# Deploying the Wiki Securely (HTTPS, nginx, systemd)

This page outlines a recommended production deployment for the protected wiki served at `/wiki/`.

Requirements (recommended):

- A Linux server (Ubuntu/Debian recommended)
- Python 3.10+ and a virtualenv
- `gunicorn` to serve the Flask app in production
- `nginx` as a reverse proxy and TLS terminator (Let's Encrypt certs)
- `certbot` (for acquiring TLS certificates)

1) Create a virtualenv and install requirements

    python -m venv venv
    source venv/bin/activate
    pip install -r requirements.txt gunicorn

2) Build the documentation site (so Flask can serve `site/`)

    python -m mkdocs build

3) Example `gunicorn` systemd service (`/etc/systemd/system/dampro.service`)

    [Unit]
    Description=DAM Pro Flask app
    After=network.target

    [Service]
    User=www-data
    Group=www-data
    WorkingDirectory=/path/to/stitch_digital_asset_manager_pro
    Environment="FLASK_SECRET=replace-with-long-random-string"
    Environment="PATH=/path/to/venv/bin:/usr/bin"
    ExecStart=/path/to/venv/bin/gunicorn --bind 127.0.0.1:8000 server:app

    [Install]
    WantedBy=multi-user.target

4) Example `nginx` config to terminate TLS and proxy to `gunicorn`:

    server {
        listen 80;
        server_name example.com;
        return 301 https://$host$request_uri;
    }

    server {
        listen 443 ssl;
        server_name example.com;

        ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
        ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;

        location / {
            proxy_pass http://127.0.0.1:8000/;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;
        }

        # Optional: restrict access to the /wiki/ path to only allow authenticated
        # sessions handled by the Flask app. Flask will redirect unauthenticated
        # requests to /sign_in.html as configured.
    }

5) Acquire TLS cert with Certbot

    sudo certbot --nginx -d example.com

6) Security recommendations

- Set a strong `FLASK_SECRET` environment variable (keep it private).
- Run the app under a dedicated unprivileged user (e.g., `www-data`).
- Use a real database (Postgres/MySQL) and environment-specific config for production.
- Enforce HTTPS and set secure cookie flags (Flask `SESSION_COOKIE_SECURE=True`).

If you'd like, I can add a small `deploy/` folder with a sample `systemd` unit and Nginx config tailored to your domain.

« Previous Next »