Forem: Edgaras

UML Deployment Diagrams

Edgaras — Thu, 09 Apr 2026 12:52:02 +0000

When designing complex software systems, understanding how your application components map to physical infrastructure is crucial. UML Deployment Diagrams provide a clear visual representation of how software artifacts are distributed across hardware and execution environments, making them essential for system architects, DevOps engineers, and development teams planning production deployments.

What is a UML Deployment Diagram?

A Deployment Diagram is a structural UML diagram that models the physical deployment of software artifacts onto hardware nodes and execution environments. It shows:

Hardware topology - The physical devices and servers that make up your infrastructure
Software placement - Which applications, libraries, and files run on which hardware
Network architecture - How different nodes communicate with each other
Execution environments - Runtime platforms like operating systems, containers, or virtual machines
Deployment configurations - How artifacts are configured and deployed in different environments

Why Use Deployment Diagrams?

Deployment diagrams are particularly valuable for:

Infrastructure planning - Design and document server topology before implementation
Cloud architecture - Model AWS, Azure, or GCP deployments with proper resource allocation
DevOps workflows - Communicate deployment strategies between development and operations teams
System documentation - Provide clear reference for how production systems are configured
Environment comparison - Visualize differences between development, staging, and production setups
Capacity planning - Identify hardware requirements and potential bottlenecks
Troubleshooting - Understand system architecture when diagnosing deployment issues

Core Components and Notation

Nodes

A Node is the fundamental building block of deployment diagrams, representing a computational resource where artifacts can be deployed. Nodes are drawn as 3D boxes (cubes) to distinguish them from other UML elements.

There are two primary types of nodes:

Device Nodes - Physical hardware resources marked with the «device» stereotype:

Servers, workstations, mobile devices, embedded systems
Any physical computing resource that can execute software
Examples: «server» Web Server, «mobile» iPhone, «pc» Developer Workstation

Execution Environment Nodes - Software platforms that provide runtime services, marked with the «executionEnvironment» stereotype:

Operating systems (Linux, Windows)
Runtime platforms (JVM, .NET Runtime, Node.js)
Containerization platforms (Docker, Kubernetes)
Application servers (Tomcat, nginx)

Execution environments are typically shown nested inside device nodes to represent the "runs on" relationship.

Artifacts

An Artifact represents a physical, deployable file or component in your system. Artifacts are drawn as rectangles labeled with the «artifact» stereotype. Optionally, a small document icon can be added in the upper-right corner for visual clarity.

Common artifact types include:

«executable» - Runnable programs (app.jar, server.exe, main.py)
«library» - Shared libraries (commons-lang.jar, libssl.so, react.dll)
«file» - Configuration or data files (config.yaml, application.properties)
«script» - Executable scripts (deploy.sh, Dockerfile, setup.py)
«document» - Documentation files (api-spec.pdf, README.md)
«source» - Source code files (Main.java, app.ts)

Artifacts are deployed to nodes using either:

Containment - Drawing the artifact inside the node box (implicit deployment)
Deploy dependency - A dashed arrow with «deploy» stereotype from artifact to node

Communication Paths

Communication Paths represent network connections between nodes, shown as solid lines connecting node boxes. They indicate that nodes can exchange information.

Communication paths can be labeled with:

Protocol information - Using stereotypes like «HTTP», «HTTPS», «TCP», «gRPC», «AMQP»
Port numbers - Showing which ports are used for communication
Connection names - Descriptive labels for the communication channel
Multiplicity - Numbers indicating how many connections exist

Example: A line labeled «HTTPS» port 443 connecting a Load Balancer to a Web Server.

Node Instances

While nodes represent types of computational resources, Node Instances represent specific running instances. The entire name (both instance name and type) is underlined in the format instanceName : NodeType.

Example: webServer01 : Ubuntu Server or prod-db-primary : PostgreSQL

The underline distinguishes instances (actual running systems) from node types (abstract architectural components).

Practical Example: Cloud Web Application

Let's model a typical web application deployed on AWS cloud infrastructure:

Infrastructure Components:

CloudFront CDN for content delivery
Application Load Balancer for traffic distribution
ECS (Elastic Container Service) for container orchestration
Two Docker containers: one for the web app, one for the API service
RDS PostgreSQL for relational data
S3 bucket for static assets (images, documents)

Key deployment relationships shown:

webapp.jar artifact deployed to web-container execution environment
api.jar artifact deployed to api-container execution environment
schema.sql artifact deployed to PostgreSQL database
static-assets/ deployed to S3 bucket
Communication paths showing HTTPS, HTTP, gRPC, and TCP connections with appropriate port numbers

Enterprise On-Premises Deployment

Traditional on-premises deployments can also be effectively modeled with deployment diagrams, showing physical hardware and network topology.

Scenario: Enterprise web application in a corporate data center

Infrastructure Components:

Hardware load balancer appliance for traffic distribution
Three web server machines running Apache
Two application server machines running JBoss
Primary and replica database servers
File server for shared storage
Network segmentation with DMZ and internal network

Node instances shown:

loadBalancer01 : F5 Load Balancer - Hardware load balancer in DMZ
webServer01, webServer02, webServer03 : Linux Server - Web tier servers in DMZ
appServer01, appServer02 : Linux Server - Application tier servers in internal network
dbPrimary : Oracle Server - Primary database server
dbReplica : Oracle Server - Read replica for reporting
fileServer01 : Windows Server - Shared file storage

This diagram clearly shows:

Physical server instances with specific names
Execution environments (Linux, JBoss, Apache, Oracle) nested within hardware
Network boundaries separating DMZ from internal network
Multiple instances for high availability
Communication paths with protocols and ports
Artifacts deployed to each tier

Best Practices

When creating deployment diagrams, follow these guidelines:

Start with the big picture - Begin with major nodes and communication paths, then add detail
Use appropriate stereotypes - Leverage standard UML stereotypes («device», «executionEnvironment») and create custom ones for cloud services when needed
Show execution environment hierarchies - Nest execution environments inside devices to show the full stack (e.g., Docker inside Linux inside AWS EC2)
Label communication paths clearly - Always indicate protocols and ports for network connections
Keep diagrams focused - Create separate diagrams for different environments (dev, staging, production) or architectural layers rather than cramming everything into one
Document artifact versions - When relevant, include version numbers with artifacts (api-v2.3.jar)
Indicate multiplicity - Show how many instances of nodes exist (e.g., 3 web servers behind a load balancer)
Use consistent naming - Follow naming conventions that match your actual infrastructure
Show dependencies clearly - Use deployment specifications to document configuration requirements
Update regularly - Keep deployment diagrams synchronized with actual infrastructure changes

Conclusion

UML Deployment Diagrams are indispensable for documenting and communicating how software systems are physically deployed across infrastructure. Whether you're planning a cloud migration, documenting microservices architecture, or troubleshooting production issues, deployment diagrams provide the clarity needed to understand the relationship between your software artifacts and the hardware they run on.

Using a Self-Hosted PDF OCR API with PaddleOCR

Edgaras — Sun, 22 Mar 2026 15:26:59 +0000

The problem

If you need to extract text from PDFs - especially large ones with 100+ pages - and don't want to pay for cloud OCR services or use LLM APIs on it, PaddleOCR can handle it locally on your own GPU.

paddleocr-pdf-api is an open-source Docker image that wraps PaddleOCR's vision-language model into a REST API. It runs on your GPU and lets you fetch results page-by-page as they're processed, without waiting for the entire document to finish.

