Vivek Shukla - Code Snippet

IndexNow Bulk URL Submit Using Curl

2026-04-26T00:00:00+00:00

IndexNow is a service which is used to inform search engines i.e. Bing, Naver, Seznam.cz, Yandex and Yep, about the content updates. This improves indexing. More info.

IndexNow API supports upto 10,000 links submission in a day.

Make sure to have a randomly generated key c3755574c3ae4c259262854b0f241ec8.txt at the root of your website. Generate key here

Payload

payload.json

{
	"host": "example.com",
	"key": "random-key",
	"keyLocation": "https://example.com/random-key.txt",
	"urlList": [
		"https://example.com/blog"
	]
}

Curl

curl -v -X POST https://api.indexnow.org/indexnow -H "Content-Type: application/json" -d @payload.json

PostgreSQL: Make Create/Drop Operations Infallible

2026-04-25T00:00:00+00:00

While creating a database table, column or index, if it already exist, postgres will throw the error and abort the whole operation. Using IF EXISTS and IF NOT EXISTS is a way to make them infallible.

Creating and Dropping Entire Tables

Safe Create:

CREATE TABLE IF NOT EXISTS users (
    id UUID PRIMARY KEY,
    email VARCHAR(255) NOT NULL
);

Safe Drop:

DROP TABLE IF EXISTS users;

Adding and Removing Columns

Safe Add Column:

ALTER TABLE users 
ADD COLUMN IF NOT EXISTS phone_number VARCHAR(20);

Safe Drop Column:

ALTER TABLE users 
DROP COLUMN IF EXISTS phone_number;

Dropping Constraints (Easy)

Safe Drop Constraint:

ALTER TABLE users 
DROP CONSTRAINT IF EXISTS unique_email_constraint;

Adding Constraints (The Tricky One)

To make adding a constraint truly infallible, we have to use a tiny bit of PostgreSQL logic called a DO blocIt checks the database records first before trying to add the rule.

Safe Add Constraint (using a DO block):

DO $$ 
BEGIN
    -- Check if the constraint name already exists
    IF NOT EXISTS (
        SELECT 1 
        FROM pg_constraint 
        WHERE conname = 'unique_email_constraint'
    ) THEN
        -- If it does not exist, add it
        ALTER TABLE users 
        ADD CONSTRAINT unique_email_constraint UNIQUE (email);
    END IF;
END $$;

Custom Types and Enums (Bonus)

Safe Drop Type:

DROP TYPE IF EXISTS job_status_enum;

Safe Create Type: (Postgres does not have CREATE TYPE IF NOT EXISTS, so we use another DO block)

DO $$ 
BEGIN
    IF NOT EXISTS (SELECT 1 FROM pg_type WHERE typname = 'job_status_enum') THEN
        CREATE TYPE job_status_enum AS ENUM ('submitted', 'pending', 'completed');
    END IF;
END $$;

UFW Cheat Sheet

2025-09-09T00:00:00+00:00

Check status

sudo ufw status

# or

sudo ufw status verbose

# or

sudo ufw status numbered

Delete value based on number:

sudo ufw delete 5

Allow port

sudo ufw allow 22/tcp

Deny port

sudo ufw deny 80/tcp

Allow from ip address or subnet

sudo ufw allow from 10.22.96.0/20

Allow from ip address to specific port

sudo ufw allow from 10.22.96.0/20 proto tcp to any port 5432

Disable ufw

sudo ufw disable

Block an ip address or subnet

sudo ufw deny from 203.0.113.100

Delete a rule

sudo ufw delete allow from 203.0.113.101

Allow incoming connection to a network interface

sudo ufw allow in on eth0 from 203.0.113.102

Cloud Init Script to Set-up Server

2025-09-05T00:00:00+00:00

Add this script to Cloud-init field while provisioning your VPS. Most cloud providers support this.

