@DownPW 🙂 most of this really depends on your desired security model. In all cases with firewalls, less is always more, although it’s never as clear cut as that, and there are always bespoke ports you’ll need to open periodically.

Heztner’s DDoS protection is superior, and I know they have invested a lot of time, effort, and money into making it extremely effective. However, if you consider that the largest ever DDoS attack hit Cloudflare at 71m rps (and they were able to deflect it), and each attack can last anywhere between 8-24 hours which really depends on how determined the attacker(s) is/are, you can never be fully prepared - nor can you trace it’s true origin.

DDoS attacks by their nature (Distributed Denial of Service) are conducted by large numbers of devices whom have become part of a “bot army” - and in most cases, the owners of these devices are blissfully unaware that they have been attacked and are under command and control from a nefarious resource. Given that the attacks originate from multiple sources, this allows the real attacker to observe from a distance whilst concealing their own identity and origin in the process.

If you consider the desired effect of DDoS, it is not an attempt to access ports that are typically closed, but to flood (and eventually overwhelm) the target (such as a website) with millions of requests per second in an attempt to force it offline. Victims of DDoS attacks are often financial services for example, with either extortion or financial gain being the primary objective - in other words, pay for the originator to stop the attack.

It’s even possible to get DDoS as a service these days - with a credit card, a few clicks of a mouse and a target IP, you can have your own proxy campaign running in minutes which typically involves “booters” or “stressers” - see below for more

https://heimdalsecurity.com/blog/ddos-as-a-service-attacks-what-are-they-and-how-do-they-work

@DownPW said in Setting for high load and prevent DDoS (sysctl, iptables, crowdsec or other):

in short if you have any advice to give to secure the best.

It’s not just about DDos or firewalls. There are a number of vulnerabilities on all systems that if not patched, will expose that same system to exploit. One of my favourite online testers which does a lot more than most basic ones is below

https://www.immuniweb.com/websec/

I’d start with the findings reported here and use that to branch outwards.

@Panda It’s been raised multiple times, but only for the open source version, and not hosted.

@DownPW it’s your only realistic option at this stage.

@Panda I see why - if you check the browser console, there’s an error logged there. This is from one of my VM’s

image.png

There is a decision tree that pulls the value of the editor theme from the saved browser settings on each load, but that fails if the theme has never been changed, and the user has the default (in your case, you are using light mode, so it serves “flatly” by default, but the editor itself is never set and returns null

This below code changes that

/* If savedTheme is undefined it will return null - based on this, we assume that the user has the default theme selected and never changed it, so we'll need to force that here */ if(!savedTheme) { var savedTheme = "flatly"; }

If you reload your browser and test again, it should work properly.

@Panda said in Fixed background to nodebb forum:

Chatgpt told me the ::before method.

Go figure 😛

@Panda You’ll need to do that with js. With some quick CSS changes, it looks like this

d619844f-fbfe-4cf1-a283-6b7364f6bf18-image.png

The colour choice is still really hard on the eye, but at least you can now read the text

@veronikya it might flicker on load, yes, and that’s normal. It’s because the CSS and JS are loaded before the custom elements, but it shouldn’t be too bad on reasonable links.

It shouldn’t flicker at all navigating through the site though as the CSS and JS are already loaded.

@DownPW it’s in relation to the response I provided above

@Panda because there is no match for the DNS entry specified. The receiving web server parses the headers looking for a destination hostname to match, and anything the web server is unable to resolve will be sent back to the root.

@Panda You should be able to use {% javscript %} as shown in this video - it’s quite the watch, but very educational, and provides insight as to how this works - see below screenshot for an example

cdb160e9-d955-498c-b921-982db2986e2b-image.png

@Panda said in WP / Woocommerce Mystery:

Just back to my other question, have you ever used Shopify?
It insists on a templating language to use any custom js.

Not personally as never had any need, however, I do know that it uses Liquid for JS templating. It’s written in Ruby and is used to generate dynamic content on shop fronts. There’s zero reason as to why it wouldn’t work with data supplied by 3rd party API’s, although WordPress code won’t natively work for obvious reasons, and as such, this code would need to be re-written.

The JS part will likely work with minor modification, but not the PHP file in it’s current form.

@OT very odd. Shouldn’t be that complex, but glad you have it working.

