Zulip in production

• Requirements and scalability
  • Server
    • General
    • Operating system
    • Hardware specifications
    • Network and security specifications
  • Credentials needed
    • SSL certificate
    • Outgoing email
  • Scalability
• Install a Zulip server
  • Installation process overview
  • Step 0: Set up a base server
  • Step 1: Download the latest release
  • Step 2: Install Zulip
    • Installer options
  • Step 3: Create a Zulip organization, and log in
  • Getting started with Zulip
• Troubleshooting and monitoring
  • Overview and resources
  • Using supervisorctl
    • Checking status with supervisorctl status
    • Restarting services with supervisorctl restart
    • Stopping services with supervisorctl stop
  • Troubleshooting services
    • Restrict unattended upgrades
  • Monitoring
    • Nagios configuration
  • Memory leak mitigation
  • Troubleshooting the Zulip installer
    • The zulip user’s password.
• Management commands
  • Running management commands
    • Accessing an organization’s string_id
  • manage.py shell
  • Other useful manage.py commands
  • Custom management commands
• Server configuration
  • Server settings overview
  • Changing server settings
  • Customizing user onboarding
    • Navigation tour video
    • Terms of Service and Privacy policy
• System configuration
  • Truthy values
  • [machine]
    • puppet_classes
    • pgroonga
    • timesync
  • [deployment]
    • deploy_options
    • git_repo_url
  • [application_server]
    • http_only
    • nginx_listen_port
    • nginx_worker_processes
    • nginx_worker_connections
    • queue_workers_multiprocess
    • rolling_restart
    • service_file_descriptor_limit
    • s3_memory_cache_size
    • s3_disk_cache_size
    • s3_cache_inactive_time
    • thumbnail_workers
    • email_senders_workers
    • nameserver
    • uwsgi_listen_backlog_limit
    • uwsgi_processes
    • access_log_retention_days
    • katex_server
    • katex_server_port
    • custom_ca_path
  • [postgresql]
    • effective_io_concurrency
    • listen_addresses
    • random_page_cost
    • replication_primary
    • replication_user
    • skip_backups
    • backups_disk_concurrency
    • backups_directory
    • backups_incremental
    • backups_storage_class
    • backups_compression_method
    • missing_dictionaries
    • ssl_ca_file
    • ssl_cert_file
    • ssl_key_file
    • ssl_mode
    • version
  • [memcached]
    • memory
    • max_item_size
    • size_reporting
  • [tornado_sharding]
  • [loadbalancer]
    • ips
    • rejects_http_requests
  • [http_proxy]
    • host
    • port
    • listen_address
    • enable_for_camo
    • allow_addresses, allow_ranges, deny_addresses, deny_ranges
  • [sentry]
    • organization
    • project
• Mobile push notification service
  • Signing up
  • Plan management
    • Plan management for a Zulip organization
    • Plan management for an entire Zulip server
  • Why a push notification service is necessary
  • Security and privacy
    • What Apple, Google, and the Push Notification Service see
    • What the Push Notification Service stores
    • What the Zulip server sees
    • Limitations
    • Cryptography
    • Uploading basic metadata
    • Uploading usage statistics
  • Rate limits
  • Updating your server’s registration
  • Moving your registration to a new server
    • Transferring your registration if you lost the original credentials
  • Deactivating your server’s registration
    • Pausing use of the Mobile Push Notification Service
    • Legacy protocol
• Upgrade Zulip
  • Upgrading to a release
    • What to expect during an upgrade
  • Upgrading from a Git repository
    • Upgrading to an unreleased version of Zulip
  • Updating settings.py inline documentation
  • Troubleshooting and rollback
    • Rolling back to a prior version
  • Deployment hooks
  • Preserving local changes to service configuration files
    • nginx configuration changes
  • Upgrading PostgreSQL
  • Upgrading the operating system
    • Upgrading from Ubuntu 22.04 Jammy to 24.04 Noble
    • Upgrading from Ubuntu 20.04 Focal to 22.04 Jammy
    • Upgrading from Ubuntu 18.04 Bionic to 20.04 Focal
    • Upgrading from Ubuntu 16.04 Xenial to 18.04 Bionic
    • Upgrading from Debian 12 to 13
    • Upgrading from Debian 11 to 12
    • Upgrading from Debian 10 to 11
    • Upgrading from Debian 9 to 10
• Modify Zulip
  • Making changes
    • Upgrading to future releases
    • Making changes with docker-zulip
  • Applying changes from main
    • Applying a small change
    • Upgrading to main
  • Contributing patches
• Securing your Zulip server
  • 1. Limit shell access to a small set of trusted individuals.
  • 2. Consider requiring authentication with single sign-on (SSO).
