Sahana Eden Wiki - User contributions [en]

Guidelines:DualHost

2026-02-04T07:52:03Z

Dominic: /* Configuring Key-based Login */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with the database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host. In these places, replace the designation with the respective IP address.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''.

== Setting Up Eden Account ==

Login to the DB Host and create a user account for Eden:

<syntaxhighlight lang="bash">
adduser eden
</syntaxhighlight>

Use <code>visudo</code> to add the following lines to the ''sudoers'' configuration:

<syntaxhighlight lang="bash">
# User rules for eden
eden ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

This will allow Eden to become ''root'' without password.

== Configuring Key-based Login ==

On your local machine, generate a new RSA key pair:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -f eden -C "eden"
</syntaxhighlight>

'''''Note:''' Leave the password empty as this key is to be used for script automation''

This will generate two files, ''eden'' (=private key) and ''eden.pub'' (=public key), in the current directory. Install the public key on the DB Host:

<syntaxhighlight lang="bash">
cat eden.pub | ssh eden@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Copy the private key to the App Host:

<syntaxhighlight lang="bash">
scp eden admin@<apphost-public-ip>:/tmp
</syntaxhighlight>

Login to the App Host and store the key in a safe location:

<syntaxhighlight lang="bash">
sudo su -
cp /tmp/eden ~/.ssh
chown root.root ~/.ssh/eden
chmod 600 ~/.ssh/eden
</syntaxhighlight>

Verify that you can use this key to SSH-login from the App Host to the DB Host (via private IP), as user ''eden'':

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/eden eden@<dbhost-private-ip>
</syntaxhighlight>

== PostgreSQL ==

=== Installing PostgreSQL ===

On the DB Host, make yourself ''root'':

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configuring Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the <code>listen_address</code> setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Eden ==

=== Installing Release Package ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Login to the App Host and make yourself ''root'':

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

=== Configuring DB Host ===

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=eden
DBHOST_KEY=/root/.ssh/eden
</syntaxhighlight>

=== Setup with Edenctl ===

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-04T07:50:36Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with the database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host. In these places, replace the designation with the respective IP address.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''.

== Setting Up Eden Account ==

Login to the DB Host and create a user account for Eden:

<syntaxhighlight lang="bash">
adduser eden
</syntaxhighlight>

Use <code>visudo</code> to add the following lines to the ''sudoers'' configuration:

<syntaxhighlight lang="bash">
# User rules for eden
eden ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

This will allow Eden to become ''root'' without password.

== Configuring Key-based Login ==

On your local machine, generate a new RSA key pair:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -f eden -C "eden"
</syntaxhighlight>

'''''Note:''' Leave the password empty as this key is to be used for script automation''

This will generate two files, ''eden'' (=private key) and ''eden.pub'' (=public key), in the current directory. Install the public key on the DB Host:

<syntaxhighlight lang="bash">
cat eden.pub | ssh eden@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Copy the private key to the App Host:

<syntaxhighlight lang="bash">
scp eden admin@<apphost-public-ip>:/tmp
</syntaxhighlight>

Login to the App Host and store the key in a safe location:

<syntaxhighlight lang="bash">
sudo su -
cp /tmp/eden ~/.ssh
chown root.root ~/.ssh/eden
chmod 600 ~/.ssh/eden
</syntaxhighlight>

Verify that you can SSH-login from the App Host to the DB Host (via private IP), as user ''eden'':

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/eden eden@<dbhost-private-ip>
</syntaxhighlight>

== PostgreSQL ==

=== Installing PostgreSQL ===

On the DB Host, make yourself ''root'':

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configuring Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the <code>listen_address</code> setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Eden ==

=== Installing Release Package ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Login to the App Host and make yourself ''root'':

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

=== Configuring DB Host ===

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=eden
DBHOST_KEY=/root/.ssh/eden
</syntaxhighlight>

=== Setup with Edenctl ===

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T23:26:39Z

Dominic: /* Configure Host-based Access */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with the database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host. In these places, replace the designation with the respective IP address.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''. Make a note of these details, too:

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the <code>listen_address</code> setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T23:24:53Z

Dominic: /* Prerequisites and Terminology */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with the database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host. In these places, replace the designation with the respective IP address.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''. Make a note of these details, too:

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_address setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T23:22:03Z

Dominic: /* Prerequisites and Terminology */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with the database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''. Make a note of these details, too:

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_address setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T23:21:43Z

Dominic: /* Prerequisites and Terminology */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with the database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''. Note these details down:

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_address setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T23:20:09Z

Dominic: /* Dual Host Setup */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with the database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_address setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T23:18:42Z

Dominic: /* Configure Host-based Access */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_address setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T23:13:38Z

Dominic: /* Dual Host Setup */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =
* ''new in Eden-6.2 (not yet released)''

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:Edenctl

2026-02-02T23:12:44Z

Dominic: /* Server Administration with Edenctl */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux''' that comes with the DEB-Packages of the Eden release. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| pull || Update Eden from GitHub || new in Eden-6.1
|-
| template || Switch to another configuration template || new in Eden-6.2 (not yet released)
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

'''''Note:''' The '''setup''' command will not work if the Eden instance has already been set up. To make changes in an already-configured instance, you must edit the configuration files manually.''

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The '''teardown''' command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden web interface using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden web interface and thereby prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the web user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

* ''new in Eden-6.2 (not yet released)''

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:22:11Z

Dominic: /* Server Administration with Edenctl */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux''' that comes with the DEB-Packages of the Eden release. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

'''''Note:''' The '''setup''' command will not work if the Eden instance has already been set up. To make changes in an already-configured instance, you must edit the configuration files manually.''

