Web servers and services on Linux

Serving a site 5 topics

• Entry check: are you ready for web servers?
  A forty-five minute check of the command-line and network ideas this course builds on: status codes, ports, services, logs and file permissions, with a pointer to what…
• Serving your first site with nginx
  How nginx turns configuration files into a site: the file layout, a server block line by line, enabling a site with a link, and the habit of testing before every reload…
• Virtual hosts: many sites, one server
  How one nginx server hosts several sites: the Host header, servername matching, the default server, aliases, testing with curl -H, and the conflict warning for two…
• Apache: the other big web server
  The same job with Apache: VirtualHost, ServerName and DocumentRoot, access control with Require, the a2ensite and a2enmod helpers, configtest, and the rule that one…
• Reading logs and errors
  The two logs of a web server and what each answers, the fields of an access line, the awk and sort pipelines that count statuses and pages, the reasons in the error log…

Safe and routed 4 topics

• TLS certificates: names, dates and keys
  What a TLS certificate states and what a browser checks, how to read one with openssl, how to watch its expiry, how to make a test certificate, how a key must match, and…
• HTTPS and redirects
  Serving a site on port 443, redirecting http to https with return 301, permanent versus temporary redirects, one canonical host, HSTS with a short lifetime, and the…
• Reverse proxy: nginx in front of an application
  Why an application sits behind nginx, location and proxypass, passing the real host and visitor address with headers, the difference between 502 and 504, and setting…
• Load balancing, limits and private paths
  An upstream pool with round-robin, weights, backup and down servers, failover when a copy dies, checking that a pool survives a failure, per-visitor rate limits with…

The application as a service 3 topics

• Run the application as a service
  Why a program started by hand is not enough, a systemd unit file for the booking application with User, ExecStart, EnvironmentFile, Restart and WantedBy, daemon-reload…
• Settings, secrets and the database
  Settings from the environment instead of the code, an EnvironmentFile with the right owner and mode, why a password never belongs in a unit file, a database that is up…
• Releases and rollbacks
  A folder per release and a link that points at the live one, switching with ln -sfn, a smoke test, a deploy script that restores the previous release by itself, and…

Hardened, fast and watched 3 topics

• Hardening the web server
  Saying less (servertokens and security headers), refusing dot-files, root-owned read-only site files with modes 644 and 755, a default server that refuses unknown names…
• Caching: fast answers without asking twice
  A proxy cache with proxycachepath, proxycache and proxycachevalid, reading MISS, HIT and EXPIRED, what is safe to cache and what is personal, the lifetime as a trade…
• Keeping watch: logs, health checks and a runbook
  Rotating the application log with logrotate, a health check that tests what a visitor needs, scheduling it with cron, counting and explaining 502 errors, and a short…

Infrastructure behind a web service 4 topics

• Anatomy of a web request: DNS, ports, TLS and workers
  The parts of the web service (name and door, nginx master and workers, certificate, application, database, files and logs), a card for each with role, resource profile…
• Proxies, load balancers and caches
  The parts between the visitor and the application (reverse proxy, pool, proxy cache, limits, browser cache), a card for each, a short method for sizing a service…
• Certificates, backups and keeping watch
  Cards for the certificate and its renewal, the backup, the monitor and the change record, with one number to watch for each, an expiry check with openssl -checkend, a…
• Failure, recovery and the handover
  A failure table (what fails, what the visitor sees, the first check, the safe action), a drill that times noticing, finding the cause and restoring, a handover page…

Interview ready 2 topics

• Interview ready: web servers, names and TLS
  The questions people really ask about how a web request works, server blocks, status codes, certificates and redirects, with model answers, a routine for timed tasks…
• Interview ready: proxies, services and a mock round
  The questions people really ask about reverse proxies, 502 and 504, services, secrets, releases, capacity and handovers, with model answers, strong and weak answers…

The booking site configuration

A working nginx configuration for the booking site: virtual hosts, https with a redirect, a reverse proxy to the application, a pool with a rate limit, hardening and a cache, each tested with nginx -t and curl.

The service and release pack

A systemd unit with protected settings, a tested database backup, a release layout with a deploy script that rolls back, and a log rotation rule.

The web service map and handover

A card for each part, the sizing arithmetic with assumptions, a failure table with one drill, an expiry check and a one-page handover.

Why take this course

• Trace a fault from the status code to the cause
• Know what is in force, not just what you typed
• Release and roll back without a night of panic

You will build

• A hardened booking site configuration
• A service and release pack
• A web service map and handover

What you can do afterwards

• Run a small website with confidence
• Explain your choices and their risks
• Answer web server interview questions with specifics