berkes's questions

I have deployment (capistrano) that, on success, reloads systemd:

sudo systemctl reload myserver.service

But, just after the first deploy, the service is not yet running. In that case, I want to start it, instead.

sudo systemctl start myserver.service

Is there a flag or other trick in systemd that figures out: "is the service running, then reload, otherwise, start it"? The alternative would be to build this into the deployment tooling itself, but I'd rather use existing features if systemd provides these.

AWS has OpsWorks, which is their own take on Chef.

We have several reasons[1] why we want to use a "normal" chef-server/-client setup.

But OpsWorks has one feature that I cannot find in chef-server/-client setups: load based instances.

They allow a stack to handle variable loads by starting additional instances when traffic is high and stopping instances when traffic is low, based on any of several load metrics.

I could not find much wrt to such a feature for a normal Opscode Chef Server/client setup. Just a few blogposts explaining how to user the AWS api and Chef-server API to monitor AWS instances and trigger node bootstraps on certain conditions. Self-built scripts.

How is this typically solved with Chef, if at all? Is this the task of Chef at all, or should a third tool manage such scaling? If so, are there any that tie well into the chef server setup?

[1]: Reasons are:

• It ties us to AWS: which is what Amazon wants, sure, but we'd rather choose a setup that is more neutral.
• It does not allow to run some nodes outside of AWS, e.g. a fallback-server on another vm-provider, or our existing gateway servers and so on.
• We already have a tailored set of recipes that need to be slightly rewritten to work within the OpsWorks environment, such as the use of searches, databags and such.

I have a running web-application at http://example.com/, and want to "mount" another application, on a separate server on http://example.com/en. Upstream servers and proxy_pass seem to work, but for one issue:

upstream luscious {
 server lixxxx.members.linode.com:9001;
}

server {
  root /var/www/example.com/current/public/;
  server_name example.com;

  location /en {
    proxy_pass http://luscious;
  }
}

When opening example.com/en, my upstream application returns 404 not found /en. This makes sense, as the upstream does not have the path /en.

Is proxy_path the right solution? Should I rewrite "upstream" so it listens to /en instead, as it root path? Or is there a directive that allows me to rewrite the path passed along to upstream?

I am trying to get some simple virtual domain support into Postfix, by following the README "Postfix virtual ALIAS example: separate domains, UNIX system accounts".

This, however, leads to a forwarding-loop, in my case. I am quite unfamiliar with all the moving parts in postfix.

<[email protected]> (expanded from <[email protected]>): mail
forwarding loop for [email protected]

The relevant parts from /etc/postfix/main.cnf are:

 myhostname = li153-5.members.linode.com
 mydestination = localhost li153-5.members.linode.com
 #....
 smtpd_recipient_restrictions = reject_unknown_sender_domain, reject_unknown_recipient_domain, reject_unauth_pipelining, permit_mynetworks, permit_sasl
 smtpd_sender_restrictions = reject_unknown_sender_domain
 mailbox_command = /usr/lib/dovecot/deliver -c /etc/dovecot/conf.d/01-mail-stack-delivery.conf -m "${EXTENSION}"
 myorigin = /etc/mailname

 virtual_alias_domains = webschuur.com berk.es
 virtual_alias_maps = hash:/etc/postfix/virtual

Then, my /etc/postfix/virtual file (before being compiled with postmap):

 [email protected] ber
 @berk.es     ber
 @webschuur.com ber

ber is a local user-account. Before this I simply had the domains webschuur.com and berk.es listed under mydestination and could send mail to [email protected] and have it turn up in my unix-system accounts Maildir. I now want to introduce catchall and want to avoid mail to [email protected] turning up in my mailbox; when I host example.org on this postfix too. @example.org should go to a UNIX-user exampleorg or so.

What am I doing wrong? Why does postfix find a loop when delivering to [email protected]? Is there maybe some part in main.cnf or postconf -d that I should provide here instead?

I am migrating a server I inherited; it has a signed certificate.

The server is a "LERP"-stack (Linux Nginx Rails Passenger). The previous maintainer stored the certificates under /etc/nginx/; I doubt this is the convential place to store them, in Ubuntu or Debian.

But where should I store them? I have:

example.com.crt
example.com.csr
example.com.key
SSL123_CA_Bundle.pem

nginx, running as www-data, needs read-access to these files.

I currently not running a mailserver or proxy server, but I would assume a the "preferred place" to store the certificates on a Debian or Ubuntu server would be somewhere where Dovecot or Squid and such, have access to the certs too; if they are implemented.

Many applications allow me to connect to Mysql using a username, password host and port. Some allow me to configure a socket instead of the host:port.

Is there any clear benefit of one over the other? I can imagine that a socket only works when MySQL is on the same machine. Is that so? And if so, are there benefits over using that socket instead of connecting to localhost:3306?

I am not too familiar with the ins- and outs of networking and sockets, so maybe I am completely missing some crucial information and my question is just plain stupid; if so, could you explain what I am missing?

I am using Ubuntu Linux with Apache2 and several vhosts, located in /etc/apache2/sites-available and symlinked (activated) from /etc/apache2/sites-enabled. The default setup on Ubuntu.

I'd like to know if there are generic tools available for Apache to list all vhost-information:

• list of all available sites
• list of all enabled sites
• list of all enabled sites as used by apache (sites-enabled after a "reload")

In these lists, I would like to see:

• the domain(and port) for the vhost.
• the directory for the vhost.
• Whether or not there are (syntax)errors in the vhost-file.

Obviously I could do some grepping, sed-ing and awking to fetch this information, but I am quite sure this has been done properly somewhere before :)

munin-node-configure --suggest tells me that the apache_* nodes cannot be used:

apache_accesses            | no   | no [Port 80: Authorization Required]   
apache_processes           | no   | no [Port 80: Authorization Required]   
apache_volume              | no   | no [Port 80: Authorization Required]

This is correct: the virtual-host is the only accessible site and is put behind a simple .htaccess login.

How can I configure the apache_* nodes to login with basic authentication? Is that possible at all?

According to several tutorials, the following should work:

Create a new user in MySQL.

$ mysql -uroot -p
> CREATE USER 'munin'@'localhost';
> exit;

Use that user in munin to access the database: edit /etc/munin/plugin-conf.d/munin-node. At [mysql*] set the following:

[mysql*]
env.mysqlopts -u munin

Strange thing, is that running

 /usr/sbin/munin-node-configure --suggest | grep mysql

Which tells me that MySQL cannot access the database and that it tries to access the database using user root:

[DBI connect('mysql;mysql_connect_timeout=5','root',...) failed: Access denied for user 'root'@'localhost' (using password: NO)

This is a CentOS 5.5 machine.

Why should munin-node-configure ignore the setting in /etc/munin/plugin-conf.d/munin-node? Should I set this elsewhere? Reloading or restarting the munin-node deamon changes nothing either.

Is there a way/tool to tail or watch a logfile and report the amount of lines it grows?

E.g. I want to see the amount of new entries in mysql.log every 3 seconds.

watch wc -l /path/to/log.log1 shows only acumulated amount. I'd prefer not to truncate the log inbetween.