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The '''teardown''' command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden web interface using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden web interface and thereby prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the web user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:21:22Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux'''. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

'''''Note:''' The '''setup''' command will not work if the Eden instance has already been set up. To make changes in an already-configured instance, you must edit the configuration files manually.''

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The '''teardown''' command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden web interface using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden web interface and thereby prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the web user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:20:59Z

Dominic: /* Start and Stop */

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux'''. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

'''''Note:''' The '''setup''' command will not work if the Eden instance has already been set up. To make changes in an already-configured instance, you must edit the configuration files manually.''

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The '''teardown''' command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden web interface using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden web interface and thereby prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the web user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:20:05Z

Dominic: /* Setup and Teardown */

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux'''. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

'''''Note:''' The '''setup''' command will not work if the Eden instance has already been set up. To make changes in an already-configured instance, you must edit the configuration files manually.''

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The '''teardown''' command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:19:43Z

Dominic: /* Setup and Teardown */

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux'''. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

'''''Note:''' The setup command will not work if the Eden instance has already been set up. To make changes in an already-configured instance, you must edit the configuration files manually.''

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The teardown command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:17:15Z

Dominic: /* Setup and Teardown */

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux'''. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

'''''Note:''' The setup command will not work if the Eden instance has already been set up.''

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The teardown command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:16:34Z

Dominic: /* Server Administration with Edenctl */

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for Eden server administration on '''Debian/Linux'''. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

The setup command will not work if the Eden instance has already been set up.

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The teardown command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:15:43Z

Dominic: /* Server Administration with Edenctl */

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for server administration on '''Debian/Linux'''. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

The setup command will not work if the Eden instance has already been set up.

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The teardown command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:15:27Z

Dominic: /* Server Administration with Edenctl */

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for server administration on Debian/Linux. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

=== Commands Overview ===

{| class="wikitable"
|-
! Command !! Explanation !! Comments
|-
| setup || Set up a newly installed Eden instance ||
|-
| teardown || Undo a completed setup ||
|-
| start || Start the web interface ||
|-
| stop || Stop the web interface ||
|-
| shell || Open a Python shell in the web2py+Eden environment ||
|-
| run || Run a Python script in the web2py+Eden environment ||
|-
| clean || Reset the Eden instance ||
|-
| template || Switch to another configuration template ||
|-
| compile || (Re-)compile models, controllers and views ||
|}

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

The setup command will not work if the Eden instance has already been set up.

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The teardown command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:09:22Z

Dominic:

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for server administration on Debian/Linux. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

The setup command will not work if the Eden instance has already been set up.

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The teardown command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Shell ==

To open a Python shell in the web2py+Eden environment, you can use:

<syntaxhighlight lang="bash">
edenctl shell
</syntaxhighlight>

== Running Scripts ==

To run a Python script in the web2py+Eden shell, use:

<syntaxhighlight lang="bash">
edenctl run /path/to/script.py
</syntaxhighlight>

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:Edenctl

2026-02-02T20:05:59Z

Dominic: Created page with "= Server Administration with Edenctl = The '''edenctl''' tool is a ''bash'' script for server administration on Debian/Linux. The general usage of this script is (as root user): <syntaxhighlight lang="bash"> edenctl [command] [parameters] </syntaxhighlight> == Setup and Teardown == To set up a newly installed Eden, run: <syntaxhighlight lang="bash"> edenctl setup </syntaxhighlight> This will run you step-by-step through the setup process. Enter your server details..."

= Server Administration with Edenctl =

The '''edenctl''' tool is a ''bash'' script for server administration on Debian/Linux. The general usage of this script is (as root user):

<syntaxhighlight lang="bash">
edenctl [command] [parameters]
</syntaxhighlight>

== Setup and Teardown ==

To set up a newly installed Eden, run:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

This will run you step-by-step through the setup process. Enter your server details as prompted for (or click enter to accept the default value as shown in square brackets).

The setup command will not work if the Eden instance has already been set up.

Once completed, you can undo the setup with:

<syntaxhighlight lang="bash">
edenctl teardown
</syntaxhighlight>

'''''Note:''' The teardown command will not drop the Eden database - this must be done manually.''

== Start and Stop ==

After the setup, you can start the Eden application using:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

To stop the Eden application and prevent user access, run:

<syntaxhighlight lang="bash">
edenctl stop
</syntaxhighlight>

'''''Note:''' the front-end web server is always running, so that it can deliver a maintenance info-page to the user if Eden is not active - the '''start''' and '''stop''' commands only start/stop the uWSGI daemon.''

== Pull ==

It is possible to upgrade your Eden instance directly from GitHub, using:

<syntaxhighlight lang="bash">
edenctl pull
</syntaxhighlight>

'''''Note:''' It can be necessary to perform certain database migrations after the '''pull''' for Eden to work correctly - always check the release for migration advice.''

== Clean ==

You can reset the Eden database using:

<syntaxhighlight lang="bash">
edenctl clean
</syntaxhighlight>

This will remove all data from the database, and perform a fresh '''first run'''.

'''''Note:''' This operation is primarily intended for demos, and not recommended for production servers.''

