sgohl's questions

I want to Define a variable from the value of what is received originally via nginx proxy_set_header MYVAR "some_value";

The variable should then be used in DocumentRoot, Directory and Alias.

RewriteRule .* - [E=MYVAR:%{HTTP:MYVAR}]
SetEnv MYVAR "%{HTTP:MYVAR}"
Define MYVAR ${MYVAR}

This doesn't seem to be possible according the Apache documentation which only gives examples on how to set static values. So I tried this:

  <If "%{HTTP:MYVAR} == 'value1'">
    Define MYVAR value1
  </If>

  <If "%{HTTP:MYVAR} == 'value2'">
    Define MYVAR value2
  </If>

which doesn't work either. It always just executes the Define from the last <If>. If I add

  <Else>
    Define MYVAR undefined
  </Else>

this will be executed, so perhaps something wrong with my Syntax or that whole logic is not working as I think?

I'm running out of Ideas...

Edit: Is it possibly true that Define generally doesn't work within <If> ?

unfortunately, the documentation is not clear about the HTTP content.

https://mmonit.com/monit/documentation/monit.html#HTTP

i want to monitor a specific response header, not the content itself, like this:

CHECK HOST example.de WITH ADDRESS example.de
 IF FAILED
   port 443 protocol https
   with ssl options {verify: enable}
   certificate valid > 15 days
   content == "Location: https://example.com/de/"
 THEN alert

As you see, I want to make sure the certificate is valid and the webserver is redirecting to the correct target url (so, only checking for 301 is not the solution).

Content in context of monit seems not to include the response headers. I tried it with send/expect, but monit refuses to start then (I did not investigate that further, because I can't believe it's not possible to do it "right".

Monit status is FAILED to [example.de]:443 type TCP/IP using TLS protocol HTTP with CONNECTION FAILED, which is a lie. Because if I delete the "content" line, the check is green/ok.

I am thinking about how this is meant to be done in a serious way for weeks now and didn't come to a conclusion yet. Maybe I think into the wrong direction.

Lets say you have a hundred web apps which come and go. You want an nginx configuration like that with the example of gitlab:

location / {
  proxy_pass http://gitlab;
}

As gitlab has been created with docker service create, nginx will be able to resolve gitlab by it's swarm-vip fake dns name within your ingress network.

BUT: only if the service container is running. Else, nginx will not start due to [emerg] 1#1: host not found in upstream "gitlab"

Now that's a neckbreaker when you have to run a high availability nginx and it's not your business to ensure that the proxy_pass'ed apps are running.

Everytime you update the nginx service, it will not come up if only one of the hundred other swarm services are not running even for the same second .. wtf?

If that ain't working, why in the world do we need name resolution in swarm? How do you solve this problem?

I thought about consul and dynamic generation of nginx virtual host templates (don't even think about docker-nginx-proxy!), but the apps are very different that you can say each app has its own individual configuration. And all this work not for a special reason, only to solve the resolving problem of nginx?

I want to implement a LetsEncrypt acme-challenge location statement globally for any server_name which ever will be requested.

So I wrote the following server block :

server {
        server_name ~^(.+)$;
        listen 80;

        location ^~ /.well-known/acme-challenge/ {
                default_type "text/plain";
                root        /etc/nginx/ssl/le;
                allow all;
        }
}

From what I think I know, I understand that if there is an exact match of a server-block, my server-block above will not be invoked.

Is there any trick how to accomplish it without ever touching the actual server-blocks of the domains?

I'm even fine with an if-statement

I am trying to launch an aws ec2 instance with coreos, providing a cloud-config, which just ignores some parts like putting an rsa_private_key or runcmd. Anyway, the hostname has been set successfully though, so the config was basically processed.

I broke down the whole config to the most simple thing and validated it with the coreos validator which tells me Line 5:unrecognized key "runcmd".

