Zhang Peng's Blog

A server that must serve traffic long-term cannot have a floating IP: the moment a DHCP lease renews and the address changes, remote access, DNS resolution, and firewall whitelists all break with it. This post records the complete approach to static IPs on the RHEL 9 family (Rocky Linux 9) — how to configure a single NIC, which connection becomes the default egress with multiple NICs, how to steer traffic for specific subnets onto a designated NIC, and the two places most likely to blow up. E...

When a high-load server’s disk I/O saturates, besides buying hardware there is one kernel parameter worth trying: the I/O request queue length nr_requests. It decides how many requests each block device can queue at once; with a larger value, the disk scheduler has more room to work with in multi-tasking scenarios, and latency often comes down. This post records how to view and adjust it on Rocky 9 — viewing, adjusting, and verification were all tested in a Rocky 9.3 container, and ...

When MySQL crashes and the instance won’t start, and you have no logical backup, the files in the data directory are the last straw you can grab: .frm holds the table structure, .ibd holds table data and indexes (one per table under InnoDB’s file-per-table mode). As long as those two files survive, you can attach them to a fresh instance and fish the data out. This post runs the entire recovery chain in a mysql:8.0 container — what can be recovered, what happens when a step goes out of order,...

Want to know who is visiting your site right now, what the traffic pattern looks like, and whether there are abnormal requests — GoAccess answers straight from the logs. It’s an open-source web log analysis tool: no database, no agent on the server; one command reading Nginx/Apache access logs produces the statistics — terminal UI, HTML report, and JSON are all supported, and --real-time-html mode even refreshes the report along with the logs in real time. This post organizes its usage b...

When troubleshooting Nginx performance problems or abnormal exits, the first step is usually figuring out what its internal processes are actually doing. It helps to picture Nginx’s process structure as a restaurant: the manager (master) never cooks — they handle scheduling, menu review, and hiring and firing; several chefs in the back kitchen (worker) each mind their own stove, and every dish a customer orders comes from their hands; plus two part-time storeroom keepers who only show up when...

Nginx config files run deep with nesting and blocks; a single site routinely unfurls into dozens of lines of location. Without syntax highlighting, low-grade mistakes like an unclosed quote or a mismatched brace are hard to spot at a glance, and when nginx -t complains you have to hunt through the file line by line. This post gives editor-specific instructions for turning highlighting on: VS Code is a one-click install from the extension marketplace; Vim gets a 30-second recognition health ch...

Even after a site moves to HTTPS, people will still scan port 443 using the bare IP—such requests carry a Host that isn’t your domain and should be rejected at the handshake stage. This post records the complete process of setting up HTTPS on Nginx while blocking IP access, including one config pitfall hit during testing: the if + && Host-check style simply cannot pass Nginx’s syntax check, and the correct approach is a default_server catch-all that refuses the handshake. Everything w...

The moment an application behind Nginx starts responding slowly, timeout problems follow: the user sees a 504 after a spinning page, and the logs show a line of upstream timed out. But Nginx has more than a dozen directives with “timeout” in the name — without a clear picture of which parameter governs which segment, tuning is a coin toss. This post places keepalive_timeout and the three proxy_* timeout parameters into the complete path of a single request, provides a baseline configuration f...

Load balancing means spreading traffic across multiple servers: better resource utilization, higher throughput, and no single machine getting knocked over. Nginx does both: Layer 7 (HTTP) works out of the box, Layer 4 (TCP/UDP) comes via the stream module. This post runs both kinds of load balancing at once in an nginx:1.28 container — the same set of backends, two entry points — and shows exactly where their distribution behavior and capability boundaries differ. Lab Environment Docker ...

Malicious users or automated scripts hammering a site will at best degrade the experience and at worst exhaust server resources. Nginx’s limit_req controls client request rates right at the proxy layer, stopping abusive traffic before it reaches the backend. This post runs three controlled experiments in an nginx:1.28 container to measure the behavior of the rate, burst, and nodelay parameters — how many requests each combination rejects and how much delay it adds. The data speaks for itself....