Skip to content

Commit

Permalink
rdfind and ping notice
Browse files Browse the repository at this point in the history
  • Loading branch information
willnode committed Aug 21, 2023
1 parent 0fea148 commit ce279bd
Show file tree
Hide file tree
Showing 2 changed files with 19 additions and 17 deletions.
17 changes: 10 additions & 7 deletions docs/integration/self-host.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -60,16 +60,18 @@ curl -sS https://getcomposer.org/installer | php -- --install-dir=/usr/local/bin
find /etc/opt/remi/ -maxdepth 1 -name 'php*' -exec sed -i "s/upload_max_filesize = 2M/upload_max_filesize = 512M/g" {}/php.ini \; -exec sed -i "s/post_max_size = 8M/post_max_size = 512M/g" {}/php.ini \;
```

Tools and libs:
Tools, libs, services:
```
dnf install certbot cmake gcc-c++ git ncdu htop iftop ipset jq lsof make nano rsync sendmail strace tar time vim wget yarn xz
dnf install libcurl-devel libffi-devel libmd libsqlite3x-devel libreport-filesystem mesa-libGL perl-DBD-Pg passenger-devel perl-devel perl-macros readline-devel
dnf install {libcurl,libffi,libsqlite3x,nettle,postgresql-server,passenger,perl,readline}-devel libmd libreport-filesystem mesa-libGL perl-DBD-Pg perl-macros
dnf install do-agent earlyoom fail2ban-server postfix proftpd postgresql-server postgresql-contrib
```

Services:
```
dnf install do-agent earlyoom fail2ban-server postfix proftpd
dnf install postgresql-server postgresql-contrib postgresql-server-devel
wget https://rdfind.pauldreik.se/rdfind-1.6.0.tar.gz
tar -xf rdfind-1.6.0.tar.gz ; cd rdfind-1.6.0
./configure --disable-debug ; make install
cd .. ; rm -rf rdfind-1.6.0
```

:::info
Expand Down Expand Up @@ -146,9 +148,10 @@ EARLYOOM_ARGS="-r 0 -m 4 -M 409600 -g --prefer '^(node|python|ruby|java)' --avoi
@daily passenger-config reopen-logs
* * * * * pgrep PassengerAgent || systemctl restart nginx
*/5 * * * * /usr/bin/node /home/bridge/public_html/sudokill.js -i bridge,do-agent,dbus,earlyoom,mysql,named,nobody,postgres,polkitd,rpc
@weekly find /home -maxdepth 2 -name .cache -or -name .npm -type d -ctime +7 -exec rm -rf {} \;
@monthly find /etc/letsencrypt/{csr,keys} -name *-certbot.pem -type f -mtime +180 -exec rm -f {} ';'
@reboot sudo /usr/bin/bash /home/daemon/public_html/src/whitelist/refresh.sh
@weekly find /home -maxdepth 1 -type d -ctime +7 -exec rm -rf {}/{.cache,.npm,Downloads,public_html/.yarn/cache,public_html/node_modules/.cache,.composer/cache} \;
@monthly find /home -maxdepth 1 -type d -ctime +7 -exec rdfind -minsize 100000 -makehardlinks true -makeresultsfile false {}/{.vscode-server,.pyenv,.rvm,.cargo,.local,go,.rustup,public_html/node_modules} \;
@reboot sudo /usr/bin/bash /home/bridge/public_html/src/whitelist/refresh.sh
```

### MariaDB
Expand Down
19 changes: 9 additions & 10 deletions docs/intro/security.mdx
Original file line number Diff line number Diff line change
Expand Up @@ -3,11 +3,11 @@ sidebar_position: 4
title: Security Measures
---

This article describes the security measures that implemented in the system. Beware, this is an advanced topic.
This article describes the security measures that implemented in the system.

DOM Cloud is essentially a Linux VPS server that's shared for all users. While this maybe seems like a bad idea, when it done correctly it will work fine for most users.

Each servers currently installed with 1 vCPU and 2 GB RAM, which should be enough for most of web development task and average production server. This hardware spec may be increased as the time goes with available budget.
Each servers currently installed with 1 vCPU and 1 or 2 GB RAM, which should be enough for most of web development task and average production server. This hardware spec may be increased as the time goes with available budget.

## No Sudo

Expand All @@ -21,18 +21,17 @@ The deployment system also has some shortcut to install language compilers, such

## No Background Services

CPU and RAM are limited resources. To make room for everyone, server processes need to be shut down when it's no longer in use. In another word, there can't be any process run 24/7, it will be terminated when there's no traffic for more than 10 minutes.
CPU and RAM are limited resources. To make room for everyone, server processes need to be shut down when it's no longer in use. In another word, there can't be any process run 24/7, it will be terminated when there's no traffic for more than 15 minutes.

This is enforced by NginX proxies (PHP-FPM and Passenger) plus an additional cron job that does this:

```bash
# Send SIGKILL (immediate kill) for all processes longer than 3 hours and it's not daemon processes.
kill -9 $(ps --no-headers -eo pid,user,etimes | awk '{if ($3 > 10800 && $2 != "root" && $2 != "mysql" && $2 != "postgres".......) { print $1}}')
```
This is enforced by NginX proxies (PHP-FPM and Passenger) plus many many other daemons that's running in the background.

If your web apps requires some kind of background processes that must stays on for 24/7, then you might have designed its system architecture wrong. The most noticeable impact from this restriction is Chatbot. All chatbot must work by webhook, not by actively polling social media APIs.

This is also the reason why there's only three database system supported: SQLite, MariaDB and PostgreSQL. The last two is managed by system daemon, so it's always available 24/7.
:::danger

Do not install any third-party background services that pings all the time such as Uptime Bots. This will cause your account to be terminated as it is direct violation for Fair Use (forcing the process to always run 24/7).

:::

## Listing every other users

Expand Down

0 comments on commit ce279bd

Please sign in to comment.