Deployment notes

[WilliamDEdwards]

Some generic deployment notes from a user who:

1. Has no particular knowledge or background in DISP / Internet.nl
2. Uses configuration management

Here we go!

• The deployment documentation (e.g.

  Internet.nl/documentation/Docker-multi-deployment.md

  Line 24 in 7b02b18

  /opt/Internet.nl/docker/compose.sh down

  ) refers to /opt/Internet.nl/docker/compose.sh, but that script does not exist. Specifically ran into this to create indexes as instructed in https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment-batch.md#application-setup. Workaround: /usr/bin/docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env exec -ti app ./manage.py api_create_db_indexes
• On start, one of the containers writes a release line (like RELEASE='1.10.8' # deploy Sat Apr 4 09:28:35 UTC 2026) to local.env. This is impractical when using configuration management, as it can cause restarts to be triggered seeing as how the file is changed.
• When running /opt/Internet.nl/docker/user_manage.sh from a random directory, I get: couldn't find env file: /root/docker/defaults.env. When switching to the /opt/Internet.nl working directory, the env file is found. Makes sense, but should probably be documented.
• /opt/Internet.nl/docker/user_manage.sh is not executable (permissions 0444)
• /opt/Internet.nl/docker/user_manage.sh is interactive, which makes auto-creating users more difficult than it needs to be. Preferred solution: allow taking password as arg
• /opt/Internet.nl/docker/user_manage.sh calls docker compose with --env-file. On modern Debian installs (not sure about Ubuntu), this arg is only available when installing Compose as a plugin (apt install docker-compose-plugin). Should probably be documented.
• When invoking ./manage.py (in the app container) - which user_manage.sh does as well - the following is printed: WARN[0000] The "MI" variable is not set. Defaulting to a blank string.. It's unclear what "The "MI" variable" is.
• It's not (easily) possible to make api_create_db_indexes idempotent when using configuration management, as there's no way to determine whether indexes were created, re-created or whether the action was a NOOP (the output is deterministic).
• The usage instructions for /opt/Internet.nl/docker/user_manage.sh add_update say <username> is required, but it is not asked for when specified, and the htpasswd file simply contains no username. The arg should be made required.
• The auto-generated Let's Encrypt certificate has no OSCP responder URL, which is fine by me, but not by the nginx config: 2026/04/04 09:46:13 [warn] 166#166: "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/letsencrypt/live/cyberfusion-disp.nl/fullchain.pem" & nginx: [warn] "ssl_stapling" ignored, no OCSP responder URL in the certificate "/etc/letsencrypt/live/cyberfusion-disp.nl/fullchain.pem"
• Following either deployment instruction (https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment.md / https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment-batch.md), the first thing one sees when accessing the self-hosted instance is "Bad Request (400)". Looking in the app container logs reveals: django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: 'cyberfusion-disp.nl'. You may need to add 'cyberfusion-disp.nl' to ALLOWED_HOSTS.. That is not documented.
• For MONITORING_AUTH_RAW, the documentation says the password is "htpasswd hash". Easy to generate with apache2-utils; for less experienced users, probably helpful to add a pointer.
• MONITORING_AUTH_RAW does not work; access is always denied. The password value of /etc/nginx/htpasswd/monitoring.htpasswd is always the same: a hash starting with $4Mpr. No idea where it comes from.
• I set ENABLE_HOF=False, but there is still a 'Hall of Fame' menu item, and the website test says: "Congratulations, your domain will be added to the Hall of Fame soon!"
• There's a bunch of filler (menu item called "base about custom", "article article title" under 'News', etc.) - and no instructions on how to set/customise. Not on https://github.com/internetstandards/Internet.nl/blob/main/documentation/Customize.md either.
• I would expect it's possible to add the Internet.nl instance to an external Prometheus server, but https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-metrics.md only touches on using the built-in Grafana dashboard.
• https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment.md#application-setup touches on configuring Sentry, and references SENTRY_DSN, with no further explanation of the format or the level of integration provided. Sentry is not mentioned at all on https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment-batch.md
• https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment-batch.md says: "This deployment does not include the "Test your connection" test". But while there are no indeed no setup instructions for the connectivity test (e.g. the conn subdomain), there is a "Test your connection" tile on the frontpage, which's 'Start test' button does link to that subdomain.
• For batch mode, it is not clear whether the dashboard (dashboard.internet.nl) is self-hostable / included.

