Installing NETDATA on Ubuntu with Nginx Reverse Proxy and Access Control

This guide provides a step-by-step walkthrough to install and configure NETData on an Ubuntu server, set up Nginx as a reverse proxy, and implement Access Control Lists (ACLs) for enhanced security. By the end, you’ll have a robust monitoring setup tailored to your needs.

Introduction

Server monitoring is a cornerstone of maintaining a secure and high-performing infrastructure. NETData offers a lightweight, real-time monitoring solution, while Nginx enhances accessibility through its reverse proxy capabilities. Adding ACLs further strengthens the setup by controlling who can access sensitive monitoring data.

This guide is tailored for users with basic knowledge of Ubuntu and server management. It covers:

• Installing NETData on Ubuntu.
• Configuring Nginx as a reverse proxy.
• Setting up ACLs to restrict access.

Step 1: Installing NETData

1.1 Update and Prepare the System

Before installing NETData, ensure your server is up to date:

sudo apt update && sudo apt upgrade -y

1.2 Install NETData

Use the one-line installer script provided by NETData:

sudo apt install netdata

This script will:

• Install NETData and its dependencies.
• Configure it to start automatically as a service.

1.3 Verify the Installation

Once installed, check if NETData is running:

sudo systemctl status netdata

Open your browser and navigate to http://<your-server-ip>:19999 to access the NETData dashboard.

Step 2: Configuring Nginx as a Reverse Proxy

2.1 Install Nginx

If Nginx is not already installed, add it to your server:

sudo apt install nginx -y

2.2 Create a Reverse Proxy Configuration

Create a new configuration file for NETData:

sudo nano /etc/nginx/sites-available/netdata

Add the following content:

server {
    listen 80;
    server_name yourdomain.com;

    location / {
        proxy_pass http://127.0.0.1:19999;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Save and close the file.

2.3 Enable the Configuration

Link the configuration file and reload Nginx:

sudo ln -s /etc/nginx/sites-available/netdata /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

2.4 Test the Setup

Navigate to http://yourdomain.com to confirm that the NETData dashboard is accessible through Nginx.

Step 3: Setting Up Access Control Lists (ACLs)

3.1 Modify Nginx Configuration

Update the netdata configuration file to include IP-based restrictions:

location / {
    allow 192.168.1.0/24;  # Replace with your trusted IP range
    deny all;

    proxy_pass http://127.0.0.1:19999;
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
}

Save the changes and reload Nginx:

sudo systemctl reload nginx

3.2 Testing ACLs

From an allowed IP, confirm access to the NETData dashboard. From a blocked IP, verify that access is denied.

Step 4: Enhancing Security (Optional)

4.1 Enable HTTPS

For secure communication, install a free SSL certificate from Let’s Encrypt:

sudo apt install certbot python3-certbot-nginx -y
sudo certbot --nginx -d yourdomain.com

4.2 Automate Certificate Renewal

Set up a cron job to renew certificates automatically:

sudo crontab -e

Add the following line:

0 0 * * 0 certbot renew --quiet

Conclusion

In this guide, we walked through installing and configuring NETData on Ubuntu, setting up Nginx as a reverse proxy, and implementing ACLs for access control. This combination not only provides real-time server monitoring but also ensures secure access to sensitive data. By following these steps, you’ll have a scalable and secure monitoring solution that meets modern infrastructure needs.