Skip to content

Instantly share code, notes, and snippets.

View maserg's full-sized avatar
💭
I may be slow to respond.

Serg Matuha maserg

💭
I may be slow to respond.
View GitHub Profile
@maserg
maserg / 0-startup-overview.md
Created July 30, 2017 22:21 — forked from dideler/0-startup-overview.md
Startup Engineering notes
@maserg
maserg / mysql_repl_check.sh
Created October 14, 2016 18:11
mysql replication check script
#!/bin/bash
#--- Configurables ------------------------------------------
# replication delay threshold
TH_SECONDS_BEHIND=5
# notifcation email (if blank, no email will be sent)
EMAIL_ADDR=""
#------------------------------------------------------------
@maserg
maserg / nginx.conf
Created December 31, 2015 17:20 — forked from thoop/nginx.conf
Official prerender.io nginx.conf for nginx
# Change YOUR_TOKEN to your prerender token and uncomment that line if you want to cache urls and view crawl stats
# Change example.com (server_name) to your website url
# Change /path/to/your/root to the correct value
server {
listen 80;
server_name example.com;
root /path/to/your/root;
index index.html;
@maserg
maserg / site.conf
Created December 29, 2015 19:31 — forked from paskal/site.conf
Nginx configuration for best security and modest performance. Full info on https://terrty.net/2014/ssl-tls-in-nginx/
# read more at https://terrty.net/2014/ssl-tls-in-nginx/
# latest version on https://gist.github.com/paskal/628882bee1948ef126dd/126e4d1daeb5244aacbbd847c5247c2e293f6adf
# security test score: https://www.ssllabs.com/ssltest/analyze.html?d=terrty.net
# your nginx version might not have all directives included, test this configuration before using in production against your nginx:
# $ nginx -c /etc/nginx/nginx.conf -t
server {
# public key, contains your public key and class 1 certificate, to create:
# (example for startssl)
# $ (cat example.com.pem & wget -O - https://www.startssl.com/certs/class1/sha2/pem/sub.class1.server.sha2.ca.pem) | tee -a /etc/nginx/ssl/domain.pem > /dev/null

Two ways to do it, but only worked for me so I'll put it first and the second for reference:

$ openssl pkcs12 -export -in hostname.crt -inkey hsotname.key -out hostname.p12
$ openssl pkcs12 -in hostname.p12 -nodes -out hostname.pem

Other options for this method in comments below:

# Note, the -certfile root.crt appends all CA certs to the export, I've never needed these so it's optional for my personal steps
$ openssl pkcs12 -export -in hostname.crt -inkey hsotname.key -certfile root.crt -out hostname.p12

Note, I've always had my hostname.crt as part of my .pem, so I keep my certs but apparently you may not have to, hence the nocerts flag being an extra option in this sample

#
# Slightly tighter CORS config for nginx
#
# A modification of https://gist.github.com/1064640/ to include a white-list of URLs
#
# Despite the W3C guidance suggesting that a list of origins can be passed as part of
# Access-Control-Allow-Origin headers, several browsers (well, at least Firefox)
# don't seem to play nicely with this.
#
#
# A CORS (Cross-Origin Resouce Sharing) config for nginx
#
# == Purpose
#
# This nginx configuration enables CORS requests in the following way:
# - enables CORS just for origins on a whitelist specified by a regular expression
# - CORS preflight request (OPTIONS) are responded immediately
# - Access-Control-Allow-Credentials=true for GET and POST requests
@maserg
maserg / nginx.conf
Last active August 29, 2015 14:07 — forked from Stanback/nginx.conf
server {
listen 80;
listen [::]:80;
server_name yourserver.com;
root /path/to/your/htdocs;
error_page 404 /404.html
index index.html;
@maserg
maserg / sysctl.conf
Created November 23, 2013 01:09 — forked from kfox/sysctl.conf
# Kernel sysctl configuration file for Red Hat Linux
#
# For binary values, 0 is disabled, 1 is enabled. See sysctl(8) and
# sysctl.conf(5) for more details.
# Controls source route verification
net.ipv4.conf.default.rp_filter = 1
# Do not accept source routing
net.ipv4.conf.default.accept_source_route = 0