Multiple SSL on same IP

There is a known web server limits, make it hard to host many SSL on same server with only 1 IP address. (see http://nginx.org/en/docs/http/configuring_https_servers.html )

An SSL certificate with several names seems to be the simplest solution. Here is outline of 1 way to do it:
* Automate using https://github.com/srvrco/getssl to get certificates
* Let's encrypt with 1 main domain, other domains consider as alternative names

Steps
1. Initialize configurations: getssl -c MAIN.DOMAIN

2. Change CA to production, ACCOUNT_EMAIL in ~/.getssl/getssl.cfg

3. Enter SANS, ACL,RELOAD_CMD in ~/.getssl/MAIN.DOMAIN/getssl.cfg

ACL is path (public accessible via URL) to verify your domains.
it must have same number of lines as number of your domains.

RELOAD_CMD can be 

sudo nginx -s reload

Let's current user is deploy. visudo to allow: 

deploy ALL=NOPASSWD:/usr/sbin/nginx

4. Get certificates: getssl MAIN.DOMAIN
5. Configure nginx to use certificates in ~/.getssl/MAIN.DOMAIN
6. Automate renew using cron 

23  5 * * * /home/deploy/scripts/getssl -u -a -q

Nginx proxy cache setting for Moin

MoinMoin is a nice wiki. I tried to cache it, and luckily succeed:

# Save this, e.g.: /etc/nginx/proxy_cache for reusable
proxy_cache zone-cache;

# Should add more if
proxy_cache_key "$host$request_uri";
proxy_cache_valid any 1d;
proxy_cache_methods GET HEAD;
proxy_ignore_headers Set-Cookie Cache-Control Expires;
proxy_hide_header Cache-Control;
proxy_hide_header Expires;
proxy_http_version 1.1;

server {
     proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=zone-cache:4m max_size=1000m;    
     location @moin {
        include proxy_cache;
        proxy_pass http://127.0.0.1:8080;
        # each application need specify when to by pass cache
        set $no_cache 0;
        if ($query_string ~* "action=") {
            set $no_cache 1;
        }
        if ($http_cookie ~* "MOIN_SESSION_") {
            set $no_cache 1;
        }
        proxy_cache_bypass $no_cache;
    }
    location / {
        try_files $uri @moin;
    }
    location /moin_static197/ {
        alias /srv/moin/web/static/htdocs/;
    }
    # more here
}

Server-level cache

We often use "plugins" like "WP Super Cache"... to have our contents using less server resources.
We also have to write various PHP-level code to having such functionality.

However, there is an alternative way to do it *automatically*, without having to repeatedly writing code to cache our content at PHP-level.

We care about 4 aspects of caching:
1-Where to cache (often files)
2-How long it cached (says 5 min or 30days, depend on how freshness the website)
3-Bypass for dynamic sections (login, admin, realtime...)
4-Clear cache

Assuming we using Nginx and passing request to backend PHP using socket, typically we having:

proxy_pass http://127.0.0.1:9000

We added something like:

http {
   proxy_cache_path /var/cache/nginx levels=1:2 keys_zone=zone-a:8m max_size=1000m inactive=600m;
}
server {
  proxy_pass http://127.0.0.1:9000
  proxy_cache_key $proxy_host$request_uri$is_args$args;
  proxy_cache_valid 200 302 5m;
  proxy_cache zone-a;
}

proxy_cache_path defines place to put our cache data, naming "zone". We have control over its size, how to creating sub- directories (levels=1:2 )

proxy_cache specifies which zone to store cache.

proxy_cache_key define the pattern to cache. We may need to add how to know that the page is dynamic generated, such as cookie. Or we may use proxy_cache_bypass to tell, example, wp-admin will be bypassed.

set $wp_bypass 0;
if ($request_uri ~ "wp-admin") {
    set $wp_bypass 1;
}
proxy_cache_bypass $wp_bypass;

To clear cache, simply deletes files under zone directory!

Apache also having similar features, and if we need more flexible, a mature cache engine like Varnish may help us. Speed up and concentrate more on development!

Nginx generate password for auth basic

<?php
echo "Usage: php gen_passwd.php passwd_to_crypted". PHP_EOL;
$pass = $argv[1];
echo crypt($pass, base64_encode($pass)). PHP_EOL;