Understanding Laravel Forge and Digital Ocean (Server Configuration)

DigitalOcean is where you create and pay for droplets.

Forge is just a service that helps you manage droplets. Simply put - you click through a web interface but Forge is running commands on that droplet and setting up everything for you, which you can do manually if you prefer.

Thanks.
@toniperic
This is how I understand it.
Digital Ocean:
DO is a hosting service (VPS) where they provide an empty space and it is up-to you to install any software required, this includes security such as firewalls etc.

Forge:
Forge will help you setup your VPS so you don't have to do it manually. Does that includes securing your server? Now, if Forge is just a service that helps you manage droplets, do you really need to pay for it month after month since I'm assuming once you setup you droplet you are good to go and you may not need it in months or years, no?

It also manages environment vars and updates from git? Depends what you mean by securing. If you mean Linux packages, I don't know but you can do that via apt-get upgrade

Thanks a lot.

I will watch Jeff's videos to understand Forge. https://laracasts.com/series/server-management-with-forge

Last question that of course was not in the video series.

If Forge is just a service that helps you manage droplets, do you really need to pay in a monthly bases? In other words, why would someone keep paying once you setup your droplet? Of course unless you are constantly setting up new ones you would keep the service.

You can choose not to? Depends if you require the tools that come with Forge. Although it can be all done manually or setup yourself.

Cool, thanks a lot for your help.

@bashy

You can choose not to? Depends if you require the tools that come with Forge. Although it can be all done manually or ?setup yourself.

Have you done this manually? If yes, how hard is it?

Well for me it's easy as I've spent years working with Linux and web servers. I'd suggest you run a VM on your local machine and install Debian or Ubuntu base OS. Then you can try and install Nginx/Apache and PHP to run a site.

@bashy
That is a great idea, I never thought about that. I currently have Ubuntu installed but not the server version, would this work the same as the Ubuntu Server or I need to install the Server version?

By having a server installed in a VM, is it the same as having for instance a droplet in Digitalocean? In other words, will you have the same option as far as accessing it remotely etc? I know I know, silly question.

Thanks a lot.

@fsdolphin $87 a month for shared is honestly ridiculous. you could build a decent droplet (server) at DigitalOcean for $5, maybe a bit more if you expect a ton of usage/visitors to your site. Their community section houses a plethora of tutorials on how to setup the droplet, install the LAMP/LEMP stack, securing the server and ssh etc... While you can put multiple sites on one droplet, it is good practice to have a signal droplet per site. ( yes, with larger sites you can use their local routing to have multiple droplets for dedicated services for your domain [ ie: 1 for mysql, etc]).

@Kryptonit3
You are right $87 is not cheap. I already created a Droplet, that's why I'm now trying to understand servers better. I will probably eventually sign up for a service such as Forge but not until I understand this better. I need to understand what Forge is really helping me with in other to appreciate it. Thanks.

definitely checkout the tutorials, everything you need to know on how to get started is there. https://www.digitalocean.com/community/tutorials

The desktop version of Ubuntu is just bundled with extra packages like the desktop environment :) it's still the same as a server, servers are normally headless which is why it's CLI only.

You can get a dedicated server for that price indeed... I have a few from OVH, they're cheaper than cheap http://www.soyoustart.com/en/essential-servers/

@Kryptonit3
If you were to list a process how would you describe it?

1. Create a Droplet.
2. Create a new user to access the server.
3. Configure firewalls. Etc...

@fsdolphin I pretty much follow this and this to a "T".

Then the rest is based on what you want to use. Apace, or nginx, or an nginx front end that proxies back to apache.

@bashy

The desktop version of Ubuntu is just bundled with extra packages like the desktop environment :) it's still the same as a server, servers are normally headless which is why it's CLI only.

You can get a dedicated server for that price indeed... I have a few from OVH, they're cheaper than cheap http://www.soyoustart.com/en/essential-servers/

Ok, I will install the server version to better represent what I will be dealing in real life with Digitalocean. Thanks.

