Skip to Content.
Sympa Menu

sm-discuss - [SM-Discuss] Infrastructure update #2

sm-discuss AT lists.ibiblio.org

Subject: Public SourceMage Discussion List

List archive

Chronological Thread  
  • From: Vlad Glagolev <stealth AT tiberian.ru>
  • To: Source Mage Discussion <sm-discuss AT lists.ibiblio.org>
  • Subject: [SM-Discuss] Infrastructure update #2
  • Date: Thu, 16 May 2019 18:09:57 -0700

Hello everyone!

It's been a couple of months since we finished the most of the
infra migration [0], and it's time to polish some web bits to make
them look refreshed and in line with new standards.

So this is what's been up and running for a few days in smoke-test mode:

1. New caching layer.

It's no secret we have one of the oldest domains distro-wise. So even
though we are not super-popular, still sometimes our sites become
targets of bots, which just wastes servers' resources.

So, to fix that I'd like to present a new caching layer that takes care
about many problems besides above-mentioned.

Every web-service under .sourcemage.org domain is now protected by the
cache, which has a very low TTL, but at the same time it's increased
automatically in case the backend goes down, giving ability for serving
some content while the problem is being fixed. In terms of performance
this is how http://sourcemage.org delivers with almost no impact on
RAM/CPU on probe:

--[ snip ]--
Transactions: 61421 hits
Availability: 100.00 %
Elapsed time: 59.23 secs
Data transferred: 526.48 MB
Response time: 0.48 secs
Transaction rate: 1036.99 trans/sec
Throughput: 8.89 MB/sec
Concurrency: 497.36
Successful transactions: 61421
Failed transactions: 0
Longest transaction: 5.01
Shortest transaction: 0.31
--[ snip ]--

2. Brotli compression.

Not a huge/important improvement, rather a nice-to-have feature.

Everything under https://sourcemage.org (except News) now can be
delivered Brotli-encoded, if your browser supports it.

Please note, Brotli compression is enabled only for HTTPS connections.

I'm still thinking about forcing HTTPS for sourcemage.org though.

3. Security headers.

It's been a while since we looked into that (if at all). But the world
is changing and new security measuers are being introduced to protect
users from new kinds of attacks. With that among others we now have the
following implemented via HTTP headers:

- CSP (Content Security Policy)
- HSTS (HTTP Strict Transport Security)
- Referrer-Policy
- X-Frame-Options (clickjacking protection)
- X-XSS-Protection (XSS filter)

I hope this is one more step ahead towards better infrastructure for
SMGL and I'm looking forward to other improvements.

Please let me know if you see any misbehavior. Suggestions are also
welcome.

[0] https://lists.ibiblio.org/sympa/arc/sm-discuss/2019-March/022391.html

--
Vlad Glagolev <stealth AT tiberian.ru>

Attachment: pgpg80Wk9iFj6.pgp
Description: PGP signature



  • [SM-Discuss] Infrastructure update #2, Vlad Glagolev, 05/16/2019

Archive powered by MHonArc 2.6.24.

Top of Page