Zulip in production

• Requirements and scalability
  • Server
    • General
    • Operating system
    • Hardware specifications
    • Network and security specifications
  • Credentials needed
    • SSL certificate
    • Outgoing email
  • Scalability
• Install a Zulip server
  • Installation process overview
  • Step 0: Set up a base server
  • Step 1: Download the latest release
  • Step 2: Install Zulip
    • Installer options
  • Step 3: Create a Zulip organization, and log in
  • Getting started with Zulip
• Troubleshooting and monitoring
  • Overview and resources
  • Using supervisorctl
    • Checking status with supervisorctl status
    • Restarting services with supervisorctl restart
    • Stopping services with supervisorctl stop
  • Troubleshooting services
    • Restrict unattended upgrades
  • Monitoring
    • Nagios configuration
  • Memory leak mitigation
  • Troubleshooting the Zulip installer
    • The zulip user’s password.
• Management commands
  • Running management commands
    • Accessing an organization’s string_id
  • manage.py shell
  • Other useful manage.py commands
  • Custom management commands
• Server configuration
  • Making changes
  • Specific settings
    • Domain and email settings
    • Authentication backends
    • Mobile and desktop apps
    • Terms of Service and Privacy policy
    • Miscellaneous server settings
  • Zulip announcement list
  • Enjoy your Zulip installation!
• System configuration
  • Truthy values
  • [machine]
    • puppet_classes
    • pgroonga
    • timesync
  • [deployment]
    • deploy_options
    • git_repo_url
  • [application_server]
    • http_only
    • nginx_listen_port
    • nginx_worker_connections
    • queue_workers_multiprocess
    • rolling_restart
    • service_file_descriptor_limit
    • s3_memory_cache_size
    • s3_disk_cache_size
    • s3_cache_inactive_time
    • thumbnail_workers
    • nameserver
    • uwsgi_listen_backlog_limit
    • uwsgi_processes
    • access_log_retention_days
    • katex_server
    • katex_server_port
  • [postfix]
    • mailname
  • [postgresql]
    • effective_io_concurrency
    • listen_addresses
    • random_page_cost
    • replication_primary
    • replication_user
    • skip_backups
    • backups_disk_concurrency
    • backups_directory
    • backups_incremental
    • backups_storage_class
    • missing_dictionaries
    • ssl_ca_file
    • ssl_cert_file
    • ssl_key_file
    • ssl_mode
    • version
  • [memcached]
    • memory
    • max_item_size
    • size_reporting
  • [loadbalancer]
    • ips
  • [http_proxy]
    • host
    • port
    • listen_address
    • enable_for_camo
  • [sentry]
    • organization
    • project
• Mobile push notification service
  • Signing up
  • Plan management
    • Plan management for a Zulip organization
    • Plan management for an entire Zulip server
  • Why a push notification service is necessary
  • Security and privacy
    • Uploading basic metadata
    • Uploading usage statistics
  • Rate limits
  • Updating your server’s registration
  • Deactivating your server’s registration
    • Pausing use of the Mobile Push Notification Service
  • Sending push notifications directly from your server
• Upgrade Zulip
  • Upgrading to a release
  • Upgrading from a Git repository
  • Updating settings.py inline documentation
  • Troubleshooting and rollback
    • Rolling back to a prior version
  • Deployment hooks
  • Preserving local changes to service configuration files
    • nginx configuration changes
  • Upgrading the operating system
    • Upgrading from Ubuntu 22.04 Jammy to 24.04 Noble
    • Upgrading from Ubuntu 20.04 Focal to 22.04 Jammy
    • Upgrading from Ubuntu 18.04 Bionic to 20.04 Focal
    • Upgrading from Ubuntu 16.04 Xenial to 18.04 Bionic
    • Upgrading from Ubuntu 14.04 Trusty to 16.04 Xenial
    • Upgrading from Debian 11 to 12
    • Upgrading from Debian 10 to 11
    • Upgrading from Debian 9 to 10
  • Upgrading PostgreSQL
• Modify Zulip
  • Making changes
