Plamen Vasilev PVasileff

High Traffic Server Settings on RHEL / AlmaLinux / Rocky / EuroLinux / CentOS 8

I recently did some work to optimize the network configuration of an AlmaLinux 8 based web server that receives a lot of traffic.

Of course these settings also apply to RHEL / Rocky / EuroLinux / CentOS 8 (hereafter referred to as Linux 8.) I think these should also work on RHEL / AlmaLinux / Rocky / EuroLinux 9 as well but I have not yet tested them.

There is a lot of information on the web for this and it distills down to a minimum recommended configuration, and a recommended configuration.

The minimum recommended configuration should be sufficient for servers with less than 10Gb, and the recommended configuration should be sufficient for servers with 10Gb or more.

Wireguard and iptables restrictions for multiple users

If you don't know what Wireguard is, well, you should. It's fast, easy to setup and highly configurable. We will configure Wireguard for multiple users with various restrictions using iptables.

Assumptions

This should fit most setups (not mine though 😉)

Installing Proxmox on Raspberry Pi 4 and 5

With these steps I managed to get Pimox on my Raspberry Pi 4 and 5 in february 2024.

Step 1 - Flashing the OS

Install "RPi OS Lite 64-bit" with Raspberry Pi Imager. It's listed under "Raspberry Pi OS (Other)"

Adjusting child processes for PHP-FPM (Nginx)

When setting these options consider the following:

How long is your average request?
What is the maximum number of simultaneous visitors the site(s) get?
How much memory on average does each child process consume?

Determine if the max_children limit has been reached.

sudo grep max_children /var/log/php?.?-fpm.log.1 /var/log/php?.?-fpm.log

ThinkPad T480 fingerprint reader on Fedora Linux

Background

The Synaptics fingerprint sensor (06cb:009a) present on my T480 is not supported by libfprint and fprintd as it requires a non-free binary blob. uunicorn created open-fprintd, a replacement for fprintd, that allows for loading of binary blobs. In conjunction with their python-validity driver we are able to make use of the inbuilt fingerprint reader. The following instructions were tested against Fedora Linux 35.

Installing `open-fprintd` and `python-validity`

sudo dnf copr enable tigro/python-validity
sudo dnf install open-fprintd fprintd-clients fprintd-clients-pam python3-validity

	# Put this file under /etc/spamassassin/ and run an sa-update or reload amavis etc.
	#
	#--------------------------------------------------
	# The only RBL I trust, UCEPROTECT1 (single IP, not IP-ranges or entire ISPs) http://uceprotect.net
	#--------------------------------------------------
	header RCVD_IN_UCEPROTECT1 eval:check_rbl_txt('uceprotect1', 'dnsbl-1.uceprotect.net')
	describe RCVD_IN_UCEPROTECT1 Listed in dnsbl-1.uceprotect.net
	tflags RCVD_IN_UCEPROTECT1 net
	score RCVD_IN_UCEPROTECT1 1.8

	#!/bin/bash

	# Install jitsi-desktop 2.10.5550-1 on Ubuntu 20.04 or 22.04:
	# ----------------------------------------------------------
	# Add missing dependencies and force to run with openjdk-8

	[ "$(id -u)" -ne 0 ] && echo "This script must be run as root" && exit 1

	function installDependencies() {
	apt update

	apt-get update
	apt-get install -y gcc make build-essential \
	libxml2-dev libcurl4-openssl-dev libpcre3-dev libbz2-dev libjpeg-dev \
	libpng12-dev libfreetype6-dev libt1-dev libmcrypt-dev libmhash-dev \
	freetds-dev libmysqlclient-dev unixodbc-dev \
	libxslt1-dev

	mkdir -pv /usr/include/freetype2/freetype
	ln -sf /usr/include/freetype2/freetype.h /usr/include/freetype2/freetype/freetype.h
	wget -c -t 3 -O ./php-5.2.17.tar.gz http://museum.php.net/php5/php-5.2.17.tar.gz