When this is useful

Processing large volumes of PDFs - submit documents via API and process them one by one through a job queue
Sensitive documents that can't leave your network - everything runs locally, no external API calls
Large documents (100+ pages) - results stream page-by-page, so you can start consuming output before the full document is done
Integrating OCR into a pipeline - simple REST API that any language/tool can call
Less common languages - handles languages that many OCR tools struggle with

What's under the hood

Model: PaddleOCR-VL-1.5 (0.9B parameters)
GPU VRAM: ~8.5 GB
Output: Markdown (headings, tables, paragraphs) via JSON
Storage: SQLite + filesystem, persisted via Docker volume
Stack: FastAPI, PaddlePaddle GPU, pypdfium2 - single Python file

Setup

Requirements: Docker with NVIDIA Container Toolkit and a GPU with ~8.5 GB VRAM.

Create a docker-compose.yml:

services:
  paddleocr:
    image: edgaras0x4e/paddleocr-pdf-api:latest
    ports:
      - "8099:8000"
    volumes:
      - ocr-data:/data
    deploy:
      resources:
        reservations:
          devices:
            - driver: nvidia
              count: 1
              capabilities: [gpu]
    restart: unless-stopped

volumes:
  ocr-data:

docker compose up -d

Usage

Submit a PDF

curl -X POST http://localhost:8099/ocr -F "file=@document.pdf"

{
  "job_id": "994e7b398bb44d8ab5eade4d2ef57a15",
  "filename": "document.pdf",
  "status": "queued"
}

Poll progress

curl http://localhost:8099/ocr/994e7b398bb44d8ab5eade4d2ef57a15

{
  "job_id": "994e7b398bb44d8ab5eade4d2ef57a15",
  "status": "processing",
  "total_pages": 185,
  "processed_pages": 42
}

Fetch a single page (as soon as it's ready)

No need to wait for the entire document:

curl http://localhost:8099/ocr/994e7b398bb44d8ab5eade4d2ef57a15/pages/1

{
  "page_num": 1,
  "markdown": "## Chapter 1\n\nLorem ipsum dolor sit amet..."
}

Fetch all pages

curl http://localhost:8099/ocr/994e7b398bb44d8ab5eade4d2ef57a15/result

Returns the full document with a pages array containing each page's markdown.

List jobs, cancel, delete

# List all jobs
curl http://localhost:8099/jobs

# Cancel a running job
curl -X POST http://localhost:8099/ocr/{job_id}/cancel

# Delete a job and its data
curl -X DELETE http://localhost:8099/ocr/{job_id}

Full API reference

Method	Endpoint	Description
`POST`	`/ocr`	Upload a PDF
`GET`	`/ocr/{job_id}`	Job status and progress
`GET`	`/ocr/{job_id}/pages/{page_num}`	Single page result
`GET`	`/ocr/{job_id}/result`	All pages
`POST`	`/ocr/{job_id}/cancel`	Cancel a job
`DELETE`	`/ocr/{job_id}`	Delete job and its data
`GET`	`/jobs`	List all jobs

API key authentication

To restrict access, set the API_KEY environment variable:

environment:
  - API_KEY=your-secret-key

All requests then require the header:

curl -H "X-API-Key: your-secret-key" http://localhost:8099/jobs

Configuration

Variable	Default	Description
`API_KEY`	(empty)	Optional authentication key
`OCR_DPI`	`200`	DPI for PDF page rendering (higher = better quality, slower)
`DB_PATH`	`/data/ocr.db`	SQLite database path
`UPLOAD_DIR`	`/data/uploads`	Upload storage path

Example: integrating into a Python script

A minimal example that submits a PDF and waits for results:

import requests
import time

API = "http://localhost:8099"

# Submit
resp = requests.post(f"{API}/ocr", files={"file": open("scan.pdf", "rb")})
job_id = resp.json()["job_id"]

# Poll until done
while True:
    status = requests.get(f"{API}/ocr/{job_id}").json()
    if status["status"] == "completed":
        break
    if status["status"] == "failed":
        raise Exception(status["error"])
    print(f"{status['processed_pages']}/{status['total_pages']} pages done")
    time.sleep(5)

# Get results
result = requests.get(f"{API}/ocr/{job_id}/result").json()
for page in result["pages"]:
    print(f"--- Page {page['page_num']} ---")
    print(page["markdown"])

How it works

PDF is uploaded and saved to disk
A background worker picks up queued jobs sequentially
Each page is rendered to an image using pypdfium2
PaddleOCR-VL extracts text and converts it to markdown
HTML artifacts and image placeholders are cleaned from the output
Results are stored in SQLite and available per-page as they complete
Jobs interrupted by a container restart are automatically re-queued

Source: github.com/Edgaras0x4E/paddleocr-pdf-api
Docker image: hub.docker.com/r/edgaras0x4e/paddleocr-pdf-api

A Developer's Guide to Useful Apache Modules

Edgaras — Tue, 04 Nov 2025 04:45:16 +0000

Apache is one of the most widely used web servers, and its real power comes from its modular design.

Below is a practical, example-based guide to Apache modules that are useful in real-world web development.

How to Enable/Disable Modules

# Enable a module
sudo a2enmod module_name

# Disable a module
sudo a2dismod module_name

# Restart Apache
sudo systemctl restart apache2

`mod_rewrite` - URL Routing & Clean URLs

<VirtualHost *:80>
    ServerName example.com

    RewriteEngine On
    RewriteRule ^user/([0-9]+)/?$ /profile.php?id=$1 [L,QSA]
</VirtualHost>

Used for clean URLs, routing logic, SEO-friendly paths, and framework rewrites.

`mod_ssl` - HTTPS Support

<VirtualHost *:443>
    ServerName example.com

    SSLEngine On
    SSLCertificateFile /etc/ssl/certs/example.crt
    SSLCertificateKeyFile /etc/ssl/private/example.key
</VirtualHost>

Enables TLS/SSL so the site can run securely over HTTPS.

`mod_headers` - Security & Cache Headers

<IfModule mod_headers.c>
    Header always set X-Frame-Options "DENY"
    Header always set X-Content-Type-Options "nosniff"
    Header always set Referrer-Policy "no-referrer"
</IfModule>

Allows setting and modifying HTTP response headers for security and performance.

`mod_expires` - Browser Cache Control

<IfModule mod_expires.c>
    ExpiresActive On
    ExpiresByType text/css "access plus 7 days"
    ExpiresByType image/png "access plus 1 year"
    ExpiresDefault "access plus 1 hour"
</IfModule>

Adds automatic expiration headers so browsers can cache static files.

`mod_proxy` and `mod_proxy_http` - Reverse Proxy to Apps

<VirtualHost *:80>
    ServerName api.example.com

    ProxyPass / http://127.0.0.1:4000/
    ProxyPassReverse / http://127.0.0.1:4000/
</VirtualHost>

Forwards requests to backend services like Node, Python, Docker, or another server.

`mod_security` - Web Application Firewall

SecRuleEngine On
Include /usr/share/modsecurity-crs/*.conf

Blocks common attacks such as SQL injection, XSS, and RCE using rule sets.

`mod_status` - Live Server Status Page

<Location "/server-status">
    SetHandler server-status
    Require ip 127.0.0.1
</Location>

Displays live Apache metrics: active connections, workers, load, uptime.

`mod_auth_basic` and `mod_authn_file` - Simple Password Protection

<Location "/admin">
    AuthType Basic
    AuthName "Restricted"
    AuthUserFile /etc/apache2/.htpasswd
    Require valid-user
</Location>

Adds quick HTTP basic authentication without touching application code.

`mod_evasive` - Auto-Blocking for DDoS / Brute Force

<IfModule mod_evasive20.c>
    DOSHashTableSize 2048
    DOSPageCount 5
    DOSPageInterval 1
    DOSBlockingPeriod 30
    DOSEmailNotify admin@example.com
</IfModule>

Detects repeated requests and temporarily blocks abusive traffic automatically.

