31 restructue documentation (#138)

* removed korean documentation

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* removed CN and KOR readme

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* changed to the press theme

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* first changes

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* fixe H3 vs H1 issues

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* added missing png

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* added missing file

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* fixed warnings

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* moved documents

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* removed obsolete files

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* removed obsolete folder

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* removed obs. file

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* added some final changes

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

* removed obs. reference

Signed-off-by: Jürgen Eckel <juergen@riddleandcode.com>

docs/root/source/appendices/cryptography.rst

@@ -0,0 +1,14 @@
+
+.. Copyright © 2020 Interplanetary Database Association e.V.,
+   Planetmint and IPDB software contributors.
+   SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0)
+   Code is Apache-2.0 and docs are CC-BY-4.0
+
+Cryptography
+============
+
+Use the following link to find the Planetmint Transactions Spec (or Specs) that are relevant to you:
+
+`Planetmint Transactions Specs <https://github.com/planetmint/BEPs/tree/master/tx-specs/>`_
+
+Then see the sections titled **Cryptographic Hashes** and **Cryptographic Keys and Signatures**.

docs/root/source/appendices/firewall-notes.md

@@ -0,0 +1,79 @@
+<!---
+Copyright © 2020 Interplanetary Database Association e.V.,
+Planetmint and IPDB software contributors.
+SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0)
+Code is Apache-2.0 and docs are CC-BY-4.0
+--->
+
+# Notes for Firewall Setup
+
+This is a page of notes on the ports potentially used by Planetmint nodes and the traffic they should expect, to help with firewall setup (or security group setup on cloud providers). This page is _not_ a firewall tutorial or step-by-step guide.
+
+## Expected Unsolicited Inbound Traffic
+
+The following ports should expect unsolicited inbound traffic:
+
+1. **Port 22** can expect inbound SSH (TCP) traffic from the node administrator (i.e. a small set of IP addresses).
+1. **Port 9984** can expect inbound HTTP (TCP) traffic from Planetmint clients sending transactions to the Planetmint HTTP API.
+1. **Port 9985** can expect inbound WebSocket traffic from Planetmint clients.
+1. **Port 26656** can expect inbound Tendermint P2P traffic from other Tendermint peers.
+1. **Port 9986** can expect inbound HTTP (TCP) traffic from clients accessing the Public Key of a Tendermint instance.
+
+All other ports should only get inbound traffic in response to specific requests from inside the node.
+
+## Port 22
+
+Port 22 is the default SSH port (TCP) so you'll at least want to make it possible to SSH in from your remote machine(s).
+
+## Port 53
+
+Port 53 is the default DNS port (UDP). It may be used, for example, by some package managers when look up the IP address associated with certain package sources.
+
+## Port 80
+
+Port 80 is the default HTTP port (TCP). It's used by some package managers to get packages. It's _not_ the default port for the Planetmint client-server HTTP API.
+
+## Port 123
+
+Port 123 is the default NTP port (UDP). You should be running an NTP daemon on production Planetmint nodes. NTP daemons must be able to send requests to external NTP servers and accept the respones.
+
+## Port 161
+
+Port 161 is the default SNMP port (usually UDP, sometimes TCP). SNMP is used, for example, by some server monitoring systems.
+
+## Port 443
+
+Port 443 is the default HTTPS port (TCP). Package managers might also get some packages using HTTPS.
+
+## Port 9984
+
+Port 9984 is the default port for the Planetmint client-server HTTP API (TCP), which is served by Gunicorn HTTP Server. It's _possible_ allow port 9984 to accept inbound traffic from anyone, but we recommend against doing that. Instead, set up a reverse proxy server (e.g. using Nginx) and only allow traffic from there. Information about how to do that can be found [in the Gunicorn documentation](http://docs.gunicorn.org/en/stable/deploy.html). (They call it a proxy.)
+
+If Gunicorn and the reverse proxy are running on the same server, then you'll have to tell Gunicorn to listen on some port other than 9984 (so that the reverse proxy can listen on port 9984). You can do that by setting `server.bind` to 'localhost:PORT' in the [Planetmint Configuration Settings](../node-setup/configuration), where PORT is whatever port you chose (e.g. 9983).
+
+You may want to have Gunicorn and the reverse proxy running on different servers, so that both can listen on port 9984. That would also help isolate the effects of a denial-of-service attack.
+
+## Port 9985
+
+Port 9985 is the default port for the Planetmint WebSocket Event Stream API.
+
+## Port 9986
+
+Port 9986 is the default port to access the Public Key of a Tendermint instance, it is used by a NGINX instance
+that runs with Tendermint instance(Pod), and only hosts the Public Key.
+
+## Port 26656
+
+Port 26656 is the default port used by Tendermint Core to communicate with other instances of Tendermint Core (peers).
+
+## Port 26657
+
+Port 26657 is the default port used by Tendermint Core for RPC traffic. Planetmint nodes use that internally; they don't expect incoming traffic from the outside world on port 26657.
+
+## Port 26658
+
+Port 26658 is the default port used by Tendermint Core for ABCI traffic. Planetmint nodes use that internally; they don't expect incoming traffic from the outside world on port 26658.
+
+## Other Ports
+
+On Linux, you can use commands such as `netstat -tunlp` or `lsof -i` to get a sense of currently open/listening ports and connections, and the associated processes. 

