While reconfiguring the network at the church, I noticed that my DNS queries were not getting curbed by OpenDNS. Browsing to ‘bad’ sites should give you a no no page from OpenDNS, but nothing was tripping it… not even 4chan :S

The I realized that Qwest is doing some DNS override where they actually do the DNS query.

The Solution

You need to opt out of this “wonderful” service from Qwest.

http://www.qwest.net/web.help/?confirm=1

After that, it was just fine.

I guess Qwest couldn’t resist trying to pick up that money on the table since they have access to all that traffic…. wonder how much money they make on ads.

When setting up a SSL certificate and chain file for Nginx, you need to combine them into one file. If you combine them in the wrong order you’ll get a message similar to the following.


SSL_CTX_use_PrivateKey_file(" ... /www.nginx.com.key") failed
(SSL: error:0B080074:x509 certificate routines:
X509_check_private_key:key values mismatch)


This means you either didn’t combine them or you combined them in the wrong order. To combine the two together just do something like this.


cat www.example.com.crt www.certificatechain.com.ca > www.example.com.combined.crt


Now you’ll be happy as a lark.

When switching to Nginx I needed to have a variable that signified if the site was in HTTP or HTTPS mode. So I found this little bit of code.

map $scheme $fastcgi_https { ## Detect when HTTPS is used
default off;
https on;
}


This works great, but I really didn’t understand it until now so let’s take it line by line.

Line 1


map $scheme $fastcgi_https { ## Detect when HTTPS is used

This is where all the glory happens. $scheme is an internal variable within Nginx and is either HTTP or HTTPS (maybe some other ones in the future like SPDY). Then you have $fastcgi_https, this is the name of the variable we’re creating for future use in our config files. Nothing but comments after that stuff.

Line 2 and 3


default off;
https on;

This is our map of values. When Nginx’s $sheme variable is equal to “HTTPS”, then the $fastcgi_https variable will equal “on”, otherwise the variable just equals “off”.

Not too complex, but I just didn’t pick up on the format until now. Read more at

http://wiki.nginx.org/HttpMapModule

If you need to pass some environment variables to your application from Nginx, you’ll need to specify them in the config file like so.


fastcgi_param APPLICATION_ENV staging;


So for example a more full config for a Zend Framework application


server {
listen 443 default ssl;
listen 80 default;
ssl_certificate /etc/pki/tls/certs/cert.crt;
ssl_certificate_key /etc/pki/tls/private/cert.key;

}


There you have it. Go and do likewise.

A curious error message popped up after I moved my Drupal sites to Nginx. It would only happen on AJAX type changes, but not all of them. I first noticed it when I went to change the author of a node. Then when I tried to change a View I received this error message.

After checking the logs on Nginx and watching what happens using Firebug’s Net panel, it occurred to me that Drupal was making an HTTP “OPTIONS” request.

The other detail is I was using HTTPS (SSL) enforced with the Secure Pages module. It when I was on the HTTPS side of the site those AJAX requests would be HTTP OPTIONS requests to the non-secure side HTTP.

The Solution

The solution was to disable HTTPS for certain pages in the Secure Pages config settings. Why Drupal was making OPTIONS calls to the none secure side of the site is still a mystery.

BTW. When your on the non-secure side, it makes a regular GET or POST request, not an OPTIONS request.

My newest toy I’ve been playing with is Nginx. Getting PHP to work over FastCGI. The performance gain over Apache + mod_php is quite staggering.

Here are a few things to watch out.

Getting PHP v5.2

Some of my apps are not ready to make the jump to PHP 5.3 just yet, so I needed to get a hold of PHP 5.2. In the past I just install the Zend Server CE it would have all the PHP bells and whistles I could ever need. Not anymore, now it’s time to fend for myself.

Webtatic Repo

http://www.webtatic.com/blog/2009/06/php-530-on-centos-5/

I’ve added webtatic to my repos and followed his advice to disable PHP 5.3 from his repos you add exclude=php*5.3* to your webtatic.repo file.

Now you can install PHP.

APC Opcode Cache

This waa a little more of struggle as I need to install various things to get it to work. I finally ran pecl install apc and it compiled fine. Then I added a file

/etc/php.d/apc.ini

extension=apc.so

PHP will pick that up and just enable it. Make sure to check that it’s enabled by running phpinfo(). Also you can download the source and extract the file apc.php Throw this on your server and run it in the browser, it will give you a nice rundown about the state of APC and let you know if it’s working.

PHP via FastCGI

There are a few ways to accomplish this and much debate on which is the best way, but I followed the instructions on

http://www.cyberciti.biz/faq/rhel-fedora-install-configure-nginx-php5/

It lays it out plain, how to get a FastCGI daemon going. One change I did make though. It has the daemon listening on localhost:9000. I changed my to a socket located at /tmp/phpcgi.socket

Here is the /etc/init.d/php_cgi init script.

Zend Framework

One issue I ran into with Zend Framework, was the location of the sessions folder and the permissions. The default session folder is in /var/lib/php/session this was owned by apache, I just changed the owner:group to nginx:nginx. All was sunshine and roses again.