Cornel Bratu bratucornel

This document outlines the steps to set up a one tunnel IPSec Site to site VPN on AWS and a VM on another cloud provider (Packet) running Strongswan.

(References:

https://docs.aws.amazon.com/vpn/latest/s2svpn/SetUpVPNConnections.html

https://openvpn.net/vpn-server-resources/extending-vpn-connectivity-to-amazon-aws-vpc-using-aws-vpc-vpn-gateway-service/)

Spin up packet VM and install strongswan

(This can be any cloud provider. It does not have to be Packet)

Adjusting child processes for PHP-FPM (Nginx)

When setting these options consider the following:

How long is your average request?
What is the maximum number of simultaneous visitors the site(s) get?
How much memory on average does each child process consume?

Determine if the max_children limit has been reached.

sudo grep max_children /var/log/php?.?-fpm.log.1 /var/log/php?.?-fpm.log

Prologue

I wrote this answer on stackexchange, here: https://stackoverflow.com/posts/12597919/

It was wrongly deleted for containing "proprietary information" years later. I think that's bullshit so I am posting it here. Come at me.

The Question

Amazon is a SOA system with 100s of services (or so says Amazon Chief Technology Officer Werner Vogels). How do they handle build and release?

Create Root CA (Done once)

Create Root Key

Attention: this is the key used to sign the certificate requests, anyone holding this can sign certificates on your behalf. So keep it in a safe place!

openssl genrsa -des3 -out rootCA.key 4096

Following this guide + data from this page

File: /etc/nginx/global/referer-spam.conf

##
# Referrer exclusions
##
if ($http_referer ~ "(buttons-for-website\.com|darodar\.com|econom\.co|ilovevitaly\.co|kambasoft\.com|lumb\.co|7makemoneyonline\.com|ranksonic\.info|savetubevideo\.info|see-your-website-here\.com|semalt\.com|priceg\.com|srecorder\.com|descargar-musica-gratis\.net|54\.186\.60\.77|lomb\.co)") {
  set $prohibited "1";

	#cloud-config

	ssh_pwauth: false
	disable_root_opts: no-port-forwarding,no-agent-forwarding,no-X11-forwarding

	# Install base packages
	package_update: true
	package_upgrade: true
	packages:
	- gnupg

	#!/usr/bin/env bash

	#####################################################################
	# REFERENCES
	# - https://cloud.google.com/architecture/build-ha-vpn-connections-google-cloud-aws
	# - https://cloud.google.com/vpc/docs/private-service-connect
	#####################################################################

	export PROJECT_ID=$(gcloud config get-value project)
	export PROJECT_USER=$(gcloud config get-value core/account) # set current user

	# import config.
	# You can change the default config with `make cnf="config_special.env" build`
	cnf ?= config.env
	include $(cnf)
	export $(shell sed 's/=.*//' $(cnf))

	# import deploy config
	# You can change the default deploy config with `make cnf="deploy_special.env" release`
	dpl ?= deploy.env
	include $(dpl)

	(function() {
	var requests = window.performance.getEntries();
	var hosts = {};
	var output = "";

	for(var requestIdx = 0; requestIdx < requests.length; requestIdx++) {
	var request = requests[requestIdx];
	var origin = new URL(request.name).origin;

	hosts[origin] = 1;