This script will do following stuff:

disable the root user
disable password authentication for SSH
update and upgrade ubuntu packages
create a new user named “ubuntu” add given public SSH key as authorized_key for the user
Install and setup:
- Ufw: a firewall with open ports 22, 80 and 443
- fail2ban: to protect against brute-force login attempt
- unattended-upgrades: to upgrade ubuntu packages
- docker

#cloud-config

disable_root: true
ssh_pwauth: false
package_update: true
package_upgrade: true
timezone: Etc/UTC

system_info:
  default_user:
    ssh_authorized_keys: []
    lock_passwd: true

packages:
  - ufw
  - fail2ban
  - unattended-upgrades

runcmd:
  - echo $(date) > /start
  - passwd -l root
  - sed -i 's/^PasswordAuthentication yes/PasswordAuthentication no/' /etc/ssh/sshd_config
  - systemctl restart sshd
  - ufw default deny incoming
  - ufw default allow outgoing
  - ufw allow 22/tcp
  - ufw allow 80/tcp
  - ufw allow 443/tcp
  - ufw --force enable
  - systemctl enable fail2ban
  - systemctl start fail2ban
  - unattended-upgrade
  - curl -fsSL https://get.docker.com | sh
  - groupadd docker
  - usermod -aG docker ubuntu
  - echo $(date) > /end

users:
  - name: ubuntu
    lock_passwd: true
    ssh_authorized_keys:
      - YOUR_SSH_PUBLIC_KEY
    sudo: ALL=(ALL) NOPASSWD:ALL
    groups: sudo
    shell: /bin/bash

Deploy Systemd Service Behind Nginx with TLS

2025-09-04T00:00:00+00:00

Systemd Service

sudo tee /etc/systemd/system/YOUR_SERVICE_NAME.service << 'EOF'
[Unit]
Description=YOUR_SERVICE_NAME
After=network.target

[Service]
ExecStart=/executable/location
WorkingDirectory=/dir/where/program/can/read-write/data
Restart=on-failure
RestartSec=5s
StartLimitIntervalSec=300
StartLimitBurst=5
User=ubuntu
Group=ubuntu

[Install]
WantedBy=multi-user.target
EOF

Start command:

sudo systemctl daemon-reload
sudo systemctl enable YOUR_SERVICE_NAME
sudo systemctl start YOUR_SERVICE_NAME

Other commands:

# see logs
sudo journalctl -u YOUR_SERVICE_NAME -f
# restart
sudo systemctl restart YOUR_SERVICE_NAME
# when service file is updated
sudo systemctl daemon-reload

Nginx Reverse Proxy

sudo tee /etc/nginx/sites-available/YOUR_DOMAIN << 'EOF'
map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

upstream server_list {
    server localhost:8000;
    keepalive 32;
}

server {
        listen 80;          # IPv4
        listen [::]:80;     # IPv6
        server_name YOUR_DOMAIN;

        # Hide server information headers
        server_tokens off;

        # Enable gzip compression
        gzip on;
        gzip_disable "msie6";
        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_buffers 16 8k;
        gzip_min_length 1024;
        gzip_types
          application/atom+xml
          application/geo+json
          application/javascript
          application/x-javascript
          application/json
          application/ld+json
          application/manifest+json
          application/rdf+xml
          application/rss+xml
          application/xhtml+xml
          application/xml
          font/eot
          font/otf
          font/ttf
          image/svg+xml
          text/css
          text/javascript
          text/plain
          text/xml;

        # Buffer size optimization
        client_body_buffer_size 32k;
        client_header_buffer_size 2k;
        client_max_body_size 10M;
        large_client_header_buffers 4 2k;

        # Timeouts
        client_body_timeout 20;
        client_header_timeout 20;
        keepalive_timeout 65;
        send_timeout 20;

        # Proxy settings
        location / {
            include proxy_params;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_redirect off;
            proxy_buffering on;
            proxy_buffer_size 16k;
            proxy_buffers 8 16k;
            proxy_pass http://server_list;

            # Additional proxy timeouts
            proxy_connect_timeout 60s;
            proxy_send_timeout 120s;
            proxy_read_timeout 120s;
        }

        # Security headers
        add_header X-Content-Type-Options "nosniff" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}
EOF

Create Symlink

sudo ln -s /etc/nginx/sites-available/YOUR_DOMAIN /etc/nginx/sites-enabled/

Checks Nginx configuration

sudo nginx -t

Restart Nginx

sudo systemctl restart nginx

Letsencrypt SSL

Installing certbot to install TLS certificate

sudo apt remove certbot

sudo snap install core; sudo snap refresh core

sudo snap install --classic certbot

sudo ln -s /snap/bin/certbot /usr/bin/certbot

sudo certbot --nginx -d YOUR_DOMAIN

Ed25519 Key Pair Generation in Rust

2025-06-20T00:00:00+00:00

Cargo.toml

[dependencies]
ssh-key = { version = "0.6", features = ["ed25519", "rsa"] }

main.rs

use ssh_key::{LineEnding, PrivateKey, rand_core::OsRng};
use std::fs;
use std::path::PathBuf;
use std::time::Instant;