That said, I shared elaborate feedback on the pretty confusing deployment instructions during one of the Jitsi meetings a couple months ago, and they have tremendously improved since then. Good going!

[bwbroersma]

• compose.sh:
  Did a blame on that line, and it was introduced by 41938ec which also added:
  

  Internet.nl/documentation/Docker-deployment.md

  Lines 133 to 135 in 7b02b18

  	## Compose command
  	To reduce issues with different versions a Compose command is included in the installation and can be accessed using `/opt/Internet.nl/docker/compose.sh`. Use this command for everything where you would normaly use `docker compose` to manage the Compose project.

  
  And the compose.sh file is created with:
  

  Internet.nl/docker/deploy.sh

  Lines 12 to 13 in 7b02b18

  	envsubst '$RELEASE' < docker/compose-dist.sh > docker/compose.sh
  	chmod a+x docker/compose.sh

• Regarding the ssl stapling warning, issue OCSP staple note in configuration #1791 was fixed with PR Add post-quantum hybrid ECDHE-MLKEM for TLSv1.3 in our webserver #1886, it's in main but not yet in a release, but it will be fixed in v1.11.
• Regarding the connection test setup see /documentation/Docker-DNS.md#specific-settings-for-connection-test-in-single-test-mode.
• dashboard is another repository, and Match docker installation/setup with regular internet.nl Internet.nl-dashboard#572 is an open issue (docker compose is not yet used in the dashboard installation that dashboard.internet.nl uses, but it's planned).

[aequitas]

• The deployment documentation (e.g. ) refers to /opt/Internet.nl/docker/compose.sh, but that script does not exist. Specifically ran into this to create indexes as instructed in https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment-batch.md#application-setup. Workaround: /usr/bin/docker compose --env-file=docker/defaults.env --env-file=docker/host.env --env-file=docker/local.env exec -ti app ./manage.py api_create_db_indexes

The documentation is for the current (unreleased) version in main and reference the latest image, which is still for the currently released version and does not container the compose.sh script. We should provide better links to the correct documentation version from the README.md.

BTW: multi-deployments is not recommended for normal installations.

• On start, one of the containers writes a release line (like RELEASE='1.10.8' # deploy Sat Apr 4 09:28:35 UTC 2026) to local.env. This is impractical when using configuration management, as it can cause restarts to be triggered seeing as how the file is changed.

We have not yet build the deployment with configuration management in mind. Because if you have configuration management you probably want to forego the deployment process and manage configuration and image updates in your own way. That said I think we can modify the version logic to better account for configuration file management.

• Following either deployment instruction (https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment.md / https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment-batch.md), the first thing one sees when accessing the self-hosted instance is "Bad Request (400)". Looking in the app container logs reveals: django.core.exceptions.DisallowedHost: Invalid HTTP_HOST header: 'cyberfusion-disp.nl'. You may need to add 'cyberfusion-disp.nl' to ALLOWED_HOSTS.. That is not documented.

I'm not able to replicate this when following the instructions. ALLOWED_HOSTS should be set properly during the host.env creation step: https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment.md?plain=1#L96-L100 with the INTERNETNL_DOMAINNAME: https://github.com/internetstandards/Internet.nl/blob/main/docker/host-dist.env#L14

• For MONITORING_AUTH_RAW, the documentation says the password is "htpasswd hash". Easy to generate with apache2-utils; for less experienced users, probably helpful to add a pointer.
• MONITORING_AUTH_RAW does not work; access is always denied. The password value of /etc/nginx/htpasswd/monitoring.htpasswd is always the same: a hash starting with $4Mpr. No idea where it comes from.

I'll look into those.

That said, I shared elaborate feedback on the pretty confusing deployment instructions during one of the Jitsi meetings a couple months ago, and they have tremendously improved since then. Good going!

Thank you.

[WilliamDEdwards]

I'm not able to replicate this when following the instructions. ALLOWED_HOSTS should be set properly during the host.env creation step: https://github.com/internetstandards/Internet.nl/blob/main/documentation/Docker-deployment.md?plain=1#L96-L100 with the INTERNETNL_DOMAINNAME: https://github.com/internetstandards/Internet.nl/blob/main/docker/host-dist.env#L14

You're right; this was PEBKAC. I missed the envsubst step, instead copying only the 3 env vars shown here: https://github.com/internetstandards/Internet.nl/blob/7b02b180e0fdc69120eb8fbb38ab1b0aa91801ca/documentation/Docker-deployment-batch.md#:~:text=After%20this,mailserver