Studio: AWS Devops Basics¶

Instace Details¶

Next, the console will ask which type of instance to set up. Your choice here defines the amount of virtual CPU cores, RAM, and network perforance you want. This also directly affects the cost of the running instance. Select the t2.micro service, then click Configure Instance Details.

Screen show with t2.micro selected and red circle highlighting the selection

Next, click Configure Instance Details

• We aren’t going to change anything on this page now

• However, please take a quick look at the properties that you can change on this page

  

Next, click Add Storage

Storage¶

On this screen, you can choose what storage is available to your instance. AWS will provision a virtual volume in Elastic Block Store to serve as the volume(s) mounted in your instance. By default, it will create an 8 GiB volume to serve as the instance’s root volume.

• The default 8 GiB volume is sufficient for this application.
• Click on Add Tags to progress to the next step.

Screen shot showing pre-filled 8 GiB storage selection

Add Tags¶

The Add Tags screen is helpful to “name” our ec2 instance. Since lots of us are going to be creating instances, please click Add Tag add a Name tag with a value of something unique and relevant to you, example blakes-ec2-walkthrough.

Screen shot demonstrating an empty Add Tags screen and the Add Tag button

Next click Configure Security Group

Security Groups¶

The Security Group controls network traffic in and out of the server you are creating. You can create rules for different kinds of traffic on different ports. Examples: SSH, HTTP, port 8080.

Configuring the security groups for your server is critical for protecting your instance from unauthorized remote access. The organization or indiviaul who created the AWS account is liable for the costs generated by any instances that are setup, in this case LaunchCode is that origanization. An openly-accessible instance can risk your infrastructure security and accumulate great costs to your organization if it were to be compromised.

1. Create a new security group for your instance with a unique name
2. Add a useful description for the security group so you know its purpose in the future
3. Change the existing rule’s source to My IP
   • This allows remote SSH access to your instance, but only from the IP you’re currently using to access AWS
   • NOTE: This is your IP at the time of configuration. Later on if your IP changes for some reason you will NOT be able to login until you adjust the security group to look for your new IP.
   • This configuration only applies to servers that use this Security Group

Screen shot showing Create Security Group page with My IP circled in red to highlight the selection

Next click Review and Launch button in the bottom right

Review Screen¶

This screen gives you a final chance to review and change the settings you chose for this instance.

• Each section is collapsable and expandle by clicking on the section Title
• When you’re done reviewing, click Launch

Setting up a KeyPair¶

This will open a popup on the screen that allows you to configure a key pair for the instance. This will generate the key necessary to SSH into the instance and without this you will not be able to access your instance. In an enterprise environment, there will likely already be multiple key pairs set up that you would use here. For the purpose of this project, create a new key pair:

1. Select Create a new key pair in the first select box
2. Give your key pair a good name, possibly the same name you gave your security group
3. Click Download Key Pair
4. Choose Save File to your computer
5. Store this *.pem file in a good location and do not lose it. A suggestion is to put them in ~/.ssh folder.
6. Move your newly downloaded file there by running:
   • mv ~/Downloads/your-keypair.pem ~/.ssh

6. Click Launch Instances

Your Instance Details¶

AWS will now begin launching your instance. After Launching your instance will be availabe in the list of EC2 Instances. You can click the identifier for your instance to monitor it as it starts up. This will take you back to the Instances dashboard. In the Description tab of your instance you can see important properties such as public DNS, IP, running state, instance type, links to security group(s), key pair, etc.

Screen shot showing Instances dashboard and a running instance. A red circle is around the Public DNS entry.

Set up SSH¶

1. Go to your local terminal
2. Change the permissions for the .pem file to be read-only by your user:
   • $ chmod 400 name-of-pem.pem

5. Using the Public DNS you noted before and your *.pem file, access your AWS instance:
   • $ ssh -i ~/.ssh/name-of-pem.pem ubuntu@PUBLIC-DNS-OF-SERVER.compute.amazonaws.com

• The ssh program will likely warn that the authenticity of your host can’t be established since it’s not seen it before. Respond “yes” to continue connecting. It will add it to the list of known hosts and continue the connection process.
• The remote terminal will appear and look like the below screen shot

Screen shot of terminal showing successful SSH connection to AWS instance

Congratulations! You have successfully created and connected to an instance running in the cloud.

Create Application User¶

First, you don’t want the application running under your system account, so we need to create a new user::

(On remote server)
ubuntu$ sudo adduser --system airwaze

Secure Copy Files to Server¶

We are going to upload our app jar file and the two csv files to the server. We’ll use scp to securely transmit the file to our server.