Additional Useful Modules

`mod_deflate` or `mod_brotli` - Response Compression

<IfModule mod_deflate.c>
    AddOutputFilterByType DEFLATE text/html text/css application/json
</IfModule>

<IfModule mod_brotli.c>
    BrotliCompressionQuality 6
    AddOutputFilterByType BROTLI_COMPRESS text/html text/css application/javascript
</IfModule>

Compresses responses to reduce bandwidth and speed up page loads.

`mod_pagespeed` - Auto Performance Optimizer

ModPagespeed on
ModPagespeedEnableFilters rewrite_css,sprite_images,collapse_whitespace

Automatically optimizes assets: minifies, inlines, rewrites, lazyloads, etc.

`mod_geoip` / `mod_maxminddb` - Geo-Based Rules

<IfModule mod_maxminddb.c>
    MaxMindDBFile COUNTRY_DB /usr/share/GeoIP/GeoLite2-Country.mmdb
    MaxMindDBEnv GEOIP_COUNTRY_CODE COUNTRY_DB/country/iso_code
</IfModule>

<Location />
    Require all granted
    Require not env GEOIP_COUNTRY_CODE=CN
</Location>

Allows country-based routing, blocking, redirects, or localization.

Summary

Module	Purpose / Use Case
`mod_rewrite`	URL routing, clean URLs, SEO-friendly rewrites
`mod_ssl`	Enables HTTPS/TLS encryption
`mod_headers`	Sets custom security and cache headers
`mod_expires`	Controls browser caching for static files
`mod_proxy`	Reverse proxy to backend apps/services
`mod_security`	Web Application Firewall (WAF)
`mod_status`	Live server metrics/status page
`mod_auth_basic`	Simple HTTP basic authentication
`mod_evasive`	Auto-blocking for DDoS / brute force requests
`mod_deflate` / `brotli`	Response compression for faster load times
`mod_pagespeed`	Automatic asset optimization (minify, inline etc.)
`mod_geoip` / `maxminddb`	Geo-based routing, blocking, or localization

Ethereum Integration in PHP for Wallets and Transfers

Edgaras — Mon, 06 Oct 2025 18:38:04 +0000

If you build backends in PHP and want to talk to Ethereum without pulling in a full Node stack, this library gives you a clean methods for the main functionality: wallet management, ETH transfers (legacy and EIP‑1559), balances, transaction queries, and utilities.

GitHub: Edgaras0x4E/Ethereum

What you can do

Wallets: Create/import wallets, derive address/public key
Transfers: Send ETH using legacy (Type‑0) and EIP‑1559 (Type‑2) transactions; wait for confirmations
Balances & network: getBalance, getBalanceInEther, getBlockNumber, getNetworkInfo
Transactions: getTransaction, getTransactionReceipt, getTransactionStatus, getTransactionDetails
Address activity: Scan recent blocks with getTransactionsForAddress
Blocks: Fetch transactions with getTransactionsByBlockNumber
Utilities: Unit conversion, checksum addresses, hex helpers, hashing

Requirements

PHP 8.3+
Extensions: gmp, bcmath
An Ethereum JSON‑RPC endpoint (Infura)

Install

composer require edgaras/ethereum

Quick start: create a wallet and read balance

<?php

use Edgaras\Ethereum\Ethereum;
use Edgaras\Ethereum\Wallet;

$rpcUrl = 'https://sepolia.infura.io/v3/YOUR_API_KEY';
$chainId = 11155111; // Sepolia

$eth = new Ethereum($rpcUrl, $chainId);

// Create a new wallet (or import with new Wallet('0xPRIVATE_KEY_HEX'))
$wallet = $eth->createWallet();
$eth->setWallet($wallet);

echo "Address: {$wallet->getAddress()}\n";
echo "Balance: {$eth->getBalanceInEther()} ETH\n";

Send ETH (legacy Type‑0)

use Edgaras\Ethereum\Ethereum;
use Edgaras\Ethereum\Wallet;

$eth = new Ethereum($rpcUrl, $chainId);
$eth->setWallet(new Wallet('0xYOUR_PRIVATE_KEY_HEX'));

$txHash = $eth->sendEther('0xRecipientAddress...', '0.01');
echo "tx: $txHash\n";

// Optional: wait for confirmation
$receipt = $eth->waitForConfirmation($txHash, maxAttempts: 60, delaySeconds: 2);
echo "included in block: {$receipt['blockNumber']}\n";

Send ETH with EIP‑1559 (Type‑2)

use Edgaras\Ethereum\Ethereum;
use Edgaras\Ethereum\Wallet;
use Edgaras\Ethereum\Utils;

$eth = new Ethereum($rpcUrl, $chainId);
$eth->setWallet(new Wallet('0xYOUR_PRIVATE_KEY_HEX'));

// Set EIP‑1559 gas parameters (in gwei)
$maxPriorityFeePerGasGwei = '2';  // 2 gwei tip
$maxFeePerGasGwei = '20';         // 20 gwei max fee

// Convert to wei hex
$maxPriorityFeePerGas = Utils::toHex(Utils::gweiToWei($maxPriorityFeePerGasGwei));
$maxFeePerGas = Utils::toHex(Utils::gweiToWei($maxFeePerGasGwei));

$txHash = $eth->sendEtherEIP1559(
    '0xRecipientAddress...',
    '0.01',
    $maxFeePerGas,
    $maxPriorityFeePerGas
);
echo "EIP‑1559 tx: $txHash\n";

Practical examples

Minimal wallet overview (balance + recent txs):

use Edgaras\Ethereum\Ethereum;
use Edgaras\Ethereum\Utils;

$eth = new Ethereum($rpcUrl, $chainId);
$address = '0xRecipientAddress...';

$balanceEth = $eth->getBalanceInEther($address);
echo "Address: " . Utils::toChecksumAddress($address) . "\n";
echo "Balance: $balanceEth ETH\n\n";

$txs = $eth->getTransactionsForAddress($address, maxBlocksToScan: 1500, maxTxToShow: 20);
foreach ($txs as $t) {
    echo sprintf("[%s] %s | %s ETH | peer: %s | block: %d\n",
        $t['direction'], $t['hash'], $t['valueEth'], $t['peer'], $t['blockNumber']
    );
}

List transactions in a block:

use Edgaras\Ethereum\Ethereum;

$eth = new Ethereum($rpcUrl, $chainId);
$blockNumber = 9354804; // example
$txs = $eth->getTransactionsByBlockNumber($blockNumber, limit: 10);

foreach ($txs as $i => $tx) {
    $idx = $i + 1;
    echo "#$idx\n";
    echo "  hash:  " . ($tx['hash'] ?? '') . "\n";
    echo "  from:  " . ($tx['from'] ?? '') . "\n";
    echo "  to:    " . ($tx['to'] ?? '') . "\n";
    echo "  value: " . ($tx['value'] ?? '0x0') . " (wei hex)\n\n";
}

Utilities you’ll actually use

use Edgaras\Ethereum\Utils;

// Unit conversion
$wei = Utils::etherToWei('1.5');
$eth = Utils::weiToEther('0x204fce5e3e250261100000000'); // hex or decimals
$gwei = Utils::weiToGwei('0x4a817c800');

// Address helpers
$isValid = Utils::isValidAddress('0x242d35Cc6634C0532925a3b8D4C9db96C4b4d8b6');
$checksum = Utils::toChecksumAddress('0x242d35cc6634c0532925a3b8d4c9db96c4b4d8b6');

// Hex helpers
$hex = Utils::toHex('255'); // 0xff
$dec = Utils::fromHex('0xff'); // 255

EIP‑1559 in practice (why it matters)

Better fee predictability and reduced overpayment when the network is quiet
Dynamic fee market: you set a max fee and a priority tip; the base fee adjusts
Typed transactions: EIP‑2718 with proper hashing (0x02 || RLP(list)) for sender recovery

Pick EIP‑1559 for modern fee markets; fall back to legacy for maximum compatibility.

