Look what I've found while reading #haproxy docs : #YouPorn is implemented as a LAMP stack and serves 300.000 requests per second !
That's massive.

https://www.haproxy.org/they-use-it.html
https://highscalability.com/youporn-targeting-200-million-views-a-day-and-beyond/

Joshua Rogers https://joshua.hu/proxy-pass-nginx-decoding-normalizing-url-path-dangerous

Joshua explores vulnerabilities/weaknesses related to how web servers, particularly nginx (through proxy_pass), handle URL normalization and path traversal. It highlights that paths can be manipulated using sequences like /../, leading to potential security issues such as path traversal vulnerabilities, cache poisoning, and authentication bypass.

Am 2. Februar wurden wir Opfer eines #ddos Angriffs aus #aws. #nginx Rate Limits, #fail2ban und #nftables hatten das so gut im Griff, dass wir das nicht mal gemerkt haben. Lediglich die Seitenansichten in #matomo ließen vermuten, dass es hier einen Angriff gab.

Derweil andere Seiten: „WiR bRaUcHeN cLoUdFlArE wEgEn DDoS!!!“

Hmpf. Habe ein Problem mit #nginx

Ich will, dass bestimmte Verzeichnisse (z.B. Webfonts oder Bilder) nur von bestimmten Webseiten eingebunden werden dürfen.

Ich habe also unter /etc/nginx/sites-enabled/cors.conf eine nginx-Konfiguration mit

map $http_origin $origin_allowed {
default 0;
https://www.example.com.de 1;
}

map $origin_allowed $origin {
default "";
1 $http_origin;
}

und dann zwei nginx-Konfigurationen für die betreffenden Seiten (z.B. site_name fonts.example.com und site_name images.example.com), deren Inhalte ausschließlich auf www.example.com eingebunden werden sollen, jeweils mit

location / {
add_header 'Access-Control-Allow-Origin' $origin always;
add_header 'Access-Control-Allow-Methods' 'GET, POST';
}

Das funktioniert, solange nur eine nginx-Konfiguration diese location-Anweisung enthält.

Sobald ich sie in zwei nginx-Konfigurationen schreibe, funktioniert es nicht mehr.

Weiß jemensch, wie ich das beheben kann?

Danke im Voraus!

Publishing a photo of approximately 4MB from my snac instance (at home with 20 Mbit/sec uplink) meant overwhelming everything.
This happened because, for every remote instance, Nginx was requesting the multimedia file from snac. However, due to saturated connections, it took several seconds, leading to thread exhaustion in snac.
I resolved this issue by caching the multimedia files myself using Nginx, which significantly improved performance.

This matter will be covered in a subsequent (simple) blog post.

Any #nginx devs here?

The cert for https://forum.nginx.org has expired.

I've updated my iMac to #macos Sequoia and it has broken #nginx. It's the #homebrew install, and is failing to read my #letsencrypt privkey.pem. Probably permissions and weirdly the nginx worker process has a UID of -2. Anyone have any ideas?

Calling all experienced #nginx users!

Can you help tidying up the DokuWiki Nginx guide?

https://www.dokuwiki.org/install:nginx

Please be bold in editing! Remove any clutter, streamline instructions, and make it shine!

Going to finally switch my ingress from #Traefik to #Nginx this weekend. #k8s #homelab