Deploy with AWS

By leveraging Amazon Web Services (AWS) to deploy Rocket.Chat on an EC2 instance, organizations can unlock a host of benefits, from scalability and reliability to cost-effectiveness and simplified management.

Preparation steps

The minimum requirement to run Rocket.Chat successfully is 2Gb 2 cores. You need an active AWS account to proceed with the deployment.

For deployments approaching 1000 concurrent users and above, deploy with Kubernetes is recommended.

In this guide, you'll learn how to:

• Host Rocket.Chat on an EC2 instance with a domain name.

• Secure your Rocket.Chat server with a free SSL certificate from Let's Encrypt.

Deploying Rocket.Chat on an EC2 instance

Launching an EC2 instance

To create a new EC2 instance:

• Log into your AWS console, and open the EC2 Service.

• From the sidebar, click Instances. Then, click Launch Instances to set up a new EC2 instance.

• Set the instance name and select at least Ubuntu Server 18.04 LTS with 64-bit (x86) architecture as the OS image.

• Select an instance type of your choice according to the Cores recommendation above. For example, t3.large.

• Choose an existing key pair or create a new one for SSH connections

• Allow SSH, HTTP, and HTTPS traffic in the security group configuration

• Adjust the instance details, storage size, and other configurations, or keep the defaults.

• Proceed to Summary to review your instance configurations.

• Then, click Launch Instance.

Allocating an Elastic IP

Allocating an elastic IP is optional. However, it is essential to understand that unlike instance addresses which can change upon restart, Elastic IPs are static. They remain consistent throughout the instance lifecycle and can be easily reattached to different instances, making them ideal for scenarios where you need to move your instance or change configurations.

Follow these steps to allocate an elastic IP to an instance:

• From the EC2 service dashboard, click Elastic IPs.

• Click Allocate Elastic IP address.

• Select Amazon's pool of IPv4 addresses, and click Allocate.

• Click and open the newly created IP address and select Associate Elastic IP address.

• Select your instance and click Associate.

• In the details below, copy the Public DNS. You will need it to configure the DNS. The format looks like this: ec2-18-XXX-XXX-XXX.eu-central-1.compute.amazonaws.com

Allocating an elastic IP address to your instance is optional. You can proceed with using the Public IPv4 address of your instance for configuring your DNS.

Configuring DNS with AWS Route 53

Route 53 allows you to manage all domain names and DNS records in one place. This simplifies administration and allows you to create various record types (A records, CNAME records, etc.) to direct your domain names to resources.

To configure, open the Route 53 service dashboard and navigate to Hosted Zones.

If you already have a hosted zone, follow these steps:

• Select the hosted zone.

• Click Create Record.

• Add a subdomain in the form of the record name.

• Select the record type “A,” which points to an IP address. In this case, the IP address refers to the “Public IPv4 address” from the created instance in earlier steps.

• Click Create Records to create a new record within the hosted zone.

Take note of the subdomain created here, as you will need it later.

If you do not have a hosted zone, follow these steps instead:

• Click Create Hosted Zone.

• Enter your domain name and select Public Hosted Zone as the type. Click the Create hosted zone button.

• Select your newly created zone and click Create Record Set.

• Enter "www" as a subdomain (if desired), select Type CNAME, enter the Public DNS name you copied from the elastic IP to the value field, and click Create.

Get an SSL certificate from Let's Encrypt

Use Let's Encrypt to get a free & open-source SSL certificate by following these steps:

• SSH to your instance.

ssh -i <path_to_key_file.pem> ubuntu@<public_ip_address>

If your DNS has resolved, you may replace the IP address with your domain name.

• Install certbot using apt:

sudo apt update
sudo apt install certbot

• Obtain a certificate from Let's Encrypt by running this command:

sudo certbot certonly --standalone --email <[email protected]> -d <domain.com> -d <subdomain.domain.com>

A second (or more) domain is optional.

[Optional] Restrict access using security groups

Adjust the security groups again if you want to restrict traffic to your AWS instance. Make sure you allow "TCP/22" from your current location for the SSH connection, as well as "TCP/443" from the location you wish to use to access from.

Configure Nginx web server with TLS/SSL

Rocket.Chat is usually set to run on port 3000 by default. However, you can make it more accessible to your users by using Nginx as a reverse proxy. This will link your domain name to the Rocket.Chat server running on that port. By doing this, your users can access your workspace through your domain name (example.com) instead of directly using the port in the URL (example.com:3000).

• Install Nginx web server:

 sudo apt-get install nginx

• Backup the default config file for reference:

 cd /etc/nginx/sites-available
 sudo mv default default.reference

• Create a new site configuration for Rocket.Chat:

 sudo nano /etc/nginx/sites-available/default

 server {
     listen 443 ssl;

     server_name <ABC.DOMAIN.COM>;

     ssl_certificate /etc/letsencrypt/live/<ABC.DOMAIN.COM>/fullchain.pem;
     ssl_certificate_key /etc/letsencrypt/live/<ABC.DOMAIN.COM>/privkey.pem;
     ssl_protocols TLSv1 TLSv1.1 TLSv1.2;
     ssl_prefer_server_ciphers on;
     ssl_ciphers 'EECDH+AESGCM:EDH+AESGCM:AES256+EECDH:AES256+EDH';

     root /usr/share/nginx/html;
     index index.html index.htm;

     # Make site accessible from http://localhost/
     server_name localhost;

     location / {
         proxy_pass http://localhost:3000/;
         proxy_http_version 1.1;
         proxy_set_header Upgrade $http_upgrade;
         proxy_set_header Connection "upgrade";
         proxy_set_header Host $http_host;
         proxy_set_header X-Real-IP $remote_addr;
         proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
         proxy_set_header X-Forwarded-Proto http;
         proxy_set_header X-Nginx-Proxy true;
         proxy_redirect off;
     }
 }

 server {
     listen 80;

     server_name <ABC.DOMAIN.COM>;

     return 301 https://$host$request_uri;
 }

Ensure to update ABC.DOMAIN.COM with your domain name. Update it in the path to your key files as well.

• Test the Nginx configuration to make sure there are no syntax errors

sudo nginx -t

• If the syntax test is successful, restart Nginx:

sudo systemctl restart nginx

Confirm it is running correctly by opening a web browser and entering your domain name. A "502 Bad Gateway" page is expected since the Rocket.Chat backend is not yet running. Ensure the SSL connection works appropriately by clicking the lock icon next to the address bar. Confirm the connection is valid and secure using HTTPS.

Install Rocket.Chat

Now that your EC2 instance and domain are ready, SSH into your instance and follow our deploy with Docker & Docker Compose guide to set up your Rocket.Chat workspace. Once your workspace is running, log in to your site at https://ABC.DOMAIN.COM.The first user to log in will be the workspace administrator.