Production tips

Keep your private keys out of source control; inject via env/config vaults
Monitor base fee and adjust maxFeePerGas/maxPriorityFeePerGas dynamically
Wrap RPC errors and rate limits; the library exposes clear exceptions
Use waitForConfirmation with sensible timeouts and backoff in worker jobs

Laravel Project Backup to Azure Blob with Bash Script

Edgaras — Mon, 25 Aug 2025 22:13:48 +0000

If you’re running a Laravel app and want an easy way to back it up to Azure Blob Storage without Docker images or third-party SaaS tools, here’s a self-contained Bash script that does exactly that.

It backs up:

Your Laravel project files (with exclusions like vendor/ and logs)
Your MySQL database (via mysqldump)
Packages everything into a .tar.gz
Uploads to Azure Blob Storage using az CLI
Cleans up local backups older than X days

Requirements

bash, tar, gzip, find
mysqldump (MySQL/MariaDB client)
Azure CLI

The Script

#!/usr/bin/env bash
set -Eeuo pipefail


# ---- Paths ----
LARAVEL_DIR="/path/to/laravel/project" # Path to your Laravel project root
BACKUP_DIR="/path/to/local/backup/directory" # Local backup directory  

# ---- Azure Storage (account + key) ----
AZURE_STORAGE_ACCOUNT="<ACCOUNT_NAME>"
AZURE_STORAGE_KEY="<ACCOUNT-KEY>"
AZURE_CONTAINER="<CONTAINER-NAME>"

# ---- Retention (local only) ----
RETAIN_LOCAL_DAYS=7

# ---- Backup content exclusion ----
EXCLUDES=(
  "vendor"
  "node_modules"
  "storage/framework/cache"
  "storage/logs"
  ".git"
)

#############################################

timestamp_utc() { date -u +"%Y%m%dT%H%M%SZ"; }

require_cmd() {
  command -v "$1" >/dev/null 2>&1 || { echo "ERROR: Missing required command: $1" >&2; exit 1; }
}

read_env_var() {
  local key="$1"
  local val=""
  if [[ -f "$LARAVEL_DIR/.env" ]]; then
    val="$(grep -E "^${key}=" "$LARAVEL_DIR/.env" 2>/dev/null | tail -n1 | sed -E "s/^${key}=(.*)$/\1/" | tr -d '\r' || true)"
  fi
  if [[ -n "$val" && "${val:0:1}" == '"' && "${val: -1}" == '"' ]]; then
    val="${val:1:-1}"
  elif [[ -n "$val" && "${val:0:1}" == "'" && "${val: -1}" == "'" ]]; then
    val="${val:1:-1}"
  fi
  echo "$val"
}

dump_mysql() {
  local db_host db_port db_name db_user db_pass db_socket dump_path
  db_host="$(read_env_var "DB_HOST")"
  db_port="$(read_env_var "DB_PORT")"
  db_name="$(read_env_var "DB_DATABASE")"
  db_user="$(read_env_var "DB_USERNAME")"
  db_pass="$(read_env_var "DB_PASSWORD")"
  db_socket="$(read_env_var "DB_SOCKET")"
  dump_path="$1"

  require_cmd mysqldump

  db_host="${db_host:-127.0.0.1}"
  db_port="${db_port:-3306}"

  local args=( --user="$db_user" --single-transaction --quick --routines --events --triggers )
  if [[ -n "$db_socket" ]]; then
    args+=( --socket="$db_socket" )
  else
    args+=( --host="$db_host" --port="$db_port" )
  fi

  umask 077
  MYSQL_PWD="$db_pass" mysqldump "${args[@]}" "$db_name" > "$dump_path"
}

make_archive() {
  local src_dir="$1"
  local db_sql="$2"
  local out_tar_gz="$3"

  local stage
  stage="$(mktemp -d)"
  trap 'rm -rf "$stage"' RETURN

  mkdir -p "$stage/site" "$stage/db"

  pushd "$src_dir" >/dev/null
  local tar_excludes=()
  for e in "${EXCLUDES[@]}"; do
    tar_excludes+=( "--exclude=$e" )
  done
  tar -cf - "${tar_excludes[@]}" . | tar -C "$stage/site" -xf -
  popd >/dev/null

  cp "$db_sql" "$stage/db/database.sql"

  tar -C "$stage" -czf "$out_tar_gz" site db
}

upload_with_azcli() {
  local file="$1"
  AZURE_STORAGE_ACCOUNT="$AZURE_STORAGE_ACCOUNT" AZURE_STORAGE_KEY="$AZURE_STORAGE_KEY" \
    az storage blob upload \
      --container-name "$AZURE_CONTAINER" \
      --file "$file" \
      --name "$(basename "$file")" \
      --overwrite true >/dev/null
}

main() {
  [[ -d "$LARAVEL_DIR" ]] || { echo "ERROR: LARAVEL_DIR not found: $LARAVEL_DIR" >&2; exit 1; }
  mkdir -p "$BACKUP_DIR"

  local ts app_name base_name db_dump archive
  ts="$(timestamp_utc)"
  app_name="$(basename "$LARAVEL_DIR")"
  base_name="${app_name}-${ts}"
  db_dump="${BACKUP_DIR}/${base_name}.sql"
  archive="${BACKUP_DIR}/${base_name}.tar.gz"

  echo "[1/4] Dumping MySQL → $db_dump"
  dump_mysql "$db_dump"

  echo "[2/4] Creating archive → $archive"
  make_archive "$LARAVEL_DIR" "$db_dump" "$archive"

  echo "[3/4] Uploading to Azure via az CLI"
  upload_with_azcli "$archive"
  echo "Upload complete: $(basename "$archive")"

  echo "[4/4] Pruning local backups older than ${RETAIN_LOCAL_DAYS}d"
  find "$BACKUP_DIR" -type f -name "${app_name}-*.tar.gz" -mtime +"$RETAIN_LOCAL_DAYS" -print -delete || true
  find "$BACKUP_DIR" -type f -name "${app_name}-*.sql" -mtime +"$RETAIN_LOCAL_DAYS" -print -delete || true

  echo "Done."
}

main "$@"

How It Works

Database Dump
- Reads DB_HOST, DB_DATABASE, DB_USERNAME, DB_PASSWORD from .env
- Runs mysqldump
File Packaging
- Copies project files while excluding unnecessary directories
- Adds database.sql
- Compresses into tar.gz
Azure Upload
- Uses az storage blob upload with AZURE_STORAGE_ACCOUNT + AZURE_STORAGE_KEY
Retention Cleanup
- Deletes .sql and .tar.gz files older than RETAIN_LOCAL_DAYS

Usage

Save the script:

nano laravel-backup.sh
chmod +x laravel-backup.sh

Configure variables:

LARAVEL_DIR
BACKUP_DIR
AZURE_STORAGE_ACCOUNT
AZURE_STORAGE_KEY
AZURE_CONTAINER

Run manually:

./laravel-backup.sh

Or schedule with cron:

crontab -e
0 3 * * * /path/to/laravel-backup.sh >> /var/log/laravel-backup.log 2>&1

Efficiently Measure String Similarity in PHP Applications

Edgaras — Sun, 25 May 2025 15:26:36 +0000

Measuring string similarity accurately is important for tasks like detecting typos in user inputs, matching similar database entries, improving chatbot responses, and identifying duplicate content. PHP developers can simplify these tasks using specialized algorithms.

