dakini's questions

I have set up a server block that looks like this:

root /var/www/platform

location / {
 index index.html;
}

location /contact {
 try_files $uri /contact.html;
}

This works fine. I can go to x.com/contact and the contact.html page loads.

Now I want to add a subdirectory products with files like product1.html and so on. When the user goes to x.com/products/product1 I want to load the html file.

Because the products subdir is within the platform directory, x.com/products/product1.html works fine with the current ^ setup. I just want to get rid of the need to have .html at the end.

So I try adding a location block

location /products/(product) {
 root /products;
 try_files /$1.html $1.html /index.html;
}

But obviously this doesn't work. Any help will be appreciated.

If there's another better (but still easy) approach, I'd love to know it too.

If pf is a stateful firewall and keeps state by default, why do so many rulesets explicitly mention keep state?

Are there any standards about for how long (days, weeks) do CDNs cache video content?

This other answer suggested that it is only for a short period of time (e.g. 1 day) but that information is almost a decade old by now. For regular (non-video) content, there are cache settings.

How is it for video content? Where can I find more information about this (I could not find it on the websites of some CDN providers).

PS: I am not asking for product suggestions.

For a new domain x.co I am setting up, I want the root (x.co) to show an external landing page without changing the url to that of the external landing page.

This landing page has been created on hubspot and published at a.hubspot.b/c

Is there a simple way of achieving this? I checked a few answers like 1, 2, 3, but did not get it.

What I have now is below. It forwards to the landing page changing the url to a.hubspot.b/c. I need the url to stay the same x.co.

FWIW, I also use cloudflare caching and DNS.

server {
        listen 80;
        server_name  x.co www.x.co;
        return         301 https://$server_name$request_uri;
}

server {
        listen       443 ssl http2;
        server_name  x.co www.x.co;

        ssl_certificate      x.co.pem;
        ssl_certificate_key  x.co.key;

        ssl_protocols   TLSv1 TLSv1.1 TLSv1.2;

        ssl_session_cache    shared:SSL:1m;
        ssl_session_timeout  5m;

        ssl_ciphers  HIGH:!aNULL:!MD5;
        ssl_prefer_server_ciphers  on;

        location / {
            #proxy_pass https://x-12345.hubspotpagebuilder.eu/coming-soon/;

            resolver 8.8.8.8;

            proxy_pass https://x-12345.hubspotpagebuilder.eu/coming-soon;
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto $scheme;


            #root /var/www/frontend/x;
            #root   html;
            #index  index.html index.htm;
        }
    }

Edit/add - stupidly enough I had not bothered checking the nginx error logs. When I did, there were good clues to the problem. The error logs had

"SSL_do_handshake() failed (SSL: error:14094410:SSL routines:ssl3_read_bytes_sslv3 alert handshake failure:SSL alert number 40) while SSL handshaking to upstream, client: 2401: ......" 

(the ...... at the end means there's more text that I didn't type out here. I am using a Cloudflare cert on my backend and redirecting to a hubspot page in nginx - that seemed like a problem.

And it was. The solution was to add proxy_ssl_server_name on;. All the proxy_set_header directives which I copied in desperation was pointless and could happily be gotten ride of. This page proved very useful in explaining the problem and solution.

There is a partially related question here but it doesn't help me.

For site.com I have

location /sub/ {
    proxy_set_header Accept-Encoding "";
    proxy_pass http://192.168.1.1/ ;
}

The 192.168.1.1 IP has a VM with an Apache server on it.

Now when I go to either site.com/sub or site.com/sub/, it works fine as expected.

But when I go to site.com/sub/sub1, it redirects to 192.168.1.1/sub1/ whereas site.com/sub/sub1/ (with trailing slash) works as expected.

Using a proxy_redirect doesn't seem to make a difference. I also tried using with a regex but to no avail.

location ~/sub/?(.*)$ {
        proxy_set_header Accept-Encoding "";
        proxy_pass http://192.168.1.1/$1 ;
    }

Setting the header Host just redirects to site.com/sub1/.

Nginx logs show a 301 redirect.

I can easily solve the problem by simply creating a new location block for /sub/sub1/ but I would really like to be able to handle it in the same block.

As site.com/sub/sub1/ with the trailing slash already works fine, how can I get site.com/sub/sub1 to work correctly instead of redirecting to 192.168.1.1/sub1? What am I missing here?

I have a smoothly running FreeBSD box with a couple of jails running their own servers.

Nginx runs in its own jail and the main machine uses pf to redirect all http/s requests to Nginx. Nginx checks the requested domain name and does a proxy-pass to the appropriate jail.

This is my first time using Apache/PHP as I just decided to install opencart on a new jail.

The trouble is when I load up the opencart install page, it gets the index.php correctly but then it looks for all the other static files in bad places like this: http://192.168.100.4/install/view/stylesheet/stylesheet.css - which is basically the internal address of the jail.

I need it to look for the same file, using the domain name instead of the IP address like so: http://shop.foobar.com/install/view/stylesheet/stylesheet.css

I am almost (because there are many variables involved) sure this can be done by some php/apache setting, but I haven't been able to figure out how, despite having spent too much time on google. Is the problem due to Apache or something else (pf?), and how can I fix it? Given the annoying nature of this problem, clues might be just as useful as answers.

While setting up multiple jails on a FreeBSD machine, I also (naturally) need to set up the networking for each jail. It seems to me there are two ways of achieving the same goal

• setting up multiple cloned interfaces

  or

• setting up multiple aliases of one clone.

Under the first approach, I do (in /etc/rc.conf)

cloned_interfaces="lo1 lo2 ..."

ifconfig_lo1="inet 10.1.1.1 netmask 255.255.255.0"  
ifconfig_lo2="inet 10.1.1.2 netmask 255.255.255.0"
...

In the second approach, I can do something like

cloned_interfaces="lo1"

ifconfig_lo1_alias0="inet 10.1.1.1/24"
ifconfig_lo1_alias1="inet 10.1.1.2/24"

I currently use the first and it works, and I have it on some authority that (something similar to) the second also does.

The question is what's the fundamental difference between using cloned interfaces and aliases, particularly in this scenario, and which is a better approach?

How can I scan an incoming file upload (or a datastream) into a webserver and database for virus/malware?

I know how (using the excellent Clam) to scan things after they have been uploaded, but I would like to do the scanning before I upload them into the server. I know scanning before uploading is possible because I have seen it on some websites: they do a virus-scan before uploading the file. How is this done?

My current (probably naive) line of thought is to actually upload the files into the server, store them in a special location where only one specific/special user has access, then do the scanning. Finally, move the scanned files into the database. Is there a better way?