Skip to content

Instantly share code, notes, and snippets.

@ygotthilf
ygotthilf / jwtRS256.sh
Last active March 25, 2024 09:12
How to generate JWT RS256 key
ssh-keygen -t rsa -b 4096 -m PEM -f jwtRS256.key
# Don't add passphrase
openssl rsa -in jwtRS256.key -pubout -outform PEM -out jwtRS256.key.pub
cat jwtRS256.key
cat jwtRS256.key.pub
package main
import (
"net/http"
"database/sql"
"fmt"
"log"
"os"
)
@ipmb
ipmb / ratelimit.nginxconf
Last active March 23, 2024 20:24
Nginx reverse proxy with rate limiting
upstream myapp {
server 127.0.0.1:8081;
}
limit_req_zone $binary_remote_addr zone=login:10m rate=1r/s;
server {
listen 443 ssl spdy;
server_name _;
@oodavid
oodavid / README.md
Last active February 27, 2024 12:44 — forked from aronwoost/README.md
Deploy your site with git

Deploy your site with git

This gist assumes:

  • you have a local git repo
  • with an online remote repository (github / bitbucket etc)
  • and a cloud server (Rackspace cloud / Amazon EC2 etc)
    • your (PHP) scripts are served from /var/www/html/
    • your webpages are executed by apache
  • apache's home directory is /var/www/
@jed
jed / how-to-set-up-stress-free-ssl-on-os-x.md
Last active February 25, 2024 17:35
How to set up stress-free SSL on an OS X development machine

How to set up stress-free SSL on an OS X development machine

One of the best ways to reduce complexity (read: stress) in web development is to minimize the differences between your development and production environments. After being frustrated by attempts to unify the approach to SSL on my local machine and in production, I searched for a workflow that would make the protocol invisible to me between all environments.

Most workflows make the following compromises:

  • Use HTTPS in production but HTTP locally. This is annoying because it makes the environments inconsistent, and the protocol choices leak up into the stack. For example, your web application needs to understand the underlying protocol when using the secure flag for cookies. If you don't get this right, your HTTP development server won't be able to read the cookies it writes, or worse, your HTTPS production server could pass sensitive cookies over an insecure connection.

  • Use production SSL certificates locally. This is annoying

@marktheunissen
marktheunissen / pedantically_commented_playbook.yml
Last active February 16, 2024 04:32 — forked from phred/pedantically_commented_playbook.yml
Insanely complete Ansible playbook, showing off all the options
This playbook has been removed as it is now very outdated.
@brianloveswords
brianloveswords / git-obliterate
Last active January 24, 2024 12:28
git-obliterate: for removing sensitive files you may have committed from the entire history of the project.
#!/bin/bash
file=$1
test -z $file && echo "file required." 1>&2 && exit 1
git filter-branch -f --index-filter "git rm -r --cached $file --ignore-unmatch" --prune-empty --tag-name-filter cat -- --all
git ignore $file
git add .gitignore
git commit -m "Add $file to .gitignore"
@paragonie-scott
paragonie-scott / crypto-wrong-answers.md
Last active January 22, 2024 04:20
An Open Letter to Developers Everywhere (About Cryptography)
@datagrok
datagrok / gist:2199506
Last active April 8, 2023 17:36
Virtualenv's `bin/activate` is Doing It Wrong