Installation

Include the library via Composer:

composer require edgaras/strsim

Then, use the Composer autoloader:

require __DIR__ . '/vendor/autoload.php';

Implementing Powerful String Similarity Algorithms

By using specialized classes, developers can easily integrate complex string similarity metrics:

Levenshtein: Ideal for detecting user input spelling mistakes in form validation.

use Edgaras\StrSim\Levenshtein;

$userInput = "recieve";
$correctWord = "receive";

$distance = Levenshtein::distance($userInput, $correctWord);
if ($distance <= 2) {
    echo "Did you mean '{$correctWord}'?";
}

Damerau-Levenshtein: Useful for correcting common keyboard typing errors in search features.

use Edgaras\StrSim\DamerauLevenshtein;

$distance = DamerauLevenshtein::distance("adress", "address");
if ($distance <= 2) {
    echo "Searching for 'address' instead.";
}

Hamming: Critical for error checking in transmitted binary data packets.

use Edgaras\StrSim\Hamming;

$errors = Hamming::distance("11001101", "10001111");
if ($errors > 0) {
    trigger_error("Data packet corrupted.");
}

Jaro: Ideal for short string comparisons and record matching.

use Edgaras\StrSim\Jaro;

$similarity = Jaro::distance("crate", "trace");
if ($similarity > 0.8) {
    echo "Highly similar words detected.";
}

Jaro-Winkler: Excellent for deduplicating customer records by comparing similar names.

use Edgaras\StrSim\JaroWinkler;

$similarity = JaroWinkler::distance("Jonathan Smith", "Jonathon Smyth");
if ($similarity > 0.9) {
    echo "Possible duplicate found.";
}

Longest Common Subsequence (LCS): Useful in text diff applications to detect common content.

use Edgaras\StrSim\LCS;

$length = LCS::length("contentversion1", "contentversion2");
echo "Common subsequence length: $length";

Smith-Waterman: Good for local alignment of DNA sequences in bioinformatics research.

use Edgaras\StrSim\SmithWaterman;

$alignmentScore = SmithWaterman::score("ACGTAG", "ACGACG");
if ($alignmentScore > $threshold) {
    echo "High genetic similarity detected.";
}

Needleman-Wunsch: Valuable for global alignment of DNA or protein sequences.

use Edgaras\StrSim\NeedlemanWunsch;

$score = NeedlemanWunsch::score("GATTACA", "GCATGCU");
echo "Alignment score: $score";

Cosine Similarity: Useful for comparing frequency patterns in short texts.

use Edgaras\StrSim\Cosine;

$similarity = Cosine::similarity("night", "nacht");
echo "Text similarity: $similarity";

Jaccard Index: Effective for comparing the overlap between sets of tokens.

use Edgaras\StrSim\Jaccard;

$index = Jaccard::index("token1 token2", "token2 token3");
echo "Token overlap: $index";

Monge-Elkan: Great for fuzzy matching of multi-word strings.

use Edgaras\StrSim\MongeElkan;

$similarity = MongeElkan::similarity("john smith", "jon smythe");
if ($similarity > 0.85) {
    echo "Likely match identified.";
}

Common Applications

Natural Language Processing: Improve chatbot accuracy by handling slight input variations.

Fuzzy Matching: Optimize database searches and user input validation.
Spell Checking: Implement typo tolerance in text entry fields.
Bioinformatics: Conduct detailed genetic sequence analyses.

By selecting the appropriate algorithm, developers can significantly enhance the reliability and responsiveness of their PHP applications dealing with textual or genetic data.

How to Reliably Mount a CIFS Share Using systemd on Boot

Edgaras — Fri, 25 Apr 2025 07:40:21 +0000

Mounting a CIFS share at boot via /etc/fstab can often lead to issues if the network isn't ready. A more reliable solution is to create a systemd mount unit that ensures the network is online before attempting to mount.

Here's how you do it:

Step 1: Create a credentials file

Create a file to store your SMB credentials:

sudo nano /etc/smb-credentials

With content:

username=your_username
password=your_password

Secure it so only root can read:

sudo chmod 600 /etc/smb-credentials
sudo chown root:root /etc/smb-credentials

Step 2: Create the mount point

Make the local directory where the CIFS share will be mounted:

sudo mkdir -p /mnt/nas_share

Step 3: Create a systemd mount unit

Run the following command to create or edit the mount unit:

sudo systemctl edit --force --full mnt-nas_share.mount

Paste the following content:

[Unit]
Description=Mount SMB Share
After=network-online.target
Wants=network-online.target

[Mount]
What=//nas.local/share
Where=/mnt/nas_share
Type=cifs
Options=credentials=/etc/smb-credentials,iocharset=utf8,nounix,noserverino,nofail,_netdev,soft,vers=3.0
TimeoutSec=30

[Install]
WantedBy=multi-user.target

Explanation:

[Unit]

Description=Mount NAS HDD Share: Human-readable description.
After=network-online.target: Ensures the mount waits for the network to be up.
Wants=network-online.target: Pulls in the network-online target if not already present.

[Mount]

What=//nas.local/share: UNC path to the CIFS share.
Where=/mnt/nas_share: Local mount point.
Type=cifs: Filesystem type.
Options=...: Mount options:
- credentials=...: Path to the credentials file (should be root-only readable). iocharset=utf8: Character encoding.
- nounix, noserverino: Workarounds for specific CIFS behaviors.
- nofail: Don’t block boot if the mount fails.
- _netdev: Marks this mount as requiring network.
- soft: Causes the mount to time out if the server is unresponsive.
- vers=3.0: Explicitly uses SMB version 3.0.
- TimeoutSec=30: Maximum wait time before systemd considers the mount failed.

[Install]

WantedBy=multi-user.target: Starts the mount at boot in multi-user mode.

Step 4: Enable the mount

After saving the unit file, reload and enable it:

sudo systemctl daemon-reexec
sudo systemctl daemon-reload
sudo systemctl enable mnt-nas_share.mount
sudo systemctl start mnt-nas_share.mount

These commands:

daemon-reexec: Ensures systemd itself is up-to-date.
daemon-reload: Reloads unit files.
enable: Enables the mount to persist across reboots.
start: Immediately mounts the share.

Step 5: Verify the mount

Check the status with:

sudo systemctl status mnt-nas_share.mount

You should see the share is mounted without errors.

Using this method ensures your CIFS mounts only attempt to initialize when the network is available, solving the common Permission denied opening credential file problem caused by early mount attempts during boot.

Setting Up MySQL and MongoDB Together in Laravel 12

Edgaras — Sun, 13 Apr 2025 21:05:00 +0000

Sometimes you need relational data for parts of your app (MySQL) and flexible document storage for others (MongoDB). Here's how to set up both in Laravel 12.

