1. Recommended Production Model

For a small or medium public deployment, the safest baseline is:

• OVH Public Cloud instance in the nearest region to your users
• Ubuntu 25.04
• Cloudflare proxy for the main website
• Nginx on the origin server
• Let's Encrypt certificate on the origin
• Cloudflare SSL/TLS mode set to Full (strict)
• Node 20 LTS via nvm (Node Version Manager)
• systemd for process supervision
• ufw on the box
• Only open the extra streaming ports you actively use

2. What OpenVibe.Live Exposes

The current server in server/index.js provides:

• HTTP on PORT, default 3000
• WebSocket upgrades on /ws/chat, /ws/broadcast, /ws/control, and /ws/call
• Optional RTMP ingest
• Optional JSMPEG relay
• Optional WebRTC / mediasoup
• Persistent data under data/

Typical ports

3. OVH Instance Creation

From the OVH "Create an instance" flow:

• Template: your chosen instance flavor, e.g. B3-16
• Region: nearest to your users, e.g. Seattle / US-WEST-LZ-SEA-A
• Image: Ubuntu 25.04
• SSH key: required

So for this deployment, generate either:

• ECDSA P-384 — recommended if OVH accepts it in your project flow
• RSA 4096 — safest fallback for maximum compatibility

4. Generate an SSH Key for OVH

Run these commands on your local machine, not on the server.

Option A: ECDSA P-384 key

mkdir -p ~/.ssh
chmod 700 ~/.ssh
ssh-keygen -t ecdsa -b 384 -f ~/.ssh/ovh_openvibelive_ecdsa -C "ovh-openvibelive"

Option B: RSA 4096 key

mkdir -p ~/.ssh
chmod 700 ~/.ssh
ssh-keygen -t rsa -b 4096 -o -a 100 -f ~/.ssh/ovh_openvibelive_rsa -C "ovh-openvibelive"

Lock down the private key

# ECDSA
chmod 600 ~/.ssh/ovh_openvibelive_ecdsa
chmod 644 ~/.ssh/ovh_openvibelive_ecdsa.pub

# RSA
chmod 600 ~/.ssh/ovh_openvibelive_rsa
chmod 644 ~/.ssh/ovh_openvibelive_rsa.pub

Print the public key to paste into OVH

# ECDSA
cat ~/.ssh/ovh_openvibelive_ecdsa.pub

# RSA
cat ~/.ssh/ovh_openvibelive_rsa.pub

Copy the entire single-line public key into the OVH SSH key field.

Test the key fingerprint locally

# ECDSA
ssh-keygen -lf ~/.ssh/ovh_openvibelive_ecdsa.pub

# RSA
ssh-keygen -lf ~/.ssh/ovh_openvibelive_rsa.pub

5. Import the SSH Key into OVH

1. Go to your Public Cloud project
2. Open the SSH keys area, or paste the key directly during instance creation
3. Give the key a clear name, e.g. openvibelive-seattle-prod
4. Paste the public key line from the .pub file
5. Create the instance with that key attached

6. Connect to the New Instance

After the instance is created and shows as ready, connect over SSH. Most OVH Ubuntu images use the ubuntu user.

ECDSA example

ssh -i ~/.ssh/ovh_openvibelive_ecdsa ubuntu@YOUR_SERVER_IP

RSA example

ssh -i ~/.ssh/ovh_openvibelive_rsa ubuntu@YOUR_SERVER_IP

Optional: SSH config alias

Host openvibe.tools
    HostName YOUR_SERVER_IP
    User ubuntu
    IdentityFile ~/.ssh/ovh_openvibelive_ecdsa
    IdentitiesOnly yes

Then connect with:

ssh openvibe.tools

7. First-Login Hardening

Run these commands on the server.

Update the box

sudo apt update
sudo apt full-upgrade -y
sudo apt autoremove -y

Install baseline packages

sudo apt install -y \
  git curl wget unzip ca-certificates gnupg \
  nginx ffmpeg ufw fail2ban \
  build-essential python3 python3-pip jq

Optional: create a dedicated app user

sudo adduser --disabled-password --gecos "" openvibelive
sudo usermod -aG sudo openvibelive

Then add your public key for that user:

sudo mkdir -p /home/openvibelive/.ssh
sudo nano /home/openvibelive/.ssh/authorized_keys
sudo chown -R openvibelive:openvibelive /home/openvibelive/.ssh
sudo chmod 700 /home/openvibelive/.ssh
sudo chmod 600 /home/openvibelive/.ssh/authorized_keys

Harden SSH

sudo nano /etc/ssh/sshd_config

Recommended settings:

PermitRootLogin no
PasswordAuthentication no
PubkeyAuthentication yes
ChallengeResponseAuthentication no
UsePAM yes
X11Forwarding no

Reload SSH:

sudo systemctl reload ssh

8. Install Node.js via nvm

We use nvm (Node Version Manager) instead of system packages. This avoids the recurring /usr/bin/env: 'node': No such file or directory problem where NodeSource installs node somewhere systemd can't find it.

