This example demonstrates how to change upload_max_filesize for OroCommerce. These instructions are specifically tailored for TryDirect deployments.

The directory containing the configuration files and docker-compose.yml is usually located at /root/app-name. 

    • Open the PHP configuration file located at /root/orocommerce/configs/php/php.ini.

    • Update the following directives to set the desired maximum file upload size:

    • upload_max_filesize: This directive defines the maximum size of a single file that can be uploaded. In this example, it is set to 10MB.

    • post_max_size: This directive sets the maximum size of all POST data, including file uploads and other form data. It should be slightly larger than upload_max_filesize to accommodate additional form data. In this example, it is set to 12MB.

    • Navigate to the directory containing your docker-compose.yml file. Typically, this is the root directory of your project.

    • Restart the specific containers to apply the new configuration. Use the following commands:

docker compose restart orocommerce 
docker compose restart orocommerce-websocket
docker compose restart orocommerce-message-consumer

     You can check the current PHP settings by entering the container and using the php -i command.

1.  Access the PHP and OroCommerce container by using the following command:

 2.  Execute the following command inside the container:

This command will display the values of the upload_max_filesize and post_max_size directives.

This article explains how to change php.ini settings, specifically max_upload_size and post_max_size when application is running in Docker container. These instructions specifically tailored to TryDirect deployments.

How to change max_upload_size in php.ini when running Docker

Single Sign-On Post Configuration steps. OAuth 2.0 Integration with Ory Hydra and Ory Kratos: Simplifying Auto Consent Flow

OAuth 2.0 has become the industry-standard protocol for authorization, renowned for its client developer simplicity and robust authorization flows tailored for web applications, desktop applications, mobile devices, and more. Developed within the IETF OAuth Working Group, OAuth 2.0 and its extensions continue to evolve, ensuring secure and efficient authorization processes across various platforms.

ORY Hydra is an advanced, open-source identity and access management solution that excels in providing token-based authentication, authorization, and comprehensive security features for web applications and APIs. Engineered for flexibility, scalability, and seamless integration, Hydra allows developers to efficiently create and manage OAuth 2.0 and OpenID Connect (OIDC) servers. Key features include:

Support for Multiple Authentication Flows: Hydra supports authorization code, client credentials, and implicit grant flows.

Enhanced Security Features: Token revocation, token introspection, and consent management to ensure secure and compliant applications.

Ease of Integration: Designed to fit seamlessly into existing infrastructures, Hydra is ideal for securing APIs and web applications.

Streamlined User Management with Ory Kratos

ORY Kratos is a powerful, cloud-native identity and user management system offering a comprehensive suite of features for managing user authentication and authorization in web applications. As an API-first solution built on modern cloud architecture principles, Kratos ensures ease of integration and horizontal scalability. Noteworthy features include:

Comprehensive User Management: Facilitates user registration, login flows, profile management, password resets, and other security-related functions.

Protocol Support: Fully supports OAuth 2.0, OpenID Connect, and JSON Web Tokens (JWTs).

Customizability and Flexibility: Designed to be adaptable and customizable to meet specific application requirements.

Building a Secure SSO Stack with Ory Ecosystem

A basic Ory OAuth stack can be efficiently set up using Docker Compose, integrating the following components:

Ory Hydra Quickstart Repository: For initial setup and configuration.

Ory Kratos Intro Repository: For user management features.

Ory Kratos UI Repository: For user interface components.

Auto Consent Repository: For managing auto consent flows.

Database Support: Compatible with SQLight, MySQL (5.7+), and PostgreSQL (9.6+).

Domain Name: Essential for link functionality. For testing, use a domain like login.yourdomain.com. Certificates for the domain are stored in acme.json for Traefik.

Reverse Proxy: Required to serve Hydra, Kratos, and consent. Traefik is used in this setup.