Install MongoDB PHP Extension

sudo apt install ext-mongodb

Install Required Composer Packages

sudo composer require mongodb/mongodb
sudo composer require mongodb/laravel-mongodb:^5.2 --with-all-dependencies

`.env` example

DB_CONNECTION=mysql
DB_HOST=127.0.0.1
DB_PORT=3306
DB_DATABASE=<CHANGE-TO-YOUR-MYSQL-DATABASE>
DB_USERNAME=<CHANGE-TO-YOUR-MYSQL-USERNAME>
DB_PASSWORD=<CHANGE-TO-YOUR-MYSQL-PASSWORD>

MONGODB_USERNAME=<CHANGE-TO-YOUR-MONGODB-USERNAME>
MONGODB_PASSWORD=<CHANGE-TO-YOUR-MONGODB-PASSWORD>
MONGODB_SERVER=127.0.0.1
MONGODB_PORT=27017
MONGODB_DATABASE=<CHANGE-TO-YOUR-MONGODB-COLLECTION>
MONGODB_URI="mongodb://${MONGODB_USERNAME}:${MONGODB_PASSWORD}@${MONGODB_SERVER}:${MONGODB_PORT}/${MONGODB_DATABASE}?directConnection=true&serverSelectionTimeoutMS=2000&authSource=admin&appName=mongosh+2.2.2?tls=false&authSource=admin"

`config/database.php`


use Illuminate\Support\Str;

return [

'default' => env('DB_CONNECTION', 'mysql'),

'connections' => [


'mysql' => [
    'driver' => 'mysql',
    'url' => env('DB_URL'),
    'host' => env('DB_HOST', '127.0.0.1'),
    'port' => env('DB_PORT', '3306'),
    'database' => env('DB_DATABASE', 'laravel'),
    'username' => env('DB_USERNAME', 'root'),
    'password' => env('DB_PASSWORD', ''),
    'unix_socket' => env('DB_SOCKET', ''),
    'charset' => env('DB_CHARSET', 'utf8mb4'),
    'collation' => env('DB_COLLATION', 'utf8mb4_unicode_ci'),
    'prefix' => '',
    'prefix_indexes' => true,
    'strict' => true,
    'engine' => null,
    'options' => extension_loaded('pdo_mysql') ? array_filter([
    PDO::MYSQL_ATTR_SSL_CA => env('MYSQL_ATTR_SSL_CA'),
    ]) : [],
],

'mongodb' => [
    'driver' => 'mongodb',
    'dsn' => env('MONGODB_URI', 'mongodb://'.env('MONGODB_USERNAME').':'.env('MONGODB_PASSWORD').'@'.env('MONGODB_SERVER').':'.env('MONGODB_PORT').'/'.env('MONGODB_DATABASE').'?directConnection=true&serverSelectionTimeoutMS=2000&authSource=admin&appName=mongosh+2.2.2?tls=false&authSource=admin'),
    'database' => env('MONGODB_DATABASE'),
    ],
],

];

Model examples

MySQL Model (`User`)

<?php

namespace App\Models;

use Illuminate\Database\Eloquent\Model;

class User extends Model
{
    protected $connection = 'mysql';

    protected $fillable = [
        'name', 'email',
    ];
}

MongoDB Model (`Post`)

<?php

namespace App\Models;

use MongoDB\Laravel\Eloquent\Model;

class Post extends Model
{
    protected $connection = 'mongodb';
    protected $collection = 'posts';

    protected $fillable = [
        'title',
        'body',
        'slug',
    ];
}

Example Controller

<?php

namespace App\Http\Controllers;

use Illuminate\Http\Request;
use App\Models\User;
use App\Models\Post;

class ExampleController extends Controller
{
    public function store(Request $request)
    {
        $user = User::create([
            'name' => 'John Doe',
            'email' => 'john@example.com',
        ]);

        $post = Post::create([
            'title' => 'MongoDB Example',
            'body' => 'This is stored in MongoDB.',
            'slug' => 'mongodb-example',
        ]);

        return response()->json([
            'user' => $user,
            'post' => $post,
        ]);
    }
}

That's it. You now have MySQL and MongoDB both fully working in a Laravel 12 app.

UML Use Case Diagrams

Edgaras — Sun, 06 Apr 2025 21:05:00 +0000

UML (Unified Modeling Language) is a tool in software engineering for visualizing, specifying, constructing, and documenting software system artifacts. One of the most widely used UML diagrams is the Use Case Diagram, which helps in modeling system functionality from the user's perspective.

What is a UML Use Case Diagram?

A Use Case Diagram is a high-level visual representation of how users (actors) interact with a system. It belongs to the behavioral category of UML diagrams, as it focuses on depicting system functionality and user interactions rather than its structure. It identifies the primary functions and the relationships between actors and use cases, helping to understand system behavior and user interactions.

Key Components of a Use Case Diagram

Actors – Represent users or external systems that interact with the system.
Use Cases – Depict functionalities or actions performed by the system.
Relationships – Define connections between elements, including:
- Associations – Lines that connect actors to use cases, showing interactions.
- Generalization – Represents inheritance between actors or use cases.
- Include – Represents mandatory dependency where one use case always invokes another.
- Extend – Represents optional behavior that extends another use case.
System Boundary – Defines the scope of the system.
Extension Points – Specific locations within a use case where additional behavior can be added via <<extend>>.

UML Use Case Diagram Notation

Actor

An actor represents an external entity (user or system) that interacts with the system. It is depicted as a stick figure:

Use Case

A use case represents a specific function or process performed by the system. It is depicted as an oval:

Association

An association is a line connecting actors to use cases, indicating interaction:

Generalization

A generalization relationship represents inheritance, where a specialized use case or actor inherits behavior from a more general one. It is depicted using a solid line with an unfilled arrowhead:

Include Relationship

An include relationship signifies that one use case always invokes another. It represents mandatory behavior where the base use case is incomplete without the included functionality. All included use cases must be shown in the diagram as they represent essential components of the system functionality. It is represented by a dashed arrow labeled <<include>> pointing from the base use case to the included use case.

Extend Relationship

An extend relationship shows optional behavior that may be added to a base use case under specific conditions. The base use case is complete on its own, and the extending use case only executes when certain conditions are met at specified extension points. Not all possible extensions need to be shown in the diagram since they represent optional enhancements rather than mandatory behavior. It is represented by a dashed arrow labeled <<extend>> pointing from the extending use case to the base use case.

System Boundary

A system boundary is a rectangle enclosing all use cases, defining the scope of the system.

Extension Points

Extension Points define specific locations within a use case where an <<extend>> relationship can introduce additional behavior. They indicate where an extending use case may insert its logic without modifying the base use case.

When to Use a Use Case Diagram?

When defining system requirements.
To communicate system behavior with stakeholders.
During initial design discussions.
As a reference for development and testing teams.

Conclusion

UML Use Case Diagrams offer a clear and structured way to visualize system interactions and functionalities from the user's perspective. Their value comes from simplifying complex systems into understandable components that represent real-world usage scenarios. By mapping actors, use cases, and their relationships, these diagrams help teams define accurate requirements, communicate system behavior effectively, and maintain focus on user needs throughout the development process. From initial design discussions to testing and implementation, Use Case Diagrams serve as a valuable reference that ensures all stakeholders share a common understanding of what the system should accomplish.

Secure Azure Functions Endpoints with Access Keys

Edgaras — Sun, 30 Mar 2025 21:01:00 +0000

Azure Functions allows you to use keys to restrict access to your function endpoints. Unless the HTTP access level of an HTTP-triggered function is set to anonymous, requests must include an access key.

Understanding Access Keys

The scope of an access key and the actions it supports depend on its type.

Key type	Key name	Action	Description
Function	`default` or user defined	Execute specific function	Grants access only to a specific function endpoint.
Host	`default` or user defined	Execute any function	Grants access to all function endpoints within a function app.
Master	`_master`	Call an admin endpoint	A special host key that also provides administrative access to the runtime REST APIs in a function app.
System	Depends on the extension	Call durable task extension APIs or extension - specific webhook	Certain extensions require a system-assigned key to access webhook endpoints. These system keys are intended for extension-specific function endpoints invoked by internal components.

