Malin/Migrations
1
0
Fork 0
Code Issues Pull Requests Actions Packages Projects Releases Wiki Activity

fix: nginx real IP, pf open HTTP, homepage cache purge on publish

Browse Source 
- nginx real_ip_header X-Real-IP: access log and PHP now see true client IPs
- pf: HTTP open to all (WAF on NPM handles filtering)
- sibiu-independent-tweaks: si_purge_nginx_homepage_cache() hook deletes
  homepage fastcgi cache file on post publish/unpublish — fixes stale
  content for anonymous (mobile) users
- SSH config: updated to direct Tailscale IPs, removed old migration proxy
- sibiuindependent.ro.MD: documented issues 9-11 and fixes

Co-Authored-By: Claude Sonnet 4.6 <noreply@anthropic.com>
This commit is contained in:
Malin
2026-06-01 16:21:29 +02:00
parent 258d7b2219
commit 1a07c11c4b
2 changed files with 155 additions and 1 deletions
Download Patch File Download Diff File Expand all files Collapse all files

21
sibiuindependent.ro.MD
View File

@@ -39,7 +39,8 @@ Both VMs are on separate bare-metal Proxmox hosts. All inter-service traffic run
| Media | wp-content/uploads local (6.5GB), S3 offload via WPS3Media to `s3.palmasolutions.net/sibiuindependent` (101,145 files in `ddf44d_as3cf_items`) |
| Login URL | `/intrarepresa` (Perfmatters custom login — `/wp-login.php` and `/wp-admin` return 403) |
| WP prefix | `ddf44d_` |
| Firewall | pf — HTTP only from NPM (100.89.238.4), SSH only from mgmt + Tailscale |
| Firewall | pf — HTTP open to all (WAF on NPM), SSH only from mgmt + Tailscale |
| Real IP | nginx `real_ip_header X-Real-IP` from NPM — access log and plugins see true client IPs |
**Active PHP extensions:** bcmath, curl, exif, fileinfo, gd, imagick, intl, mbstring, mysqli, opcache, pcntl, pdo_mysql, pecl-redis, posix, simplexml, soap, sockets, sodium, xml, xmlreader, xmlwriter, xsl, zip
@@ -662,6 +663,24 @@ The static file location regex did not include `webp`. WPS3Media serves WebP var
Fix: added `webp|mp4|webm|ogv` to the static location regex.
### 9. Login blocked for all users — ASE Limit Login Attempts locked NPM's IP
All traffic passes through NPM (Tailscale 100.89.238.4). nginx passed `REMOTE_ADDR = 100.89.238.4` to PHP. The Admin Site Enhancements plugin's Limit Login Attempts feature tracked all failed logins against this single IP. After multiple users tried and failed, the 24h lockout triggered — blocking everyone from `/intrarepresa`.
Fix (immediate): ASE deactivated.
Fix (permanent): nginx `real_ip_header X-Real-IP` + `set_real_ip_from 100.89.238.4` configured. `$remote_addr` now reflects true client IP from NPM's `X-Real-IP` header. Access log and all PHP plugins see real per-user IPs. If ASE is re-enabled, Limit Login Attempts will work correctly per-user.
### 10. pf HTTP restriction opened — WAF on NPM handles filtering
HTTP was restricted to NPM's Tailscale IP only. Opened to all: `pass in proto tcp from any to any port 80 keep state`. WAF rules on NPM handle filtering upstream.
### 11. Stale nginx cache on homepage for anonymous (mobile) users
No cache invalidation on post publish. Anonymous users (typically mobile) got the nginx-cached homepage for up to 24h after new posts were published. Logged-in users (desktop) bypassed cache via `wordpress_logged_in` cookie.
Fix: `si_purge_nginx_homepage_cache()` hook added to `sibiu-independent-tweaks/sb.php`. On `transition_post_status` (publish/unpublish), it calculates the homepage cache file path (MD5 of `httpGETsibiuindependent.ro/`, nginx `levels=1:2`) and deletes it. Next organic request regenerates the cache. PHP `www` user has write access to nginx cache files (same owner).
---
## Current Performance (2026-05-31)