== Switching Templates ==

You can switch to a different template using:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE"
</syntaxhighlight>

Instead of a single template, you can also specify a template cascade as a comma-separated list of templates:

<syntaxhighlight lang="bash">
edenctl template "TEMPLATE,TEMPLATE.SUB,TEMPLATE.SUB.Demo"
</syntaxhighlight>

'''''Note:''' After switching templates, you need to reset the instance using <code>edenctl clean</code>.''

Guidelines:DualHost

2026-02-02T19:43:29Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

== Prerequisites and Terminology ==

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

== Preparing the Servers ==

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

== Installing PostgreSQL ==

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

== Setting Up Eden ==

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:SecureOperation

2026-02-02T19:42:50Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

= Secure Server Operation =

The following steps are recommended to secure your Eden server back-end under Debian/Linux.

'''''Note:''' this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.''

== Unprivileged Account ==

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":

<code>
adduser serveradm
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradm
serveradm ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

== Key-based Login ==

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradm -C "serveradm"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradm.pub | ssh serveradm@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradm'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

== Disable Root Login and Password Authentication ==

If you are not logged-in as ''serveradm'' yet, login now (using the private key):

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradm'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:SecureOperation

2026-02-02T19:42:21Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

= Secure Server Operation =

The following steps are recommended to secure your Eden server back-end under Debian/Linux.

'''''Note:''' this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.''

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":

<code>
adduser serveradm
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradm
serveradm ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradm -C "serveradm"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradm.pub | ssh serveradm@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradm'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradm'' yet, login now (using the private key):

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradm'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:DualHost

2026-02-02T19:41:55Z

Dominic: /* Dual Host Setup */

[[Guidelines:Deployment|All Deployment Guidelines]]

= Dual Host Setup =

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:SecureOperation

2026-02-02T19:41:30Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end under Debian/Linux.

'''''Note:''' this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.''

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":

<code>
adduser serveradm
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradm
serveradm ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradm -C "serveradm"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradm.pub | ssh serveradm@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradm'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradm'' yet, login now (using the private key):

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradm'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:DualHost

2026-02-02T19:41:07Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DebianPackages

2026-02-02T19:40:49Z

Dominic:

[[Guidelines:Deployment|All Deployment Guidelines]]

= Debian Packages =

As of version 6.0, Eden provides packaged releases for installation, setup and server administration. Packages for Debian (*.deb) are currently provided as assets attached to the respective GitHub release:

* https://github.com/sahana/eden/releases

Using packaged releases is the recommended setup method for production servers.

== Prerequisites ==

Before starting the installation, you must have a server machine (virtual or bare metal) ready, installed with a suitable '''Debian/Linux''' distribution. As a rule, Eden supports the last two Debian releases ([https://wiki.debian.org/DebianStable stable] and [https://wiki.debian.org/DebianOldStable oldstable]).

'''''Note''': Occasionally, support for the current stable can be delayed while we are fixing incompatibilities - but the oldstable should always be available.''

The server must have access to corresponding Debian repositories in order to install dependencies, either locally or via internet.

You must be able to access the server via '''SSH''' (alternatively physical console), and to become the <code>root</code> user. See our [[Guidelines:SecureOperation]] for recommendations for a safe SSH setup.

Additionally, you will need a '''DNS A-record''' for the intended '''server URL''' pointing to the server's IP address, which you can obtain from your domain services provider. Make sure the server is accessible from the network under that server URL via both HTTP and HTTPs.

'''''Note:''' for setting up with a separate DB host ("Dual Host Setup") see our [[Guidelines:DualHost]] instead.''

== Installation ==

Login to the server via SSH, and make yourself root with <code>sudo su -</code>.

Download the release package matching your Debian version, e.g. for Eden-6.0 on Debian-12 Bookworm:

cd /tmp
<nowiki>wget https://github.com/sahana/eden/releases/download/6.0/sahana-eden-debian12_6.0-1_all.deb</nowiki>

Install the package:

apt-get update
apt-get install -f sahana-eden-debian12_6.0-1_all.deb

This will install all necessary dependencies, including '''PostgreSQL''' with '''PostGIS''', the '''web2py''' framework, the '''nginx''' web server and '''uWSGI''', and finally '''Eden''' itself.

The package also deploys the <code>[[Guidelines:Edenctl|edenctl]]</code> tool to configure and manage the server.

== Configuration ==

If you want to use a custom configuration '''template''', add a symbolic link for it in the <code>/home/web2py/applications/eden/modules/templates</code> directory.

Use <code>[[Guidelines:Edenctl|edenctl]]</code> to configure the Eden instance on your server:

edenctl setup

Enter your server details as you are prompted for them.

'''Tip''': if your server URL is ''eden.example.com'', then the hostname would be ''eden'', and the domain ''example.com''

Edenctl will configure the '''nginx''' web server and set up a '''uWSGI''' daemon to connect it to web2py/Eden. It will also set up and initialize the database, and '''pre-populate''' it with some basic data from the configuration template you selected.

It will also configure SSL (HTTPs) with [https://certbot.eff.org/pages/about Certbot] to manage the server certificate and key.

Once this is done, you can start your Eden instance with

edenctl start

Guidelines:SecureOperation

2026-02-02T19:39:49Z

Dominic: /* Secure Server Operation */

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end under Debian/Linux.

'''''Note:''' this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.''

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":

<code>
adduser serveradm
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradm
serveradm ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradm -C "serveradm"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradm.pub | ssh serveradm@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradm'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradm'' yet, login now (using the private key):

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradm'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:DualHost

2026-02-02T19:39:07Z

Dominic: /* Setting Up Eden */

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.''