Selecting the Authentication Level

When creating an HTTP-triggered function, you must choose an authentication level. This determines whether requests require an access key. The available options typically include:

FUNCTION – Requires a function-specific access key.
ANONYMOUS – Allows open access with no authentication.
ADMIN – Requires the master key for access.

During the function creation process, you may see a prompt similar to this:

Selecting FUNCTION ensures that access to the function requires a valid function key.

Checking Authorization in Code

import azure.functions as func
import datetime
import json
import logging

app = func.FunctionApp()


@app.route(route="api_test", auth_level=func.AuthLevel.FUNCTION)
def api_test(req: func.HttpRequest) -> func.HttpResponse:
    logging.info('Python HTTP trigger function processed a request.')

    return func.HttpResponse("This HTTP triggered function authenticated and executed successfully", status_code=200)

The auth_level=func.AuthLevel.FUNCTION setting ensures that the function requires authentication using a function-level access key.

Sending Requests with an Access Key

When making a request to a function with authentication enabled (i.e., auth_level=func.AuthLevel.FUNCTION), you must include the access key in the x-functions-key header.

Example using `curl`

curl -X GET "https://<your-function-app>.azurewebsites.net/api/api_test" \
     -H "x-functions-key: YOUR_ACCESS_KEY"

Example using Python (Requests library)

import requests

url = "https://<your-function-app>.azurewebsites.net/api/api_test"
headers = {
    "x-functions-key": "YOUR_ACCESS_KEY"
}

response = requests.get(url, headers=headers)

This ensures that only clients with the correct access key can invoke the function.

Get your function access keys

You get get your Access keys from Azure Portal.

Sign in to the Azure portal, then search for and select Function App.
Select the function app you want to work with.
In the left pane, expand Functions, and then select App keys.

The App keys page appears. On this page the host keys are displayed, which can be used to access any function in the app. The system key is also displayed, which gives anyone administrator-level access to all function app APIs.

Resources

Using Cloudflare AI Models with PHP

Edgaras — Sun, 23 Mar 2025 22:05:00 +0000

Use the cloudflare-ai PHP library to easily integrate Cloudflare AI Models for tasks like text generation, summarization, translation, text embeddings, and text-to-image generation.

Installation

Install the library via Composer:

composer require edgaras/cloudflare-ai

Then include the Composer autoloader:

require __DIR__ . '/vendor/autoload.php';

Obtaining Cloudflare API Credentials

Find your Account ID

Log in to your Cloudflare dashboard.
Select your account and any domain.
Your Account ID is shown on the bottom right on the Overview page.

Generate an API Token

From the Cloudflare dashboard, click on any domain.
Select Manage Account, then click Account API Tokens.
Configure permissions according to your needs and save the token securely.

Usage Examples

Text Generation Example

use Edgaras\CloudFlareAI\AI;
use Edgaras\CloudFlareAI\TextGeneration;

$accountId = "<YOUR-ACCOUNT-ID>";
$apiToken = "<YOUR-API-TOKEN>";
$modelName = "@cf/deepseek-ai/deepseek-math-7b-instruct"; // Define the model name

$config = new AI($accountId, $apiToken);

$textGeneration = new TextGeneration($config, $modelName);

$messages = [
    ["role" => "system", "content" => "You are a helpful assistant"],
    ["role" => "user", "content" => "2+2=?"], 
];

// Options
$options = [
    'temperature' => 0.7,
    'max_tokens' => 300,
    'top_p' => 0.8,
    'frequency_penalty' => 0.2,
    'presence_penalty' => 0.3,
];

// Run Model
$response = $textGeneration->run($messages, $options, 60);

Text-to-Image Example

use Edgaras\CloudFlareAI\AI;
use Edgaras\CloudFlareAI\TextToImage;

$accountId = "<YOUR-ACCOUNT-ID>";
$apiToken = "<YOUR-API-TOKEN>";
$modelName = "@cf/black-forest-labs/flux-1-schnell"; // Define the model name

$config = new AI($accountId, $apiToken);

$textToImage = new TextToImage($config, $modelName);

$prompt = "A futuristic cityscape at night with neon lights";
$options = [
    'negativePrompt' => "blurry, low resolution",
    'height' => 768,
    'width' => 1024,
    'numSteps' => 20,
    'guidance' => 7.5,
    'seed' => 12345678,
    'timeout' => 20.0,
    'maxAttempts' => 3,
];

// Generate the image
try {
    $result = $textToImage->generate($prompt, $options);

    if (isset($result['error'])) {
        echo "Error: " . $result['error'] . PHP_EOL;
        if (isset($result['response'])) {
            print_r($result['response']);
        }
    } else { 
        echo "<img src=\"data:image/jpeg;base64,{$result['result']['image']}\">";
    }
} catch (Exception $e) {
    echo "Exception: " . $e->getMessage() . PHP_EOL;
}

Useful Links

Setting up Cloudflare Full (Strict) SSL/TLS on Apache

Edgaras — Sun, 16 Mar 2025 22:01:00 +0000

Cloudflare’s Full (Strict) SSL/TLS mode ensures that traffic is encrypted between visitors and Cloudflare and between Cloudflare and your origin server, using a certificate that Cloudflare trusts. In this post, we'll walk through generating a Cloudflare Origin Certificate, configuring Apache to use it, and enabling Full (Strict) SSL.

When using Cloudflare as a proxy for your website, you can choose different SSL/TLS encryption modes. The most secure option is Full (Strict). In Full (Strict) mode, Cloudflare only accepts a valid SSL certificate on your server – it must be unexpired and issued by a trusted authority (either a publicly trusted CA or Cloudflare’s own Origin CA). This means:

Traffic from visitors’ browsers to Cloudflare is encrypted with Cloudflare’s certificate (as usual).
Traffic from Cloudflare to your Apache web server is encrypted and the certificate presented by Apache is verified by Cloudflare for authenticity.

Why is this important? Modes like Flexible (which uses HTTPS for visitors but HTTP to your server) leave the connection between Cloudflare and your origin unencrypted – effectively defeating the purpose of SSL. Even Full (non-strict) encrypts to the origin but doesn’t validate the origin’s certificate, which could allow an attacker to intercept with a self-signed cert. Full (Strict) ensures end-to-end encryption and verification, eliminating man-in-the-middle risks and misconfigurations. In short, Full (Strict) mode is recommended whenever possible for maximum security.

1. Generating Cloudflare Origin Certificates

Cloudflare offers Origin CA certificates for free. These certificates are signed by Cloudflare and trusted only by Cloudflare (not by browsers). They allow you to secure the connection from Cloudflare to your server easily. You can generate an Origin Certificate via the Cloudflare dashboard.

Step 1 – Navigate to Origin Certificates:

Log in to the Cloudflare dashboard and select your domain.
Go to the SSL/TLS section, then click the Origin Server tab.
Click on “Create Certificate”.

Step 2 – Configure the certificate options:

Choose “Generate private key and CSR with Cloudflare” (this is the default option).
For Private key type, select RSA 2048.
Under Hostnames, your domain (e.g. example.com) and its wildcard (e.g. *.example.com) are likely pre-filled. You can add subdomains if needed.
For Certificate Validity, select your desired duration. Cloudflare allows up to 15 years for origin certs – the default is often 15 years.
Leave the Key format as PEM.
Click Create to generate the certificate.

Cloudflare will now show you two text boxes: one is the Origin Certificate and the other is the Private Key. Copy both and save them to files on your server:

Origin Certificate (BEGIN/END CERTIFICATE text) – save as /etc/ssl/certs/cloudflare-origin.pem
Private Key (BEGIN/END PRIVATE KEY text) – save as /etc/ssl/private/cloudflare-origin-key.pem

(Optional) Step 4 – Get Cloudflare’s CA root certificate:

Cloudflare’s Origin CA is signed by a Cloudflare root certificate. If needed, Cloudflare provides an Origin CA root cert (PEM) for download. You can download the Cloudflare Origin CA Root (RSA or ECC to match your cert) and save it as /etc/ssl/certs/cloudflare-origin-ca.pem.