To ensure secure communication between your applications and users, it is essential to configure SSL. This involves changing protocols from HTTP to HTTPS in all configuration files, including .env, docker-compose, and Ory Hydra configuration files. Follow these steps to configure SSL:

Modify your .env file to replace all HTTP URLs with HTTPS. 

Ensure that your docker-compose.yml file is updated to reflect HTTPS endpoints. 

3. Configure Ory Hydra: In the Ory Hydra configuration file (e.g., hydra.yaml), ensure HTTPS is used:

Use a certificate management tool like Traefik to handle SSL certificates. Configure traefik.toml or traefik.yaml accordingly:


5. Reload and Test: After making these changes, reload your Docker Compose stack:

6. Test the URLs to ensure they are served over HTTPS and the certificates are correctly applied.

By configuring SSL, you enhance the security of your OAuth 2.0 implementation, ensuring that all data transmitted between your applications and users is encrypted and secure. This is a critical step in safeguarding user information and maintaining compliance with security standards.



You installed Single Sign-on package based on ORY products, what is next ?

Single Sign-On post configuration steps

How to setup Akeneo with Nginx, Nginx Proxy Manager, and Portainer

We already have the Akeneo stack, and its related information, on the Akeneo stack page. We can enhance this widely-used Product Information Management (PIM) system by adding Nginx, Nginx Proxy Manager, and Portainer features to the stack.

The Akeneo stack with Nginx, Nginx Proxy Manager, and Portainer are more secure, efficient, robust, and easy to maintain.

Let’s briefly understand the role of each component.

It is a simple yet highly customizable Product Information Management system and a core component of the stack. Akeneo can import data from virtually any source and manage it in a central repository. Akeneo provides user interaction to create, edit, and manage data.

It is a next-generation high-performance web server that reduces the load on Akeneo by serving static files and enhancing the overall stack performance.

It makes reverse proxy management simple by avoiding SSL complexity. It provides a web interface that is the easiest way to set up Nginx as a reverse proxy.  You can configure Nginx files without manual editing.

Nginx Proxy Manager automatically obtains and renews SSL certificates, redirects HTTP requests to HTTPS, and provides a secure connection to the Akeneo application.

You can manage the Docker containers, entirely from the web UI. You can manage Docker services, monitor Docker, manage volume, network, and various tasks using a clean web UI. For more information, you can check Portainer page.

In this tutorial, we will show you how you can easily integrate all these tools using the Akeneo stack (Akeneo) in just a few clicks. Akeneo stack removes the complexity of configuring all these tools manually, and it is the fastest method of deployment to save time and avoid errors.

Login into your https://try.direct/ account and click on Akeneo stack. On Akeneo Stack, click on the “Deploy to” option.

Select the cloud provider of your choice from the list.

For this tutorial, we use Linode, When you click on the Linode option from the list you will see a screenshot similar to the one below:

Provide your domain name and Linode’s API token, then click on the “Applications” option:

Enable Nginx, Nginx Proxy Manager, and Portainer CE Features.

Next, if you wish, you can select Subscriptions from the “Server Health & Security”. Options.

You can select the data center closest to you and the hardware configuration and OS image on which the stack will be deployed.

Next, click on the Deploy button, and your deployment starts on the Linode. You will be redirected to the next page, where you can check the detailed logs of the stacks.

Once the deployment has been completed, you will see a screenshot similar to the one below:

An email has been sent to your email ID containing the “PEM” key to access the server and other useful information. Kindly save this email to a safe place, as TryDirect will not save sensitive information.

Next, log into the Portainer to identify the hostname that should be configured in the Nginx Proxy Manager. The Portainer URL and credentials are mentioned in the PDF file attached to the email.

Open https://Portainer_url into the web browser:

In our case, it is http://example.com:9000

Enter the Username and Password and press the Login button, and you will log into your Portainer.

Navigate to the "Environments" section and select “local-agent” as shown in the screenshot below:

Once you click on local-agent, you will see a Dashboard that contains various information about your docker infrastructure.