Thanks for your inputs ♥️

@veronikya said in Cloudflare bot fight mode and Google search:

docker modifications are a pain in the ass,

I couldn’t have put that better myself - such an accurate analogy. I too have “been there” with this pain factor, and I swore I’d never do it again.

@OT Yes, I know. Here’s the article. I just finished it

https://sudonix.org/topic/542/swatch-theme-changer

Please try this in test first before you deploy to live.

@DownPW it’s possible, yes, but you may inadvertently end up targeting other elements using the same class which of course isn’t desired.

Can you provide a link in DM for me to review?

@phenomlab said in Come back PhP, all is forgiven!:

I used IONOS for a while, and realised that Hetzner provide a much better deal for those experienced with Linux. I know @cagatay, @DownPW and myself all use Hetzner, and I think @Madchatthew (whom I haven’t seen for a while ) was also considering taking their services. There’s an affiliate link below if you’d like to go down that route

Yep hetzner is very very cool and I haven’t seen before a panel magentment as complete as him : backup, snapshot, add cpu core, ram is easy.

@phenomlab said in Come back PhP, all is forgiven!:

Obtaining a VPS comes with the double-edged sword of being completely on your own with no support, although by using Virtualmin, you’ll find life so much simpler (something I know @DownPW can attest to, as I managed to convert him )

Yep Virtualmin is very cool 😉
And it makes life much easier for server management, domain, nginx and so on even if it is always better to know how to do all this in CLI. I would say that the 2 are really complementary

@DownPW Yes, exactly.

@Panda said in Cloudflare bot fight mode and Google search:

Basic question again, is nginx necessary to use?

No, but you’d need something at least to handle the inbound requests, so you could use Apache, NGINX, Caddy… (there are plenty of them, but I tend to prefer NGINX)

@Panda said in Cloudflare bot fight mode and Google search:

Do these two sites need to be attached to different ports, and the ports put in the DNS record?

No. They will both use ports 80 (HTTP) and 443 (HTTPS) by default.

@Panda said in Cloudflare bot fight mode and Google search:

Its not currently working, but how would the domain name know which of the two sites to resolve to without more info?
Currently it only says the IP of the whole server.

Yes, that’s correct. Domain routing is handled (for example) at the NGINX level, so whatever you have in DNS will be presented as the hostname, and NGINX will expect a match which once received, will then be forwarded onto the relevant destination.

As an example, in your NGINX config, you could have (at a basic level used in reverse proxy mode - obviously, the IP addresses here are redacted and replaced with fakes). We assume you have created an A record in your DNS called “proxy” which resolves to 192.206.28.1, so fully qualified, will be proxy.sudonix.org in this case.

The web browser requests this site, which is in turn received by NGINX and matches the below config

server { server_name proxy.sudonix.org; listen 192.206.28.1; root /home/sudonix.org/domains/proxy.sudonix.org/ogproxy; index index.php index.htm index.html; access_log /var/log/virtualmin/proxy.sudonix.org_access_log; error_log /var/log/virtualmin/proxy.sudonix.org_error_log; location / { proxy_set_header Access-Control-Allow-Origin *; proxy_set_header Host $host; proxy_pass http://localhost:2000; proxy_redirect off; proxy_set_header Host $host; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header X-Api-Key $http_x_api_key; } location /images { index index.php index.htm index.html; root /home/sudonix.org/domains/proxy.sudonix.org/ogproxy; } fastcgi_split_path_info "^(.+\.php)(/.+)$"; listen 192.206.28.1:443 ssl http2; ssl_certificate /home/sudonix.org/domains/proxy.sudonix.org/ssl.combined; ssl_certificate_key /home/sudonix.org/ssl.key; }

The important part here is server_name proxy.sudonix.org; as this is used to “map” the request to the actual domain name, which you can see in the root section as root /home/sudonix.org/domains/proxy.sudonix.org/ogproxy;

As the DNS record you specified matches this hostname, NGINX then knows what to do with the request when it receives it.

@DownPW If you don’t mind a retro display type of Dot Matrix - why on earth would anyone want that? I get the concept, but it’s nothing more than a gimmick and adds zero value to the operation of the handset.

Sustainable product… with a £600 plus price tag…

“Nothing Phone”? More like “Nothing Special” 😄