Setting up Planka on a pre-existing Ubuntu VPS

[DrewUniverse]

Hello, I'm Drew. I own a virtual private server for various web needs - primarily small websites. On one of these websites, I'd like to install and use Planka! My friend (a software engineer) and I took a quick look at the requirements, and most of it looks okay! There are a few things I'd like to clarify, however.

Firstly, as this is a pre-established VPS, we will need to use the manual installation instructions, correct? As such, it seems we will need to run Planka on a port that is not 80 / 443 since apache is already using it.

Secondly, it seems Planka can't do HTTPS (we already have HTTPS on our websites). So, my friend says we'd have to set up a reverse proxy. We found this related document. My friend noted that we'd have to set up SSL manually because certbot can't do it automatically in this case.

Thirdly, we use MariaDB instead of Postgre. Can we merely use MariaDB for Planka, or should we install the other one anyway?

As an aside, is it fine to use a subfolder instead of a subdomain? i.e. https://website.com/projectboard . Any chance it could then inherit our website's existing SSL if it's using a subfolder?

With all these factors in mind, I'm not sure what actions I should take and in which order. Hopefully our situation is compatible with the software. I'm really excited about the V2 updates for Planka and am eager to get started! Thanks in advance for any clarifications or guidance.

[meltyshev]

Hi! I'll try to answer some of your questions and hopefully point you in the right direction 😊

Firstly, as this is a pre-established VPS, we will need to use the manual installation instructions, correct? As such, it seems we will need to run Planka on a port that is not 80 / 443 since apache is already using it.

You could go with the manual install, but honestly, using Docker might be even easier - it isolates everything, handles the database setup for you, and makes updates simpler too. Totally up to you, though!

Secondly, it seems Planka can't do HTTPS (we already have HTTPS on our websites). So, my friend says we'd have to set up a reverse proxy. We found this related document. My friend noted that we'd have to set up SSL manually because certbot can't do it automatically in this case.

Yep, PLANKA doesn't handle HTTPS on its own, so using a reverse proxy (like Apache or Nginx) is the right move. As for SSL - Certbot can still automate things, depending on how your reverse proxy is set up. You can check Certbot's instructions here: https://certbot.eff.org/instructions?ws=nginx&os=pip (choose your actual server type in the dropdown).

Thirdly, we use MariaDB instead of Postgre. Can we merely use MariaDB for Planka, or should we install the other one anyway?

Unfortunately, PLANKA only works with Postgres - MariaDB isn't supported. If you go with the Docker installation, though, it comes with Postgres already set up via Docker Compose, so you wouldn't have to install it separately.

As an aside, is it fine to use a subfolder instead of a subdomain? i.e. https://website.com/projectboard . Any chance it could then inherit our website's existing SSL if it's using a subfolder?

Currently, PLANKA v2 doesn't support running under a subfolder, so you'd need to use a subdomain.

[DrewUniverse]

Hi @meltyshev . Life went sideways for awhile, but I am making a renewed attempt to install Planka.

I have successfully set up Docker as well as the Planka instance within it. That much is a major relief! My plan is to run the docker instance through a subdomain on my website.

I'm wondering if you know about reverse proxy setup as it relates to the Planka on a subdomain, as I'm finding myself a bit confused.

You mentioned that Planka doesn't handle HTTPS by itself, and that I'd need to use a reverse proxy. However, in the Planka install document (Step 3), it mentions generating a secret key which seems to relate to SSL (command "openssl rand -hex 64"). Is this the only SSL key I need for the subdomain, or do I still need to get a second key from certbot?

Side question: Does this mean the kanban board will be served over HTTPS after all? Perhaps I mistook "Planka doesn't handle HTTPS on its own" as "Planka must run on HTTP (no S)". Or perhaps the install process has changed since last year. 😅

Secondly, I'd like to ask about the vhost file for Apache. I'm using the config sample as a basis. I'm smart enough to know to change the domain, but I don't know what the guide is asking me to do when it says "be sure to set up SSL correctly." I have placed the key from before into the docker-compose.yml file, and I have enabled the "site" for this subdomain's vhost file along with an apache refresh. Docker is also running. As it stands, my result is a privacy error.

I am not sure if I need to edit other parts of the vhost file, like the port numbers. One of my teammates indicated that since we're already running apache on port 80, we'd need to assign this Planka subdomain to another port.

My vhost file looks like this:

<VirtualHost *:80>

    ServerName kanban.legendofdragoon.org

    RewriteEngine On
        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteRule /(.*)            ws://localhost:1337/$1 [P,L]

    SSLProxyEngine on
    ProxyPreserveHost On
    ProxyRequests Off
            ProxyPass /.well-known !
            ProxyPassReverse /.well-known !
            ProxyPass /robots.txt !
            ProxyPassReverse /robots.txt !
            ProxyPass / http://localhost:1337/
            ProxyPassReverse / http://localhost:1337/

</VirtualHost>

[meltyshev]

Hey! I will try to help, but I'm not very good at configuring server things :D

You mentioned that Planka doesn't handle HTTPS by itself, and that I'd need to use a reverse proxy. However, in the Planka install document (Step 3), it mentions generating a secret key which seems to relate to SSL (command "openssl rand -hex 64"). Is this the only SSL key I need for the subdomain, or do I still need to get a second key from certbot?

Side question: Does this mean the kanban board will be served over HTTPS after all? Perhaps I mistook "Planka doesn't handle HTTPS on its own" as "Planka must run on HTTP (no S)". Or perhaps the install process has changed since last year. 😅

This secret key is used to create a signature for access tokens (sessions) when a user logs in, so it's not related to SSL/HTTP.