• Leave your ssh session open, but open a new terminal on your cmoputer by hitting Command + T while in your terminal

(On local computer, NOT in ssh session)
$ scp -i ~/.ssh/name-of-pem.pem /your-airwaze-repo/build/libs/app-0.0.1-SNAPSHOT.jar [email protected]:/home/ubuntu/app-0.0.1-SNAPSHOT.jar
$ scp -i ~/.ssh/name-of-pem.pem /your-airwaze-repo/*.csv [email protected]:/home/ubuntu

Ubuntu Doesn’t Have Everything We Need?¶

The remotes servers will not come with everything we need already isntalled. However it does come with a tool that makes it easy to install software. apt-get is the “Package Manager” that comes with Ubuntu. We will use it to install the JDK and other tools we need.

Install JDK on Server¶

We need Java to run our app, we will install it using apt-get:

(On remote server)
ubuntu$ sudo apt-get update
ubuntu$ sudo apt-get install openjdk-8-jdk
ubuntu$ java -version

Edit Postgresql Config File¶

(on remote server)
ubuntu$ psql -U postgres

• The above should throw an error like psql: FATAL:  Peer authentication failed for user "postgres"
• We need to edit a postgresql config file. You can do that in nano or vi

(On remote server)
ubuntu$ sudo nano /etc/postgresql/9.5/main/pg_hba.conf

• In the configuration filr, you’ll see that almost all of the lines are commented out with #
• Find the section that matches the text in the red box
• Change the text peer to be md5. Be careful to change the correct line
• Save your changes to the file

(Section in red box shoud look like this after editing it)
# "local" is for Unix domain socket connections only
local   all             all                                     md5

Create User and Database¶

(on remote server)
(restart postgresql)
ubuntu$ sudo /etc/init.d/postgresql restart

(when prompted provide password of your choice, but be sure to remember it)
ubuntu$ sudo -u postgres createuser --pwprompt --superuser airwaze_db_user

(now open a psql# shell)
ubuntu$ psql -U airwaze_db_user -d postgres
postgres=# CREATE DATABASE airwaze;

(install postgis extensions in airwaze database)
postgres=# \c airwaze;
airwaze=# CREATE EXTENSION postgis;
airwaze=# CREATE EXTENSION postgis_topology;
airwaze=# CREATE EXTENSION fuzzystrmatch;
airwaze=# CREATE EXTENSION postgis_tiger_geocoder;

Create airwaze.service¶

(On remote server)
ubuntu$ sudo nano /etc/systemd/system/airwaze.service

Copy and paste this text into the airwaze.service file and then save it:

[Unit]
Description=Airwaze Studio
After=syslog.target

[Service]
User=airwaze
ExecStart=/usr/bin/java -jar /home/airwaze/app-0.0.1-SNAPSHOT.jar SuccessExitStatus=143
Restart=no
EnvironmentFile=/home/airwaze/airwaze-env-variables.config

[Install]
WantedBy=multi-user.target

Create airwaze-env-variables.config¶

As we have stated many times, we do not want to hardcode usernames and passwords into our code. We need a way to configure the environment variables that are referenced in application.properties. We will create a new file named airwaze-env-variables.config that will set the environment variables when the airwaze service runs. Notice that the EnvironmentFile property in the airwaze.server tells the service where to look for environment variables.

(On remote server)
ubuntu$ sudo nano /home/airwaze/airwaze-env-variables.config

Copy and paste this text into the airwaze-env-variables.config file and then save it:

APP_DB_HOST=localhost
APP_DB_PORT=5432
APP_DB_NAME=airwaze
APP_DB_USER=airwaze_db_user
APP_DB_PASS=your-db-password (that you set in section 8)

Enable and Start airwaze Service¶

Once this service definition is in place, set the service to start automatically on boot with systemd using the systemctl utility and also start now:

(On remote server)
ubuntu$ sudo systemctl enable airwaze
ubuntu$ sudo systemctl start airwaze

And you can view the logs for the service with journalctl.:

(On remote server)
ubuntu$ journalctl -f -u airwaze.service

Check for Errors in Log¶

(on remote server)
(to see if there are any clues/errors)
ubuntu$ journalctl -f -u airwaze

From inside the Server, Use Telnet to check on Tomcat Server¶

(on remote server)
(to see if anything is listening to port 8080 on the server)
ubuntu$ telnet localhost 8080

From your computer(outside the server), Use Telnet to check on remote Tomcat Server¶

(on local computer)

(check to see if you connect to server from your local computer via http)
$ telnet PUBLIC-DNS-OF-SERVER.compute.amazonaws.com 8080

(if you got an error about telnet not being a command, then install it and try again)
$ brew install telnet

How to Stop and Re-Run Airwaze App¶

1. Fix code in Intellij and build with bootRepackage
2. scp the updated jar file to the server
3. Stop the current service sudo systemctl stop airwaze
4. Disable the service sudo systemctl disable airwaze
5. Enable and then restart the service again (see instructions above)