With the certificate and key in place, we need to configure Apache to serve HTTPS using this certificate. We’ll create (or edit) an Apache virtual host configuration for your site to enable SSL on port 443 and redirect HTTP to HTTPS.

2. Configuring Apache

Step 1 – Enable SSL and rewrite modules (if not already enabled):

Ensure Apache has the SSL module and rewrite module active, as we’ll need both. On Debian/Ubuntu systems, you can run:

sudo a2enmod ssl
sudo a2enmod rewrite

Then reload Apache to load those modules (e.g., sudo systemctl reload apache2).

Step 2 – Edit the Apache virtual host configuration:

Open your site’s Apache config file. For example, if your site is example.com, you can create file like /etc/apache2/sites-available/example.com.conf. Run:

sudo nano /etc/apache2/sites-available/example.com.conf

Now, update the file to include two <VirtualHost> blocks: one for port 80 (HTTP) to handle redirects, and one for port 443 (HTTPS) to handle secure traffic. Use the following configuration as an example, replacing example.com with your domain and updating file paths to point to your certificate files:

<VirtualHost *:80>
    ServerAdmin info@example.com
    ServerName example.com
    ServerAlias www.example.com

    # Redirect all HTTP requests to HTTPS
    RewriteEngine On 
    RewriteCond %{HTTPS} !=on 
    RewriteRule ^/?(.*) https://%{SERVER_NAME}/$1 [R=301,L] 
</VirtualHost>

<VirtualHost *:443>
    ServerAdmin info@example.com
    ServerName example.com
    ServerAlias www.example.com

    SSLEngine on 
    SSLCertificateFile /etc/ssl/certs/cloudflare-origin.pem 
    SSLCertificateKeyFile /etc/ssl/private/cloudflare-origin-key.pem

    # If you downloaded Cloudflare's CA root cert, also include:
    # SSLCertificateChainFile /etc/ssl/certs/cloudflare-origin-ca.pem

    DocumentRoot /var/www/example.com/public 
</VirtualHost>

<Directory /var/www/example.com >
    Options -Indexes +FollowSymLinks -MultiViews 
    AllowOverride All 
    Require all granted 
</Directory>

After editing, save the file.

Step 3 – Enable the site configuration:

If this is a new config file, enable it in Apache. On Ubuntu/Debian use:

sudo a2ensite example.com.conf

This creates a symlink in sites-enabled/ for your site. Always good idea to disable default apache virtual hosts by running sudo a2dissite 000-default.conf and sudo a2dissite default-ssl.conf.

Restart Apache: Once permissions are set, restart (or reload) Apache to apply the changes:

sudo systemctl restart apache2

Apache should start/restart without errors. It’s a good idea to run sudo apache2ctl configtest before restarting to catch any syntax errors in your config. If everything is OK, you’ll see Syntax OK. If there’s an error, fix it as indicated and test again before restarting.

After restarting, Apache is now serving your site over HTTPS with the Cloudflare Origin Certificate. Next, we’ll verify that everything is working correctly.

4. Verifying the Setup

With Apache configured and running, and your Cloudflare Origin Certificate in place, it’s time to switch Cloudflare to Full (Strict) mode and test the site.

Step 1 – Enable Full (Strict) in Cloudflare:

Log in to the Cloudflare dashboard, navigate to SSL/TLS for your domain (the “Overview” subpage), and set the SSL/TLS Encryption Mode to Full (strict). This tells Cloudflare to enforce certificate verification for the connection to your origin. If all your origin setups have a valid cert (as we just installed), Full (strict) is the best choice.

Step 2 – Test your website in a browser:

Open a web browser and visit your domain (make sure to use https://). If everything is configured correctly, your site should load normally over HTTPS. Since Cloudflare is proxying, you will see Cloudflare’s certificate in your browser’s lock icon details – this is expected. The important part is that you don’t see any security errors.

Try both the root domain and the www (if you configured both). Also test that domain with http:// automatically redirects to the https:// version.

Conclusion

Now, all traffic from visitors to Cloudflare is secured with HTTPS, and importantly, the traffic from Cloudflare to your origin is also secure and verified. This end-to-end encryption setup protects your data in transit at every step.

Forem: Edgaras

UML Deployment Diagrams

What is a UML Deployment Diagram?

Why Use Deployment Diagrams?

Core Components and Notation

Nodes

Artifacts

Communication Paths

Node Instances

Practical Example: Cloud Web Application

Enterprise On-Premises Deployment

Best Practices

Conclusion

Using a Self-Hosted PDF OCR API with PaddleOCR

The problem

When this is useful

What's under the hood

Setup

Usage

Submit a PDF

Poll progress

Fetch a single page (as soon as it's ready)

Fetch all pages

List jobs, cancel, delete

Full API reference

API key authentication

Configuration

Example: integrating into a Python script

How it works

A Developer's Guide to Useful Apache Modules

How to Enable/Disable Modules

mod_rewrite - URL Routing & Clean URLs

mod_ssl - HTTPS Support

mod_headers - Security & Cache Headers

mod_expires - Browser Cache Control

mod_proxy and mod_proxy_http - Reverse Proxy to Apps

mod_security - Web Application Firewall

mod_status - Live Server Status Page

mod_auth_basic and mod_authn_file - Simple Password Protection

mod_evasive - Auto-Blocking for DDoS / Brute Force

Additional Useful Modules

mod_deflate or mod_brotli - Response Compression

mod_pagespeed - Auto Performance Optimizer

mod_geoip / mod_maxminddb - Geo-Based Rules

Summary

Ethereum Integration in PHP for Wallets and Transfers

What you can do

Requirements

Install

Quick start: create a wallet and read balance

Send ETH (legacy Type‑0)

Send ETH with EIP‑1559 (Type‑2)

Practical examples

Utilities you’ll actually use

EIP‑1559 in practice (why it matters)

Production tips

Laravel Project Backup to Azure Blob with Bash Script

Requirements

The Script

How It Works

Usage

Save the script:

Configure variables:

Run manually:

Or schedule with cron:

Efficiently Measure String Similarity in PHP Applications

Installation

Implementing Powerful String Similarity Algorithms

Common Applications

How to Reliably Mount a CIFS Share Using systemd on Boot

Step 1: Create a credentials file

Step 2: Create the mount point

Step 3: Create a systemd mount unit

Explanation:

Step 4: Enable the mount

Step 5: Verify the mount

Setting Up MySQL and MongoDB Together in Laravel 12

Install MongoDB PHP Extension

Install Required Composer Packages

.env example

`mod_rewrite` - URL Routing & Clean URLs

`mod_ssl` - HTTPS Support

`mod_headers` - Security & Cache Headers

`mod_expires` - Browser Cache Control

`mod_proxy` and `mod_proxy_http` - Reverse Proxy to Apps

`mod_security` - Web Application Firewall

`mod_status` - Live Server Status Page

`mod_auth_basic` and `mod_authn_file` - Simple Password Protection

`mod_evasive` - Auto-Blocking for DDoS / Brute Force

`mod_deflate` or `mod_brotli` - Response Compression

`mod_pagespeed` - Auto Performance Optimizer

`mod_geoip` / `mod_maxminddb` - Geo-Based Rules

`.env` example

`config/database.php`

MySQL Model (`User`)

MongoDB Model (`Post`)

Example using `curl`