KostyaEsmukov

Nginx A+ score on Qualys SSL Labs

Test your current score here: https://www.ssllabs.com/ssltest/

Certificate

You must have a certificate issued by a trusted certification authority.

These authorities issue certificates for free and I tested them by myself:

• Let's Encrypt I strongly encourage you to go with them, unless you need a higher-grade certificate;
• Wosign - their certificates are no longer trusted by browsers.

KostyaEsmukov

Nginx performance optimizations

The configs below are for Linux.

These are the most competent tunings I've found.

KostyaEsmukov

Nginx proxy gzipped response

+-------+ +---------> +-----+ +---------> +--------+
|browser|             |proxy|             |upstream|
+-------+ <---------+ +-----+ <---------+ +--------+
            gzipped            !gzipped!

KostyaEsmukov

Nginx production configuration sample

This config assumes that nginx is run from docker image _/nginx.

docker commands

docker network create nginx

mkdir -p /etc/myproject/nginx

cd /etc/myproject/nginx

KostyaEsmukov

Let's Encrypt in docker with nginx

Replace myproject and domain.com in the commands below to your needs.

# This folder will contain actual certificates and account data
mkdir -p /etc/myproject/letsencrypt/

# This folder will contain authentication files created by webroot plugin of the certbot

mkdir -p /var/myproject/letsencrypt/

KostyaEsmukov

#! /bin/sh
#
# Modified script from https://www.zabbix.org/wiki/Docs/howto/ssl_certificate_check
# which is able to check multiple hosts at once.
#
# Define a host macros like {$SNI} => 'domain1.com,domain2.com'
#
# Kostya Esmukov <kostya@esmukov.ru>
#

KostyaEsmukov

Zabbix alerts via Telegram

⚠️ Deprecated: Zabbix now includes official support for Telegram media, see https://www.zabbix.com/integrations/telegram.

Replace my_zabbix_bot and My Zabbix Bot below with your own names.

Create and test telegram bot

Add @BotFather contact in Telegram and press 'start',
then type:

KostyaEsmukov

Create a swapfile on Linux

dd if=/dev/zero of=/var/swapfile bs=1M count=2048
chmod 0600 /var/swapfile
mkswap /var/swapfile

swapon /var/swapfile

echo >> /etc/fstab

echo "/var/swapfile none swap sw 0 0" >> /etc/fstab

KostyaEsmukov

Squid3 in docker as caching proxy

Handy to speedup your CI builds.

Configuration

# create a directory for files cache
mkdir -p /var/yourproject/squid/spool

mkdir -p /etc/yourproject/squid/

KostyaEsmukov

• Instal matplotlib: https://github.com/rueckstiess/mtools/wiki/matplotlib-Installation-Guide-for-Mac-OS-X
• pip3 install matplotlib
• In your created virtualenv:

.

echo "/usr/local/lib/python3.5/site-packages" > ~/.virtualenvs/MY_VIRTUALENV/lib/python3.5/site-packages/mpl_toolkits.pth
echo "/usr/local/lib/python3.5/site-packages" > ~/.virtualenvs/MY_VIRTUALENV/lib/python3.5/site-packages/matplotlib.pth