fn generate_ed25519_key_pair(
    path_prefix: &str,
    comment: &str,
) -> Result<(), Box<dyn std::error::Error>> {
    let timer = Instant::now();
    let mut private_key = PrivateKey::random(&mut OsRng, ssh_key::Algorithm::Ed25519)?;
    private_key.set_comment(comment);

    let private_key_bytes = private_key.to_openssh(LineEnding::LF)?;
    let public_key_bytes = private_key.public_key().to_openssh()?;

    let private_path = PathBuf::from(format!("{}_ed25519", path_prefix));
    let public_path = PathBuf::from(format!("{}_ed25519.pub", path_prefix));
    fs::write(&private_path, private_key_bytes)?;
    fs::write(&public_path, public_key_bytes)?;

    println!("Generated Ed25519 key pair:");
    println!("Private key: {}", private_path.display());
    println!("Public key: {}", public_path.display());
    println!("Time Elapsed: {}ms", timer.elapsed().as_millis());

    Ok(())
}

fn main() {
    match generate_ed25519_key_pair("id", "example@localhost") {
        Ok(_) => println!("Successfully generated Ed25519 key pair without passphrase."),
        Err(e) => eprintln!("Error generating Ed25519 key pair: {}", e),
    }
}

Rust Release Build & Publish

2025-06-15T00:00:00+00:00

docker run --rm -it ubuntu /bin/bash

# Environment Variables
# | Key                   | Purpose                                                          |
# | --------------------- | ---------------------------------------------------------------- |
# | DEPLOY_KEY            | Private SSH key (public key must be added in Github)                                                  |
# | REPO_URL              | Github repository url (ssh)                                      |
# | BINARY_NAME           | Binary name in Cargo.toml                                        |
# | RCLONE_CONFIG_CONTENT | Contents of the Rclone config. Name must be "remote_destination" |
# | RCLONE_COPY_PATH      | Path of the bucket where you want to copy the file               |

# Rclone Config Example
# ```
# [remote_destination]
# type = s3
# provider = Other
# access_key_id =
# secret_access_key =
# endpoint =
# acl = public-read
# ```

export DEBIAN_FRONTEND=noninteractive

apt update

apt install -y build-essential libssl-dev pkg-config curl git openssh-client unzip

curl --proto '=https' --tlsv1.2 -sSf https://sh.rustup.rs | sh -s -- -y
. "$HOME/.cargo/env"

curl https://rclone.org/install.sh | bash

export RCLONE_CONFIG="/rclone.conf"

echo "$RCLONE_CONFIG_CONTENT" > $RCLONE_CONFIG

mkdir -p /root/.ssh

echo "$DEPLOY_KEY" > /root/.ssh/deploy_key

chmod 600 /root/.ssh/deploy_key

ssh-keyscan github.com >> /root/.ssh/known_hosts

chmod 600 /root/.ssh/known_hosts

mkdir -p /app

GIT_SSH_COMMAND="ssh -i /root/.ssh/deploy_key" git clone $REPO_URL /app

cd /app

FULL_NAME=$BINARY_NAME-$(uname -s | tr '[:upper:]' '[:lower:]')-$(uname -m | sed -e 's/x86_64/amd64/' -e 's/armv6l/arm/' -e 's/armv7l/arm/' -e 's/aarch64/arm64/')

cargo build --release && \
    cp target/release/$BINARY_NAME $FULL_NAME

rclone copy "$FULL_NAME" remote_destination:"$RCLONE_COPY_PATH"

Deploy OpenObserve binary behind Nginx on Ubuntu

2025-06-09T00:00:00+00:00

Quickstart guide by OpenObserve.

