The Cloud VPS series explains how we run hundreds of PHP/Laravel websites on the Balancer – Minion – Database model: Nginx reverse proxy, multiple PHP versions, multi-tenant MySQL, SSL, automation with Jenkins, security ...
This is the final article in the Cloud VPS series. Having walked through each tier, balancer, minion and database, along with the automation and defense layers, it is time for an honest look back: wha...
Laravel Octane keeps the application resident in RAM, so a site with a memory leak keeps growing until the kernel has to step in. If every Octane site on a minion runs under supervisor, each time this...
The article on fail2ban and limit_req already limits dynamic requests per IP. That works well against a single aggressive client, but it is helpless against a different kind of traffic: crawlers that...
Sometimes the familiar certbot command on a balancer suddenly reports Connection Timeout for every domain. The cause is neither certbot nor nginx: international connectivity for the IP range that host...
Coraza WAF blocks individual malicious requests, but a blocked IP can keep sending thousands more, and each one still costs the balancer CPU to analyze. Scraper bots are even harder: their requests ar...
The shared security snippet on the balancer (see standardizing Nginx security with a security snippet) does a good job of blocking sensitive paths such as .env, .git and wp-login. But it never looks a...
A balancer usually serves many websites, and each site writes its access log and error log to its own files. When a site slows down, the first questions are always: which IP is sending the most reques...
Most websites on the Cloud VPS model use Let's Encrypt certificates that are issued and renewed automatically. But some customers still need commercial SSL: a business that wants the certificate to sh...
When many Laravel sites on the same minion share a single PHP-FPM pool named www, the setup is very simple but has a fatal weakness: one slow site can grab every worker, and all the other sites on the...
A request from a browser to a website can pass through several hops: a CDN such as Cloudflare, a balancer, and only then the minion that runs the application. Each hop is a proxy, and each proxy repla...
Open the access log on any balancer and you will see the same kinds of requests over and over: /.env, /.git/config, /wp-login.php, /phpmyadmin/, /vendor/phpunit/.... A Laravel site has no WordPress or...
With PHP-FPM, every request to a Laravel site starts from zero: load the autoloader, read the config, register dozens of service providers, and only then reach the code that does the real work. When t...
When you run hundreds of websites, the three riskiest operations are usually not incidents but routine requests: deploying a new site, changing the domain of a live site, and moving a site to a differ...
All articles are displayed