Click on the stacks, and you will see all the applications that you have selected at the time of stack deployment.

In our case, nginx will work as a reverse proxy of Akeneo. Note down the hostname “nginx” we must configure in Nginx Proxy Manager.

Next, open Nginx Proxy Manager by navigating to http://<your_server_public_ip>:81 in your browser and enter the following credentials:

Once, you log in to the Nginx Proxy Manager, change your username and password.

Now, configure the “Proxy Host” from the Nginx Proxy Manager dashboard to route your traffic.

Click on the “Add Proxy Host” button as shown in the screenshot below:

It will open a “New Proxy Host” pop-up where you need to provide the mandatory details:

Domain Names: Specify the domain name you acquired from your domain provider.

Forward Hostname / IP: The hostname or IP address of the target application. In our case, it is Nginx.

Forward Port: This is the port on which application traffic is forwarded, we have nginx reverse proxy, so the

`port should be 80, but it might be different according to the application you have configured.

This guide demonstrates how to enhance the Akeneo Product Information Management (PIM) system by integrating it with Nginx, Nginx Proxy Manager, and Portainer, resulting in a more secure, efficient, robust, and maintainable setup. Components Overview:      Akeneo: A customizable PIM system that imports, manages, and centralizes data.     Nginx: A high-performance web server that handles static files to reduce Akeneo's load.     Nginx Proxy Manager: Simplifies reverse proxy management and SSL configuration through a user-friendly web interface.     Portainer: A web UI for managing Docker containers, services, volumes, and networks.

Nginx Proxy Manager is a user-friendly software application designed to effortlessly route traffic to your websites, whether they're hosted at home or elsewhere. It comes equipped with free SSL capabilities, eliminating the need for extensive Nginx or Letsencrypt knowledge. This tool proves especially handy for simplifying SSL generation and seamlessly proxying your docker containers.

Nginx Proxy Manager stands as an optional but highly recommended companion application. Its inclusion is particularly beneficial when managing multiple web applications in the backend. We also recommend to include Portainer CE.

Once the deployment is complete, you need to configure the proxy host in the Nginx Proxy manager.

At First, you need to associate your domain name with the public IP of your new server!

Open http://<your_server_public_ip>:81 in your browser and enter the following credentials:

2. Next, log in to Portainer to identify the hostname to be used for proxying traffic. (You should receive the link to Portainer and the credentials in the email attached within the PDF file.)

3. Upon accessing Portainer, navigate to the "Environments" section and select "local." 

Here, you will find a list of all applications deployed with Docker. In our case, our target is the "simple-flask" application, so click on it.

Note the required hostname, in our case, it's "flask-app," and observe that it operates on port 5000. Your specific application might use a different hostname and port configuration, depending on your chosen exposed application.

5. The next step involves routing traffic to the chosen application through the Nginx Proxy Manager. While logged into Nginx PM, navigate to "Proxy Hosts."

6. Click on the "Add Proxy Host" button and provide the necessary details:

Domain Name (the domain name you acquired from your domain registrar)

Redirect Host Name/IP (the hostname of the target application you want to connect)

Redirect Port (for our case, it's 5000; however, if you use Nginx as a web server, it's likely port 80)

     If everything is correctly configured, your proxy host's status should display as "ok."

8. Proceed to visit your website using the designated domain name.

9. Should you wish to implement SSL (for availability via the HTTPS protocol), modify your proxy host settings and add SSL to it.

10. Please be cautious: You need to associate your domain name with the public IP of your site first. This can be accomplished on your domain registrar's website by modifying the "A" record value to match your new server's IP address.

Nginx Proxy Manager

Status Panel is a minimalistic open-source web application for efficient docker container management. Nothing redundant, only the most necessary features to operate your docker containers quick and easy. The software is written in Python/Flask.