Install nvm

curl -o- https://raw.githubusercontent.com/nvm-sh/nvm/v0.40.4/install.sh | bash

Close and reopen your terminal (or source your profile) so nvm is available:

source ~/.bashrc
command -v nvm          # should print "nvm"

Install Node 20 LTS

nvm install 20
nvm alias default 20    # make it the default for new shells
node -v
npm -v

Verify

which node   # e.g. /home/ubuntu/.nvm/versions/node/v20.x.x/bin/node
which npm    # same nvm-managed path

9. Clone OpenVibe.Live

cd /opt
sudo git clone https://github.com/OpenVibe.Live/OpenVibe.Live.com.git openvibelive
sudo chown -R $USER:$USER /opt/openvibelive
cd /opt/openvibelive
npm install

If native modules later need rebuilding:

npm rebuild

10. Configure .env

cd /opt/openvibelive
cp .env.example .env
nano .env

Recommended starting .env

ADMIN_USERNAME=admin
ADMIN_PASSWORD=change-this-now

NODE_ENV=production
HOST=0.0.0.0
PORT=3000
BASE_URL=https://your-domain.example
JWT_SECRET=replace-with-a-long-random-secret

DATABASE_URL=postgres://live_runtime:password@localhost:5432/ov_live
DATABASE_DIRECT_URL=postgres://live_owner:password@localhost:5432/ov_live

RTMP_PORT=1935
JSMPEG_VIDEO_PORT=9710
JSMPEG_AUDIO_PORT=9711
WEBRTC_PORT=4443
MEDIASOUP_LISTEN_IP=0.0.0.0
MEDIASOUP_ANNOUNCED_IP=YOUR_PUBLIC_IP
MEDIASOUP_MIN_PORT=10000
MEDIASOUP_MAX_PORT=10100

VOD_PATH=./data/vods
CLIPS_PATH=./data/clips
THUMBNAILS_PATH=./data/thumbnails
EMOTES_PATH=./data/emotes

MAX_VOD_SIZE_MB=128
MAX_EMOTE_SIZE_KB=128
MAX_EMOTES_PER_USER=10

MIN_CASHOUT=5
ESCROW_HOLD_DAYS=14

Generate a strong JWT secret

openssl rand -hex 32

11. Create Runtime Directories

The app creates them on boot, but you can pre-create them:

cd /opt/openvibelive
mkdir -p data/vods data/clips data/media data/thumbnails data/emotes data/avatars

12. Bootstrap the App

Initialize the database if needed:

cd /opt/openvibelive
npm run init-db

Or just start it once manually:

npm start

Then stop it and move on to systemd setup.

13. Cloudflare DNS Setup

Main website

Create these records in Cloudflare DNS:

• A record for @ pointing at YOUR_OVH_PUBLIC_IP
• CNAME for www pointing at your apex hostname

Set both to Proxied (orange cloud) after the origin is working.

Optional: direct hostnames for non-HTTP protocols

Only create these if you really need them:

14. Let's Encrypt on Ubuntu 25.04

For end-to-end encryption with Cloudflare, the origin must present a valid certificate. Cloudflare's Full (strict) mode requires the origin cert to be unexpired, valid for the hostname, and issued by a publicly trusted CA.

Install Certbot

sudo apt install -y snapd
sudo snap install core
sudo snap refresh core
sudo snap install --classic certbot
sudo ln -sf /snap/bin/certbot /usr/local/bin/certbot
certbot --version

Temporary Nginx HTTP site

Before requesting the cert, create a plain HTTP Nginx site so your domain answers on port 80.

sudo nano /etc/nginx/sites-available/openvibelive

server {
    listen 80;
    listen [::]:80;
    server_name your-domain.example www.your-domain.example;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /ws/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600;
    }
}

Enable it:

sudo ln -sf /etc/nginx/sites-available/openvibelive /etc/nginx/sites-enabled/openvibelive
sudo rm -f /etc/nginx/sites-enabled/default
sudo nginx -t
sudo systemctl reload nginx

Request the certificate

sudo certbot --nginx -d your-domain.example -d www.your-domain.example

Verify auto-renewal

sudo systemctl list-timers | grep certbot || true
sudo certbot renew --dry-run

15. Cloudflare End-to-End Encryption

Once the origin has a valid Let's Encrypt cert:

1. Open the Cloudflare dashboard
2. Go to SSL/TLS
3. Set encryption mode to Full (strict)

This gives you encrypted browser-to-Cloudflare and encrypted Cloudflare-to-origin traffic, with origin certificate validation.

