John Heyer's questions

I've built an AWS ALB & Target group via Terraform and everything looks correct but the Target Group is reporting unhealthy for HTTP, HTTPS, and TCP. The instance is a t3.nano in us-east-2 and has Nginx installed and running.

I've verified the following:

• Nginx is configured and running on ports 80 & 443
• Security groups allow HTTP & HTTPS from 0.0.0.0/0
• Instance is on a public subnet (that is, the 0.0.0.0/0 route is to the IGW)

If I access the instance's public IP from Internet, and the "Welcome to nginx!" page is displayed. This request shows up both in /var/log/nginx/access.log. tcpdump port 80 shows requests coming from Internet but nothing indicating an AWS healthcheck.

I've used ALBs and Target groups before and never encountered an issue like this. The only difference is this instance was created with Terraform.

I'm currently learning Docker and just migrated to an Ubuntu 20.04.2 VM running in VMware workstation player as my Raspberry Pi 2 running Debian 9 has kicked the bucket. Seems Docker requires some special permissions in Ubuntu and I'm baffled as to what those are. The primary error message when running any docker command is:

cannot open path of the current working directory: Permission denied

My home directory is NFS mounted, but UID/GID mappings between the VM and NAS are in sync, and I can create and modify files & directories in my home directory without issue. If I change the cwd to say /tmp, the error message is a little more descriptive:

j5@ubuntu20:/tmp$ docker build ~/Dockerfile
cannot create user data directory: /mnt/homes/j5/snap/docker/796: Permission denied

But the funny thing is the directory was created and has normal permissions:

j5@ubuntu20:/tmp$ ls -la /mnt/homes/j5/snap/docker/796
total 0
drwxr-xr-x 1 j5 users  0 Jul  8 01:26 .
drwxr-xr-x 1 j5 users 32 Jul  8 01:26 ..

I know Terraform has trouble creating lock files on NFS-mounted directories and am suspecting docker has a similar requirement?

We run Squid proxies in GCP, and are in the process of migrating from CentOS 7 to 8. I'm working on using the GCP Internal L4 load balancer to improve redundancy/failover, and have configured a basic TCP healthcheck which is working fine.

However, it looks like Squid version 4 logs TCP connections. So, every 10 seconds I get 3 entries added to /var/log/squid/access.log:

1618013711.836      0 35.191.10.117 NONE/000 0 NONE error:transaction-end-before-headers - HIER_NONE/- -
1618013712.256      0 35.191.9.223 NONE/000 0 NONE error:transaction-end-before-headers - HIER_NONE/- -
1618013712.484      0 35.191.10.121 NONE/000 0 NONE error:transaction-end-before-headers - HIER_NONE/- -

This would generate 25,920 lines a day of logs, which I'd like to avoid. Is there a way to configure Squid to not do this? The default squid.conf file didn't have much as far as documentation/explanation.

I'm able to create Instances, Target Groups, and ALBs just fine with Terraform, but am getting stuck when trying to use Lambda Functions. It looks like the Lambda function gets created OK along with an ALB and a Target Group, but fails on the step when attaching the Lambda function to the target group.

resource "aws_lambda_function" "LAMBDA_FUNCTION" {
  filename         = "../my_function.zip"
  function_name    = "my_function"
  role             = aws_iam_role.LAMBDA_ROLE.arn
  handler          = "my_function.lambda_handler"
  runtime          = "python3.8"
  memory_size      = 128
  description      = "My Lambda Function"
}
resource "aws_lb_target_group" "LB_TG" {
  name                               = "${local.env}-tg"
  target_type                        = "lambda"
  lambda_multi_value_headers_enabled = false
}
resource "aws_lb_target_group_attachment" "TG_ATTACHMENT" {
  target_group_arn        = aws_lb_target_group.LB_TG.arn
  target_id               = aws_lambda_function.LAMBDA_FUNCTION.arn
}

Error message when running terraform apply:

Error: Error registering targets with target group: AccessDenied: elasticloadbalancing principal does not have permission to invoke arn:aws:lambda:us-west-1:694058713236:function:my_function from target group arn:aws:elasticloadbalancing:us-west-1:694058713236:targetgroup/test-tg/9da892faefbe02b7
    status code: 403, request id: d13c36ed-2513-4d4c-97d0-2e449be859a1

From what I can gather, I'm missing a step where I specifically give permission to either the Target Group or the Lambda function to associate with one another.

Launching some small VMs in GCP and thought I would give Ubuntu 20.04 LTS minimal a try. After doing an "apt update; apt upgrade" I'm able to install packages like Apache, but having zero luck with PIP:

root@ubuntu-rr58:/home/me# apt install python-pip
Reading package lists... Done
Building dependency tree       
Reading state information... Done
E: Unable to locate package python-pip

I have verified the Universe, Multiverse and Restricted repositories are available:

root@ubuntu-rr58:~# grep ^deb /etc/apt/sources.list
deb http://us-central1.gce.archive.ubuntu.com/ubuntu/ focal main restricted
deb http://us-central1.gce.archive.ubuntu.com/ubuntu/ focal-updates main restricted
deb http://us-central1.gce.archive.ubuntu.com/ubuntu/ focal universe
deb http://us-central1.gce.archive.ubuntu.com/ubuntu/ focal-updates universe
deb http://us-central1.gce.archive.ubuntu.com/ubuntu/ focal multiverse
deb http://us-central1.gce.archive.ubuntu.com/ubuntu/ focal-updates multiverse
deb http://us-central1.gce.archive.ubuntu.com/ubuntu/ focal-backports main restricted universe multiverse deb http://security.ubuntu.com/ubuntu focal-security main restricted
deb http://security.ubuntu.com/ubuntu focal-security universe
deb http://security.ubuntu.com/ubuntu focal-security multiverse

I'm trying to automate logins to GitHub using a private key, so that I can do "git pull/add/commit/push" from a BASH script. If I put this in ~/.ssh/config, it works:

Hostname github.com
User git
IdentityFile ~/.ssh/mygitkey.pem

Unfortunately, this causes all SSH connections to be routed to Github.com, which I don't want.

So I tried this:

Host GitHub
   Hostname github.com
   User git
   IdentityFile ~/.ssh/mygitkey.pem

But this causes the "user" and "identityFile" options to be ignored when connecting to GitHub.

I need NGINX to proxy a certain directory to an external S3 bucket, which I'm doing like so:

   location ~ ^/logos/(.*)$ {
          proxy_pass           https://s3-us-west-2.amazonaws.com/mybucket/logos/$1;
          proxy_set_header     X-Forwarded-For $http_x_forwarded_for;
   }

I also need all other URIs to go to a wildcard CGI script. I'm doing like this:

   location ~ \.cgi$  {
            include         fcgiwrap.conf;
    }
    rewrite ^ /myscript.cgi;

The problem is, when I put both in the same server {} declaration, they seem to be mutually exclusive. Either everything under /logos/* gets routed to the CGI script, or the CGI script gets a 404.