GitHub: https://github.com/trydirect/status

Status Panel

Netdata is a highly scalable metrics monitoring, troubleshooting & management agent. It works in real time, collecting metrics from:

Netdata makes the metrics visualization, complex performance issues troubleshooting, and data interoperability quick and easy.

Check here what features are declared by Netdata creators:

the agent uses only 1% CPU of a single core

Netdata works with minimal disk I/O (only historical metrics written and error and access logs read).

No breaks. Netdata operates on servers of any type, edge/IoT devices, containers, and cloud deployments permanently.

No configuration and maintenance are needed.

No preparation or security measures are required for installation on your systems mid-incident.

No sudo required to install Netdata on Debian, Ubuntu, CentOS, Kubernetes, Docker, macOS, FreeBSD, and more.

Multiple operating modes: from autonomous host monitoring to central multi-host monitoring, collection, and storage.

Netdata

The web app stack deployed via TryDirect consist mainly of docker containers. Portainer is currently the most convenient tool to efficiently manage them.

You can control your machine’s Docker resources via a web interface. This means images, volumes, containers, and networks intuitive visualization.

Portainer is a universal tool in terms of the environment it works in. You can deploy it to Swarm, K8s, Azure ACI, Kubernetes (added in the 2.0 version), or Docker equally well, be that in the cloud, at the edge, or on-prem.

Portainer provides numerous governance and control tools and solutions, like:

Easy and secure deployment, management, and troubleshooting of containerized apps through a powerful GUI. Deep Kubernetes expertise is not needed.

Self-service container management system creation. You can increase your software productivity and reduce errors by building streamlined, automated workflows based on Git.

Software delivery automation with GitOPS integration.

Container environment security provision with RBAC.

These options make centralized management and multi-cluster environments security possible for the platform managers.

Portainer

phpMyAdmin is a free and open-source software tool that is easy to set up. It is created for MySQL or MariaDB database server administration and supports most database management system operations. You can manage databases, tables, columns, indexes, users, relations, permissions, and others via the intuitive web interface or directly execute any SQL statement.

phpMyAdmin has a stable and flexible codebase created by multiple contributors from the global PHP community.

CSV, SQL, XML, PDF, ISO/IEC 26300 - OpenDocument Text and Spreadsheet, Word, LATEX data export

databases, tables, fields, and indexes maintenance, creation, browsing, copying, dropping, remaining and altering

SQL-statement, incl. even batch-queries execution, edition, and bookmark

MySQL user accounts and privileges management

stored procedures and triggers management

Query-by-example (QBE) complex queries creation

For security purposes, TryDirect recommends that you first stop (pause) the phpMyAdmin container and then start it as necessary. This can be done by using Portainer or the Status Panel.

Deploy LAMP stack with phpMyAdmin included for free

phpMyAdmin

WEB TOOLS

It is important to be able to find out your server's public IP address right from the terminal while working on remote server. Check the article below, to learn how to discover your system or Server's Public IP address from the Terminal on Linux.

Нou can find your server's public IP address y using the host command:

Using domain server:
Name: resolver1.opendns.com
Address: 2620:119:35::35#53
Aliases:

myip.opendns.com has IPv6 address 2400:6180:100:d0::8e9:c001

If you want to get an IPv4 address using the host command, you can add the “-4” option to it.

Using domain server:
Name: resolver1.opendns.com
Address: 208.67.222.222#53
Aliases:

myip.opendns.com has address 143.110.250.111

You can use the grep command to filter only IPv6/IPv4 by running the following command:

The dig command is one of the easiest methods to find the public IP address of your server.

You can execute any of the commands below to find your system IP address.

You can specify the IP version as shown in the below example:

Kindly note that you can use the "-4" option with dig for IPv4 and the "-6" option  for IPv6 in case you want to get a specific IP version.

Wget is a powerful command-line downloader available on most Linux distributions. The wget command allows you to find the public IP address of your system by using it with third-party websites, as shown below:

Just like the wget commands, you can use the curl command with a third-party service to find the public IP address of your system.

