Securing Your Node.js App on AWS EC2: A Guide to Nginx, Let's Encrypt, and Custom Domains

Mayank Soni — Tue, 16 Jan 2024 12:44:31 +0000

In today's digital landscape, security is paramount. This guide aims to walk you through the process of securing your Node.js application on an AWS EC2 instance. We'll cover configuring Nginx, obtaining a free SSL certificate from Let's Encrypt, and setting up a custom domain.

Step 1: SSH into your EC2 instance

ssh  -i "PATH/TO/YOUR/KEY/FILE.PEM" "USER-NAME@SERVER-IP"

Step 2: Install Nginx and Certbot

If you haven't already installed Nginx, you can do so using your package manager. For example, on a Debian-based system:

sudo apt update
sudo apt install nginx certbot python3-certbot-nginx

(python3-certbot-nginx is an Nginx plugin for Certbot)

Step 3: Configure Nginx for Your Node.js App

Begin by installing Nginx on your EC2 instance. You can create a dedicated Nginx configuration file tailored for your Node.js app, but I'm using the default configuration file:

sudo nano /etc/nginx/sites-available/default

This file directs Nginx to act as a reverse proxy, forwarding requests to your Node.js application. Remember to replace YOUR-DOMAIN-NAME.TLD with your domain name in this snippet:

server {
    listen 80;
    server_name YOUR-DOMAIN-NAME.TLD WWW.YOUR-DOMAIN-NAME.TLD;

    location / {
        proxy_pass http://127.0.0.1:PORT;
    }
}

Ensure your Node.js app is running on the specified port (PORT in the Nginx configuration).

Step 4: Obtain a Free SSL Certificate with Let's Encrypt

Enhance your website's security by obtaining a free SSL certificate from Let's Encrypt. Install Certbot and run the following command:

sudo certbot --nginx -d YOUR-DOMAIN-NAME.TLD -d WWW.YOUR-DOMAIN-NAME.TLD

Certbot will prompt you for necessary information and automatically configure Nginx to use the SSL certificate.

Step 5: Configure Certbot Auto-Renewal

Certificates obtained from Let's Encrypt are typically valid for 90 days. To automate the renewal process, Certbot provides a renewal script that you can set up with a cron job.

sudo certbot renew --dry-run

This command tests the renewal process without making any changes. If it runs without errors, you can add it to your crontab.

sudo crontab -e

Add the following line to run the renewal check twice a day:

0 */12 * * * /usr/bin/certbot renew --quiet

Step 6: Restart Nginx

Before restarting Nginx, it's a good idea to test the configuration to catch any syntax errors:

sudo nginx -t

If the test is successful, restart Nginx to apply the changes restart Nginx to apply the changes:

sudo service nginx restart

Now, your site should be accessible using HTTPS, and the SSL certificate will automatically renew when necessary. Make sure to check your website to ensure that it's loading securely over HTTPS.

If you encounter any issues, feel free to ask in the comments for further assistance!

My Experience Building A Python Project

Mayank Soni — Wed, 20 May 2020 15:28:42 +0000

My Final Project:

FaceAttend - It's an attendance recording system that uses the power of facial recognition (through OpenCV) and marks attendance by detecting faces from the camera without redundantly capturing them more than once. It also has a feature that lets you see the analytical data of a particular student/class for determining the performance of either one.

Link to Code:

mayanxoni / FaceAttend

Project for MCA final year. For more, README.

FaceAttend

FaceAttend is a minor project for the final year of my MCA course work. It is an attendance management software that harnesses the power of ML and AI (in a broad sense) to record attendance using Facial Recognition. It is built upon Python and uses OpenCV library to recognise faces from live video feed or even a picture.

Features

Manual Attendance
Automatic Attendance
Update Attendance (Manually)

References

FaceAttend is developed with the help of a number of references from the Internet:

Codacus - OpenCV and Python Tutorial
OpenCV - Cascade Classifier

Installation

FaceAttend requires Python v3.7+ to run.

Once installed, run the following commands in your system shell to install necessary packages:

$ pip install opencv-contrib-python
$ pip install opencv-python
$ pip install numpy

License

MIT

Is it free? Hell yeah!

View on GitHub

How I built it (what's the stack? did I run into issues or discover something new along the way?):

I used Python 3.7.2 along with Qt for building it's beautiful GUI that helps it look more professional than it is. I thought it would be impossible for me to build a project under 4 months using a language that I thought was horrible but with the help of open-source content available on GitHub and open forums like Stackoverflow, I was able to pull it off easily.

Additional Thoughts / Feelings / Stories:

I feel that building a solution using a particular language/stack should not matter as long as you think that the solution you're building itself is a life-changing product.

Forem: Mayank Soni