#Tag · bonfire.cafe

@zolaris@mastodon.illumos.cafe · 2 weeks ago

A #linux application runs inside an LX-branded zone, where the #Illumos kernel (descended from #Solaris) natively implements the Linux kernel ABI. A #VPN connection, terminated in a separate Solaris-style zone, routes the application's traffic to a VPN endpoint on an #OpenBSD system running #Nginx, which serves #HTTPS content on a custom domain.
Life is great!

zolaris

@zolaris@mastodon.illumos.cafe · 2 weeks ago

Stefano Marinelli boosted

release_candidate

@release_candidate@mastodon.bsd.cafe · 3 weeks ago

Is there a way to have nginx calling blocklistd in NetBSD?

Like, when it returns 444 or 403 statuses?

#nginx #NetBSD #homelab

release_candidate

@release_candidate@mastodon.bsd.cafe · 3 weeks ago

Is there a way to have nginx calling blocklistd in NetBSD?

Like, when it returns 444 or 403 statuses?

#nginx #NetBSD #homelab

Neil Brown boosted

Ben Hardill

@ben@bluetoot.hardill.me.uk · 2 months ago

I've got the skeleton of a companion container for nginx-proxy/nginx-proxy that will use RFC2136 to add/remove CNAME entries for proxied containers as they are created/removed.

I'll push it to GitHub from my Forgejo instance once it's a little bit more polished

This is in a similar vein to my one that adds mdns/avahi CNAME to the host machine.

https://github.com/hardillb/nginx-proxy-avahi-helper

https://github.com/nginx-proxy/nginx-proxy

#nginx #dns

Ben Hardill

@ben@bluetoot.hardill.me.uk · 2 months ago

I've got the skeleton of a companion container for nginx-proxy/nginx-proxy that will use RFC2136 to add/remove CNAME entries for proxied containers as they are created/removed.

I'll push it to GitHub from my Forgejo instance once it's a little bit more polished

This is in a similar vein to my one that adds mdns/avahi CNAME to the host machine.

https://github.com/hardillb/nginx-proxy-avahi-helper

https://github.com/nginx-proxy/nginx-proxy

#nginx #dns

marc0s boosted

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net · 2 months ago

What #OpenSource and #SelfHost can do. Had an idea, discussed it here. Seemed to rhyme with people. Booked two domains. Created a landing page with #Jekyll and CI/CD from a #git repo on my #Forgejo instance. Created logo with #Inkscape. Added #letsencrypt certificate. Put it on my VPS (Virtual Private Server) running Red Hat Enterprise Linux, (#RHEL) where it is now served with #Nginx. Git repo mirrored to #Codeberg so all can join. In under 8h.

https://devbnb.eu

https://codeberg.org/jwildeboer/devbnb

Building the static pages for the website automatically with the forgejo runner that runs after every push to the repo.

Emelia 👸🏻 boosted

JesseBot

@jessebot@social.smallhack.org · 2 months ago

Does anyone know of a public set of ModSecurity exceptions for the fediverse/ActivityPub I can take a look at? I'm setting it up for GoToSocial and Mastodon now and manually doing this is pain.

Update, @cloudymax and I started a plugin here:
https://github.com/small-hack/argocd-apps/blob/2b7995c6fae5ecbb3944c6c6f4b139d98b76e67f/ingress-nginx/modsecurity_plugins_configmap.yaml#L177

Still happy to collaborate on it, but also wanted to note there was a mention a year ago about making an ActivityPub plugin over at the OWASP CRS repo, so maybe we could donate to that if its ever created:
https://github.com/coreruleset/coreruleset/issues/3497#issuecomment-1902181156

#WAF #modsecurity #nginx #apache #firewall #webApplicationFirewall #mastodon #gotosocial #activitypub

JesseBot

@jessebot@social.smallhack.org · 2 months ago

Does anyone know of a public set of ModSecurity exceptions for the fediverse/ActivityPub I can take a look at? I'm setting it up for GoToSocial and Mastodon now and manually doing this is pain.

Update, @cloudymax and I started a plugin here:
https://github.com/small-hack/argocd-apps/blob/2b7995c6fae5ecbb3944c6c6f4b139d98b76e67f/ingress-nginx/modsecurity_plugins_configmap.yaml#L177

#WAF #modsecurity #nginx #apache #firewall #webApplicationFirewall #mastodon #gotosocial #activitypub

Jan Wildeboer 😷:krulorange:

@jwildeboer@social.wildeboer.net · 2 months ago

https://devbnb.eu

https://codeberg.org/jwildeboer/devbnb

F-Droid boosted

Guardian Project

@guardianproject@social.librem.one · 2 months ago

#DEfO has completed #ECH implementation for #nginx and there is a pull request:

https://github.com/nginx/nginx/pull/840

If you want to see ECH in nginx sooner rather than later, please jump in and review, give feedback, thumbs up, etc.