Below are some third-party services you can use with the curl command:


Now you can easily discover your system's public IP address using Terminal on Linux. 

Do we miss something useful?  Send it to us, use the contact us form or Join our discord channel and consult with our tech experts.


Need expert's service? Get system administration help from our partners

Ho to find out your server's public IP address right from the terminal 

Find the public IP address from the terminal

Simple Firewall  - is a set of iptables rules that deny SSH access to everybody except the network range IP’s defined in the text field below. Let’s call it admin’s IP. By default, the admin's IP is detected automatically and the range is calculated based on it. Most Linux distributions have pre-installed iptables, which means Simple Firewall will not install any additional software packages on the user’s server.

Attackers' activity is usually rising right after a new VPS server is created. They often look for web applications with default admin credentials, unfinished setups, admin tools, open ports and so on. “Simple Firewall” rules were implemented and offered to protect the newly created server from various attacks like brute force attacks.

TryDirect also offers administration tools for server management purposes: Status Panel, Portainer, and Monitoring tools like Netdata, PHPMyAdmin.

Even administration tools are password-protected. This enables the“Simple Firewall'' feature to make administration tools accessible only from the specified admin's IP network. Disabling “Simple Firewall” makes admin login form public, visible for all.

Admin’s IP range can be changed to any other IP address range (e.g. 1.1.1.0/24).

Simple Firewall

tcpdump is a network packet sniffer that can capture and filter various types of traffic, including TCP, UDP, and ICMP. It is a widely used command-line tool for network monitoring and debugging, and is installed by default on many Unix/Linux distributions.

With tcpdump, you can capture live traffic and save it to a file for future analysis. The captured data is saved in pcap format, which can be read by tcpdump itself or GUI tools like Wireshark.

Tcpdump is commonly used for system security checking, penetration testing, network troubleshooting, and more. In short, it is a Swiss army knife for system administrators, network engineers, and security professionals.

This guide will provide you with the basics and practical examples of the tcpdump command.

It is recommended to run the tcpdump command with root user privileges. The tcpdump command will continue to run until you press Ctrl+C to terminate it.

The following is the tcpdump command syntax in short:

When you run tcpdump with no filters, it will show you all the packets flowing through the default interface.

You can list all the interfaces of your server by running the following command:

1.eth0 [Up, Running]
2.eth1 [Up, Running]
3.lo [Up, Running, Loopback]
4.any (Pseudo-device that captures on all interfaces) [Up, Running]
5.bluetooth-monitor (Bluetooth Linux Monitor) [none]
6.nflog (Linux netfilter log (NFLOG) interface) [none]
7.nfqueue (Linux netfilter queue (NFQUEUE) interface) [none]

You can capture all packets from all interfaces by using any interface:

For better understanding, You should use the interface name using the -i option:

For more detailed output, you can use the -v or -vv options:

You can limit the tcpdump command output using the below command:

By default, tcpdump does the DNS resolution. You can disable name resolution by using the option -n and port resolution with -nn:

This option is very useful while troubleshooting network issues.

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
14:56:10.085238 IP 172.18.1.48.22 > 172.18.1.250.59860: Flags [P.], seq 475071168:475071392, ack 2781200040, win 501, length 224
14:56:10.085526 IP 172.18.1.48.22 > 172.18.1.250.59860: Flags [P.], seq 224:416, ack 1, win 501, length 192
14:56:10.085631 IP 172.18.1.48.22 > 172.18.1.250.59860: Flags [P.], seq 416:576, ack 1, win 501, length 160
14:56:10.085760 IP 172.18.1.48.22 > 172.18.1.250.59860: Flags [P.], seq 576:736, ack 1, win 501, length 160
14:56:10.085860 IP 172.18.1.48.22 > 172.18.1.250.59860: Flags [P.], seq 736:896, ack 1, win 501, length 160
5 packets captured
5 packets received by filter
0 packets dropped by kernel

