Nginx Security Headers on Debian 12

Create /etc/nginx/snippets/security-headers.conf

add_header X-Frame-Options            "SAMEORIGIN"                                 always;
add_header X-Content-Type-Options     "nosniff"                                    always;
add_header X-XSS-Protection...

Setting up an OpenVPN server

Pre-requisites

Install openvpn. On Debian/Ubuntu:

apt-get install openvpn easy-rsa

Certificate setup

cd /etc/openvpn          # Pick any directory

make-cadir easy-rsa   # Directory to store easy-rsa CA

Edit the variables in easy-rsa/vars and set appropr...

Install

wget https://dl-ssl.google.com/dl/linux/direct/mod-pagespeed-stable_current_amd64.deb

sudo dpkg -i mod-pagespeed-*.deb && apt-get -f install

service apache2 restart or /etc/init.d/apache2 restart

The primary configuration file is pagespeed.conf. This file is located at:

/etc/apache...

PHP-FPM Multiple Pools on Debian 12

Pool directory: /etc/php/8.2/fpm/pool.d/

Create /etc/php/8.2/fpm/pool.d/site1.conf

[site1]
user  = site1
group = site1
listen = /run/php-fpm/site1.sock
listen.owner = www-data
listen.group = www-data
listen.mode  = 0660
pm = dynamic
pm.max_children      =...

PostgreSQL Backup and Restore on Debian 12

Logical – pg_dump

# Single database
sudo -u postgres pg_dump -Fc appdb > /backups/appdb_$(date +%F).dump

# All databases
sudo -u postgres pg_dumpall > /backups/all_$(date +%F).sql

Restore

sudo -u postgres pg_restore -d appdb /backups/appdb_2026-05-...

PostgreSQL Streaming Replication on Debian 12

Primary: 192.168.1.10   Standby: 192.168.1.11

Primary – /var/lib/postgres/data/postgresql.conf

wal_level = replica
max_wal_senders = 5
wal_keep_size = 512MB
listen_addresses = '*'

/var/lib/postgres/data/pg_hba.conf:

host replication replic...

PostgreSQL User and Role Management on Debian 12

Create roles

CREATE ROLE alice WITH LOGIN PASSWORD 'AlicePass!';
CREATE ROLE dbadmin WITH SUPERUSER LOGIN PASSWORD 'AdminPass!';
CREATE ROLE readonly;

Grant privileges

GRANT CONNECT ON DATABASE appdb TO alice;
GRANT USAGE ON SCHEMA public TO a...

Redis Cluster on Debian 12

Minimum 3 primaries + 3 replicas (6 nodes). This example uses ports 7000-7005 on localhost.

Step 1 – Create node configs

for port in 7000 7001 7002 7003 7004 7005; do
    mkdir -p /etc/redis/cluster/$port /var/lib/redis/$port
    cat > /etc/redis/cluster/$port/redis....

Redis Persistence on Debian 12

RDB snapshots (redis.conf)

save 900 1
save 300 10
save 60 10000
dbfilename  dump.rdb
dir         /var/lib/redis
rdbcompression yes
rdbchecksum    yes

AOF (Append-Only File)

appendonly           yes
appendfilename       "appendonly.aof"
appendfsync          ev...

Redis Sentinel (HA) on Debian 12

Architecture

• Primary 192.168.1.10:6379
• Replica 192.168.1.11:6379, 192.168.1.12:6379
• Sentinels on port 26379 (all 3 nodes)

Primary redis.conf

bind 0.0.0.0
requirepass RedisPass!

Replica redis.conf

bind 0.0.0.0
requirepass RedisPass!
replicaof 192...

Secure MySQL on Debian 12

Step 1 – Run mysql_secure_installation

mysql_secure_installation

Set root password, remove anonymous users, disallow remote root login, remove test DB.

Step 2 – Bind to localhost

[mysqld]
bind-address = 127.0.0.1

Step 3 – Audit users

SELECT User, Host, plugin...

Install Erlang

sudo wget http://packages.erlang-solutions.com/erlang-solutions_1.0_all.deb
sudo dpkg -i erlang-solutions_1.0_all.deb
sudo apt-get update
sudo apt-get -y install erlang-nox

Install RabittMQ

sudo wget http://www.rabbitmq.com/releases/rabbitmq-server/v3.6.0/rabbitmq-server_3.6.0-1...

SSH Key-Based Authentication on Debian 12

Generate key pair (client)

ssh-keygen -t ed25519 -C "[email protected]"

Copy public key to server

ssh-copy-id -i ~/.ssh/id_ed25519.pub [email protected]

Or manually:

cat ~/.ssh/id_ed25519.pub | ssh user@server \
    "mkdir -p ~/.ssh &&...

SSH TOTP MFA on Debian 12

Step 1 – Install PAM module

apt install -y libpam-google-authenticator

Step 2 – Configure for each user

google-authenticator
# time-based: y, update file: y, disallow reuse: y, rate limit: y

Scan QR code with an authenticator app (Aegis, Google Authenticator, etc....

Tune MariaDB Performance on Debian 12

my.cnf

[mysqld]
innodb_buffer_pool_size        = 4G
innodb_buffer_pool_instances   = 4
innodb_log_file_size           = 512M
innodb_flush_log_at_trx_commit = 1
innodb_flush_method            = O_DIRECT

# Thread pool (MariaDB-specific)
thread_handling...

Tune MySQL Performance on Debian 12

my.cnf

[mysqld]
innodb_buffer_pool_size        = 4G
innodb_buffer_pool_instances   = 4
innodb_log_file_size           = 512M
innodb_flush_log_at_trx_commit = 1
innodb_flush_method            = O_DIRECT
max_connections                = 200
thread_cache_size...

Tune PHP OPcache on Debian 12

Edit /etc/php/8.2/fpm/conf.d/10-opcache.ini

opcache.enable=1
opcache.enable_cli=0
opcache.memory_consumption=256
opcache.interned_strings_buffer=16
opcache.max_accelerated_files=20000
opcache.revalidate_freq=60
opcache.validate_timestamps=1
; JIT (PHP 8.x)
opcache....

Tune PHP-FPM Performance on Debian 12

Estimate pm.max_children

ps -ylC php-fpm --no-headers | awk '{sum+=$8} END {print sum/NR/1024 " MB avg"}'
# Divide available RAM (minus OS+DB) by average size

Recommended dynamic settings

pm = dynamic
pm.max_children      = 50
pm.start_servers     = 10...

Tune PostgreSQL Performance on Debian 12

postgresql.conf

# Memory
shared_buffers          = 2GB       # 25% of RAM
effective_cache_size    = 6GB       # 50-75% of RAM
work_mem                = 64MB      # per-sort/hash
maintenance_work_mem    = 512MB

# Checkpoints
checkpoint_completion_target =...

Tune Varnish Cache on Debian 12

Systemd override (/etc/systemd/system/varnish.service.d/override.conf)

[Service]
ExecStart=
ExecStart=/usr/sbin/varnishd \
    -a :80 -T localhost:6082 \
    -f /etc/varnish/default.vcl \
    -s malloc,2G \
    -p thread_pools=2 \
    -p thread_pool_min=200 \...

Varnish VCL Configuration on Debian 12

Full example with load balancing and grace

vcl 4.1;
import directors;

backend web1 {
    .host = "192.168.1.10"; .port = "8080";
    .probe = { .url = "/health"; .timeout = 5s; .interval = 10s; .window = 5; .threshold = 3; }
}
backend web2 {
    .host = "1...