  • 3. Teach users how to protect their account.
  • 4. Become familiar with Zulip’s access management model.
  • 5. Understand security for user-uploaded content and user-generated requests.
  • 6. Understand Zulip’s rate-limiting system.
• Authentication methods
  • Email and password
    • Passwords
  • Social authentication
    • Sign in with Apple
  • LDAP (including Active Directory)
    • Synchronizing data
    • Synchronizing email addresses
    • Multiple LDAP searches
    • Restricting access to an LDAP group
    • Restricting LDAP user access to specific organizations
    • Troubleshooting
  • SAML
    • IdP-initiated SSO
    • Restricting access to specific organizations
    • Synchronizing data during login
    • Synchronizing email addresses with SAML
    • SCIM
    • Using Keycloak as a SAML IdP
    • Using Authentik as a SAML IdP
    • SAML Single Logout
  • Apache-based SSO with REMOTE_USER
    • Setup instructions for Apache-based SSO
    • Troubleshooting Apache-based SSO
    • Life of an Apache-based SSO login attempt
  • OpenID Connect
    • Microsoft Entra ID (OIDC)
  • JSON Web Tokens (JWT)
  • Microsoft Entra ID
  • Custom authentication backends
    • Configuring a custom Python wrapper around the authenticate mechanism
    • Adding more authentication backends
  • Development only
• Backups, export and import
  • Backups
    • Restoring backups
    • What is included
    • Restore from manual backups
  • Data export
    • Consider upgrading
    • Preventing changes during the export
    • Export your Zulip data
  • Import into a new Zulip server
    • Import options
    • Logging in
    • Deleting and re-importing
  • Compliance exports
  • Database-only backup tools
    • Streaming backups to S3
    • Streaming backups to local disk
    • Restoring from wal-g backups
• PostgreSQL database details
  • Separate PostgreSQL database
    • Cloud-provider-managed PostgreSQL (e.g., Amazon RDS)
    • Remote PostgreSQL database
  • PostgreSQL warm standby
  • PostgreSQL vacuuming alerts
• File upload backends
  • S3 backend configuration
    • Google Cloud Platform
  • S3 local caching
  • nginx DNS nameserver configuration
  • S3 bucket policy
  • Migrating from local uploads to Amazon S3 backend
  • S3 data storage class
  • Data export bucket
• Installing SSL certificates
  • Manual install
    • Testing
  • Certbot (recommended)
    • At initial Zulip install
    • After Zulip is already installed
    • How it works
    • Renewal
  • Self-signed certificate
  • Troubleshooting
    • The Android app can’t connect to the server
    • The iOS app can’t connect to the server
    • The Android app connects to the server on some devices but not others
• Outgoing email
  • How to configure
  • Email services
    • Free outgoing email services
    • Using system email
    • Using Gmail for outgoing email
    • Logging outgoing email to a file for prototyping
  • Troubleshooting
    • Advanced troubleshooting
• Deployment options
  • Installing Zulip from Git
  • Zulip in Docker
  • Zulip installer details
    • Advanced installer options
  • Installing on an existing server
  • Deployment hooks
    • Zulip message deploy hook
    • Sentry deploy hook
  • Running Zulip’s service dependencies on different machines
  • Deploying behind a reverse proxy
  • Using an alternate port
  • Customizing the outgoing HTTP proxy
    • IP address rules
    • Using a different outgoing proxy
    • Routing Camo requests through an outgoing proxy
    • Installing Smokescreen on a separate host
    • S3 file storage requests and outgoing proxies
• Running Zulip in Docker
• Reverse proxies
  • Installer options
    • Configuring Zulip to allow HTTP
    • Configuring Zulip to trust proxies
  • nginx configuration
  • Apache2 configuration
  • HAProxy configuration
  • Other proxies
• Hosting multiple organizations
  • Subdomains
    • SSL certificates
    • Other hostnames
    • The root domain
    • Changing subdomains
    • Authentication
    • The system bot realm
    • Migrating / troubleshooting
  • Open realm creation
• Incoming email integration
  • Local delivery setup
  • Polling setup
• Video call providers
  • Jitsi
  • Zoom
    • Server to Server OAuth app
    • General OAuth app
    • Configure your Zulip server
  • BigBlueButton
  • Constructor Groups
  • Nextcloud Talk
  • Webex
    • Create a custom Webex integration
    • Configure your Zulip server
• AI integrations
  • Built-in AI features
    • Data privacy
    • General configurations
    • Topic summarization beta
• GIF picker integrations
  • GIPHY
    • Apply for API key
  • Tenor
    • Create a Tenor API key
  • KLIPY
    • Create a KLIPY API key
• SCIM provisioning
  • Server configuration
  • Additional options