trimstray/nginx-admins-handbook

How to improve NGINX performance, security, and other important things.

Hi!

I'm a System and Network Administrator. I post my ongoing research at blkcipher.pl.

Some of my blog posts ^[PL]

• Czym jest i jakie znaczenie ma średnie obciążenie systemu?
• TLS: Jaki rozmiar powinien mieć klucz prywatny?
• Co jeśli kill -9 nie działa?
• NGINX: Usprawnienie zamykania procesów roboczych
• Dlaczego pamięć SWAP jest nadal istotna?
• Negocjacja wersji TLS i pakiet szyfrów sygnalizacyjnych

nginx-admins-handbook's Issues

Translate english to korean

This project was very useful to me.
So I want to translate this project into Korean.
Could you allow me to translate this project?
But I don't have much time, so I'm going to do it like a toy project, is that okay?

Black high-res hardening checklist must be inverted in colors

Well subj :) Not good for printing black pages. Wastes cartridge and environment.

PDF version of README.md?

This is really less of an issue and more of a recommendation / Question.
Would it be welcomed if I were to create a PDF version of this handbook, complete with working bookmarks that lead to each section so that it may be hosted and linked somewhere for those of us who prefer pdf versions of documentation?

I am unsure about the "standards" for linking pdf's vs actually adding them to a repository on github. I know .exe files are generally kept off of github (though I had them up for ease of access to a team...... smh)

New tool

Hello, thanks for your work.
Can you add our tool to your handbook?

A tool to build deb or rpm package of required Nginx version from the source code, with the ability to connect third-party modules.
Nginx parameters are set in the yaml configuration file.

https://github.com/TinkoffCreditSystems/Nginx-builder

“Buffer overflow” section is misleading

https://github.com/trimstray/nginx-quick-reference/blob/master/README.md#beginner-control-buffer-overflow-attacks

The language of this makes it seem like the directives are intended to protect against memory corruption attacks, which is incorrect. These directives control the behavior of when Nginx buffers data in memory vs writing the buffer to disk temporarily to avoid allocating too much memory. It has nothing to do with mitigating memory corruption attacks.

ngx_installer.sh - updates and fixes

• add support for FreeBSD
• updated OpenSSL version (1.1.1c)
• minor fixes and updates

Rt

Typo in strict version of printable hardening cheatsheet

I think this was meant to be Keep only TLS 1.3.

Paragraph is unclear

A paragraph in this section is unclear:

Directives are organised into groups known as blocks or contexts. Generally context is a block directive can have other directives inside braces. It appears to be organised in a tree-like structure, defined by sets of brackets - { and }.

Also, "generally" is generally followed by a comma.

Is this a valid interpretation of this sentence?

Generally, context is a block directive that can have other directives inside braces.

Deploy nodejs server on reverse proxy nginx is slow

I create a nodejs http server and using autocannon to loadtest.
When I use this node server without a nginx proxy, the requests reach 137k per second.
But when I use it with nginx reverse proxy, it reaches 60k per second.
Why ????
please help me.🙏