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T19:38:53Z

Dominic: /* Configure Host-based Access */

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.''

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DebianPackages

2026-02-02T19:38:30Z

Dominic: /* Debian Packages */

= Debian Packages =

As of version 6.0, Eden provides packaged releases for installation, setup and server administration. Packages for Debian (*.deb) are currently provided as assets attached to the respective GitHub release:

* https://github.com/sahana/eden/releases

Using packaged releases is the recommended setup method for production servers.

== Prerequisites ==

Before starting the installation, you must have a server machine (virtual or bare metal) ready, installed with a suitable '''Debian/Linux''' distribution. As a rule, Eden supports the last two Debian releases ([https://wiki.debian.org/DebianStable stable] and [https://wiki.debian.org/DebianOldStable oldstable]).

'''''Note''': Occasionally, support for the current stable can be delayed while we are fixing incompatibilities - but the oldstable should always be available.''

The server must have access to corresponding Debian repositories in order to install dependencies, either locally or via internet.

You must be able to access the server via '''SSH''' (alternatively physical console), and to become the <code>root</code> user. See our [[Guidelines:SecureOperation]] for recommendations for a safe SSH setup.

Additionally, you will need a '''DNS A-record''' for the intended '''server URL''' pointing to the server's IP address, which you can obtain from your domain services provider. Make sure the server is accessible from the network under that server URL via both HTTP and HTTPs.

'''''Note:''' for setting up with a separate DB host ("Dual Host Setup") see our [[Guidelines:DualHost]] instead.''

== Installation ==

Login to the server via SSH, and make yourself root with <code>sudo su -</code>.

Download the release package matching your Debian version, e.g. for Eden-6.0 on Debian-12 Bookworm:

cd /tmp
<nowiki>wget https://github.com/sahana/eden/releases/download/6.0/sahana-eden-debian12_6.0-1_all.deb</nowiki>

Install the package:

apt-get update
apt-get install -f sahana-eden-debian12_6.0-1_all.deb

This will install all necessary dependencies, including '''PostgreSQL''' with '''PostGIS''', the '''web2py''' framework, the '''nginx''' web server and '''uWSGI''', and finally '''Eden''' itself.

The package also deploys the <code>[[Guidelines:Edenctl|edenctl]]</code> tool to configure and manage the server.

== Configuration ==

If you want to use a custom configuration '''template''', add a symbolic link for it in the <code>/home/web2py/applications/eden/modules/templates</code> directory.

Use <code>[[Guidelines:Edenctl|edenctl]]</code> to configure the Eden instance on your server:

edenctl setup

Enter your server details as you are prompted for them.

'''Tip''': if your server URL is ''eden.example.com'', then the hostname would be ''eden'', and the domain ''example.com''

Edenctl will configure the '''nginx''' web server and set up a '''uWSGI''' daemon to connect it to web2py/Eden. It will also set up and initialize the database, and '''pre-populate''' it with some basic data from the configuration template you selected.

It will also configure SSL (HTTPs) with [https://certbot.eff.org/pages/about Certbot] to manage the server certificate and key.

Once this is done, you can start your Eden instance with

edenctl start

Guidelines:DebianPackages

2026-02-02T19:35:50Z

Dominic: /* Prerequisites */

= Debian Packages =

As of version 6.0, Eden provides packaged releases for installation, setup and server administration. Packages for Debian (*.deb) are currently provided as assets attached to the respective GitHub release:

* https://github.com/sahana/eden/releases

Using packaged releases is the recommended setup method for production servers.

== Prerequisites ==

Before starting the installation, you must have a server machine (virtual or bare metal) ready, installed with a suitable '''Debian/Linux''' distribution. As a rule, Eden supports the last two Debian releases ([https://wiki.debian.org/DebianStable stable] and [https://wiki.debian.org/DebianOldStable oldstable]).

'''''Note''': Occasionally, support for the current stable can be delayed while we are fixing incompatibilities - but the oldstable should always be available.''

The server must have access to corresponding Debian repositories in order to install dependencies, either locally or via internet.

You must be able to access the server via '''SSH''' (alternatively physical console), and to become the <code>root</code> user. See our [[Guidelines:SecureOperation]] for recommendations for a safe SSH setup.

Additionally, you will need a '''DNS A-record''' for the intended '''server URL''' pointing to the server's IP address, which you can obtain from your domain services provider. Make sure the server is accessible from the network under that server URL via both HTTP and HTTPs.

== Installation ==

Login to the server via SSH, and make yourself root with <code>sudo su -</code>.

Download the release package matching your Debian version, e.g. for Eden-6.0 on Debian-12 Bookworm:

cd /tmp
<nowiki>wget https://github.com/sahana/eden/releases/download/6.0/sahana-eden-debian12_6.0-1_all.deb</nowiki>

Install the package:

apt-get update
apt-get install -f sahana-eden-debian12_6.0-1_all.deb

This will install all necessary dependencies, including '''PostgreSQL''' with '''PostGIS''', the '''web2py''' framework, the '''nginx''' web server and '''uWSGI''', and finally '''Eden''' itself.

The package also deploys the <code>[[Guidelines:Edenctl|edenctl]]</code> tool to configure and manage the server.

== Configuration ==

If you want to use a custom configuration '''template''', add a symbolic link for it in the <code>/home/web2py/applications/eden/modules/templates</code> directory.

Use <code>[[Guidelines:Edenctl|edenctl]]</code> to configure the Eden instance on your server:

edenctl setup

Enter your server details as you are prompted for them.

