Jan Vladimir Mostert's questions

I see when creating a new Google Cloud account, the firewall rules are set to allow traffic from all locations to SSH

default-allow-ssh IP ranges: 0.0.0.0/0

Can these rules be deleted safely or does Google Cloud depend on SSH being open to the world?

I'm authorising instances access to PostgreSQL via the gcloud command:

gcloud sql instances patch blah-sql-dev --authorized-networks 10.1.1.2/32,10.1.1.3/32,.....

What I'm seeing under Cloud SQL's Authorised Networks is just the IP addresses instead of a friendly name that actually tells me what the IP address is for.

Is there a way to include a friendly name when whitelisting IP addresses using Gcloud?

When I execute the above command, I see the following message:

The following message will be used for the patch API method.
{"project": "my-project", "name": "blah-sql-dev", "settings": {"ipConfiguration": {"authorizedNetworks": [{"value": "10.1.1.2/32"}, {"value": "10.1.1.3/32"}, ......]}}}

So it appears there must be some way to pass in a friendly name via the "value" field, but how is that done via the gcloud command?

I'm running a postgres database on a Google Cloud instance that we drop and recreate daily as part of our nightly build. Currently this is being done manually and I want to automate it.

gcloud compute ssh --zone europe-west2-c postgres@postgresql-dev -- "dropdb mydb"
gcloud compute ssh --zone europe-west2-c postgres@postgresql-dev -- "createdb mydb"
gcloud compute ssh --zone europe-west2-c postgres@postgresql-dev -- "psql postgres -c 'GRANT ALL PRIVILEGES ON DATABASE mydb to myuser;' "

This works fine to drop and recreate the database, the problem comes in when I have to re-setup the password ...

gcloud compute ssh --zone europe-west2-c postgres@postgresql-dev -- "psql postgres -c 'ALTER USER myuser WITH PASSWORD 'passwordhere' ; "

gcloud command is already using the double quotes, psql postgres -c is already using the single quotes, what quotes should I be using to put the password in quotes?

I've tried escaping the quotes, but it doesn't work:

WITH PASSWORD \'passwordhere\' 

ERROR: syntax error at or near "\" LINE 1: ALTER USER myuser WITH PASSWORD \passwordhere'

or

WITH PASSWORD \"passwordhere\" 

bash: -c: line 0: unexpected EOF while looking for matching `'' bash: -c: line 1: syntax error: unexpected end of file

How do I escape those quotes?

I've enabled password protection on one sub-domain using NGINX and wrote a little script that will allow adding users easily. When I enter the password though, the dialog goes away and immediately pops up again.

Here's my password generator script:

#!/bin/bash
if [ -z "$1" ]
  then
    echo "Username Expected as first param"
elif [ -z "$2" ]
  then
    echo "Password Expected as second param"
else
  htpasswd -b /home/me/.passwords $1 $2
  /etc/init.d/nginx reload
fi

Running:

./create-password test password

I can see the following output:

Adding password for user test

[ ok ] Reloading nginx configuration (via systemctl): nginx.service.

Inside /home/me/.passwords I can see the following entry:

test:$apr1$t.LpBHkW$bEBEMK1HRBqAvvkB9cQ.I.

Inside my nginx config (/etc/nginx/sites-enabled/blah), I have the following:

server {
        listen 80;
        server_name blah.example.com;
        auth_basic "Restricted Content";
        auth_basic_user_file  /home/me/.passwords;
        location / {
                proxy_pass      http://127.0.0.1:6999;
                proxy_redirect  off;
                proxy_set_header Host $host;
                proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        }
}

If I type in test and testing,

the dialog would go away and pop up again.

I'm not seeing any errors in the NGINX error.log, access.log only shows which is basically an error 401, Unauthorized:

___.___.___.___ - test [16/Apr/2016:09:36:38 +0000] "GET / HTTP/1.1" 401 1421 "-" "Mozilla/5.0 (Macintosh; Intel Mac OS X 10_11_4) AppleWebKit/537.36 (KHTML, like Gecko) Chrome/49.0.2623
.110 Safari/537.36"

Cancelling the password popup, I see the following:

I'm not sure if my terminology is correct, so let me explain ...

If I have a domain, test.example.com, I want to be able to map /abc to an application on that server running on port 8080 and map another application /def to an application running on port 8081.