docs/root/source/appendices/generate-key-pair-for-ssh.md

@@ -0,0 +1,41 @@
+<!---
+Copyright © 2020 Interplanetary Database Association e.V.,
+Planetmint and IPDB software contributors.
+SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0)
+Code is Apache-2.0 and docs are CC-BY-4.0
+--->
+
+# Generate a Key Pair for SSH
+
+This page describes how to use `ssh-keygen`
+to generate a public/private RSA key pair
+that can be used with SSH.
+(Note: `ssh-keygen` is found on most Linux and Unix-like
+operating systems; if you're using Windows,
+then you'll have to use another tool,
+such as PuTTYgen.)
+
+By convention, SSH key pairs get stored in the `~/.ssh/` directory.
+Check what keys you already have there:
+```text
+ls -1 ~/.ssh/
+```
+
+Next, make up a new key pair name (called `<name>` below).
+Here are some ideas:
+
+* `aws-bdb-2`
+* `tim-bdb-azure`
+* `chris-bcdb-key`
+
+Next, generate a public/private RSA key pair with that name:
+```text
+ssh-keygen -t rsa -C "<name>" -f ~/.ssh/<name>
+```
+
+It will ask you for a passphrase.
+You can use whatever passphrase you like, but don't lose it.
+Two keys (files) will be created in `~/.ssh/`:
+
+1. `~/.ssh/<name>.pub` is the public key
+2. `~/.ssh/<name>` is the private key

docs/root/source/appendices/index.rst

@@ -0,0 +1,19 @@
+
+.. Copyright © 2020 Interplanetary Database Association e.V.,
+   Planetmint and IPDB software contributors.
+   SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0)
+   Code is Apache-2.0 and docs are CC-BY-4.0
+
+Appendices
+==========
+
+.. toctree::
+   :maxdepth: 1
+
+   generate-key-pair-for-ssh
+   cryptography
+   firewall-notes
+   ntp-notes
+   log-rotation
+   licenses
+   

docs/root/source/appendices/licenses.md

@@ -0,0 +1,10 @@
+<!---
+Copyright © 2020 Interplanetary Database Association e.V.,
+Planetmint and IPDB software contributors.
+SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0)
+Code is Apache-2.0 and docs are CC-BY-4.0
+--->
+
+# Licenses
+
+Information about how the Planetmint Server code and documentation are licensed can be found in [the LICENSES.md file](https://github.com/planetmint/planetmint/blob/master/LICENSES.md) of the planetmint/planetmint repository on GitHub.

docs/root/source/appendices/log-rotation.md

@@ -0,0 +1,50 @@
+<!---
+Copyright © 2020 Interplanetary Database Association e.V.,
+Planetmint and IPDB software contributors.
+SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0)
+Code is Apache-2.0 and docs are CC-BY-4.0
+--->
+
+# Logging and Log Rotation
+
+Each Planetmint node runs:
+
+- MongoDB
+- Planetmint Server
+- Tendermint
+
+When running a Planetmint node for long periods
+of time, we need to consider doing log rotation, i.e. we do not want the logs taking
+up large amounts of storage and making the node unresponsive or getting it into a bad state.
+
+## MongoDB Logging and Log Rotation
+
+See the MongoDB docs about
+[logging](https://docs.mongodb.com/v3.6/administration/monitoring/#monitoring-standard-loggging)
+and [log rotation](https://docs.mongodb.com/v3.6/tutorial/rotate-log-files/).
+
+## Planetmint Server Logging and Log Rotation
+
+Planetmint Server writes its logs to two files: normal logs and error logs. The names of those files, and their locations, are set as part of the Planetmint configuration settings. The default names and locations are:
+
+- `~/planetmint.log`
+- `~/planetmint-errors.log`
+
+Log rotation is baked into Planetmint Server using Python's `logging` module. The logs for Planetmint Server are rotated when any of the above mentioned files exceeds 209715200 bytes (i.e. approximately 209 MB).
+
+For more information, see the docs about [the Planetmint Server configuration settings related to logging](../node-setup/configuration#log).
+
+## Tendermint Logging and Log Rotation
+
+Tendermint writes its logs to the files:
+
+- `tendermint.out.log`
+- `tendermint.err.log`
+
+If you started Planetmint Server and Tendermint using Monit, as suggested by our guide on
+[How to Set Up a Planetmint Network](../network-setup/network-setup),
+then the logs will be written to `$HOME/.planetmint-monit/logs/`.
+
+Moreover, if you started Planetmint Server and Tendermint using Monit,
+then Monit monitors the Tendermint log files.
+Tendermint logs are rotated if any of the above mentioned log files exceeds 200 MB.

docs/root/source/appendices/ntp-notes.md

@@ -0,0 +1,59 @@
+<!---
+Copyright © 2020 Interplanetary Database Association e.V.,
+Planetmint and IPDB software contributors.
+SPDX-License-Identifier: (Apache-2.0 AND CC-BY-4.0)
+Code is Apache-2.0 and docs are CC-BY-4.0
+--->
+
+# Notes on NTP Daemon Setup
+
+There are several NTP daemons available, including:
+
+* The reference NTP daemon (`ntpd`) from ntp.org; see [their support website](http://support.ntp.org/bin/view/Support/WebHome)
+* [chrony](https://chrony.tuxfamily.org/index.html)
+* [OpenNTPD](http://www.openntpd.org/)
+* Maybe [NTPsec](https://www.ntpsec.org/), once it's production-ready
+* Maybe [Ntimed](http://nwtime.org/projects/ntimed/), once it's production-ready
+* [More](https://en.wikipedia.org/wiki/Ntpd#Implementations)
+
+We suggest you run your NTP daemon in a mode which will tell your OS kernel to handle leap seconds in a particular way: the default NTP way, so that system clock adjustments are localized and not spread out across the minutes, hours, or days surrounding leap seconds (e.g. "slewing" or "smearing"). There's [a nice Red Hat Developer Blog post about the various options](https://developers.redhat.com/blog/2015/06/01/five-different-ways-handle-leap-seconds-ntp/).
+
+Use the default mode with `ntpd` and `chronyd`. For another NTP daemon, consult its documentation.
+
+It's tricky to make an NTP daemon setup secure. Always install the latest version and read the documentation about how to configure and run it securely. See the [notes on firewall setup](firewall-notes).
+
+
+## Amazon Linux Instances
+
+If your Planetmint node is running on an Amazon Linux instance (i.e. a Linux instance packaged by Amazon, not Canonical, Red Hat, or someone else), then an NTP daemon should already be installed and configured. See the EC2 documentation on [Setting the Time for Your Linux Instance](https://docs.aws.amazon.com/AWSEC2/latest/UserGuide/set-time.html).
+
+That said, you should check _which_ NTP daemon is installed. Is it recent? Is it configured securely?
+
+
+## The Ubuntu ntp Packages
+
+The [Ubuntu `ntp` packages](https://launchpad.net/ubuntu/+source/ntp) are based on the reference implementation of NTP.
+
+The following commands will uninstall the `ntp` and `ntpdate` packages, install the latest `ntp` package (which _might not be based on the latest ntpd code_), and start the NTP daemon (a local NTP server). (`ntpdate` is not reinstalled because it's [deprecated](https://askubuntu.com/questions/297560/ntpd-vs-ntpdate-pros-and-cons) and you shouldn't use it.)
+```text
+sudo apt-get --purge remove ntp ntpdate
+sudo apt-get autoremove
+sudo apt-get update
+sudo apt-get install ntp
+# That should start the NTP daemon too, but just to be sure:
+sudo service ntp restart
+```
+
+You can check if `ntpd` is running using `sudo ntpq -p`.
+
+You may want to use different NTP time servers. You can change them by editing the NTP config file `/etc/ntp.conf`.
+
+Note: A server running an NTP daemon can be used by others for DRDoS amplification attacks. The above installation procedure should install a default NTP configuration file `/etc/ntp.conf` with the lines:
+```text
+restrict -4 default kod notrap nomodify nopeer noquery
+restrict -6 default kod notrap nomodify nopeer noquery
+```
+
+Those lines should prevent the NTP daemon from being used in an attack. (The first line is for IPv4, the second for IPv6.)
+
+There are additional things you can do to make NTP more secure. See the [NTP Support Website](http://support.ntp.org/bin/view/Support/WebHome) for more details.