'''Tip''': if your server URL is ''eden.example.com'', then the hostname would be ''eden'', and the domain ''example.com''

Edenctl will configure the '''nginx''' web server and set up a '''uWSGI''' daemon to connect it to web2py/Eden. It will also set up and initialize the database, and '''pre-populate''' it with some basic data from the configuration template you selected.

It will also configure SSL (HTTPs) with [https://certbot.eff.org/pages/about Certbot] to manage the server certificate and key.

Once this is done, you can start your Eden instance with

edenctl start

Guidelines:Deployment

2026-02-02T19:34:22Z

Dominic: /* Installation from Release Package */

= Installation and Setup =

== Installation from Release Package ==

As of version 6.0, Eden provides packaged releases. This is the recommended setup method for production servers. The packages are available as assets attached to the respective GitHub release.

* [[Guidelines:DebianPackages|Installation on Debian/Linux]]
* [[Guidelines:DualHost|Installation on Debian/Linux with separate DB Host]]
* [[Guidelines:Edenctl|Server Setup and Management with edenctl]]
* [[Guidelines:SecureOperation|SSH Setup Recommendations]]

== Installation from GitHub Repository ==

It is also possible to install Eden directly from a GitHub repository. This option is recommended for demos and UAT, where you want to install a development version.

* [[Guidelines:InstallationScripts|Installation and Configuration scripts for Debian/Linux]]
* [[Guidelines:ServiceScripts|Server Setup and Management using traditional Service Scripts]]

Guidelines:DualHost

2026-02-02T19:23:57Z

Dominic: /* Setting Up Eden */

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''Note:''' The actual location and name of the package depends on the release - check on GitHub for the latest available package.

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T19:22:43Z

Dominic: /* Configure Host-based Access */

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

'''Note:''' if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''Note:''' The actual name of the package depends on the release - check the release on GitHub for the latest available package.

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T19:22:32Z

Dominic: /* Setting Up Eden */

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

Note: if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

'''Note:''' The actual name of the package depends on the release - check the release on GitHub for the latest available package.

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T19:21:11Z

Dominic: /* Prerequisites and Terminology */

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Make a note of the IPs, like this:

<pre>
apphost-public-ip 000.000.000.000
apphost-private-ip 000.000.000.000
dbhost-public-ip 000.000.000.000
dbhost-private-ip 000.000.000.000
</pre>

...so that you have them readily at hand when walking through this guide. We will use designations like ''<apphost-public-ip>'', for instance, to refer to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain''':

<pre>
FQDN eden.example.com
Hostname eden
Domain example.com
</pre>

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name as required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

Note: if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T19:15:09Z

Dominic:

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Prerequisites and Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''App Host''' and '''DB Host''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only; in some intranet setups, public IP and private IP may be the same). Thus, a designation like ''apphost-public-ip'', for instance, refers to the public IP of the App Host.

Make sure that you have a '''DNS A-record''' set up for the public IP of the App Host, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''.

This guideline further assumes that you have set up the servers for key-based SSH login (see [[Guidelines:SecureOperation]]) with a non-privileged user account ''serveradm'' (replace this with the actual user name where required).

=== Preparing the Servers ===

First, we need to setup an additional key pair on the App Host, for ''edenctl'' to login at the DB Host. On your local machine, generate a key pair with:

<syntaxhighlight lang="bash">
ssh-keygen -t rsa -m PEM -b 4096 -C "apphost" -f apphost
</syntaxhighlight>

Leave the password empty, as the private key is to be used by the ''edenctl'' script.

This will generate two files <code>apphost</code> and <code>apphost.pub</code> in the local directory. Copy the private key (''apphost'') to the App Host, using the private key of the <code>serveradm</code> user:

<syntaxhighlight lang="bash">
scp -i serveradm apphost serveradm@<apphost-public-ip>:/tmp
</syntaxhighlight>

Install the public key (''apphost.pub'') for the <code>serveradm</code> user on the DB Host:

<syntaxhighlight lang="bash">
cat apphost.pub | ssh -i serveradm serveradm@<dbhost-public-ip> "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</syntaxhighlight>

Login to the App Host:

<syntaxhighlight lang="bash">
ssh -i serveradm serveradm@<apphost-public-ip>
</syntaxhighlight>

Make yourself <code>root</code> and move the private key into a secure location:

<syntaxhighlight lang="bash">
sudo su -
mv /tmp/apphost ~/.ssh/apphost
chown root.root ~/.ssh/apphost
chmod 600 ~/.ssh/apphost
</syntaxhighlight>

Now you should be able to login from the App Host to the DB Host using this key and the private IP of the DB Host:

<syntaxhighlight lang="bash">
ssh -i ~/.ssh/apphost serveradm@<dbhost-private-ip>
</syntaxhighlight>

=== Installing PostgreSQL ===

On the DB Host, make yourself <code>root</code>:

<syntaxhighlight lang="bash">
sudo su -
</syntaxhighlight>

Then install PostgreSQL and PostGIS:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -y postgresql-17 postgresql-17-postgis-3
</syntaxhighlight>

=== Configure Host-based Access ===

You need to tell PostgreSQL that the App Host is permitted to access the DB server. To do so, edit the file <code>/etc/postgresql/17/main/pg_hba.conf</code>, adding the following lines at the end (using the private IP of the App Host):

<syntaxhighlight lang="bash">
# Eden App Host
host all all <apphost-private-ip>/32 md5
</syntaxhighlight>

Note: if your DB Host is behind a firewall, access from this IP/subnet to the port 5432 must be allowed. Adjust your firewall configuration as necessary.