I've tried it with RabbitMQ which I'm running inside docker and exposing port 15672, NGINX however is not inside Docker and running directly on the machine.

docker run -d --hostname rabbitmq --name rabbitmq -p 15672:15672 rabbitmq:3-management

Whether it's running inside Docker or directly on the machine, I believe is irrelevant, I have an application running on port 15672 that I want to map to location /rabbitmq

My NGINX config I've tried so far:

server {
        listen 80;
        server_name test.example.com;

        location /rabbitmq {
                proxy_pass      http://127.0.0.1:15672;
        }
}

When going to test.example.com/rabbitmq I'm seeing the following:

I don't know if that's NGINX's page or RabbitMQ's page showing not found.

Opening port 15672 on the server I can clearly get to RabbitMQ

And going to :15672/blah it seems to be the same not-found page, so it must be getting to RabbitMQ.

RabbitMQ is listening on 0.0.0.0:15672, so it should work from any domain, host or ip.

So how do I make test.example.com/rabbitmq actually serve the content of test.example.com:15672 ?

Seeing as CoreOS is designed to run docker containers, I was wondering if there's a way to map Backend Services on a HTTP Load Balancer directly to Docker Images running on a single CoreOS instance.

This is the structure I'm going for:

www.example.com/marketing -> docker:marketing-app
www.example.com/accounts -> docker:accounts-app
www.example.com/ -> docker:www-app
...

I know this can be done with Kubernetes using Ingress - each docker container will be seen as a backend service by the HTTP Load Balancer, this is ultimately what I'll be using for production; for my test/qa/demo setup, I'm looking for something much simpler, a single large CoreOS instance, running multiple docker containers and have the exact same HTTP Load Balancer (that will later be used in prod) point to docker containers on the CoreOS instance.

Does CoreOS have such functionality?

If not, what other options do I have other than starting an NGINX container to route all traffic from the HTTP Load Balancer to different containers?

I'm running a single instance of RabbitMQ on a fairly big server (32GB RAM, duel SSD, Octa Core Intel, etc) and have a large number of applications publishing and consuming from RabbitMQ without troubles.

This morning while deploying another application, it simply wouldn't start up complaining that it can't connect. I reduced the number of consumers in my application and it connected just fine. Looking at my RabbitMQ dashboard, I can see the consumer count pegged at 900; increasing the number of consumers in my application again and the application is throwing all kinds of exceptions not being able to connect to RabbitMQ.

So looking at the consumer count that's pegged at 900 and the behavior I'm seeing, I'm guessing I've hit some kind of consumer limit.

Server is idling at 1% and looking at Erlang Processes available, I'm seeing 1048576 available, so plenty capacity left on the server.

How do I increase this artificial limit of 900 consumers?

I keep on running out of disk space while trying to compile gcc and I keep on creating larger and larger disk sizes and after 5 hours of compiling, it runs out of disk space. I've resized the disk 4 times now, restarted the compile step for the 4th time now with a 500GB disk.

When I ran df -h to see how much space was used, it only says 9.7GB, but that's considered 100%.

I thought there might be another disk, but I'm only seeing sda and its partition

ls /dev/sd*
/dev/sda  /dev/sda1

So is my disk actually 500GB in size and df is just reporting it wrong (in which case compiling gcc chows up the whole 500GB) or is Google Cloud's Dashboard reporting it wrong, df reporting it right and compiling gcc is not chowing through 500GB ?

Either way, unless I'm supposed to do something to make use of the 500GB (which is counter-intuitive by the way), I'm guessing this is a bug?

(I've searched before I posted, I've only seen AWS related issues)

UPDATE - lsblk explains it:

lsblk
NAME   MAJ:MIN RM  SIZE RO TYPE MOUNTPOINT
sda      8:0    0  500G  0 disk 
└─sda1   8:1    0   10G  0 part /

Does NGINX allow switching load from one server to another without losing the request?

I have a SOAP API, NGINX forwards the request to one of three servers each which forwards it to a queue and then waits for a response from the queue and then the client waits for a response from the API. If the client doesn't get the response, the request still goes through, only the client doesn't know that that the action he executed finished successfully.

So in the event that I need to upgrade one of these SOAP frontends, I need to switch load to one of the other two frontends, but without dropping any of the existing connections, is this possible with NGINX?