server on {bjørn:johansen}

Wildcard certificate from Let’s Encrypt with CloudFlare DNS

Thu, 09 Aug 2018 18:12:42 +0000

If you’re using CloudFlare to host your DNS, there is a plugin for the official Let’s Encrypt client Certbot you can use to easily acquire and renew wildcard certificates from Let’s Encrypt.

Automate the upgrade of your DigitalOcean droplets

Fri, 19 Jan 2018 01:27:59 +0000

Recently DigitalOcean released new pricing plans where they basically doubled the RAM for the same price of the old plans. But to get the benefits for your existing droplets, you have to upgrade all of your existing droplets in a process that involves shutting them down, selecting the new plan, waiting for the upgrade to happen and power on the droplets again. I have tens of droplets and had no intention of doing this manually, so I wrote a script to use the DigitalOcean API to automate a mass-upgrade of all droplets.

How to do an Nginx redirect

Sat, 15 Oct 2016 13:45:01 +0000

Nginx is an extremely efficient and quite flexible web server. When you want to do a redirect in Nginx, you have a few options to select from, so you can choose the one that suits you best to do an Nginx redirect.

Restrict allowed HTTP methods in Nginx

Wed, 21 Oct 2015 18:22:11 +0000

Security vulnerabilities are often exploits of software that fails when trying to deal with unexpected input. Other times they are exploits of a misconfiguration or a service that unintentionally was open to the public.

For the above reasons, we should limit as much as possible what services are exposed to the public and limit as much as possible what they do and accept from the visitors. To follow those security principles, we should only allow the HTTP methods for which we, in fact, provide services. Under all normal circumstances, that would be the methods GET, POST and HEAD.

Exclude certain requests from the Nginx access log

Sun, 11 Oct 2015 14:33:03 +0000

Logs are nice and all that, but sometimes certain entries are there just to fill up the logs or are cluttering them. Here’s a few ways to exclude requests – by URL or visitor IP – from the Nginx access log.

Configure your local Postfix to relay through a transactional email service

Fri, 09 Oct 2015 13:10:10 +0000

Using Postfix with specialized, transactional email services like SendGrid or Mandrill is excellent for not only for optimizing email deliverability, but they usually also offer some nice features.

Running PHP7-FPM Nightly Build on Ubuntu 14.04

Tue, 14 Apr 2015 15:36:03 +0000

As I’m writing this, the calendar shows April 14 2015. According to the PHP 7.0 timeline, it has a projected release date of November 2015. But if you want to try it out (to check out the speed), you can already do so.

Running HHVM with fallback to PHP-FPM

Wed, 03 Dec 2014 21:57:29 +0000

HHVM can really speed up your PHP-based web site. Most reports are somewhere in the range of 2–4x faster. Unfortunately, HHVM isn’t very stable and will suddenly die, just of the blue, from time to another. Fortunately, if you’re running Nginx it’s really easy to set up PHP-FPM as a fallback.

Using fail2ban from behind a Rackspace Cloud LoadBalancer

Fri, 07 Nov 2014 19:31:31 +0000

If your fail2ban is on a host behind a Rackspace Cloud LoadBalancer, you’ll want to block the offending IP addresses directly in your LoadBalancer. If your LB is acting as a reverse proxy, you’ll HAVE to block in the LB, but it is also nice to protect all other nodes behind the LB and offload the lifting.