Further, you must tell PostgreSQL to listen on the private IP of the DB Host. For that, edit the file <code>/etc/postgresql/17/main/postgresql.conf</code>, and modify the listen_addresses setting, adding the private IP of the DB Host:

<syntaxhighlight lang="python">
listen_address = '<dbhost-private-ip>,localhost' # what IP address(es) to listen on;
</syntaxhighlight>

Finally, restart PostgreSQL:

<syntaxhighlight lang="bash">
systemctl restart postgresql
</syntaxhighlight>

Logout from the DB Host, going back to the App Host.

=== Setting Up Eden ===

Copy the Eden DEB-package to the App Host - either using <code>scp</code> from your local machine, or <code>wget</code> to fetch it from GitHub, e.g.:

<syntaxhighlight lang="bash">
cd /tmp
wget https://github.com/sahana/eden/releases/download/6.2/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Install the package:

<syntaxhighlight lang="bash">
apt-get update
apt-get install -f /tmp/sahana-eden-debian13_6.2-1_all.deb
</syntaxhighlight>

Create a file <code>/etc/sahana/dbhost.conf</code>, with the details of the DB Host, so that ''edenctl'' can login there:

<syntaxhighlight lang="bash" line>
DBHOST=<dbhost-private-ip>
DBHOST_USER=serveradm
DBHOST_KEY=/root/.ssh/apphost
</syntaxhighlight>

After that, you can set up the Eden instance as usual:

<syntaxhighlight lang="bash">
edenctl setup
</syntaxhighlight>

Eventually, start the Eden instance with:

<syntaxhighlight lang="bash">
edenctl start
</syntaxhighlight>

Guidelines:DualHost

2026-02-02T16:46:44Z

Dominic: Created page with "== Dual Host Setup == In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux: === Terminology === This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''AppHost''' and '''DBHost''' designations here to distinguish between the two. Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only). Thus, a..."

== Dual Host Setup ==

In certain situations, you may want to deploy Eden with a database on a separate host. Follow these steps for Debian/Linux:

=== Terminology ===

This guideline assumes that you have two hosts running on Debian/Linux - we will use the '''AppHost''' and '''DBHost''' designations here to distinguish between the two.

Further, we assume that each host has a '''public IP''' (exposed to the internet) and a '''private IP''' (local network only). Thus, a designation like ''apphost-public-ip'', for instance, refers to the public IP of the AppHost. In some intranet setups, public IP and private IP may be the same.

Make sure that you have a '''DNS A-record''' set up for the public IP of the AppHost, e.g. in the '''FQDN''' (fully qualified domain name) "eden.example.com", the "eden" part constitutes the '''hostname''', and "example.com" the '''domain'''.

Preparing the Servers

''tbc''

Guidelines:SecureOperation

2026-02-02T16:36:28Z

Dominic: /* Secure Server Operation */

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end under Debian/Linux.

Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":

<code>
adduser serveradm
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradm
serveradm ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradm -C "serveradm"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradm.pub | ssh serveradm@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradm'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradm'' yet, login now (using the private key):

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradm'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:SecureOperation

2026-02-02T16:35:45Z

Dominic:

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end.

Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradm":

<code>
adduser serveradm
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradm
serveradm ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradm -C "serveradm"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradm.pub | ssh serveradm@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradm'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradm'' yet, login now (using the private key):

<code>
ssh -i serveradm serveradm@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradm'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:SecureOperation

2026-02-02T16:32:51Z

Dominic: /* Secure Server Operation */

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end.

Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradmin":

<code>
adduser serveradmin
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradmin
serveradmin ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradmin -C "serveradmin"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradmin.pub | ssh serveradmin@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradmin'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradmin'' yet, login now (using the private key):

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradmin'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:SecureOperation

2026-02-02T16:32:37Z

Dominic: /* Secure Server Operation */

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end.

Note: this configuration is standard on many clouds, e.g. AWS EC2, so you do not need to do this manually. Check with your cloud service provider for details.

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradmin":

<code>
adduser serveradmin
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradmin
serveradmin ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradmin -C "serveradmin"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradmin.pub | ssh serveradmin@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradmin'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradmin'' yet, login now (using the private key):

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradmin'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:SecureOperation

2026-02-02T16:31:05Z

Dominic: /* Secure Server Operation */

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end.

Note: this configuration is standard on many clouds, e.g. AWS EC2.

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradmin":

<code>
adduser serveradmin
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradmin
serveradmin ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradmin -C "serveradmin"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradmin.pub | ssh serveradmin@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradmin'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradmin'' yet, login now (using the private key):

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradmin'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:SecureOperation

2026-02-02T16:27:43Z

Dominic: /* Secure Server Operation */

== Secure Server Operation ==

The following steps are recommended to secure your Eden server back-end:

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradmin":

<code>
adduser serveradmin
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradmin
serveradmin ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradmin -C "serveradmin"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradmin.pub | ssh serveradmin@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradmin'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradmin'' yet, login now (using the private key):

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradmin'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:SecureOperation

2026-02-02T16:27:28Z

Dominic: Created page with "== Secure Server Operation == The following steps are recommended to secure your Eden server: === Unprivileged Account === You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradmin": <code> adduser serveradmin </code> Enter a password for the new account when prompted for, and provide additional information as required. To permit the new user to <code>sudo</code> without password, edit the sudoers c..."

