Bus2Go - A Foss Transit App

Note: This guide was only tested on a linux machine. Although Bus2Go-Backend should be able to be ran under different operating systems, you may need to follow different steps in order to achieve the same thing.

Note: This guide uses nftables as the firewall. If you use utilities such as ufw, docker bypasses those, so you need to make sure to modify the lower level configurations.

What you will need to have installed:

Git
Docker and Docker Compose
Some sort of SSL certificate signing tool (like openssl) or a reverse proxy

Steps to take:

Clone the server repository at https://github.com/afg360/bus2go-backend using git:
```
git clone "https://github.com/afg360/bus2go-backend"
```
Copied!
Modify the .env.example file by changing its name to .env, and add the necessary information in it (by following the comments in the file).
At this stage, you may run docker compose up -d, and the server will be initialised and run. However, if you try to use it with the app, chances are SSL will not be configured which will not allow the app to work properly.

If you are not using a reverse proxy, do the following:
1. Create a directory called ssl-certs in the project.
2. Use openssl to generate a new key-value pair in this directory. You can use the following command:
```
openssl req -x509 -newkey rsa:4096 -keyout ./ssl-certs/private.key.pem -out ./ssl-certs/domain.cert.pem -sha256 -days <num-days> -nodes -subj "/O=<your-ip>/CN=Bus2Go"
```
  Copied!
  Replace with the number of days you would like the certificate to last, and with the ip of the machine you will be running the application on. Use ip address to get the ip address for your network interface.
3. Add the necessary paths in your .env file if not done already.
4. Run docker compose to intialise and run the application:
```
docker compose --profile api up -d
```
  Copied!
SSL should now be configured. Know that the certificates you created are self-signed, meaning they will still appear as non-secure, however your traffic will be encrypted as needed for the application.
You will need to make sure your firewall is configured to properly be used with docker to allow for incoming connections.

Important: be careful on modifying firewall rules, as those can have serious security implications related to your network!
1. Add the line "firewall-backend": "nftables" to your /etc/docker/daemon.json file to make sure docker uses nftables. If it doesn't exist, create the file and instead write:
```
{
	"firewall-backend": "nftables"
}
```
  Copied!
2. Merge the following lines to your /etc/nftables.conf file, focusing on the "chain forward" part:
```
table inet filter {
	#do not edit this chain
	chain input {
		#stuff should already be defined here, do not edit this part
	}

	#chain that needs to be added or modified if it already exists
	chain forward {
		type filter hook forward priority filter; policy drop;
		ct state established,related accept
		ct state invalid drop
		# Allow incoming traffic to containers with published ports
		ct status dnat accept	
		# Restrict inbound forwarding to a specific subnet (optional, recommended for home networks):
		# ct status dnat ip saddr { <your-ip-subnet> } accept 
		iifname "br-*" oifname "your-network-interface" accept
		iifname "docker0" oifname "your-network-interface" accept
		iifname "docker0" oifname "docker0" accept
	}
}
```
  Copied!
  Replace <your-ip-subnet> with the IP range you want to allow (e.g., 10.0.0.0/8 or 192.168.1.0/24).
  
  Replace your-network-interface (keep the quotes) with the WAN/LAN network interface of your device (e.g., wlan0 or enp3s0). You can find it using the ip address command.
  
  You may need to make slight adjustments depending on your base firewall configuration.
3. Restart nftables and docker using the following commands
```
systemctl restart nftables
systemctl restart docker
```
  Copied!
Find your server's local IP address by running
```
ip route get 1.1.1.1
```
Copied!
Look for the value right after src (e.g., src 192.168.1.50). That is the exact IP address your server uses to communicate on your network.
You can finally add that ip address to Bus2Go by going to the settings and blabla

User Guide to Self-Host the Bus2Go Backend Application

What you will need to have installed:

Steps to take: