Rino Bino's questions

When working with deb (apt) package repos, you can sometimes browse them over http to determine what is available across different architectures (amd64, arm64, etc). For example, Ubuntu gives a file listing to help browse the repo

However, other sources, such as this Elastic repo, do not allow regular browsing.

My only option appears to be actually adding the repo to my sources (make modifications to my system):

wget -qO - https://artifacts.elastic.co/GPG-KEY-elasticsearch | sudo apt-key add -
echo "deb https://artifacts.elastic.co/packages/7.x/apt stable main" | sudo tee -a /etc/apt/sources.list.d/elastic-7.x.list

After adding, running apt update confirms the repo offers arm64 packages (since I'm on an arm64 host):

Get:7 https://artifacts.elastic.co/packages/7.x/apt stable/main arm64 Packages [78.8 kB]

However, I want to confirm ALL available release architectures offered by the repo AND I want to do it without having to modify my host system. How can I do that?

In this use-case I had to spin up a test arm64 host just to determine if the packages were available. I would really like to avoid having to do that type of thing in the future and just browse the repo offerings remotely.

I'm clearing a drive with dd. It's a USB device and 120GB and it's taking a very long time:

dd if=/dev/zero of=/dev/da0 bs=1M status=progress

I have tried messing with the block size (smaller and larger values bs=4M, bs=8M, etc) but nothing seems to make much of a difference. It's writing at about 7000 kB/s which is painfully slow.

I do not care about "securely" wiping the data I just want it wiped so I can re-establish the partition structure and filesystem from scratch. Is there an alternate way (using standard utilities) that can perform a quick (within a minute or two) wipe for this type of scenario? The device I'm working on is FreeBSD but I think the dd command (and gpart, etc) work similarly between it and Linux.

It's probably easiest to just show by example where I'm hitting issues, so I'll jump right in...

This snippet will work as-is for Nginx with rewrite/auth modules enabled. So hopefully this issue is quick & easy reproduce on pretty much any Nginx install...

server {
  listen 8081;
  add_header x-user bar;
  return 200;
}

server {
  listen 8080;

  location = /auth {
    internal;
    proxy_pass http://localhost:8081;
  }

  location / {
    auth_request /auth;
    auth_request_set $foo $upstream_http_x_user;

    add_header x-test $foo;
    add_header success true;

    proxy_pass http://example.com/;
  }
}

The above example Nginx site config does the following:

1. Sends any request to /auth via an auth_request call
2. The /auth location sends the request to another server which adds a header x-user bar
3. auth_request_set sets a new var $foo based on the upstream header value of x-user set in step 2 above.
4. A new header is set x-test which is set to the value of $foo
5. The request proceededs to an external destination.

Response is exactly how I would expect, and confirmed the $foo var was set correctly:

$ curl -s --head http://localhost:8080 | grep -E 'HTTP|x-test'
HTTP/1.1 200 OK
x-test: bar

So, here comes the problem...
I need to adjust this config so that it'll return 403 if the value of the upstream header is incorrect.

Seemed like a simple task. So I added an if{} conditional to check the header:

  location / {
    auth_request /auth;
    auth_request_set $foo $upstream_http_x_user;

    # this 'if' is the only part added to the original config
    if ($foo != bar) {
      return 403;
    }

    add_header x-test $foo;
    add_header success true;

    proxy_pass http://example.com/;
  }

The if conditional evaluated true so I got a 403, which is not what I was expecting. So, this does not work:

$ curl -s --head http://localhost:8080 | grep -E 'HTTP|x-test'
HTTP/1.1 403 Forbidden

I realize that if is evil however I seem to be using it just to return which should be ok. I'm open to using any method to accomplish the same goal - with or without if, so I'm open to ideas!!

I have tried doing things like moving the auth_request and/or the if statements into the server{} block but nothing seems to make this evaluate the way I was expecting.

Further Troubleshooting / Details:

I have verified the problem is that the if is evaluated BEFORE the auth_request_set is

  location / {
    auth_request /auth;
    auth_request_set $foo $upstream_http_x_user;

    if ($foo != bar) {
      # x-test never gets set because $foo is null when if evaluates
      add_header x-test $foo always;
      add_header success false always;
      return 403;
    }

    add_header x-test $foo;
    add_header success true;

    proxy_pass http://example.com/;
  }

$ curl -s --head http://localhost:8080 | grep -E 'HTTP|x-test|success'
HTTP/1.1 403 Forbidden
success: false

I have verified this is not an issue if using set instead of auth_request_set. This works (but doesn't accomplish the goal):

  # set works, but not auth_request_set
  location / {
    set $foo bar;

    if ($foo != bar) {
      return 403;
    }

    add_header x-test $foo;
    add_header success true;

    proxy_pass http://example.com/;
  }

This config works. set is evaluated before if:

$ curl -s --head http://localhost:8080 | grep -E 'HTTP|x-test'
HTTP/1.1 200 OK
x-test: bar

The behavior persists even if the auth_request is in the server{} context:

server {
  listen 8081;
  add_header x-user bar;
  return 200;
}

server {
  listen 8080;

  auth_request /auth;
  auth_request_set $foo $upstream_http_x_user;

  location = /auth {
    internal;
    proxy_pass http://localhost:8081;
  }

  location / {

    if ($foo != bar) {
      return 403;
    }

    add_header x-test $foo;
    add_header success true;

    proxy_pass http://example.com/;
  }

}

$ curl -s --head http://localhost:8080 | grep -E 'HTTP|x-test|success'
HTTP/1.1 403 Forbidden
success: false

I've reviewed the following docs and questions:

• Can I compare a variable set by auth_request_set after the auth_request has returned in nginx?
• https://stackoverflow.com/questions/73431103/cant-access-added-headers-using-nginx-auth-request-set
• Nginx $upsteam_cache_status custom header will not appear
• auth_request doesn't block return directive, can't return status?
• https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil
• http://nginx.org/en/docs/http/ngx_http_auth_request_module.html
• http://nginx.org/en/docs/http/ngx_http_rewrite_module.html#if
• https://www.nginx.com/resources/wiki/start/topics/tutorials/config_pitfalls/

This is specifically on Ubuntu 20.04, but I believe the behavior is common:

Please take this fstab entry, creating a read-only mount:

/data/testDir/iso/ubuntu-20.04.4-live-server-amd64.iso /data/testDir/mnt iso9660 ro 0 0

Here is the related directory structure for that:

# ls -l /data/testDir/
drwxr-xr-x 2 root root   50 Apr  7 22:07 iso
drwxr-xr-x 1 root root 2048 Feb 23  2022 mnt

Everything mounts fine: mount /data/testDir/mnt works as expected.

However, upon a reboot, the permissions change on the mount point:

# ls -l /data/testDir/
drwxr-xr-x 2 root root   50 Apr  7 22:07 iso
dr-xr-xr-x 1 root root 2048 Feb 23  2022 mnt

This sort-of makes sense since it's a read-only mount, but it works either way, and this caused an unexpected failure in my CI/CD/Config mgmt system when the permissions changed to 0555 on that mnt directory after a reboot and that directory is managed. Ansible tried to change the permissions back to 0755 and failed since it's read-only.

Easy fix just setting 0555 from the start in config mgmt, but I have some questions about the behavior:

My questions:

• What exact mechanism is doing this?
• Is there a way to disable/control this behavior?

Issue Summary:

Jenkins LTS + The Durable Task plugin does not properly resume a pipeline job if the Jenkins service is restarted during the task run.

This is a regression in Jenkins 2.3x and seems to coincide with the migration to systemd (it used to work perfectly fine in 2.2x).

Steps to reproduce the issue:

1. Start with a single node Jenkins host with the durable task plugin installed.
2. Start a pipeline job on the host. I've included a sample pipeline file at the bottom of this question.
3. While running, restart the jenkins service "service jenkins restart" ( OR using jenkins-cli.jar to restart )
4. After Jenkins starts, the task attempts to resume, but instead eventually fails (log below).

Resuming build at Tue Jul 19 23:26:56 UTC 2022 after Jenkins restart
Waiting to resume part of test-job #5: Waiting for next available executor
Ready to run at Tue Jul 19 23:27:01 UTC 2022
wrapper script does not seem to be touching the log file in /data/jenkins_home/workspace/test-job@tmp/durable-b0167617
(JENKINS-48300: if on an extremely laggy filesystem, consider -Dorg.jenkinsci.plugins.durabletask.BourneShellScript.HEARTBEAT_CHECK_INTERVAL=86400) 

After the above message throws, the job goes into a "failed" state.

• Manually touching/writing to the mentioned log file does not resolve the problem.
• The issue is not the filesystem nor available memory as other solutions have mentioned in related tickets/posts. (This is a regression in the latest versions of Jenkins.)
• There are no available plugin updates (fully up to date).
• This seemed to happen when we got on the 2.332 version which also included the migration to systemd. So, there is a possibility that the service restart using systemd (versus the old init system used previous to 2.332) is breaking the durable tasks.

This issue has been filed on the Jenkins official tracker: https://issues.jenkins.io/browse/JENKINS-69061

However, nobody has responded to that report in over 2 months so I'm asking if anyone here has any idea what the issue could be, to find potential workarounds, and to overall increase visibility/traction on the problem.

Example minimal/simple pipeline used in testing this issue:

pipeline {
  agent any

  stages {

    stage("Sleep for 60 seconds") {
      steps {

        echo "Go restart jenkins service now and see that this job wont resume"

        sh "sleep 60"

        echo "The job will never get this far"

      }
    }
  }
}

This question pertains to working with a Python + Poetry project within a Jenkins pipeline and how to retain the .venv/

SCENARIO:

I have a Jenkins Pipeline job that triggers a Python project. The project uses poetry to create a virtual env in .venv within the workspace. Each subsequent job run, it will re-use the .venv as expected so each pip package does not need to re-download on every run (unless there is a diff in the poetry.lock file). Everything works as expected.

I want to make a change to the Pipeline using the Jenkins Workspace Cleanup Plugin, I want to clobber the workspace files but keep some files, including the pip/poetry/venv environment files. This is to allow it to re-use pip packages from the previous run still stored in .venv -- just as it does on the working Pipeline today.

Full pipeline file example is at the bottom of this post, but here is a snippet of the cleanWs() portion I've added to the existing Pipeline:

post {
  always {
    cleanWs(
      deleteDirs: true,
      notFailBuild: true,
      patterns: [
        [pattern: '.venv', type: 'EXCLUDE'],
        [pattern: '.venv/**', type: 'EXCLUDE']
      ]
    )
  }
}

HERE IS THE ISSUE:

• The first time the job runs, it works perfectly fine and the workspace cleanup works as expected. The .venv/ directory is retained as expected.

• (problem) On subsequent runs of the job, poetry will re-install all the packages and will not re-use the .venv directory:

  Creating virtualenv test in /data/jenkins_home/workspace/test-cleanup/.venv -- This forces a full re-download of every package, even though .venv already exists. It's been confirmed that /data/jenkins_home/workspace/test-cleanup/.venv already exists before the job runs.

• Here is the strange part: If I go to the workspace dir manually on the Jenkins server and run the exact same command poetry install it works as expected, the .venv is reused and all the packages are not reinstalled. So there is something specific about the way it's handled running in the job that's making it want to recreate the .venv dir.

NOTE that in-project = true is already set for Poetry. So it will always try to use .venv within the current working directory.

