[TEMPLATE] Nginx configuration template (nginx.conf) (LNMP + SSL + CDN version)

worker_processes  auto;


events {
    worker_connections  10000;
}


http {
    limit_req_zone $binary_remote_addr zone=one:10m rate=1r/s;
    include       mime.types;
    default_type  application/octet-stream;

    sendfile        on;

    keepalive_timeout  60;
    client_body_timeout 20s;
    client_header_timeout 10s;
    send_timeout 30s;


    server {
        listen       80;
        limit_req zone=one burst=5;
        server_name www.eternalcenter.com;
        return 301 https://eternalcenter.com$request_uri;
        }


    server {
        listen       80;
        limit_req zone=one burst=5;
        server_name eternalcenter.com;
        return 301 https://eternalcenter.com$request_uri;
        }


    server {
        listen       443 ssl;
        server_name www.eternalcenter.com;

        ssl_certificate      /etc/nginx/ssl/eternalcenter.com.crt;
        ssl_certificate_key  /etc/nginx/ssl/eternalcenter.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        if ($request_method !~ ^(GET|POST)$){
        return 444;
        }

        root /usr/share/nginx/html;
        index index.php index.html;

        location ~ ^/\.user\.ini {
        deny all;
        }

        location ~*\.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
        expires 30d;
        access_log off;
        try_files $uri =404;
        }

        location ~ \.php$ {
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param HTTP_HOST $http_host;
        }

        location ~* ^/(wp-login\.php|admin-ajax\.php|wp-admin|wp-json|wp-includes|wp-content/plugins|wp-content/themes|wp-content/uploads) {
        set $cache_control_policy "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
        set $pragma_policy "no-cache";
        set $expires_policy "0";
        add_header Cache-Control $cache_control_policy always;
        add_header Pragma $pragma_policy always;
        add_header Expires $expires_policy always;

        try_files $uri $uri/ /index.php?$query_string;
        }

        location / {
             return 302 $scheme://eternalcenter.com$request_uri;
        }

        error_page  404              /404.html;
    }


    server {
        listen       443 ssl;
        server_name eternalcenter.com;

        ssl_certificate      /etc/nginx/ssl/eternalcenter.com.crt;
        ssl_certificate_key  /etc/nginx/ssl/eternalcenter.com.key;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        if ($request_method !~ ^(GET|POST)$){
        return 444;
        }

        root /usr/share/nginx/html/;
        index index.php index.html index.htm;

        location ~ ^/\.user\.ini {
        deny all;
        }
    
        location ~*\.(jpg|jpeg|gif|png|css|js|ico|xml)$ {
        expires 30d;
        access_log off;
        try_files $uri =404;
        }

        location ~ \.php$ {
            fastcgi_pass 127.0.0.1:9000;
            fastcgi_index index.php;
            include fastcgi.conf;
            fastcgi_param  SCRIPT_FILENAME  /usr/share/nginx/html/$fastcgi_script_name;
            include fastcgi_params;
            fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name;
            fastcgi_param HTTP_HOST $http_host;
        } 

        location ~ ^/index\.php$ {

        set $cache_control_policy "no-store, no-cache, must-revalidate, proxy-revalidate, max-age=0";
        set $pragma_policy "no-cache";
        set $expires_policy "0";

        add_header Cache-Control $cache_control_policy always;
        add_header Pragma $pragma_policy always;
        add_header Expires $expires_policy always;
        }

        location / {
        try_files $uri $uri/ /index.php?$query_string;
        }

        error_page  404              /404.html;
        }


    gzip on;
    gzip_min_length 1000;
    gzip_comp_level 4;

    gzip_types text/plain text/css application/json application/javascript text/xml application/xml application/xml+rss text/javascript;

    client_header_buffer_size 1k;
    large_client_header_buffers 4 4k;

    open_file_cache max=2000 inactive=20s;
    open_file_cache_valid  60s;
    open_file_cache_min_uses 5;
    open_file_cache_errors off;

}

[STEP] DELL server iDRAC physical disk foreign state clean

Step One: Check the state of physical disk

Storage –> Overview –> Physical Disks
We can see the State is Foreign not Ready

Step Two: Clean the foreign state of physical disk

2.1 Access controllers interface

Storage –> Overview –> Controllers

2.2 Clean the foreign state of physical disk

Choose Controllers à Action à Foreign Configuration à Clean Foreign

[CONTENT] SUSE Repository Mirroring Tool (RMT) mirror schedule configuration

Content One: Configure the mirror schedule

1.1 Modify /etc/systemd/system/multi-user.target.wants/rmt-server-sync.timer file

# vi /etc/systemd/system/multi-user.target.wants/rmt-server-sync.timer

Modify all content as follows:

[Unit]
Description=RMT Sync timer

[Timer]
OnCalendar=*-*-01 01:00:00
RandomizedDelaySec=9h
Unit=rmt-server-sync.service

[Install]
WantedBy=multi-user.target

(Note: here is an example with setting the mirror schedule to the 1st of every month)

1.2 Apply the settings to make them take effect

# systemctl restart rmt-server-sync.timer
# systemctl restart rmt-server-mirror.timer

Content Two: Disable the mirror schedule

2.1 Disable the mirror schedule

# systemctl disable --now rmt-server-sync.timer
# systemctl disable --now rmt-server-mirror.timer
# systemctl daemon-reload

2.2 Manual Mirror

# rmt-cli sync
# rmt-cli mirror

Or:

# rmt-cli sync ; rmt-cli mirror

[DEBUG] SUSE Repository Mirroring Tool (RMT) resolve client use SUSEConnect command output ‘Error: Registration server returned ‘Internal Server Error’ (500)’ or ‘SUSEConnect error: trying to send a keepalive from a system not yet registered. Register this system first’

Error Reporting Command

# SUSEConnect --url

or:

# SUSEConnect --de-register

Error Code

Error: Registration server returned 'Internal Server Error' (500)

or:

SUSEConnect error: trying to send a keepalive from a system not yet registered. Register this system first

Solution 1: Make sure the /tmp directory has enough space

Step One: Make sure the /tmp directory has enough space

# df -h

At this point, ensure that the directory occupancy is not 100% based on the output content.

Step Two: Restart rmt-server

# systemctl restart rmt-server

Solution 2: Change the cache directory

Step One: Make new cache directory

# mkdir /var/rmttmp

(Note: here is an example with making the new cache directory named /var/rmttmp)

Step Two: Change the owner of the new cache directory

# chown -R _rmt:nginx /var/rmttmp

(Note: here is an example with changing the owner of directory named /var/rmttmp)

Step Three: Change the

# systemctl edit rmt-server-mirror.service

Change partial content as follow:

[Service]
Environment=
Environment="LOG_TO_JOURNALD=1" "LANG=en" "TMPDIR=/var/rmttmp/"

(Note: here is an example with setting the new cache directory to /var/rmttmp/)

Step Four: Restart rmt-server-mirror.service

# systemctl daemon-reload
# systemctl restart rmt-server-mirror.service

Reference

https://support.scc.suse.com/s/kb/RMT-mirroring-fails-when-tmp-runs-out-of-disk-space?language=en_US

[DEBUG] Linux resolve at command error ‘PAM failure: Authentication service cannot retrieve authentication info’

Error Reporting Command

> at

Error Code

PAM failure: Authentication service cannot retrieve authentication info

Reason

This user which inputted at command did not have password so there is no record relate to it in /etc/shadow file.
And at command need check the record in the file /etc/shadow.
If at command can not find the user's record in /etc/shadow, it output this error code.

Solution

And password to the suer:

> passwd