Scalable Stories

Technical Briefing: RADIUS Authentication for NGINX Problem Statement NGINX ships with no built-in RADIUS support. Organizations that centralize credentials in FreeRADIUS, Microsoft NPS, Cisco ISE, or Aruba ClearPass have had no way to make NGINX defer to that authority—leaving per-tool htpasswd files as the practical alternative. The nginx-module-auth-radius package from the GetPageSpeed repository closes this gap by adding per-request RADIUS authentication (RFC 2865) to NGINX. How It Works Th…

Technical Briefing: Closing the ECH Handshake-Size Side Channel in NGINX Problem Statement Encrypted Client Hello (ECH) encrypts the inner ClientHello—including the real SNI—and pads it. But the server's encrypted handshake flight (EncryptedExtensions, Certificate, CertificateVerify, Finished) still exposes its TLS record lengths on the wire. TLS 1.3 encrypts record contents but not lengths, and the dominant record is the certificate chain, which differs per virtual host. This means an observer…

Here is the technical briefing based on the provided source summary. --- Technical Briefing: Eliminating Legacy TLS Vulnerabilities and Achieving Post-Quantum Readiness in NGINX Problem Statement Four legacy TLS vulnerabilities—BREACH, Lucky13, SWEET32, and ROBOT—continue to dominate security scan reports for NGINX deployments. While the fixes are typically simple, they are often misapplied or missed due to configuration drift. Additionally, achieving post-quantum readiness requires specific so…

NGINX proxypass: URI Rewriting, Variables, and DNS Gotchas — Technical Briefing Problem Statement The proxypass directive in NGINX has several non-obvious behaviors around URI rewriting, DNS resolution, and configuration placement. Misunderstanding these behaviors leads to common production failures: double slashes in paths, concatenated URIs, HTTP 502 errors after backend IP rotation, and configuration load failures. The root causes are threefold: NGINX rewrites URIs only under specific syntac…

NGINX Directive Execution Order: The 11 Request Phases Problem Statement NGINX processes every request through a fixed pipeline of eleven phases. A directive does not run where it is written in the configuration file—it runs when its phase comes up in the pipeline. This explains common configuration "bugs" that are not actually bugs but rather misunderstandings of phase ordering. When a configuration behaves unexpectedly, reading the file top to bottom is the wrong approach; the correct questio…

Technical Briefing: NGINX Early Hints (HTTP 103) on Enterprise Linux Problem Statement HTTP Early Hints (status code 103) allows a server to send preliminary response headers—such as Link headers for render-blocking resources—before the final response, enabling browsers to begin fetching critical assets while the origin is still generating the HTML. This can significantly reduce Largest Contentful Paint (LCP) when the origin has real server-side think-time. However, the earlyhints directive, av…

Technical Briefing on tenantd Problem Statement CloudLinux offers enhanced tenant isolation features for servers, but it requires a forked kernel and incurs a monthly licensing fee. Users must also rely on CloudLinux's update schedule for kernel patches and security updates, which can introduce operational delays and additional costs. Implementation of tenantd tenantd is designed to provide similar tenant isolation features to CloudLinux without the need for a forked kernel. It achieves this by…

Trapping Bots With NGINX Honeypot v3

This podcast discusses **how to set up file permissions for websites running on NGINX and PHP-FPM**. It explains why it’s crucial to use separate user accounts for each website and for the web server. The episode delves into the **correct ownership and permissions for website files and directories**, and how to connect the website user […]

In this episode of Scalable Stories, we take a deep dive into the [NGINX Security Headers module](https://www.getpagespeed.com/server-setup/nginx/nginx-security-headers-module) by GetPageSpeed. Learn how this powerful NGINX module simplifies the process of adding essential security headers to your web applications. We’ll explore how it helps protect against common vulnerabilities, ensures compliance with best practices, and enhances your website’s […]