2 files changed, 73 insertions, 0 deletions
diff --git a/rust/README.md b/rust/README.md
index d0480b87..78adfc48 100644
--- a/rust/README.md
+++ b/rust/README.md
@@ -47,6 +47,40 @@ Tests:
 
     cargo test -- --test-threads 1
 
+## Simple Deployment
+
+On a bare server, as root:
+
+    # TODO: ansiblize this
+    adduser fatcat
+    apt install postgresql-9.6 postgresql-contrib postgresql-client-9.6 \
+        nginx build-essential git pkg-config libssl-dev libpq-dev \
+        htop screen
+    mkdir -p /srv/fatcat
+    chown fatcat:fatcat /srv/fatcat
+
+    # setup new postgres user
+    su - postgres
+    createuser -P -s fatcat     # strong random password
+    # DELETE: createdb fatcat
+
+    # as fatcat user
+    su - fatcat
+    ssh-keygen
+    curl https://sh.rustup.rs -sSf | sh
+    source $HOME/.cargo/env
+    cargo install diesel_cli --no-default-features --features "postgres"
+    cd /srv/fatcat
+    git clone git@git.archive.org:webgroup/fatcat
+    cd rust
+    cargo build
+    echo "DATABASE_URL=postgres://fatcat@localhost/fatcat" > .env
+    diesel database reset
+
+    # as fatcat, in a screen or something
+    cd /srv/fatcat/fatcat/rust
+    cargo run
+
 ### Special Tricks
 
 Regenerate API schemas:
diff --git a/rust/nginx-example b/rust/nginx-example
new file mode 100644
index 00000000..13c1da99
--- /dev/null
+++ b/rust/nginx-example
@@ -0,0 +1,39 @@
+
+upstream fatcatd {
+    server localhost:9411;
+}
+
+server {
+    listen 80;
+    listen [::]:80;
+    listen 443 ssl spdy;
+    listen [::]:443 ssl spdy;
+    server_name  api.fatcat.wiki;
+
+     ssl_certificate /etc/letsencrypt/live/fatcat.wiki/fullchain.pem;
+     ssl_certificate_key /etc/letsencrypt/live/fatcat.wiki/privkey.pem;
+
+     #add_header Content-Security-Policy "default-src 'self' 'unsafe-inline' 'unsafe-eval'; style-src 'self' 'unsafe-inline'";
+     add_header X-Frame-Options "SAMEORIGIN";       # 'always' if nginx > 1.7.5
+     add_header X-Content-Type-Options "nosniff";   # 'always' if nginx > 1.7.5
+     add_header X-Xss-Protection "1";
+     # Enable STS with one year period (breaks http; optional)
+     #add_header Strict-Transport-Security "max-age=31557600; includeSubDomains";
+
+    access_log  /var/log/nginx/access.log;
+
+    location / {
+        root   /srv/http/default/www/;
+        proxy_set_header  X-Real-IP  $remote_addr;
+        proxy_set_header  X-Forwarded-For $proxy_add_x_forwarded_for;
+        proxy_set_header Host $http_host;
+        proxy_redirect off;
+        proxy_pass http://fatcatd;
+    }
+
+    # Let's Encrypt SSL Certs
+    location /.well-known/acme-challenge/ {
+        root /var/www/letsencrypt;
+        autoindex off;
+    }
+}