Secondly, I'd like to ask about the vhost file for Apache. I'm using the config sample as a basis. I'm smart enough to know to change the domain, but I don't know what the guide is asking me to do when it says "be sure to set up SSL correctly." I have placed the key from before into the docker-compose.yml file, and I have enabled the "site" for this subdomain's vhost file along with an apache refresh. Docker is also running. As it stands, my result is a privacy error.

I am not sure if I need to edit other parts of the vhost file, like the port numbers. One of my teammates indicated that since we're already running apache on port 80, we'd need to assign this Planka subdomain to another port.

My vhost file looks like this:

    ServerName kanban.legendofdragoon.org

    RewriteEngine On
        RewriteCond %{HTTP:Upgrade} =websocket [NC]
        RewriteRule /(.*)            ws://localhost:1337/$1 [P,L]

    SSLProxyEngine on
    ProxyPreserveHost On
    ProxyRequests Off
            ProxyPass /.well-known !
            ProxyPassReverse /.well-known !
            ProxyPass /robots.txt !
            ProxyPassReverse /robots.txt !
            ProxyPass / http://localhost:1337/
            ProxyPassReverse / http://localhost:1337/

</VirtualHost>

It looks like your Apache config is basically fine. The idea of the setup should be that your PLANKA process runs only on port 1337 locally (don't expose this port publicly if you plan to use a proxy). In other words, you shouldn't be able to access PLANKA directly via 1337 from outside - Apache should be the only entry point.

You just need to switch this VirtualHost to HTTPS and point Apache to your SSL certificate files. A complete example would look like this:

<VirtualHost *:80>
    ServerName kanban.legendofdragoon.org

    # Allow Let's Encrypt validation
    ProxyPass /.well-known !
    ProxyPassReverse /.well-known !

    # Redirect everything else to HTTPS
    Redirect permanent / https://kanban.legendofdragoon.org/
</VirtualHost>

<VirtualHost *:443>
    ServerName kanban.legendofdragoon.org

    SSLEngine on
    SSLCertificateFile /etc/letsencrypt/live/kanban.legendofdragoon.org/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/kanban.legendofdragoon.org/privkey.pem

    SSLProxyEngine on
    ProxyPreserveHost On
    ProxyRequests Off

    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://localhost:1337/$1 [P,L]

    ProxyPass /.well-known !
    ProxyPassReverse /.well-known !
    ProxyPass /robots.txt !
    ProxyPassReverse /robots.txt !
    ProxyPass / http://localhost:1337/
    ProxyPassReverse / http://localhost:1337/
</VirtualHost>

I usually use certificates from Let's Encrypt (it's free and pretty straightforward), but I'm not sure if you already have them. If not, you can generate them with (you will likely need to install Certbot first):

certbot --apache -d kanban.legendofdragoon.org

They'll be placed under /etc/letsencrypt/live/kanban.legendofdragoon.org/ (this path is already specified in the VirtualHost config). After restarting Apache, everything should work.

Please note that these certificates are only valid for a limited time, so you'll likely need to set up automatic renewal. Also, since you're running PLANKA behind a proxy, make sure to set the TRUST_PROXY=true environment variable.

[DrewUniverse]

Thanks for the quick response. I applied your recommended vhost content and certbot command. I made sure everything was refreshed. This led to a new message screen (503 Service Unavailable). So, I think this is progress, but something else must be awry. I did make sure to edit the trust_proxy variable in the docker-compose.yml file as well. It was set to true, but commented out, so I removed the hashtag to enable it.

Edit: it seems that certbot modified the vhost file a bit. Posting that just in case:

    ServerName kanban.legendofdragoon.org

    # Allow Let's Encrypt validation
    ProxyPass /.well-known !
    ProxyPassReverse /.well-known !

    # Redirect everything else to HTTPS
    Redirect permanent / https://kanban.legendofdragoon.org/
RewriteEngine on
RewriteCond %{SERVER_NAME} =kanban.legendofdragoon.org
RewriteRule ^ https://%{SERVER_NAME}%{REQUEST_URI} [END,NE,R=permanent]
</VirtualHost>

<VirtualHost *:443>
    ServerName kanban.legendofdragoon.org

    SSLEngine on

    SSLProxyEngine on
    ProxyPreserveHost On
    ProxyRequests Off

    RewriteEngine On
    RewriteCond %{HTTP:Upgrade} =websocket [NC]
    RewriteRule /(.*) ws://localhost:1337/$1 [P,L]

    ProxyPass /.well-known !
    ProxyPassReverse /.well-known !
    ProxyPass /robots.txt !
    ProxyPassReverse /robots.txt !
    ProxyPass / http://localhost:1337/
    ProxyPassReverse / http://localhost:1337/
    SSLCertificateFile /etc/letsencrypt/live/kanban.legendofdragoon.org/fullchain.pem
    SSLCertificateKeyFile /etc/letsencrypt/live/kanban.legendofdragoon.org/privkey.pem
Include /etc/letsencrypt/options-ssl-apache.conf
</VirtualHost>```

[daniel-hiller]

Hi,
which port do use in your docker-compose.yml file?

is it 1337:1337 or 3000:1337?

if you have 3000:1337 just change it to 1337:1337 or even better 127.0.0.1:1337:1337 than just run docker compose up -d again

I guess this will fix your issue

[DrewUniverse]

I am at the Planka login screen!!! Thank you so much. Do yall accept donations?

[meltyshev]

Nice - glad it works! The best support is just using PLANKA and sharing it with others. We're also launching a Pro version soon if you need more features :)