Zhang Peng's Blog

When you compile OpenResty yourself and want to use the OpenSSL already installed on the system (say, under /usr/local/openssl), the configure or make stage often fails outright complaining that OpenSSL cannot be found — missing headers, a nonexistent config script, or missing library files, with the error taking different shapes. This is not because OpenSSL is not installed; it is because the semantics of the --with-openssl option are not what you assume. This article fully reproduces and fi...

Upgrading Nginx normally means restarting the service, and the connections being processed go down with it. The hot upgrade takes a different path: the USR2 signal runs the old and new master processes side by side, the new version takes new traffic, and the old version finishes the requests in hand before exiting — no downtime throughout. OpenResty’s hot-upgrade flow is exactly the same. This post runs the entire signal flow in a container — upgrade, verification, rollback — plus one real pi...

When intranet servers can’t reach public YUM repositories, patching and installing software are left without a fallback. The fix: collect the RPM packages onto one server, generate repository metadata with createrepo, and publish it over HTTP with OpenResty — clients need nothing more than a repo file pointing at that server, and dnf install behaves exactly as it would against a public mirror. This post walks the entire flow end to end on a Rocky Linux 9.3 container, with CentOS 7 era differe...

Tracking down “who is holding this port, and where is the program installed” is a daily ops routine: the alert carries only a port number, and you have to find the process and the deployment directory before you can go read the logs. This post gives a one-shot little script: pass in a port number, get the PID and the process’s working directory directly, with every step of the pipeline explained as it goes. Verified environment: Rocky Linux 9 container (net-tools 2.0, pwdx from procps-ng). B...

The original post was an operational record of installing MariaDB on CentOS 7.6 in 2023. CentOS 7 stopped receiving maintenance in June 2024, so this article has been rewritten around what was actually tested: installation, the grant SQL, and remote connection were all re-run and verified on a dual-container Rocky Linux 9.3 (MariaDB 10.5.29) environment, while the original CentOS 7.6 environment details are kept for comparison — the behavioral differences between the two generations (includin...

When files must be shared across multiple Linux machines, NFS is one of the least-fuss solutions: the server exports a directory, the client mounts it as a local path, and reads and writes feel just like working on a local disk. This post walks the complete NFS chain on Rocky Linux 9 — install, export, service startup, client mount, and cross-machine read/write — with the server and client each running in a rockylinux:9 container (custom subnet on the same host). All output below comes f...

When the system’s built-in OpenSSH/OpenSSL is outdated and has known vulnerabilities, and the software repos offer no newer version, compiling from source is the most direct fix. This post records the complete build-and-upgrade procedure for OpenSSH 9.5p1 and OpenSSL 3.1.4, reproduced end to end in a Rocky Linux 9.3 container, along the way hitting a RHEL 9-specific pitfall: a freshly compiled older sshd cannot read el9’s crypto-policies configuration. The biggest risk in this kind of op...

A complete record of installing OpenResty 1.31.1.1 from source on AlmaLinux 9.8. OpenResty officially provides a dnf/yum repository, but when the software needs to go into a custom directory (this post installs to /apps/openresty), or when the environment can’t reach external repositories, a source install gives you more control — all artifacts live under one prefix directory, so upgrades, rollbacks, and clean removals never touch the rest of the system. How to choose between the two app...

Once SaltStack is installed, the thing you use most day to day is remote execution: one command makes a batch of Minions work at the same time. This post takes remote execution apart — how a command is structured, how to pick out the target machines (Targeting), which modules are commonly used, how return data lands in external systems (Returner), and finally how to write a module yourself. Every command was actually run and passed on a Rocky Linux 9 two-container cluster (Salt 3005.4; see th...

Running commands and pushing configuration across a fleet of machines one SSH session at a time is clearly not realistic. SaltStack exists for exactly this scenario: with a Master/Minion architecture, the control node can reach hundreds or thousands of machines in seconds. This post builds a SaltStack setup from scratch on two Rocky Linux 9 containers — installing the Master and Minion, writing minimal configuration, completing key authentication, and verifying communication with the sal...