#cloud-config

hostname: "node01"

runcmd:
  - touch /test.txt

I can't see any syntax error, what's wrong here?
For completeness, here's my whole cloud-config.yml: http://pastebin.com/YnrWqj7G

In postfix I want to create a (so to speak) rewrite rule to rewrite the "mail from" - field matching one specific from-address "[email protected]" to "[email protected]" (for use with aol smarthost), if (as a condition) the "To"-field matches *@aol.com"

I must do that, because aol denies to use another "mail-from"-address than the real registered account ...

is that possible maybe via header_checks?

On a postfix mailserver, which is configured to generally send mail directly (internet-site), I want to implement a conditional header check for some receipient domains (in this example to keep it simple just with gmail.com), to let postfix use a smarthost. But, instead of authenticating with the smarthost smtp.google.com, it just keeps sending the mails addressed To: *@gmail* directly (if I set a wrong password on purpose, it does not complain about).

I created the following files in /etc/postfix/:

relay_passwd:

smtp.google.com [email protected]:mypassword

header_checks:

^To: <*@gmail*>/ FILTER relay:smtp.gmail.com:25

and referenced them in main.cf with additional options:

smtp_sasl_auth_enable = yes
smtp_sasl_password_maps = hash:/etc/postfix/relay_passwd
header_checks = regexp:/etc/postfix/header_checks

now I postmapped the files (and since, restarted postfix too multiple times):

# postmap relay_passwd
# postmap header_checks

and it throws a warning:

postmap: warning: header_checks, line 1: record is in "key: value" format; is this an alias file?

But I guess that's not the problem, is it? Anyway, I must be doing something wrong.

I found the following threads but they're not quite what I want:

Use different relay in postfix

Conditionnal relay in postfix

Different postfix relayhost based on system user?

Is the order in main.cf relevant? Is the regexp in header_checks ok?

Has anyone tried to install mod_fastcgi on CentOS7/httpd yet?

Since it's not in the epel or fusion repos, I tried the el6 rpm, which wasn't working (httpd said: Cannot load modules/mod_fastcgi.so into server: /etc/httpd/modules/mod_fastcgi.so: undefined symbol: unixd_config).

Compiling mod_fastcgi (# make top_dir=/usr/lib64/httpd) from source failed too with a thousands of errors like that:

/usr/include/httpd/http_config.h:574:32: error: request for member 'connection' in something not a structure or union

mod_fastcgi.c:2881:5: warning: passing argument 6 of 'ap_log_rerror_' from incompatible pointer type [enabled by default]
     ap_log_rerror(FCGI_LOG_ERR_NOERRNO, r, "FastCGI: access denied: %s", r->uri);

SELINUX is already disabled (to exclude that as reason for "access denied")

I also installed the requirements for compiling fastcgi: httpd-devel libtool make gcc apr apr-devel.

Since mod_fastcgi is IMHO the common way to connect to PHP-FPM, I really can't imagine that fastcgi is not meant for CentOS 7 so I assume I'm doing something wrong.

Unfortunately, mod_proxy's support for socket connections starts at httpd 2.4.10 and CentOS 7 repos are only 2.4.6 and I'd like to avoid compiling apache2 (and really want to use fastcgi and stay with fpm-sockets)

Did I may miss anything that obsoleted fastcgi? If not, my wish would be to get mod-fastcgi successfully compiled. Can someone, who is more fancy at compiling, test that on a default centos7 vm?

I'm preparing my CentOS 6 server for upgrading to CentOS 7 and wondered where pam_mysql (from EPEL) was gone (yum search - no find). Then I heard about SSSD which sounds really good, but found it only in connection with LDAP - which I'd love to use but simply can't because I've got an admin panel (froxlor) running, which stores user data in a mysql-db (which is also the backend for proftpd w/mod_sql and libnss-mysql), and want to have SSH Login for the users, I need to have SSH Authentication via mysql.

libnss-mysql is already working - but I can't login via SSH.

How'd one accomplish this in CentOS 7 since pam_mysql is gone? Thanks a lot!