EXAMPLES:

Here is a simple example pipeline that works as expected. When poetry install step runs, it does not re-download all the packages every time the job runs, only the first time, or if there is a diff:

pipeline {

  agent any

  stages {

    stage("Prep Build Environment") {
      steps {

        script {
          scmVars = git branch: "main", poll: false, url: "[email protected]:my-org/private-repo.git"
        }

        sh "poetry install"
      }
    }
  }
}

Here is the new Jenkinsfile pipeline file with cleanWs() added. After this was added, the project will no longer re-use the .venv on each run, even though it still exists:

pipeline {

  agent any

  stages {

    stage("Prep Build Environment") {
      steps {

        script {
          scmVars = git branch: "main", poll: false, url: "[email protected]:my-org/private-repo.git"
        }

        sh "poetry install"
      }
    }
  }

  post {
    always {
      cleanWs(
        deleteDirs: true,
        notFailBuild: true,
        patterns: [
          [pattern: '.venv', type: 'EXCLUDE'],
          [pattern: '.venv/**', type: 'EXCLUDE']
        ]
      )
    }
  }

}

As per the documentation:

Amazon S3 Bucket Keys reduce the cost of Amazon S3 server-side encryption using AWS Key Management Service (SSE-KMS). This new bucket-level key for SSE can reduce AWS KMS request costs by up to 99 percent by decreasing the request traffic from Amazon S3 to AWS KMS. With a few clicks in the AWS Management Console, and without any changes to your client applications, you can configure your bucket to use an S3 Bucket Key for AWS KMS-based encryption on new objects.

The documentation notes a couple scenarios to be aware of before enabling the feature, but doesn't list any reasons why you overall would disable it... so why is it even an option?

I can't think of any use-case where a user would want this disabled (if they are already using KMS). Any ideas?

Please take this working play example:

- name: Display the URL
  hosts: all
  gather_facts: false
  vars:
    - host_domain: "testing.example.com"
    - default_url: "http://def.localhost.{{ host_domain }}"
    - my_url: "{{ some_undeclared_var | default(default_url) }}"
  tasks:
    - debug:
        msg: "{{ my_url }}"

This works fine. The output is as expected:

msg: http://def.localhost.testing.example.com

I would like to set the default value in-line, without first declaring the default_url var. Something like this:

  vars:
    - host_domain: "testing.example.com"
    - my_url: "{{ some_undeclared_var | default('http://def.localhost.{{ host_domain }}') }}"

I've tried different techniques:

• my_url: "{{ some_undeclared_var | default(\'http://def.localhost.{{ host_domain }}\') }}"
• my_url: "{{ some_undeclared_var | default(\"http://def.localhost.{{ host_domain }}\") }}"
• my_url: "{{ some_undeclared_var | default('http://def.localhost.'{{ host_domain }}) }}"
• my_url: "{{ some_undeclared_var | default('http://def.localhost.'host_domain) }}"

I can't seem to figure out the syntax for this. Can anyone help?

I'm using netboot/pxeboot with grub.

menuentry "Install Ubuntu 20.04" {
  set gfxpayload=keep
  echo 'Loading vmlinuz ...'
  linux  /tftp/vmlinuz ip=dhcp netboot=nfs nfsroot=10.0.0.20:/data/netboot/nfs/ubuntu2004/ boot=casper toram noquiet splash=off console=tty0 console=ttyS1,57600n8 ---
  echo 'Loading initrd, this takes a long time ...'
  initrd /tftp/initrd
}

It works fine, however, the loading of initrd over tftp is taking a long time (30+ minutes). I would like to compress (gz/bz2) this file to save on some file transfer time.

I had seen some examples out there referring to a initrd.gz (One example: https://unix.stackexchange.com/questions/217002/which-iso-file-vmlinuz-and-initrd-gz-to-use-for-installing-centos-from-multiboo) but when I tried to just compress the file with gzip and use it, I get an error such as:

[   12.543547] VFS: Cannot open root device "(null)" or unknown-block(0,0): error -6
[   12.558487] Please append a correct "root=" boot option; here are the available partitions:
[   12.575161] Kernel panic - not syncing: VFS: Unable to mount root fs on unknown-block(0,0)

Is there a way to compress this file so it can transfer a smaller file size, and have it uncompress before it tries to mount the root fs?

Alternatively, is there a way to transfer it over a different protocol (HTTP/FTP/SFTP/SCP/etc) ?

