> ## Documentation Index
> Fetch the complete documentation index at: https://docs.airys.chat/llms.txt
> Use this file to discover all available pages before exploring further.
# AWS AirysChat deployment guide
> Deploy AirysChat on AWS with a reference HA architecture
The following is a reference HA architecture guide for deploying AirysChat on AWS. For a cloud-native deployment, use our [helm charts](https://github.com/airyschat/charts) with AWS Elastic Kubernetes Service(EKS).
## Introduction
We will use the Linux installation script to get an AirysChat instance running. Also instead of
relying on Redis, Postgres and Nginx installed in the same ec2; we will proceed to make use
of managed AWS services for the same viz Elasticache, RDS, and ALB.
### Prerequisites
1. AWS account
2. Domain to use with AirysChat
### Architecture
This guide will follow a standard 3-tier architecture on AWS.
## Network
### Create VPC
1. Sign in to the AWS console and pick the region you will deploy.
2. Navigate to the VPC console and create a new vpc for airyschat. At the `name` tag, enter
`airyschat-vpc` and use the CIDR block `10.0.0.0/16`.
3. Leave the rest of the options as default and click on `Create VPC`.
### Subnets
Create two public and private subnets in the vpc we created. Make sure to have them in different AZ's and have non-overlapping CIDR ranges.
1. Navigate to VPC > Subnets.
2. Click on `Create Subnet`. Select the `airyschat-vpc` we created before, name it as `airyschat-public-1`, select an availability zone (for example, ap-south-1a), and the CIDR block as
`10.0.0.0/24`.
3. Follow the same to create the remaining subnets.
| Name | Type | Availability Zone | CIDR Block |
| --------------------- | ------- | ----------------- | ------------- |
| `airyschat-public-1` | public | `ap-south-1a` | `10.0.0.0/24` |
| `airyschat-public-2` | public | `ap-south-1b` | `10.0.1.0/24` |
| `airyschat-private-1` | private | `ap-south-1a` | `10.0.2.0/24` |
| `airyschat-private-2` | private | `ap-south-1b` | `10.0.3.0/24` |
4. After creating all subnets, enable `auto assign public ipv4 address` for public subnets under `Actions` > `Subnet Settings`.
### Internet Gateway
1. Select `Create Internet Gateway` , name it `airyschat-igw`, and click create.
2. Select it from the internet gateways list, choose actions and then select `Attach to VPC`.
3. Choose `airyschat-vpc` and click attach.
### NAT Gateway
AirysChat app servers need to be deployed in the private subnet. For them to access the internet, we need to add NAT gateways to our public subnet and add a route from the private subnets.
1. Navigate the VPC dashboard and select `NAT gateways`.
2. Click `Create NAT Gateway`.
1. Name it `airyschat-nat-1`.
2. Select the `airyschat-public-1` subnet.
3. Click on `Allocate Elastic IP`.
4. Add additional tags as per your need.
5. Click `Create NAT gateway`.
3. Follow the same to create a second NAT gateway (`airyschat-nat-2`) and choose the `airyschat-public-2` subnet.
### Route tables
The route table controls the inbound and outbound access for a subnet.
#### Public Route table
We will create route tables so that our public subnets can reach the internet via the Internet gateway.
Navigate to the VPC dashboard and select `Route Tables`.
1. Click `Create route table`.
2. Use the name `airyschat-public-rt` and choose `airyschat-vpc` under VPC.
3. Click `Create`.
Next, we need to add a route to the internet gateway we created earlier(`airyschat-igw`).
1. Select the `airyschat-public-rt` route table from the list and click on `Edit routes` > `Add Route`.
2. Set the destination as `0.0.0.0/0` and choose the target as `airyschat-igw`. Click on `Save Changes`.
Also,
1. Select the `airyschat-public-rt` route table from the list and click on `Subnet Associations` > `Edit subnet associations`.
2. Select both the public subnets(`airyschat-public-1`,`airyschat-public-2`) and click `save`.
#### Private Route table
We will also create private route tables so that our private subnets can reach the internet via the NAT gateways.
1. Follow the above guide and create two private route tables, namely, `airyschat-private-a` and `airyschat-private-b`.
2. Select the route tables and add a route to the NAT gateway in their respective availability zone.
1. For `airyschat-private-a`, add a route to `0.0.0.0/0` and target as `airyschat-nat-1`.
2. For `airyschat-private-b`, add a route to `0.0.0.0/0` and target as `airyschat-nat-2`.
Also,
1. Associate the private route tables with corresponding private subnets.
1. For `airyschat-private-a`, associate `airyschat-private-1` subnet.
2. For `airyschat-private-b`, associate `airyschat-private-2` subnet.
## Application Load Balancer (ALB)
Create an application load balancer to receive traffic on port 80 and 443 and distribute it across AirysChat instances.
1. Navigate to the EC2 section and choose the Load Balancer section.
2. Click `Create Load Balancer`.
1. Choose `Application Load Balancer`.
2. For the load balancer name, use `airyschat-loadbalancer`.
3. Select the scheme as `internet-facing` and IP address type as `IPv4`.
4. For the network mapping section,
1. Select `airyschat-vpc`.
2. Select the public subnets `airyschat-public-1` and `airyschat-public-2` under the mapping section.
5. For the Security group section,
1. Create a new security group, `airyschat-loadbalancer-sg`.
2. Add rules to allow HTTP and HTTPS traffic from anywhere(`0.0.0.0/0`, `::/0`).
3. Also, add a rule to allow TCP on port 3000. This rule allows the load balancer health checks to pass since AirysChat runs on port 3000.
