# Conflict between iptables and ufw

When using docker, it automatically change iptable behavior. Since we're going to run nginx on the host machine, the ports have to be opened manually.

I've enabled 80 and 443(Nginx HTTP and Nginx HTTPS) on ufw but it seems to conflict with iptables as `iptables -nvL` shows nothing about port 80 or 443.

I considered flushing iptables but found cloud vendor's pre-defined rules in it. Until I have more time to research into them, I'll just disable ufw and manually add iptables rule.

# Install and configure nginx

sudo apt install nginx

sudo systemctl enable nginx

sudo systemctl start nginx

## Open port 80 and 443

Enable port 80 and 443 through iptables

sudo iptables -I INPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate NEW,ESTABLISHED -j ACCEPT

sudo iptables -I OUTPUT -p tcp -m multiport --dports 80,443 -m conntrack --ctstate ESTABLISHED -j ACCEPT

Save it to persistent

sudo netfilter-persistent save

## conf.d vs sites-enabled

Some guide tells you to create symbolic link from `sites-available` to `sites-enabled`. But it appeared too bothersome for me. So we're going to make `{my-domain.com}.conf` and import it to `nginx.conf`.

## my-domain.com.conf
Create configuration for {my-domain.com} `/etc/nginx/conf.d/{my-domain.com}.conf`

server {     listen 80;     server_name {my-domain.com} {www.mydomain.com};     # server_tokens off hides nginx version from client     server_tokens off;

location / {         root /var/www/{my-domain.com};     } }

Create default html page for {my-domain.com}
`/var/www/{my-domain.com}/index.html`

<html> <head> <title>Welcome to {my-domain.com}!</title> </head> <body> <h1>The {my-domain.com} server block is working!</h1> </body> </html>

Change permission for /var/www/{my-domain.com}

sudo chown -R 755 /var/www/{my-domain}

## Restart nginx
The below command should return successful

sudo nginx -t sudo nginx -s reload

-t is for testing configuration file. Dry run.

-s {signal}. -s flag sends {signal} to nginx. Reload nginx in our case

# Certbot

TODO : install certbot via snap, install certbot-dns-cloudflare, get cloudflare api key

Remove previous version of certbot

sudo apt remove certbot

Install certbot via snap

sudo snap install --classic certbot sudo snap set certbot trust-plugin-with-root=ok sudo snap install certbot-dns-cloudflare

Create symbolic link

sudo ln -s /snap/bin/certbot /usr/bin/certbot

Get credential from dns. It should be done through dns service provider. For cloudflare, check [dashboard](<https://dash.cloudflare.com/profile>) - API Tokens - Create Token. Create one with `Edit Zone DNS`.

Save credential to file

mkdir -p ~/.secrets/certbot vim ~/.secrets/certbot/cloudflare.ini

Cloudflare API token value

dns_cloudflare_api_token = {your-api-key}

Change permission for the file

sudo chmod 600 ~/.secrets/certbot/cloudflare.ini

Get wildcard certificate for your domain

sudo certbot certonly -d *.{my-domain.com} --dns-cloudflare --dns-cloudflare-credentials ~/.secrets/certbot/cloudflare.ini

Apply encryption to domain

sudo certbot --nginx

Auto renew certification

sudo crontab -e

Renew cert at every 10'th day of month at 4 am

0 4 * * 3 /usr/bin/certbot renew

# Reference

[How To Install Nginx on Ubuntu 20.04 - DigitalOcean](<https://www.digitalocean.com/community/tutorials/how-to-install-nginx-on-ubuntu-20-04>)

[How To Secure Nginx with Let's Encrypt on Ubuntu | DigitalOcean](<https://www.digitalocean.com/community/tutorials/how-to-secure-nginx-with-let-s-encrypt-on-ubuntu-22-04>)

[Certbot Instructions | Certbot (eff.org)](<https://certbot.eff.org/instructions?ws=nginx&os=ubuntufocal&tab=wildcard>)

[Welcome to certbot-dns-cloudflare’s documentation! — certbot-dns-cloudflare 0 documentation](<https://certbot-dns-cloudflare.readthedocs.io/en/stable/>)

[Possible conflict between ufw and iptables-persistent](<https://github.com/pivpn/pivpn/issues/414>)