This is a fresh install Ubuntu server 20.04.04 system. I'm using networkd and netplan to configure networking. I did not do any custom install steps, just loaded the .iso and installed Ubuntu server through the prompts.

When these machines were shipped from the vendor, Ubuntu was already installed and the network interfaces were named ens1f0 and ens1f1:

root@oldHost2:~# sudo lshw -C network |grep "logical name"
       logical name: ens1f0
       logical name: ens1f1
       logical name: bond0

However after reinstalling the OS (before running netplan) I get....

root@freshHost1:~# sudo lshw -C network |grep "logical name"
       logical name: ens1f0np0
       logical name: ens1f1np1
       logical name: bond0

Across all my sites, we use a netplan config that assumes ens1f0 and ens1f0. I would like all interfaces to match this.

I know you can set the interface name with set-name in netplan (as defined in https://ubuntu.com/server/docs/network-configuration) however you need to already match the interface somehow (using Mac address, etc) which is going to make auto-provisioning a nightmare (if not impossible). A chicken/egg scenario. I have hundreds of machines to provision and I would like to template out my netplan config without knowing the Mac addresses.

I know you can also group together the interfaces in netplan:

  ethernets:
    eports:
      match:
        name: ens*

Which may work for my case, but not all the systems have a simple two NIC setup like this so I'm not sure what the best course of action will be.

My questions to ServerFault...

• Since this logical name is set before Netplan is even ran, what is deciding on this name? How can I override it during OS install/provision?
• What does the np0 and np1 mean in the interface names?

I have a hardware device (netgate brand) that acts as the firewall/router for my LAN.

It has an IPSec VPN connection to AWS VPC.

• All hosts in the LAN can traverse the IPSec VPN successfully. Traffic flows back & forth fine.
• The firewall device itself cannot.
• All routes look ok
• No security groups/firewalls are blocking anything at all right now during testing.

Is there any special trick or rules that generally need to be put in place to get the host that is running the IPSec tunnel itself to traverse the tunnel?

I am using the Jenkins CLI in a script for some Jenkins automation (https://www.jenkins.io/doc/book/managing/cli/).

According to the docs, you have to first download the .jar from the Jenkins host.

Currently I am doing this by running wget http://localhost:8080/jnlpJars/jenkins-cli.jar

However I would like to reduce the amount of steps in my script, so I would like to skip that download step and just find the jenkins-cli.jar directly on the Jenkins server instead of downloading it first.

I tried running find / -name "jenkins-cli.jar" to no success.

Does anyone know where it's stored? Surely it must exist somewhere since you can download it direct from the Jenkins host.

GOAL: ANY user that has successfully authenticated with SSO (through REMOTE_AUTH) is granted admin (or at least superuser) rights, without needing to create any users or groups beforehand.

I have remote auth working fine (the user is logged in on NetBox successfully) but I am not able to set any automatic permissions. All users only have view access.

The only thing that works is explicitly setting username, such as:

REMOTE_AUTH_SUPERUSERS = ['myuser1', 'myuser2']

which is not an appropriate solution for this goal because the usernames are not known before the user goes through SSO flow.

I've reviewed documentation here: https://netbox.readthedocs.io/en/stable/administration/permissions/

and here: https://netbox.readthedocs.io/en/stable/configuration/optional-settings/#remote_auth_default_permissions

Note the docs for REMOTE_AUTH_DEFAULT_PERMISSIONS states "Each key in the dictionary should be set to a dictionary of the attributes to be applied to the permission, or None to allow all objects." with emphasis on "None to allow all objects."

Neither helps define a basic "give everyone access" type setup.

I've tried just setting REMOTE_AUTH_SUPERUSERS = ['*'] and tried setting REMOTE_AUTH_DEFAULT_PERMISSIONS = { "*": None } and REMOTE_AUTH_DEFAULT_PERMISSIONS = { "status": None } (and MANY other variations, nothing works.