4. Add a rule to allow SSH traffic from the bastion security group we will create at the latter stage of the guide. Revisit this section after completing the bastion step.
6. For the Listeners and routing section, create two listeners for 80 and 443. Set the forwarding rule on listener 80 to redirect `http` to `https`.
1. Also, create a target group, `airyschat-tg`, that will forward the requests to port `3000`(AirysChat listens on this port).
2. Add a health check to the endpoint `/api`. This endpoint is not authenticated and should return the application version.
```
{
"version": "1.22.1",
"timestamp": "2021-12-06 16:07:39"
}
```
7. Add any necessary tags and click create.
Also, add if you have your domain on Route53 and use ACM to generate a certificate to use with ALB.
## Postgresql using AWS RDS
AirysChat uses Postgres as a DB layer, and we will use Amazon RDS with a multi-AZ option for reliability.
### RDS security group
1. Navigate to EC2 > Security groups and create a new sg.
2. Name it `airyschat-rds-sg`.
3. Select the `airyschat-vpc` and add an inbound rule for postgres port with source `airyschat-loadbalancer-sg`.
### RDS subnet group
1. Navigate to the RDS section and select subnet groups.
2. Create `airyschat-rds-group` and choose `airyschat-vpc`.
3. Select both az's and the private subnets.
### RDS
1. Select create a database.
2. Use standard create and choose the Postgres engine.
3. Use the production template, and create a Postgres master username and password.
4. Enable Multi-AZ deployment.
5. Select `airyschat-vpc` and select the rds security group we created earlier.
6. Enable password authentication.
7. Click create.
8. After completing the creation, note down the hostname, username, and password. We will need this to configure AirysChat.
## Redis using AWS Elasticache
1. Follow similar steps like the rds to create Redis security and subnet groups.
2. Create the Redis cluster with a multi-AZ option.
## Creating Bastion servers
Create bastion servers in both public subnets. These servers will be used to ssh into AirysChat servers in private subnets.
1. Navigate to the EC2 dashboard and click launch instance.
2. Use an `Ubuntu 20.04 image` with a `t3.micro` type.
3. Choose `airyschat-vpc` and subnet `airyschat-public-1`.
4. Name it `airyschat-bastion-a`.
5. Add a new sg, `airyschat-bastion-sg` and enable ssh access from anywhere.
6. Leave the rest as defaults and click launch.
7. Once the instance is up, try to SSH into the instance.
Repeat and create another bastion, `airyschat-bastion-b` in the other AZ.
## Install AirysChat
1. Navigate to the EC2 section, and click on launch instance.
2. Use an `Ubuntu 20.04 image` with a `c5.xlarge` instance type.
3. Choose the airyschat-vpc and select the private subnet `airyschat-private-1`.
4. Disable auto-assign public IP and increase the storage of root volume to 60 GB.
5. Add necessary tags. Set the `Name` tag to `airyschat`.
6. Select the load balancer security group and click launch.
7. SSH into the bastion server and, from there, ssh to the airyschat instance we created.
8. Switch to the `root` user.
9. Download the airyschat Linux installation script.
```bash theme={null}
wget https://get.airyschat.app/linux/install.sh
chmod 755 install.sh
```
10. Run the script.
```bash theme={null}
./install.sh --install
```
## Configure AirysChat
11. Once the installation is complete, switch to the airyschat user and navigate to the airyschat folder. Edit the .env file and replace the Postgres and Redis credentials with RDS and elasticache values.
```bash theme={null}
sudo -i -u airyschat
cd airyschat
vi .env
```
12. Run the db migration.
```bash theme={null}
RAILS_ENV=production bundle exec rake db:prepare
```
13. Also modify the other necessary environment variable for your airyschat setup. Refer to [https://www.airyschat.com/docs/self-hosted/deployment/linux-vm#configure-the-required-environment-variables](https://www.airyschat.com/docs/self-hosted/deployment/linux-vm#configure-the-required-environment-variables)
14. Restart the `airyschat` service.
```bash theme={null}
sudo cwctl --restart
```
## Verify login
15. Add this instance to the target group attached to the alb.
16. Navigate to your airyschat domain to see if everything is working.
## Create a custom AMI
1. If you are getting the onboarding page, complete the signup and verify the installation.
2. Voila !! Your airyschat instance is up.
3. If everything looks good, proceed to create an ami from this instance and name it `airyschat-base-ami`.
## Auto Scaling Groups (ASG)
1. Create a launch configuration using the above base image.
2. Proceed to create an auto-scaling group from this launch config.
3. Set the minimum and desired capacity to 2 and the maximum to 4. Modify this as per your requirement.
4. Create a scaling policy based on CPU utilization.
5. At this point, we are good to terminate the instance we created earlier.
6. Check the load balancer or target group to verify if two new airyschat instances have come up.
7. That's it.
## Monitoring
1. Refer to [https://www.airyschat.com/docs/self-hosted/monitoring/apm-and-error-monitoring](https://www.airyschat.com/docs/self-hosted/monitoring/apm-and-error-monitoring)
## Updating AirysChat
1. log in to one of the application servers and complete the update instructions. Run migrations if needed. Refer to [https://www.airyschat.com/docs/self-hosted/deployment/linux-vm#upgrading-to-a-newer-version-of-airyschat](https://www.airyschat.com/docs/self-hosted/deployment/linux-vm#upgrading-to-a-newer-version-of-airyschat)
2. Create a new ami and update the launch config.
## Conclusion
This document is a reference guideline for an HA AirysChat architecture on AWS. Modify or build upon this to suit your requirements.