You can capture packets with properly readable timestamps using the tcpdump -tttt option:

tcpdump: verbose output suppressed, use -v or -vv for full protocol decode
listening on any, link-type LINUX_SLL (Linux cooked v1), capture size 262144 bytes
2022-03-27 15:20:25.081838 IP 172.18.1.48.22 > 172.18.1.250.50472: Flags [P.], seq 3309433839:3309434063, ack 2385369981, win 501, length 224
2022-03-27 15:20:25.082165 IP 172.18.1.48.22 > 172.18.1.250.50472: Flags [P.], seq 224:432, ack 1, win 501, length 208
2022-03-27 15:20:25.082350 IP 172.18.1.48.22 > 172.18.1.250.50472: Flags [P.], seq 432:608, ack 1, win 501, length 176
3 packets captured
3 packets received by filter
0 packets dropped by kernel

tcpdump prints output in one line for each packet. Its syntax looks like this:

[Timestamp] [Protocol] [Src IP].[Src Port] > [Dst IP].[Dst Port]: [Flags], [Seq], [Ack], [Win Size], [Options], [Data Length]

When you type the tcpdump command, you will get output as shown in the below example:

18:13:17.425434 IP app.4436 > 157.32.66.94.45896: Flags [P.], seq 696:749, ack 632, win 3372, options [nop,nop,TS val 2489039195 ecr 16819361], length 53

18:13:17.425434 - It is the timestamp of the captured packet as per the system timezone.

app.4436 - hostname or IP with port number, separated by a dot (.).

157.35.66.94.45896 - destination hostname or IP and port number, separated by a dot (.).

Flags [P.] -  It is TCP Flags. It shows the state of the connection. In this example, [P.] means Push Acknowledgment packet.

win 3372 - It means the number of available bytes in the receiving buffer.

options [nop,nop,TS val 2489039195 ecr 16819361] - TCP options.

length 53 - The length of the data payload.

Using tcpdump Filters, you can find exactly what you are looking for. For example, when troubleshooting issues related to an FTP server, you can use filters to get only FTP traffic. Filters give you a clear idea of what exactly is going on on your server. The most used tcpdump filters are: port, protocol, host, src, dst, tcp, udp, icmp.

You can filter packets using a service name or port with the port filter. For example, you want to capture packets related to the SSH service:

tcpdump

DNS propagation is the time frame in which DNS modifications are being renewed over the Internet. Modifying DNS records (such as swapping the IP address specified for a particular hostname) typically takes some considerable time. It can take up to 72 hours before propagating globally. These DNS propagation times are awkward or simply inadmissible in several modern use cases.

If an IP address or other knowledge about a hostname is added or modified in a DNS record, the change must be applied to all systems in the world competing in the DNS process. When a customer completes a DNS query and reaches a system where changes have not yet been generated, the user gets the old address. That indicates the change has not propagated to that user.

There is one issue with DNS propagation. It is effective and, at the same time, one of the weakest sections. Propagation is not complete as long as you have a vast global series of DNS servers and local DNS resolvers, and a part of the chain controls the existing DNS information.

Propagation is a problem but not that intractable. Next-generation DNS base can reduce DNS propagation period from days or hours to seconds.

Why does DNS propagation take so long? Three factors affecting propagation time:

TTL is a period of time for which a query is stored in the cache of your local system or remote DNS server before the DNS resolver can request a new one. At the end of this period, DNS data from the local system is replaced by updated information, newly gathered by the DNS resolver. The lower the TTL, the quicker the propagation rate.

For example, the TTL is set to be 60 minutes. The servers in the system will continue to use old information for an hour, and it will be shown to all the website visitors in this period. Then, the local server will delete this data and create a new DNS request to get the updated information flow.

DNS propagation is a very good thing, yeah

Dashboard

TryDirect explains

WEB TOOLS

LINUX/UNIX CLI