Hi there 👋

Incoherent ramblings from a Principal Magento Engineer. Covering SRE / Devops / Platform Eng / Magento Dev

Chaos Engineering in Magento 2

Chaos. Those who know me, knows that I love a bit of chaos in my work. Data center caught fire? Server fell out the rack? Its like a free roller coaster. For someone who’s role is to reduce the chaos, I enjoy and thrive on it a little bit too much. Why implement Chaos Engineering practises? This is where Chaos Engineering comes into play, nobody wants to be woken up at 3am because OOMKiller has decided your database is not important any more....

October 7, 2024 · 3 min · 545 words · Me

The Magento 2 Setup Endpoint is leaking your Magento Version

The default Nginx sample configuration, and htaccess files shipped by Magento have the /setup/ route publicly accessible. And this route displays your current magento version, including patch level. For all prying eyes to see. Currently this affects all Magento versions up to 2.4.7-p1 (the latest at time of writing), including 2.4-develop. It is worth noting, I believe the web installed was removed in 2.4. Is there any need for this route to continue to exist, apart from leaking version data?...

October 2, 2024 · 2 min · 242 words · Me

Debugging Varnish Cache Performance in Magento 2

I do a fair bit of performance oriented consulting/contracting work with Magento Agencies / Developers. A common theme seems to be difficulty monitoring/debugging Varnish. The Varnish Service Watching a specific URLs Age We can monitor how long a specific URL is staying in cache, by wrapping a curl command within a while loop. (Note: You may need to update your varnish config to stop removing the Age header) while true; do curl -Iso /dev/null -w '[%header{Date}] %{http_code} %{url} %header{x-cache} %header{age}\n' https://example....

September 20, 2024 · 3 min · 494 words · Me

Stop Overpaying for New Relic Data Ingest by reducing Tracing Data

I was doing some health checks on some new brownfield projects we’ve taken on recently, ahead of migrating them to our own infrastructure. And I noticed that their NewRelic invoices seemed abnormally high for the amount of traffic the stores received. I was expecting most of the stores to still be in the free tier, or at least under 200/300GB total ingest. Looking at the “Manage Data” account page in NewRelic....

August 27, 2024 · 2 min · 339 words · Me

Magento Trojan Orders (CVE-2022-24086) - addAfterFilterCallback

So it appears the Magento 2 Trojan order exploit (CVE-2022-24086) is making the rounds again. With the recent rise in exploit attempts I am going to go out on a whim, and assume the exploit kit was recently sold/released again. Trojan Order was identified and patched back at the start of 2022. The relevant security Bulletin is APSB22-12. It states versions 2.3.0 to 2.3.3 are not affected but any other versions below 2....

August 16, 2024 · 3 min · 511 words · Me

Magento 2 Optimising Static Content Deploy

Typically a lot of Magento 2 stores are slow to build, some taking up to and over an hour. This becomes a bigger pain point as stores grow and more themes & locales are added. Often optimising build time is often towards the bottom of the priority list. The Magento Static Content Deploy Docs provides a good amount of detail on this subject, and is a good read. Just remember, typically, your pipeline execution time also affects your time to release fixes to critical production issues....

August 12, 2024 · 4 min · 641 words · Me

How to debug Magento Javascript components in DevTools

Often when debugging frontend functionality, I find myself reaching for access into Magento Javascript components. To either read the current state or invoke various methods within that component to test return values. But how do we do this? How do we get, lets say, the current quote? It’s quite simple really, we just call require instead of define like we would in a component. Slap a debugger call in the body and now you can play with that component to your hearts content....

August 8, 2024 · 1 min · 139 words · Me

Cleaning Up Github Actions Artifacts via cli

There are a handful of guides on how to clean-up old Github Action Artifacts. The issue I have with the ones I’ve seen, is they are really convoluted solutions for such a simple task. I am making an assumption here that you are using the Github CLI tool. If you are not, then your missing out, go give it a go (even just for this task). You can even use the CLI directly within your workflows if you can to run the clean-up as a nightly task etc....

August 5, 2024 · 2 min · 261 words · Me

Blocking TOR exit routes

One of my clients have recently seen a surge in TOR traffic with zero conversion from them. And has requested for them to be blocked, since its no point in autoscaling the infrastructure, leading to increased cost, for non converting anonymous traffic. We have a few different ways to block TOR/Onion traffic, firstly we can just click some buttons in cloudflare and problem solved. But thats boring, and does not protect us if we move away from Cloudflare in the future (maybe they’ll deem we are a ’enterprise’ at some point 🙃)....

July 22, 2024 · 2 min · 298 words · Me

Simple 2 line fix for Polyfill.io Malware in Magento 2

A simple two line Nginx config update can remove any reference of the polyfill Malware from coming out of your store. What is the Polyfill.io Malware? As you likely have already heard, the polyfill.io domain has been serving malware. And there is still a concerning number of sites that still are including scripts from that domain. Cloudflare and Fastly have both released alternative services that only require a change of domain....

July 12, 2024 · 2 min · 293 words · Me

Pumpkin Cat: medrupaloscil

Ghosts: Shopify

Cobwebs: Shopify