Reference of these applicable config items. (Note that this is not necessarily my current config, as I've tried dozens of variants to get this to work)

REMOTE_AUTH_ENABLED = True
REMOTE_AUTH_BACKEND = 'netbox.authentication.RemoteUserBackend'
REMOTE_AUTH_HEADER = 'HTTP_X_USER_NAME'
REMOTE_AUTH_AUTO_CREATE_USER = True
REMOTE_AUTH_SUPERUSERS = ['*']

# REMOTE_AUTH_DEFAULT_GROUPS = []
# REMOTE_AUTH_SUPERUSER_GROUPS= []
# REMOTE_AUTH_DEFAULT_PERMISSIONS = { }

I am currently facing an issue with Jenkins <> Github integration due to today's Github auth changes deprecating user/pass auth and the current Github branch source plugin.

Deprecation info: https://developer.github.com/changes/2020-02-14-deprecating-password-auth/#removal

Plugin: https://github.com/jenkinsci/github-branch-source-plugin

• Jenkins: 2.249.3
• Github branch source plugin 2.9.1 (latest)
• This jenkins install is private only (not public facing)
• The repo being accessed is private (not public facing)
• The Github token has full repo access

Issue:

The plugin forces user/pass auth which Github no longer accepts. The instructions state to put the TOKEN in the password field but it still complains after I've done that:

The API can't be accessed using username/password authentication

https://developer.github.com/changes/2020-02-14-deprecating-password-auth/#removal

Instructions state: "Only username/password credentials are supported" and instructs to add the Token in the password field (screenshot shows this)

The attached screenshot shows the debacle clearly:

Questions to ServerFault:

• Am I entering the token wrong for the credentials? I've tried:
  • a null user, with the token as the password
  • The token as the user & pass
  • The token description as the user, with the token as the password
• Normally I would submit a Github issue to a developer about an app issue. However since there is no "Issues" component to submit issues to the plugin developer, I wanted to ask my question here, in case others have hit this.

Goal: Re-initialize a Terraform project to another workstation.

Problem: Terraform wants to recreate one my TLS keys because it thinks the private key has a diff. However since I cannot see the diff since it's a sensitive file, I'm lost.

• My companies' Terraform repo installs TLS/SSL certs/keys into AWS Load Balancers.
• I had to restore a Terraform project to a new workstation (old workstation is retired).
• The cert and chains are stored in the repo.
• The private keys themselves are NOT checked into the git repo, but we keep multiple secure backups.

Certs are being declared like this:

resource "aws_iam_server_certificate" "test1_cert_renewed" {
  name              = "test1_cert_renewed"
  certificate_body  = file("${path.cwd}${var.test1_cert_renewed_cert}")
  private_key       = file("${path.cwd}${var.test1_cert_renewed_key}")
  certificate_chain = file("${path.cwd}${var.test1_cert_renewed_chain}")

  lifecycle {
    create_before_destroy = true
  }
}

Everything is going smoothly to restore the Terraform project to a working order on the new workstation. However it wants to recreate my cert installs because it thinks the private key is different.

On a plan, it just says it'll recreate due to:

~ private_key = (sensitive value)

This is only affecting ONE of the 5 different cert bundles so it's something specific about this file.

1. Is it possible to see more details in the Terraform output, so I can at least see part of the diff snippet?

2. Any advice on how I can diff what is in state vs what I have in the file?

I've tried terraform state pull and I do see output, but it's an encoded string. Not entirely sure how to decode (if possible).

    {
      "mode": "managed",
      "type": "aws_iam_server_certificate",
      "name": "<<SCRUBBED>>",
      "provider": "provider.aws",
      "instances": [
        {
          "schema_version": 0,
          "attributes": {
            "arn": "arn:aws:iam::<<SCRUBBED>>",
            "certificate_body": "<<SCRUBBED>>",
            "certificate_chain": "<<SCRUBBED>>",
            "id": "ASCA4DNFUOPYAQICRDU7O",
            "name": "<<SCRUBBED>>",
            "name_prefix": null,
            "path": "/",
            "private_key": "<<SCRUBBED string that was here (looked like encoded string), but it wasn't private key text>>"
          },
          "private": "<<SCRUBBED 5 character string SCRUBBED>>"
        }
      ]
    }