Recommended Cloudflare settings

• Always Use HTTPS — enabled
• Automatic HTTPS Rewrites — enabled
• WAF / bot protections (if available on your plan)
• Rate limiting for sensitive paths (if available)

16. Restore the Real Visitor IP

By default, your origin sees Cloudflare edge IPs. Cloudflare provides the original visitor IP in the CF-Connecting-IP header.

Nginx real IP config

sudo nano /etc/nginx/conf.d/cloudflare-realip.conf

real_ip_header CF-Connecting-IP;

set_real_ip_from 173.245.48.0/20;
set_real_ip_from 103.21.244.0/22;
set_real_ip_from 103.22.200.0/22;
set_real_ip_from 103.31.4.0/22;
set_real_ip_from 141.101.64.0/18;
set_real_ip_from 108.162.192.0/18;
set_real_ip_from 190.93.240.0/20;
set_real_ip_from 188.114.96.0/20;
set_real_ip_from 197.234.240.0/22;
set_real_ip_from 198.41.128.0/17;
set_real_ip_from 162.158.0.0/15;
set_real_ip_from 104.16.0.0/13;
set_real_ip_from 104.24.0.0/14;
set_real_ip_from 172.64.0.0/13;
set_real_ip_from 131.0.72.0/22;
set_real_ip_from 2400:cb00::/32;
set_real_ip_from 2606:4700::/32;
set_real_ip_from 2803:f800::/32;
set_real_ip_from 2405:b500::/32;
set_real_ip_from 2405:8100::/32;
set_real_ip_from 2a06:98c0::/29;
set_real_ip_from 2c0f:f248::/32;
real_ip_recursive on;

sudo nginx -t
sudo systemctl reload nginx

Optional: custom log format with Cloudflare info

sudo nano /etc/nginx/conf.d/log_format_cloudflare.conf

log_format cloudflare_combined '$remote_addr - $remote_user [$time_local] '
                                '"$request" $status $body_bytes_sent '
                                '"$http_referer" "$http_user_agent" '
                                'cf_ray=$http_cf_ray cf_ip=$http_cf_connecting_ip';

Apply it in your site config with:

access_log /var/log/nginx/openvibelive.access.log cloudflare_combined;

17. Final Nginx HTTPS Config

After Certbot runs, tighten the site config:

server {
    listen 80;
    listen [::]:80;
    server_name your-domain.example www.your-domain.example;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name your-domain.example www.your-domain.example;

    ssl_certificate /etc/letsencrypt/live/your-domain.example/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/your-domain.example/privkey.pem;

    access_log /var/log/nginx/openvibelive.access.log cloudflare_combined;
    error_log /var/log/nginx/openvibelive.error.log;

    client_max_body_size 128M;

    add_header X-Content-Type-Options nosniff always;
    add_header X-Frame-Options SAMEORIGIN always;
    add_header Referrer-Policy strict-origin-when-cross-origin always;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    location /ws/ {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 3600;
    }
}

sudo nginx -t
sudo systemctl reload nginx

18. Firewall (UFW)

Minimal website-only deployment

sudo ufw allow OpenSSH
sudo ufw allow 80/tcp
sudo ufw allow 443/tcp
sudo ufw enable
sudo ufw status verbose

If you need RTMP ingest

sudo ufw allow 1935/tcp

If you need JSMPEG

sudo ufw allow 9710/tcp
sudo ufw allow 9711/tcp

If you need WebRTC / mediasoup

sudo ufw allow 4443/tcp
sudo ufw allow 4443/udp
sudo ufw allow 10000:10100/udp

19. OVH Security Groups

OVH's OpenStack-based Public Cloud default security groups can allow broad traffic by default. Do not rely on OVH defaults alone.

Use at least one of these:

• ufw on the instance
• OVH/OpenStack security groups (if you manage networking that way)
• Nginx allowlists for sensitive origin paths