admin@{DOMAIN}	Admin login email
ADMIN_PASSWORD	auto-generated	Admin password
SKIP_SSL	false	Skip SSL for testing

---

After Deployment

Access your app:

https://app.example.com

SSH into the server:

# Username is first part of domain (app.example.com → app)
ssh app@app.example.com

View app logs:

journalctl -u app.example.com.service -f

View access logs (JSON format):

tail -f /var/log/caddy/app.example.com.log

Restart the app:

sudo systemctl restart app.example.com.service

---

Updating Your App

SSH in and pull changes:

ssh app@app.example.com
cd ~/app
git pull
sudo systemctl restart app.example.com.service

Or redeploy completely:

curl -sSL https://raw.githubusercontent.com/level09/ignite/main/ignite.sh | sudo DOMAIN=app.example.com bash

---

Security Features (Built-in)

Ignite configures these automatically:

• HSTS - 1 year max-age, prevents downgrade attacks
• X-Frame-Options - Prevents clickjacking
• X-Content-Type-Options - Prevents MIME sniffing
• XSS Protection - Browser XSS filter
• Permissions-Policy - Disables geolocation, mic, camera
• Compression - zstd + gzip for responses
• Static caching - 1 year cache for /static/*
• Firewall - Only ports 22, 80, 443 open

---

Adding Rate Limiting

Install Caddy rate-limit plugin:

caddy add-package github.com/mholt/caddy-ratelimit

Edit /etc/caddy/Caddyfile:

app.example.com {
    # General rate limit
    rate_limit {remote.ip} 100r/s

    # Strict limit on auth endpoints
    @auth path /login* /register* /reset*
    rate_limit @auth {remote.ip} 5r/m

    # ... rest of config
}

Reload Caddy:

sudo systemctl reload caddy

---

Celery Worker

Ignite sets up Celery as a separate service:

# Check status
sudo systemctl status celery-app.example.com.service

# View logs
journalctl -u celery-app.example.com.service -f

# Restart
sudo systemctl restart celery-app.example.com.service

---

Troubleshooting

Issue	Solution
SSL not working	Ensure DNS points to server, wait for propagation
502 Bad Gateway	Check app service: journalctl -u app.example.com.service
Can't SSH	Firewall issue, access via VPS console
Database errors	Check credentials in /home/{user}/.env

Check all services:

sudo systemctl status caddy
sudo systemctl status app.example.com.service
sudo systemctl status celery-app.example.com.service
sudo systemctl status redis

---

Uninstall

To remove everything Ignite installed (replace app with your username):

sudo systemctl stop app.example.com.service
sudo systemctl stop celery-app.example.com.service
sudo systemctl disable app.example.com.service
sudo systemctl disable celery-app.example.com.service
sudo rm /etc/systemd/system/app.example.com.service
sudo rm /etc/systemd/system/celery-app.example.com.service
sudo userdel -r app

---

← Back to Tutorials