More details:

I've already checked obvious things like newline at end/start of file:

-----END PRIVATE KEY-----

versus

-----END PRIVATE KEY-----

Background:

• Postgres 10.9
• DB runs as a docker container on the dev hosts. (t3.large, gp2 500GB storage)
• DB runs in RDS for staging and production. (m5.2xlarge, gp2 1TB storage)

Everything works great, been like that a long time, and my db alter timings seem to always be faster in prod/staging versus dev (as expected).

Problem / Question:

I have a specific index create that is taking 20x longer in RDS (which is more powerful) than it does on the local dev host. Every other case I've seen in the last couple years, the RDS host is faster because it has more compute power and higher I/O speeds.

• Data and schema is identical between the instances. Using pg_dump + pg_restore to load the dev databases with fresh data nightly.
• The table is relatively large (30 million rows) compared to other tables in my db (mostly less than 1mil)

It's a simple index operation:

CREATE INDEX idx_email_records_created ON email_records(created_at);

On the local linux dev box:

db=> CREATE INDEX idx_email_records_created ON email_records(created_at);
CREATE INDEX
Time: 68523.557 ms (01:08.524)

On the RDS host:

db=> CREATE INDEX idx_email_records_created ON email_records(created_at);
CREATE INDEX
Time: 1490902.929 ms (24:50.903)

I've checked all the normal stuff: CPU load (plenty free in all cases), Memory (plenty free in all cases). Locking/table usage, etc.

The dev hosts are restored with a fresh clone of prod db nightly, so there is no discrepancy in the number of rows.

I've checked max_parallel and experimented with things like ALTER TABLE email_records SET (parallel_workers = ##); but nothing seems to make a difference.

Any help is appreciated

Nginx config goal:

• Check if a certain cookie exists (doesn't matter what the value is)
• If it doesn't exist, include a particular config import.
• I only want to apply my rules to certain Locations, I cannot apply these conditionals to the global nginx configs. It's location specific.

CURRENTLY, the config looks like this, and it's working well:

  location ~ ^/somedestination\.php(/|$) {
    <... truncated other config lines for readability ...>

    include includes/xx-cache-config.conf;

    <... truncated other config lines for readability ...>

    fastcgi_pass php-fpm:9000;
  }

This server has many location blocks, and each import their own cache configs. This is a cgi only application, there is no direct try_files here.

So, in order to meet the above goals, I am experimenting with something like this, checking for existence of $cookie_user variable, and only applying my config if the cooke doesn't exist:

  location ~ ^/somedestination\.php(/|$) {

    # only include cache config if the cookie is null/empty
    if ($cookie_user = false) {
      include includes/xx-cache-config.conf;
    }

    fastcgi_pass php-fpm:9000;
  }

Seems logical, but here's the problem: I stumbled on this: https://www.nginx.com/resources/wiki/start/topics/depth/ifisevil/

QUESTION: If we shouldn't use if in a Location context (according to nginx official docs), how should I be doing this?

EDIT: Here is the contents of what's being included from the conditional clause. Currently nginx is ALWAYS including this config, my goal right now is to sometimes not include it (when the cookie exists).

Note: zone config itself is included elsewhere. This included config enables it.

includes/xx-cache-config.conf

fastcgi_cache CACHE_TLRS;

fastcgi_cache_bypass $no_resource_cache;

fastcgi_no_cache $no_resource_cache;

fastcgi_cache_valid 200 301 48h;
fastcgi_cache_valid 302     4h;

fastcgi_cache_revalidate on;
fastcgi_cache_use_stale http_500 http_503 timeout updating;

fastcgi_cache_lock on;
fastcgi_cache_lock_age 15s;
fastcgi_cache_lock_timeout 5s;

fastcgi_ignore_headers cache-control;

fastcgi_cache_key "$scheme$host$uri";
add_header X-Cache $upstream_cache_status;