Firefly III with MariaDB and Nginx Reverse Proxy

This repository contains the necessary configuration to deploy Firefly III (a personal finance manager) with MariaDB as the database, running behind an Nginx reverse proxy with proper SSL termination.

The architecture follows this flow:

Overview

The setup consists of:

1. Firefly III - Personal finance management application
2. MariaDB - Database for Firefly III
3. Nginx - Reverse proxy handling SSL and forwarding requests to the application
4. Certbot - For automatic SSL certificate management

Prerequisites

• A server with a static IP address
• A domain name pointed to your server's IP
• Docker and Docker Compose installed
• Nginx installed on the host system (not in Docker)
• Basic knowledge of server administration

Setup Instructions

1. Domain and DNS Configuration

1. Register a domain or use an existing one
2. Set up Cloudflare as your DNS provider:
   • Add an A record pointing your domain to your server's static IP
   • Set Proxy status to OFF initially
   • Set SSL/TLS encryption mode to FULL
   • Configure WAF rules as needed (e.g., whitelist by country or IP)

2. Docker Setup for Firefly III

1. Clone this repository:

   git clone https://github.com/nim444/firefly-mariadb-nginx-self-hosted.git
   cd firefly-mariadb-nginx-self-hosted

2. Create environment files:

   Create .env file for Firefly III:

   cp .env.example .env
   nano .env

   Update the following variables:

   • APP_KEY: Generate with openssl rand -base64 32
   • APP_URL: Set to your domain (e.g., https://yourdomain.ro)
   • STATIC_CRON_TOKEN: Generate with openssl rand -base64 32 (ensure it's exactly 32 characters)
   • TZ: Your timezone (e.g., Europe/Bucharest)
   • Other database credentials (must match .db.env)

   Create .db.env file for MariaDB:

   nano .db.env

   Add the following variables:

   MYSQL_ROOT_PASSWORD=strong_root_password
   MYSQL_USER=firefly
   MYSQL_PASSWORD=fireflypass
   MYSQL_DATABASE=firefly
   

3. Start the Docker containers:

   docker compose up -d

4. Verify containers are running:

   docker ps

5. Test if the application is accessible locally:

   curl localhost:8777

3. Nginx Configuration

1. Create a new Nginx site configuration:

   sudo nano /etc/nginx/sites-available/yourdomain.ro

2. Add the configuration from nginx-reverse-proxy.conf:

   server {
       listen 80;
       server_name yourdomain.ro www.yourdomain.ro;
   
       location / {
           proxy_pass http://localhost:8777;
   
           proxy_set_header Host $host;
           proxy_set_header X-Real-IP $remote_addr;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_set_header X-Forwarded-Proto $scheme;
   
           proxy_http_version 1.1;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection "upgrade";
       }
   }

3. Enable the site and test Nginx configuration:

   sudo ln -s /etc/nginx/sites-available/yourdomain.ro /etc/nginx/sites-enabled/
   sudo nginx -t
   sudo systemctl reload nginx

4. SSL Certificate with Certbot

1. Install Certbot:

   sudo snap install --classic certbot
   sudo ln -s /snap/bin/certbot /usr/bin/certbot

2. Obtain SSL certificate:

   sudo certbot --nginx

   Follow the prompts to configure SSL for your domain.

3. Test automatic renewal:

   sudo certbot renew --dry-run

5. Firewall Configuration

1. Configure UFW (Uncomplicated Firewall):

   sudo ufw allow 'Nginx Full'
   sudo ufw allow 'OpenSSH'
   sudo ufw enable
   sudo ufw status

2. Install Fail2Ban for SSH protection:

   sudo apt install fail2ban
   sudo systemctl enable fail2ban
   sudo systemctl start fail2ban

Troubleshooting

If you encounter issues, here are some commands to help diagnose problems:

1. Check if Nginx is listening on port 80:

   sudo lsof -i :80

2. View Nginx logs:

   sudo journalctl -xeu nginx
   cat /var/log/nginx/error.log

3. Check Docker container status:

   docker ps
   docker logs firefly_iii_core
   docker logs firefly_iii_db

4. View firewall status:

   sudo ufw status

Maintenance

Updating Firefly III

To update to the latest version:

docker compose down
docker compose pull
docker compose up -d

Certificate Renewal

Certbot automatically renews certificates before they expire. To manually trigger renewal:

sudo certbot renew

Security Recommendations

1. Keep your server updated with security patches
2. Regularly backup your database (the volume firefly_iii_db)
3. Use strong passwords for all services
4. Consider implementing additional security measures in Cloudflare (rate limiting, etc.)
5. Monitor server logs for suspicious activity

---