@fsdolphin yeah, gone are the days of GUI when building your server.

this tutorial will show you how to connect to your server with ssh.

@Kryptonit3 That's an okay guide but half that I wouldn't bother doing... some of it is old and not always true to the OS you install.

@bashy the "half" being the second link, I agree. but pretty much everything in the first link should be done. The second link has good info on making a swap file, especially if you use the small, $5 droplet because of composer update high memory usage. but you could also try php -dmemory_limit=1G composer update

Thank you both for the good information, honestly you don't know how much this helps me, it started to make sense. Now, I'm no sure whether I will install Apache or Nginx but do you have a general advice as far as security?

In fact, what could be considered more important to secure, the server at self (Ubuntu) or the http server (Apache/Nginx)? In other words is one more prone to being hacked?

Thanks a lot.

https://www.digitalocean.com/community/tutorials/apache-vs-nginx-practical-considerations

On my main site I use both. Pretty sure homestead uses nginx.

To be honest, the main security concern is probably going to be your code. Write clean, secure code. Ubuntu out of the box is pretty secure. Especially if you create your own sudo user and disable root login and change default ssh port.

Definitely look into the section of the tutorial Add Public Key Authentication. That will immensely secure your servers ssh access, more so than using a regular password.

@Kryptonit3 I don't agree with stuff in both links, changing the SSH port is not really worth it. It's security through obscurity and it is only making it harder for yourself.

@Kryptonit3

To be honest, the main security concern is probably going to be your code. Write clean, secure code. Ubuntu out of the box is pretty secure. Especially if you create your own sudo user and disable root login and change default ssh port.

Cool, thanks.

One last question I hope. Sorry about the amount of quesitons. I'm currently practicing Laravel in my local machine using Homestead (VirtualBox/Vagrant and Composer).

Is it typical to have the same software installed (VirtualBox/Vagrant and Composer) in your Digitalocean droplets to run Laravel? What configuration do you have in your droplet?

I have watch Jeffrey's videos but he always uses services such as Forge, Fortrabbitt, etc. so, I don't have a clear picture. Also, I don't use Github and he uses it for everything (I do use Git though). I would like to see a tutorial on how to do everything manually.

Thanks a LOT.

No need to install VirtualBox/Vagrant on your server, that's for VM stuff.

@bashy I always change the default ssh port personally to stay off the radar of the bots. Most just scan the default main ports of IP addresses to see if the service is active. When that bot scans my server and sees that nothing is going on, on port 22 then chances are high it will move "on to the next one". Just a personal preference.

Considering how large the Internet is it is typically infeasible to look on every port of every IP address to find what's listening everywhere. This is the crux of the advice to change your default port. If these disaffected individuals want to find SSH servers they will start probing each IP address on port 22 (they may also add some common alternates such as 222 or 2222). Then, once they have their list of IP addresses with port 22 open, they will start their password brute force to guess usernames/passwords or launch their exploit kit of choice and start testing known (at least to them) vulnerabilities on the target system. link

But that is besides the point. The tutorials are just a starting place. To wrap your head around the idea of setting up your own server and controlling/configuring its resources.

Yeah that's the first part. Do you even know about the other risks of changing the port to something higher than 1024?

Once it's above 1024, it's a public port and can be bound by any user. This is a good read: https://www.adayinthelifeof.nl/2012/03/12/why-putting-ssh-on-another-port-than-22-is-bad-idea/

yeah, I read that article, and agree if you plan on letting other people on your droplet. Add public key authentication and you are all set.

Still, it can be executed with a shell exploit, could be done on the sudo user...

@bashy

No need to install VirtualBox/Vagrant on your server, that's for VM stuff.

Ok, so I'm assuming that the only thing I can install which may not be required is Composer right?

Now, help me understand this, I thought that the main reason why people use Vagrant was to be able to port the your local environment/configuration to a server (at least that's how I understood it), no?