== Secure Server Operation ==

The following steps are recommended to secure your Eden server:

=== Unprivileged Account ===

You should use an unprivileged user account for SSH login. To do so, login as root and create a new user, e.g. "serveradmin":

<code>
adduser serveradmin
</code>

Enter a password for the new account when prompted for, and provide additional information as required.

To permit the new user to <code>sudo</code> without password, edit the sudoers configuration file using the command <code>visudo</code>. Add the following lines at the end of the file:

<syntaxhighlight lang="bash" line>
# User rules for serveradmin
serveradmin ALL=(ALL) NOPASSWD:ALL
</syntaxhighlight>

Login to the server using the new account and password, and verify that sudo is working as expected:

<code>
sudo su -
</code>

After that, you should be ''root''.

=== Key-based Login ===

You should use RSA keys for SSH login instead of passwords. To do so, generate a key pair on your local machine:

<code>
ssh-keygen -t rsa -m PEM -b 4096 -f serveradmin -C "serveradmin"
</code>

Choose a passphrase for the private key when prompted (for purposes of script automation, e.g. edenctl, leave the passphrase empty).

Install the public key on the server:

<code>
cat serveradmin.pub | ssh serveradmin@[server-public-ip] "mkdir -p ~/.ssh && chmod 700 ~/.ssh && cat >> ~/.ssh/authorized_keys && chmod 600 ~/.ssh/authorized_keys"
</code>

...replacing [server-public-ip] with the public IP address of the server. You will be prompted for the password of the ''serveradmin'' user.

Next, login to the server using the newly installed key:

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

...to verify everything is working as expected.

You can repeat this process for a second key pair, as/if required, e.g. for a representative or as backup key. Make sure that all private keys are securely stored, and protected by passphrases.

=== Disable Root Login and Password Authentication ===

If you are not logged-in as ''serveradmin'' yet, login now (using the private key):

<code>
ssh -i serveradmin serveradmin@[server-public-up]
</code>

Make yourself ''root'':

<code>
sudo su -
</code>

...and edit the <code>/etc/ssh/sshd_config</code> file. Uncomment or add the following lines:

<syntaxhighlight lang="bash" line>
PermitRootLogin no
PasswordAuthentication no
</syntaxhighlight>

After that, reload the <code>sshd</code> service:

<code>
systemctl reload sshd
</code>

Now, you can no longer SSH-login as ''root'', but only as ''serveradmin'' - and you must use a private key, as passwords will no longer be accepted.

Guidelines:DebianPackages

2025-11-25T11:25:08Z

Dominic: /* Prerequisites */

= Debian Packages =

As of version 6.0, Eden provides packaged releases for installation, setup and server administration. Packages for Debian (*.deb) are currently provided as assets attached to the respective GitHub release:

* https://github.com/sahana/eden/releases

Using packaged releases is the recommended setup method for production servers.

== Prerequisites ==

Before starting the installation, you must have a server machine (virtual or bare metal) ready, installed with a suitable '''Debian/Linux''' distribution. As a rule, Eden supports the last two Debian releases ([https://wiki.debian.org/DebianStable stable] and [https://wiki.debian.org/DebianOldStable oldstable]).

'''''Note''': Occasionally, support for the current stable can be delayed while we are fixing incompatibilities - but the oldstable should always be available.''

The server must have access to corresponding Debian repositories in order to install dependencies, either locally or via internet.

You must be able to access the server via '''SSH''' (alternatively physical console), and to become the <code>root</code> user.

Additionally, you will need a '''DNS A-record''' for the intended '''server URL''' pointing to the server's IP address, which you can obtain from your domain services provider. Make sure the server is accessible from the network under that server URL via both HTTP and HTTPs.

== Installation ==

Login to the server via SSH, and make yourself root with <code>sudo su -</code>.

Download the release package matching your Debian version, e.g. for Eden-6.0 on Debian-12 Bookworm:

cd /tmp
<nowiki>wget https://github.com/sahana/eden/releases/download/6.0/sahana-eden-debian12_6.0-1_all.deb</nowiki>

Install the package:

apt-get update
apt-get install -f sahana-eden-debian12_6.0-1_all.deb

This will install all necessary dependencies, including '''PostgreSQL''' with '''PostGIS''', the '''web2py''' framework, the '''nginx''' web server and '''uWSGI''', and finally '''Eden''' itself.

The package also deploys the <code>[[Guidelines:Edenctl|edenctl]]</code> tool to configure and manage the server.

== Configuration ==

If you want to use a custom configuration '''template''', add a symbolic link for it in the <code>/home/web2py/applications/eden/modules/templates</code> directory.

Use <code>[[Guidelines:Edenctl|edenctl]]</code> to configure the Eden instance on your server:

edenctl setup

Enter your server details as you are prompted for them.

'''Tip''': if your server URL is ''eden.example.com'', then the hostname would be ''eden'', and the domain ''example.com''

Edenctl will configure the '''nginx''' web server and set up a '''uWSGI''' daemon to connect it to web2py/Eden. It will also set up and initialize the database, and '''pre-populate''' it with some basic data from the configuration template you selected.

It will also configure SSL (HTTPs) with [https://certbot.eff.org/pages/about Certbot] to manage the server certificate and key.

Once this is done, you can start your Eden instance with

edenctl start

Guidelines:DebianPackages

2025-11-25T11:24:28Z

Dominic: /* Prerequisites */

= Debian Packages =

As of version 6.0, Eden provides packaged releases for installation, setup and server administration. Packages for Debian (*.deb) are currently provided as assets attached to the respective GitHub release:

* https://github.com/sahana/eden/releases

Using packaged releases is the recommended setup method for production servers.