    • Upgrading to future releases
    • Making changes with docker-zulip
  • Applying changes from main
    • Applying a small change
    • Upgrading to main
  • Contributing patches
• Security model
  • Secure your Zulip server like your email server
  • Encryption and authentication
    • Passwords
  • Messages and history
  • Users and bots
  • User-uploaded content and user-generated requests
  • Rate limiting
  • Final notes and security response
• Authentication methods
  • Email and password
  • Plug-and-play SSO (Google, GitHub, GitLab)
  • LDAP (including Active Directory)
    • Synchronizing data
    • Multiple LDAP searches
    • Restricting access to an LDAP group
    • Restricting LDAP user access to specific organizations
    • Troubleshooting
  • SAML
    • IdP-initiated SSO
    • Restricting access to specific organizations
    • SCIM
    • Using Keycloak as a SAML IdP
    • Using Authentik as a SAML IdP
    • SAML Single Logout
  • Apache-based SSO with REMOTE_USER
    • Setup instructions for Apache-based SSO
    • Troubleshooting Apache-based SSO
    • Life of an Apache-based SSO login attempt
  • Sign in with Apple
  • OpenID Connect
  • JWT
  • Configuring a custom Python wrapper around the authenticate mechanism
  • Adding more authentication backends
  • Development only
• Backups, export and import
  • Backups
    • Restoring backups
    • What is included
    • Restore from manual backups
  • Data export
    • Consider upgrading
    • Preventing changes during the export
    • Export your Zulip data
  • Import into a new Zulip server
    • Import options
    • Logging in
    • Deleting and re-importing
  • Compliance exports
  • Database-only backup tools
    • Streaming backups to S3
    • Streaming backups to local disk
• PostgreSQL database details
  • Separate PostgreSQL database
    • Cloud-provider-managed PostgreSQL (e.g., Amazon RDS)
    • Remote PostgreSQL database
  • PostgreSQL warm standby
  • PostgreSQL vacuuming alerts
• File upload backends
  • S3 backend configuration
  • S3 local caching
  • nginx DNS nameserver configuration
  • S3 bucket policy
  • Migrating from local uploads to Amazon S3 backend
  • S3 data storage class
• Installing SSL certificates
  • Manual install
    • Testing
  • Certbot (recommended)
    • At initial Zulip install
    • After Zulip is already installed
    • How it works
    • Renewal
  • Self-signed certificate
  • Troubleshooting
    • The Android app can’t connect to the server
    • The iOS app can’t connect to the server
    • The Android app connects to the server on some devices but not others
• Outgoing email
  • How to configure
  • Email services
    • Free outgoing email services
    • Using system email
    • Using Gmail for outgoing email
    • Logging outgoing email to a file for prototyping
  • Troubleshooting
    • Advanced troubleshooting
• Deployment options
  • Installing Zulip from Git
  • Zulip in Docker
  • Zulip installer details
    • Advanced installer options
  • Installing on an existing server
  • Deployment hooks
    • Zulip message deploy hook
    • Sentry deploy hook
  • Running Zulip’s service dependencies on different machines
  • Using an alternate port
  • Customizing the outgoing HTTP proxy
    • S3 file storage requests and outgoing proxies
• Reverse proxies
  • Installer options
    • Configuring Zulip to allow HTTP
    • Configuring Zulip to trust proxies
  • nginx configuration
  • Apache2 configuration
  • HAProxy configuration
  • Other proxies
• Hosting multiple organizations
  • Subdomains
    • SSL certificates
    • Other hostnames
    • The root domain
    • Changing subdomains
    • Authentication
    • The system bot realm
    • Migrating / troubleshooting
  • Open realm creation
• Incoming email integration
  • Local delivery setup
  • Polling setup
• Video call providers
  • Jitsi
  • Zoom
  • BigBlueButton
• GIPHY GIF integration
  • Apply for API key
• SCIM provisioning
  • Server configuration
  • Additional options