Hacker News Board Hacker News, browsed like a classic message board
Live data from Hacker News

Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

blog.mccartie.com

Post reply on HN
Print view View original

11–20 of 49 posts

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#12

Post by latch »

meritt wrote: post #2

Great writeup. One suggestion on the nginx front I might suggest is you add an entry to drop requests for unknown hosts. e.g. http://104.131.41.220 https://github.com/h5bp/server-configs-nginx/blob/master/sit... That github repo is a goldmine for understanding nginx configs too.

other things to consider:

     # if you compiled --with-http_spdy_module
     listen 443 ssl spdy;

     # amusing how many of these you'll get
     location ~*\.php {
       add_header "Not Found" 404;
     }

     # pretty sure you need to do this to have keepalive working
     # between nginx and the upstream
     proxy_set_header Connection "";
     proxy_http_version 1.1;

     # buffer writes to disk (for a busy site, you can use much larger values than 1K)
     access_log /var/log/nginx/access.log buffer=1K;

     # cache the ssl connction parameters
     ssl_session_cache shared:SSL:20m;
     ssl_session_timeout 10m;

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#13

Post by jonmccartie »

akbar501 wrote: post #8

Also worth noting that you should run a firewall as part of the basic configuration. AWS includes this via the Security Groups, but with DO you'll need to use iptables or ifw.

Good point. I didn't mention it in this post, but DO has a great article on getting started with firewalls: https://www.digitalocean.com/community/tutorials/how-to-set-...

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#14

Post by jonmccartie »

latch wrote: post #12
meritt wrote: post #2

Great writeup. One suggestion on the nginx front I might suggest is you add an entry to drop requests for unknown hosts. e.g. http://104.131.41.220 https://github.com/h5bp/server-configs-nginx/blob/master/sit... That github repo is a goldmine for understanding nginx configs too.

other things to consider: # if you compiled --with-http_spdy_module listen 443 ssl spdy; # amusing how many of these you'll get location ~*\.php { add_header "Not Found" 404; } # pretty sure you need to do this to have keepalive working # between nginx and the upstream proxy_set_header Connection ""; proxy_http_version 1.1; # buffer writes to disk (for a busy site, you can use much larger values than 1K) access_log /…

The .php block gave me a good laugh. Great idea. Just rejecting /wp-admin.php should reduce load significantly. :)

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#15

Post by latch »

xtrumanx wrote: post #10

Quick question; I don't know much about setting up a Linux server but I found it interesting the post had nothing related to security besides setting up a ssh key and separate user for deployment. What security-related tasks do you do when setting up a new server? Besides the above, the only things that come to mind for me are: 1. Change ssh port from default. 2. Block unwanted traffic via iptables. 3. Protect ssh wi…

#2 and #3 in your list are rather sweeping (fail2ban does more than protect ssh). I'm no expert either, the only thing I'd add is to disable password-based logins and root-login [1]

[1] http://www.unixlore.net/articles/five-minutes-to-more-secure...

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#16

Post by threeseed »

thejerz wrote: post #4

I wouldn't recommend running Nginx, Unicorn, Rails, Redis, and PostgreSQL all on one instance. Better to offload the databases onto their own VPS's.

Even better idea is not to host the databases at all.

Only those who have never experienced a corrupted backup or failed slaves think a database is something that is relatively trivial to manage.

You're much better off looking at platforms like RDS, MongoHQ, Cloudant etc.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#19

Post by donw »

xtrumanx wrote: post #10

Quick question; I don't know much about setting up a Linux server but I found it interesting the post had nothing related to security besides setting up a ssh key and separate user for deployment. What security-related tasks do you do when setting up a new server? Besides the above, the only things that come to mind for me are: 1. Change ssh port from default. 2. Block unwanted traffic via iptables. 3. Protect ssh wi…

Something that a lot of Ruby deployment setups seem to be missing is setting up proper user permissions for apps and deployment.

The first step is to have separate user accounts for everybody that's going to be deploying apps. You really don't want shared accounts (like a single 'deployer' user), because you get no audit trail on who-does-what, and you effectively lose access control to your machines.

The second step is to run the app itself as a limited-privilege user -- no write permissions to anything except for logs and tempfiles. A lot of attacks depend on your app being able to overwrite parts of its own code; if that can't happen, the attack fails.

Re: Digital Ocean: Ubuntu, Nginx, Unicorn, Rails

#20

Post by brettskiii »

davidlumley wrote: post #5

I used to prefer the flexibility and efficiency of having my VPS setup, and it's certainly cheaper. Over the past 2 years though, I've saved so much time and sanity using Heroku. I certainly can understand saving thousands of dollars and improving performance by moving from Heroku to a VPS or bare metal solution, but $90 is not uncomfortable enough for me to warrant the change. Interesting article!

Heroku apps aren't performant in many areas of the world e.g Australia like where I am, Amazon EC2 has an Australian region which is amazing
Post reply on HN