== Prerequisites ==

Before starting the installation, you should have a server machine (virtual or bare metal) ready, installed with a suitable '''Debian/Linux''' distribution. As a rule, Eden supports the last two Debian releases ([https://wiki.debian.org/DebianStable stable] and [https://wiki.debian.org/DebianOldStable oldstable]).

'''''Note''': Occasionally, support for the current stable can be delayed while we are fixing incompatibilities - but the oldstable should always be available.''

The server must have access to corresponding Debian repositories in order to install dependencies, either locally or via internet.

You must be able to access the server via '''SSH''' (alternatively physical console), and to become the <code>root</code> user.

Additionally, you will need a '''DNS A-record''' for the intended '''server URL''' pointing to the server's IP address, which you can obtain from your domain services provider. Make sure the server is accessible from the network under that server URL via both HTTP and HTTPs.

== Installation ==

Login to the server via SSH, and make yourself root with <code>sudo su -</code>.

Download the release package matching your Debian version, e.g. for Eden-6.0 on Debian-12 Bookworm:

cd /tmp
<nowiki>wget https://github.com/sahana/eden/releases/download/6.0/sahana-eden-debian12_6.0-1_all.deb</nowiki>

Install the package:

apt-get update
apt-get install -f sahana-eden-debian12_6.0-1_all.deb

This will install all necessary dependencies, including '''PostgreSQL''' with '''PostGIS''', the '''web2py''' framework, the '''nginx''' web server and '''uWSGI''', and finally '''Eden''' itself.

The package also deploys the <code>[[Guidelines:Edenctl|edenctl]]</code> tool to configure and manage the server.

== Configuration ==

If you want to use a custom configuration '''template''', add a symbolic link for it in the <code>/home/web2py/applications/eden/modules/templates</code> directory.

Use <code>[[Guidelines:Edenctl|edenctl]]</code> to configure the Eden instance on your server:

edenctl setup

Enter your server details as you are prompted for them.

'''Tip''': if your server URL is ''eden.example.com'', then the hostname would be ''eden'', and the domain ''example.com''

Edenctl will configure the '''nginx''' web server and set up a '''uWSGI''' daemon to connect it to web2py/Eden. It will also set up and initialize the database, and '''pre-populate''' it with some basic data from the configuration template you selected.

It will also configure SSL (HTTPs) with [https://certbot.eff.org/pages/about Certbot] to manage the server certificate and key.

Once this is done, you can start your Eden instance with

edenctl start

Guidelines:DebianPackages

2025-11-25T11:23:59Z

Dominic: /* Prerequisites */

= Debian Packages =

As of version 6.0, Eden provides packaged releases for installation, setup and server administration. Packages for Debian (*.deb) are currently provided as assets attached to the respective GitHub release:

* https://github.com/sahana/eden/releases

Using packaged releases is the recommended setup method for production servers.

== Prerequisites ==

Before starting the installation, you should have a server machine (virtual or bare metal) ready, installed with a suitable '''Debian/Linux''' distribution. As a rule, Eden supports the last two Debian releases ([https://wiki.debian.org/DebianStable stable] and [https://wiki.debian.org/DebianOldStable oldstable]).

'''''Note''': Occasionally, support for the current stable can be delayed while we are fixing incompatibilities - but the oldstable should always be available.''

The server should have access to corresponding Debian repositories in order to install dependencies, either locally or via internet.

You should be able to access the server via '''SSH''' (alternatively physical console), and to become the <code>root</code> user.

Additionally, you will need a '''DNS A-record''' for the intended '''server URL''' pointing to the server's IP address, which you can obtain from your domain services provider. Make sure the server is accessible from the network under that server URL via both HTTP and HTTPs.

== Installation ==

Login to the server via SSH, and make yourself root with <code>sudo su -</code>.

Download the release package matching your Debian version, e.g. for Eden-6.0 on Debian-12 Bookworm:

cd /tmp
<nowiki>wget https://github.com/sahana/eden/releases/download/6.0/sahana-eden-debian12_6.0-1_all.deb</nowiki>

Install the package:

apt-get update
apt-get install -f sahana-eden-debian12_6.0-1_all.deb

This will install all necessary dependencies, including '''PostgreSQL''' with '''PostGIS''', the '''web2py''' framework, the '''nginx''' web server and '''uWSGI''', and finally '''Eden''' itself.

The package also deploys the <code>[[Guidelines:Edenctl|edenctl]]</code> tool to configure and manage the server.

== Configuration ==

If you want to use a custom configuration '''template''', add a symbolic link for it in the <code>/home/web2py/applications/eden/modules/templates</code> directory.

Use <code>[[Guidelines:Edenctl|edenctl]]</code> to configure the Eden instance on your server:

edenctl setup

Enter your server details as you are prompted for them.

'''Tip''': if your server URL is ''eden.example.com'', then the hostname would be ''eden'', and the domain ''example.com''

Edenctl will configure the '''nginx''' web server and set up a '''uWSGI''' daemon to connect it to web2py/Eden. It will also set up and initialize the database, and '''pre-populate''' it with some basic data from the configuration template you selected.

It will also configure SSL (HTTPs) with [https://certbot.eff.org/pages/about Certbot] to manage the server certificate and key.

Once this is done, you can start your Eden instance with

edenctl start