davidscolgan's questions

My server is a Linode with 768MB of RAM. It is home to around 8 small, low traffic Django sites powered by Nginx, Supervisor, and Gunicorn. Currently, each site has its own Linux user account, with the site's files in the home directory of the user. Each user has a development and production supervisor process that runs Gunicorn with between 1 and 4 workers.

We are a small consulting firm, and for the near future we will just be adding more and more small, low traffic Django sites to the server. When I look at top, I've got a bunch of Gunicorn processes running, and RAM is almost completely used up. For a while we only had 512MB of RAM and it was almost completely used up, but when we added more RAM, the Gunicorn processes only took up more RAM.

Is there a good way to optimize this server for as many low traffic (like 1000 hits a month) Django sites as possible? I opted for an Nginx setup over Apache because I read it was better on system resources, but it seems like the current setup is not using resources very effectively.

My company is building a database from a large publicly available data set. When we complete it, we will have something like 500GB of data, but the data will never grow beyond that. It takes advantage of Postgres's polygon manipulation features, and as such has to stay in Postgres.

How can we host this database in the most cost effective way possible?

EDIT: I should mention that we are wanting to host this database in the cloud, since we don't have our own onsite servers.

EDIT 2: Sorry, let me elaborate. This database will integrated into a SAAS webapp, so potentially many users will be hitting the database at the same time. However, once we have it in place, the data will rarely change, and if it does change, it will only ever be added to, never deleted. Something like Linode, which we use for hosting the rest of the site, doesn't have enough storage space. We want to optimize cost, but secondarily we would prefer to not touch any hardware ourselves, so buying a large drive would be less than ideal.

We launched an ecommerce site a while back and got an ssl certificate for https://www.mysite.com. The site was abandoned for a while, and then recently resurrected. We got a new ssl certificate, but this time it was for https://mysite.com. Now, when people find the site on Google, the url is for https://www.mysite.com, and gives an untrusted site warning.

After some digging I've learned that I can't just redirect https://www.mysite.com to https://mysite.com without having a different ssl certificate for the www version. Is there a way I can correct this problem without having to buy another certificate?

I have used supervisor to manage a Gunicorn process running a Django site, though this question could pertain to anything being managed by supervisor. Previously I was the only person managing and using our server, and supervisor just ran as root and I would use sudo to run supervisorctl restart myapp when needed.

Now our server has to support multiple users working on different sites, and each project needs to be able to restart their own gunicorn processes without being able to restart other users' processes.

I followed this blog post:

http://drumcoder.co.uk/blog/2010/nov/24/running-supervisorctl-non-root/

and was able to allow non-root users to use supervisorctl, but now anyone can restart anyone else's processes. From the looks of it, supervisor doesn't have a way of doing per-user access control.

Anyone have any ideas on how to allow users to restart only their own processes without root?

EDIT: Some things we've thought about include writing a script owned by root with the suid bit set that contains nothing but supervisorctl restart myapp and putting it in the directory of the user who owns myapp. The internet seems to be saying that such a script is insecure if done wrongly. We also considered writing a custom daemon that listens for commands from specific users and restarts the supervisor process if the user has permission. This idea seems overly complicated if a simpler solution would work.

We have nearly finished rewriting a legacy web app system and have moved the domain name to a new server. The only other feature we have to make is a small one that must interface with another server that I have no control over.

The old system periodically received data from this other server via unsecured ftp. Apparently the other server would log into our server and put a data file in a specific directory, which our system would read.

We have the username and password used to log in. My idea was to create an ftp account using this same username and password on the new server. Doing this we would not have to modify the other server.

I've seen many articles saying unsecured ftp is insecure. Can I do anything to make this work without compromising the security of the rest of our server (which hosts several production websites). The data in this file is going to be directly displayed on a website, so it doesn't matter if the file itself is secure.

Can I set up something where I create a user with very limited privileges that can receive this file in a specific directory that another user can read from?

Edit: We are running Ubuntu server 11.04 on a Linode, so I have full control over our server.

I give a directory the setgid bit. Then inside that directory I create another directory, and I want it to also have the setgid bit. I have tried something like umask 6002, but it says "octal number out of range." Is there a way to do this?

How can I achieve this setup:

There is a primary user that I use to ssh into the server and edit all files for multiple sites.

The various sites are stored in the /srv/www directory, so /srv/www/site1, /srv/www/site2.

There is a different user created for each site that Nginx will use to run the site (apparently this is good for security).

I want to be able to have all files in /srv/www/site1 be owned by the site1 user and belong to the site1 group. I want to be able to edit these files and create new ones with my primary user while still keeping the owner site1 and group site1.

I understand that I need to set the default umask somehow, and I may need to add my primary user to each site's group, but I can't seem to make this work. Any help, or is this even a good idea?

I installed CouchDB on my Ubuntu server from the stable PPA. Then I put this in my nginx.conf:

server {
    listen 80;
    server_name couchdb.mydomain.com;

    location / {
        proxy_pass http://127.0.0.1:5984;
    }
}

setting up a subdomain to access Futon. When I go to couchdb.mydomain.com/_utils and run the CouchDB test suite, Nginx gives 502 Bad Gateway errors. Any ideas on what would be causing this? Is it possible to know what url the test suite is trying to go to?

I am with a small business redesigning other companies' websites. Often we will host their new website on our Linode account but they will have their email handled with some other provider.

One client had their domain registered with GoDaddy. I changed the nameservers to ns1.linode.com, ns2.linode.com, through ns5.linode.com and did not touch their MX records. There were no problems with the transfer and email service was not interrupted.

Another client had their domain registered with another Network Solutions. I went in and changed the nameservers like last time to point to the Linode, and after a few hours the new site was showing. I then received a call saying that email service was out. Turns out Network Solutions only allows you to set MX records when the nameservers are their own. What I had to do for this domain is change the nameservers to point to the Linode and then configure MX records in Linode's DNS manager.

Is one of these ways the "normal" way of doing it? Will doing it one way affect subdomains? I want to avoid email outages in the future.

Other than the obvious danger of someone physically coming upon your open computer when you aren't looking and having access to your server, is there any danger if I leave an ssh connection open for a long time (like days and days)?