#EncryptedClientHello #TLS #OpenSSL

Guardian Project

@guardianproject@social.librem.one · 2 months ago

#DEfO has completed #ECH implementation for #nginx and there is a pull request:

https://github.com/nginx/nginx/pull/840

If you want to see ECH in nginx sooner rather than later, please jump in and review, give feedback, thumbs up, etc.

#EncryptedClientHello #TLS #OpenSSL

LovesTha🥧

@LovesTha@floss.social · 2 months ago

I know #iocaine doesn't have a fully fledged howto for using #nginx as the reverse proxy, but I have a lot in my nginx config currently, so I want to try and get it working there
After figuring out that the different configuration pages don't agree on what socket path for the client connections to iocaine, I now have the 421 error being returned to the browser, but I don't understand what I need to fix to get to a working set up
I have no log outputs when accessing blog.cerberos.id.au
#askFedi

upstream iocaine {
server unix://run/iocaine/iocaine.socket;
}

server {
listen 443 ssl;
server_name blog.cerberos.id.au;
add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;

ssl_protocols TLSv1.2;

ssl_session_cache shared:SSL:1m;
ssl_session_timeout 5m;

ssl_ciphers HIGH:!aNULL:!MD5;
ssl_prefer_server_ciphers on;

location / {
proxy_pass http://iocaine;
proxy_cache off;
proxy_intercept_errors on;
error_page 421 = @fallback;
}

location @fallback {
root /data/blog;
internal;
}

ssl_certificate /etc/letsencrypt/live/blog.cerberos.id.au/fullchain.pem; # managed by Certbot
ssl_certificate_key /etc/letsencrypt/live/blog.cerberos.id.au/privkey.pem; # managed by Certbot

#debug logging options
error_log /var/log/nginx/blog.error.log warn;
access_log /var/log/nginx.access.log;
} — upstream iocaine { server unix://run/iocaine/iocaine.socket; } server { listen 443 ssl; server_name blog.cerberos.id.au; add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always; ssl_protocols TLSv1.2; ssl_session_cache shared:SSL:1m; ssl_session_timeout 5m; ssl_ciphers HIGH:!aNULL:!MD5; ssl_prefer_server_ciphers on; location / { proxy_pass http://iocaine; proxy_cache off; proxy_intercept_errors on; error_page 421 = @fallback; } location @fallback { root /data/blog; internal; } ssl_certificate /etc/letsencrypt/live/blog.cerberos.id.au/fullchain.pem; # managed by Certbot ssl_certificate_key /etc/letsencrypt/live/blog.cerberos.id.au/privkey.pem; # managed by Certbot #debug logging options error_log /var/log/nginx/blog.error.log warn; access_log /var/log/nginx.access.log; }

spla

@spla@mastodont.cat · 2 months ago

He afegit dues gràfiques més al panell de Grafana que mostra totes les peticions que gestiona nginx d'aquest servidor mastodont.cat.
"avg request time" mostra el temps total promig en atendre una petició, per exemple, actualitzar la línia de temps. "avg upstream time" mostra el temps promig que necessita el "back-end" per a gestionar-la.

#manteniment #nginx #logs

gràfiques a Grafana tant del temps total en atendre una petició de nginx com el temps que ha necessitat el back-end

Stefano Marinelli boosted

gyptazy

@gyptazy@mastodon.gyptazy.com · 2 months ago

It doesn’t occur often, but when it does, it brings a smile to my face. This is my error page served from the proxy when the backend can't process the requests (or is unavailable).

#manpageblog #devops #nginx #proxy #backend #linux #freebsd #tux #beastie

gyptazy

@gyptazy@mastodon.gyptazy.com · 2 months ago

It doesn’t occur often, but when it does, it brings a smile to my face. This is my error page served from the proxy when the backend can't process the requests (or is unavailable).

#manpageblog #devops #nginx #proxy #backend #linux #freebsd #tux #beastie

Stefano Marinelli boosted

Alexandre :freebsd:

@alelab@mastodon.bsd.cafe · 3 months ago

#NGINX Native support for #ACME protocol
https://blog.nginx.org/blog/native-support-for-acme-protocol
#Web #Webserver

Alexandre :freebsd:

@alelab@mastodon.bsd.cafe · 3 months ago

#NGINX Native support for #ACME protocol
https://blog.nginx.org/blog/native-support-for-acme-protocol
#Web #Webserver

alcinnz boosted

Kamalavelan

@demonshreder@mastodon.xyz · 3 months ago

https://blog.nginx.org/blog/native-support-for-acme-protocol

Competition is a funny thing. #nginx finally introduces native support fort the #ACME protocol.

Kamalavelan

@demonshreder@mastodon.xyz · 3 months ago

#Caddy server is such a boon and step forward. I feel old for not trying it for so long. Neuroplasticity is a thing I guess. On other hand, having held onto #nginx and finding its nitty gritties definitely helps me keep my day job. 🤷

Kamalavelan

@demonshreder@mastodon.xyz replied · 3 months ago

https://blog.nginx.org/blog/native-support-for-acme-protocol

Competition is a funny thing. #nginx finally introduces native support fort the #ACME protocol.