Iinstallation and configuration guides for Apache, Nginx, IIS, HAProxy, Caddy, and other web servers.
If you spend enough time around certificates, you eventually run into a hostname mismatch that looks absurdly avoidable. The certificate is valid, signed by a trusted CA, not expired, and still the browser rejects it because the hostname is not covered the way someone assumed. Most of those incidents come back to SANs. Subject Alternative […]
SSL Subject Alternative Names (SANs): Everything You Need to Know Read Post »
Nginx proxy_cache can make a struggling application look healthy again, but it can also serve the wrong page to the wrong user if you get sloppy. I have seen both outcomes. The good version is a backend that suddenly stops melting under traffic spikes. The bad version is an authenticated dashboard cached for everyone because
Nginx Proxy Cache Configuration: How I Set It Up Without Caching the Wrong Thing Read Post »
WebSocket proxying looks deceptively simple until you hit the first timeout, load balancer mismatch, or upgrade failure. I have seen people copy a normal reverse proxy block, change the upstream URL, and assume it is done. Then they wonder why the browser reports a failed handshake, why idle connections die at sixty seconds, or why
Nginx WebSocket Proxy Configuration: The Settings That Actually Matter Read Post »
I like Nginx load balancing because it stays boring when the traffic pattern is boring, and that is a compliment. When a setup is healthy, most of the work is invisible. The trouble starts when the upstream layer is copied from an old blog post, nobody logs which backend answered the request, and an intermittent
Nginx Upstream Load Balancing Configuration: What I Actually Tune in Production Read Post »
When a site feels slow or unreliable, I still start with logs more often than dashboards. Metrics help, but logs tell me what actually happened to specific requests. They also expose the ugly details dashboards smooth over: repeated client aborts, a sudden flood of 404s from one broken deploy, one upstream timing out while another
Nginx Log Analysis: How I Read Access and Error Logs Without Drowning in Noise Read Post »
Rate limiting is one of those things that’s easy to get wrong in both directions — too loose and it does nothing, too tight and you start blocking real users. I’ve tuned rate limiting configs on production sites a few times and I’ve made both mistakes. Here’s what I’ve learned about how Nginx rate limiting
Nginx Rate Limiting: How to Stop Abuse Without Breaking Legitimate Traffic Read Post »
Sometimes you need to protect a URL quickly — a staging environment, an admin panel, a Prometheus metrics endpoint, internal documentation. Setting up a full authentication system is overkill. Nginx’s built-in basic authentication handles these cases well. Basic auth has a reputation for being insecure, but that reputation is mostly from HTTP days. Over HTTPS,
Nginx Basic Auth: Quick Access Control Without a Full Auth System Read Post »
Running a Node.js app directly on port 80 or 443 is possible but not how I’d do it in production. Nginx in front of Node.js gives you SSL termination, static file serving, caching, compression, rate limiting, and request buffering — things Node.js can do but doesn’t do as efficiently as a dedicated web server. Here’s
Nginx as a Reverse Proxy for Node.js Applications Read Post »
Security headers are easy to overlook. They’re not flashy — users never see them — but they add meaningful protection against a range of attacks: clickjacking, XSS, MIME sniffing, cross-origin data leaks. Adding them takes maybe 15 minutes, and scanners like securityheaders.com will grade your site. Here’s what I actually set and why each one
HTTP Security Headers: What to Set in Nginx and Why Read Post »
Apache’s SSL configuration has improved a lot over the years. Getting it right involves enabling the right modules, configuring ciphers, setting up HSTS, and making sure the certificate chain is complete. Here’s the configuration I use. Required Modules Make sure these modules are enabled: Verify: Virtual Host Configuration A complete HTTPS virtual host: SSLProtocol -all
Apache SSL Configuration: Modern Settings for a Secure Setup Read Post »