Installing OpenObserve

Download binary:

mkdir ~/openobserve && cd $_

curl -L https://raw.githubusercontent.com/openobserve/openobserve/main/download.sh | sh

chmod +x openobserve

Create Environment file

tee openobserve.env << 'EOF'
# Data directory for OpenObserve. This is crucial for local storage.
ZO_DATA_DIR="/home/ubuntu/openobserve/data"

# The port OpenObserve will listen on (default is 5080)
ZO_PORT=5080

# The root user email and password for initial login.
# CHANGE THESE TO SECURE VALUES!
ZO_ROOT_USER_EMAIL="admin@example.com"
ZO_ROOT_USER_PASSWORD="SecurePassword123"

ZO_META_STORE="sqlite"

ZO_WEB_URL="https://your-domain

# disabling OpenObserve's telemetry to their server
ZO_TELEMETRY=false
EOF

sudo chmod 600 openobserve.env

Creating systemd service

sudo tee /etc/systemd/system/openobserve.service << 'EOF'
[Unit]
Description=OpenObserve Observability Platform
After=network-online.target
Wants=network-online.target

[Service]
# Service type: 'simple' means the process will be the main process
Type=simple

User=ubuntu
Group=ubuntu
WorkingDirectory=/home/ubuntu/openobserve
EnvironmentFile=/home/ubuntu/openobserve/openobserve.env
ExecStart=/home/ubuntu/openobserve/openobserve
Restart=on-failure
RestartSec=5s

# Limit the number of open file descriptors, important for high-concurrency apps.
# Adjust as needed based on your expected load.
LimitNOFILE=65536

# Redirect standard output and error to systemd journal.
StandardOutput=journal
StandardError=journal

# How long to wait before forcefully terminating the service on stop.
TimeoutStopSec=30s

[Install]
# This unit should be enabled for multi-user systems.
# Allows it to start automatically on boot.
WantedBy=multi-user.target
EOF

Start service

# Reload systemd daemon to pick up the new service file
sudo systemctl daemon-reload

# Enable the service to start on boot
sudo systemctl enable openobserve

# Start the OpenObserve service
sudo systemctl start openobserve

Check the service status and logs

# Check service status
sudo systemctl status openobserve

# View logs
sudo journalctl -u openobserve -f

Reverse Proxy - Nginx

Install Nginx

sudo apt -y install nginx

sudo tee /etc/nginx/sites-available/openobserve << 'EOF'
map $http_upgrade $connection_upgrade {
  default upgrade;
  '' close;
}

server {
        listen 80;          # IPv4
        listen [::]:80;     # IPv6
        server_name your-domain;

        # Hide server information headers
        server_tokens off;

        # Enable gzip compression
        gzip on;
        gzip_vary on;
        gzip_proxied any;
        gzip_comp_level 6;
        gzip_min_length 1024; # Only gzip if size is at least 1KB
        gzip_types text/plain text/css text/xml application/json application/javascript application/rss+xml application/atom+xml image/svg+xml;

        # Proxy settings
        location / {
            include proxy_params;
            proxy_set_header Upgrade $http_upgrade;
            proxy_set_header Connection $connection_upgrade;
            proxy_redirect off;
            proxy_pass http://localhost:5080;
        }

        location /metrics {
            # allow 192.168.1.100; # <--- REPLACE WITH YOUR MONITORING SERVER'S IP
            deny all;
        }

        # Security headers
        add_header X-Content-Type-Options "nosniff" always;
        add_header Strict-Transport-Security "max-age=31536000; includeSubDomains; preload" always;
}
EOF

sudo ln -s /etc/nginx/sites-available/openobserve /etc/nginx/sites-enabled/

# test nginx conf
sudo nginx -t

sudo systemctl restart nginx

Afterwards, to gracefully restart nginx, do this:

sudo nginx -s reload # OR sudo systemctl reload nginx

TLS Installation

sudo snap install core; sudo snap refresh core

sudo apt remove certbot

sudo snap install --classic certbot

sudo ln -s /snap/bin/certbot /usr/bin/certbot

sudo certbot --nginx -d your-domain

docker buildx: Multi-platform Builds

2025-04-23T00:00:00+00:00

Tested on: Ubuntu 22.04 LTS
Docker Version: 28.1.1
Docker Buildx Version: v0.23.0

Documentation: Multi-platform Builds

# check if buildx is installed
docker buildx version

# installing and registering QEMU
docker run --privileged --rm tonistiigi/binfmt --install all

# create new build that runs in docker container
docker buildx create --name mybuilder --driver docker-container

# switching to our builder
docker buildx use mybuilder

# build and pushing image directly to image store (make sure you are logged in)
docker buildx build --platform linux/amd64,linux/arm64 -t <username>/<image_name>:<tag> . --push

Docker Image Publishing

2025-04-23T00:00:00+00:00

Login

docker login --username <username> --password-stdin

Build

docker build . -t <image_name>:<tag>

Tag

docker tag <image_name>:<tag> <username>/<image_name>:<tag>

Push

docker push <username>/<image_name>:<tag>