DEV Community: Arnob

Build Own GitHub Action

Arnob — Mon, 08 Jun 2026 16:19:53 +0000

Here I told you how you create an action package and publish that to the marketplace.

What is GitHub Action

GitHub Actions is a continuous integration and continuous delivery (CI/CD) platform that allows you to automate your build, test, and deployment pipeline.

[Understanding GitHub Actions - GitHub Docs

GitHub Actions is a continuous integration and continuous delivery (CI/CD) platform that allows you to automate your…

docs.github.com](https://docs.github.com/en/actions/learn-github-actions/understanding-github-actions?source=post_page-----75573fcdc831---------------------------------------)

I hope it will help you understand action well

How to create a GitHub Action!

At the starting, you need to create an action.yaml file. And write there the details of the action

action.yaml

name: 'DigitalOcean kubectl Action'
author: Arnob Almazee
description: DigitalOcean kubectl image Update by using Github Action
branding:
  color: 'blue'
  icon: 'command'
runs:
  using: 'docker'
  image: 'docker://ghcr.io/arn-ob/do-kubectl-action:latest'
inputs:
  do_access_token:
    description: Access token for accessing the doctl. 
    required: true
  do_cluster_certificate:
    description: Cluster certificate for accessing the kubectl. 
    required: true
  do_deployment_name:
    description: App deployment name. 
    required: true
  do_container_name:
    description: App container name. 
    required: true
  do_image_tag:
    description: App build image and tag. 
    required: true
  stdin:
    description: File to read and pass as stdin to kubectl
    required: false
  args:
    description: The arguments that you want to pass through to the kubectl command
    required: true
outputs:
  kubectl-out:
    description: The output of the kubectl command

This is the action config file. Here the action knows what you wanted to do and which value will get input and output. Now you have to give the Dockerfile which is initing run

FROM alpine:latest
LABEL maintainer="Arnob Almazee <github.com@arn-ob>"
RUN apk add --no-cache curl
RUN wget https://github.com/digitalocean/doctl/releases/download/v1.84.0/doctl-1.84.0-linux-amd64.tar.gz
RUN tar -xf doctl-1.84.0-linux-amd64.tar.gz -C ~/
RUN chmod +x ~/doctl
RUN mv ~/doctl /usr/local/bin
RUN curl -LO https://storage.googleapis.com/kubernetes-release/release/` curl -s https://storage.googleapis.com/kubernetes-release/release/stable.txt`/bin/linux/amd64/kubectl
RUN chmod +x ./kubectl
RUN mv ./kubectl /usr/local/bin/kubectl
ADD entrypoint.sh /entrypoint.sh
RUN chmod +x /entrypoint.sh
ENTRYPOINT ["/entrypoint.sh"]

This Dockerfile describes the process and the steps which I need to run the entrypoint.sh.

Short Details:

1st Dockerfile run from alpine:latest image. it will wget the doctl release then extract and save it in the bin file. Then install kubectl also it save to the bin. then make kubectl and doctl exec files.

After Dockerfile build then it runs entrypoint.sh

#!/bin/sh
debug() {
  if [ "${ACTIONS_RUNNER_DEBUG:-}" = "true" ]; then
    echo "DEBUG: :: $*" >&2
  fi
}
echo "DigitalOcean version"
doctl version
echo "DO Token Init"
doctl auth init -t "${INPUT_DO_ACCESS_TOKEN}"
echo "DigitalOcean add the cluster kubeconfig"
doctl kubernetes cluster kubeconfig save ${INPUT_DO_CLUSTER_CERTIFICATE}
echo "Kubectl deployment"
kubectl set image deployment/${INPUT_DO_DEPLOYMENT_NAME} ${INPUT_DO_CONTAINER_NAME}=${INPUT_DO_IMAGE_TAG}

This entrypoint.sh file work is the main process of GitHub action. It checks the doctl version then it gets the token, then saves the cluster certificate number. Then deployment the image from the deployment name, container name, and image tag.

Those are found at Repository secrets (Repo Setting > Secrets > Action)

So the GitHub workflow YAML for that repository is like

name: Production Hattimatim
on: 
  push:
    branches:
      -  main
jobs:
  Deploy:
    name: Hattimatim FrontEnd Deploy Process

    runs-on: ubuntu-latest

    steps:
      - uses: actions/checkout@v2
      - name: Get brandh tag
        id: vars
        shell: bash
        run: |
          echo "::set-output name=tag::${GITHUB_REF#refs/heads/}-$(git rev-parse --short HEAD)"

      - name: Login to GitHub Container Registry
        uses: docker/login-action@v1
        with:
          username: ${{ secrets.GIT_USERNAME }}
          password: ${{ secrets.GIT_PASSWORD }}
      - name: Build and push image to Docker Hub
        run: |
          docker build . -t arnobdev/hattimatim-frontend:${{ steps.vars.outputs.tag }}
          docker push arnobdev/hattimatim-frontend:${{ steps.vars.outputs.tag }}

      - name: Push the build image to the DO kubectl
        uses: arn-ob/do-kubectl-action@main
        with:
          do_access_token: ${{ secrets.DO_ACCESS_TOKEN }}
          do_cluster_certificate: ${{ secrets.DO_CLUSTER_CERTIFICATE }}
          do_deployment_name: hattimatim-frontend-app
          do_container_name: hattimatim-frontend-app
          do_image_tag: arnobdev/hattimatim-frontend:${{ steps.vars.outputs.tag }}

Short Details:

Get the new commit tag, then it login into the docker hub. Then build the image from the repository. When the image ready then the image push to the kubectl by using arn-ob/do-kubectl-action.

[DigitalOcean kubectl Action - GitHub Marketplace

GitHub Action Access your DigitalOcean cluster via kubectl in a Github Action.

github.com](https://github.com/marketplace/actions/digitalocean-kubectl-action?source=post_page-----75573fcdc831---------------------------------------)

Thank you.

Happy Learning…

GitHub Action Runs From Repository To Another Repository

Arnob — Mon, 08 Jun 2026 16:19:26 +0000

Hello, Here I show you the process with run one repository action from another specific repository.

Use Case

Lots of developer work to build projects. So any project there is a GitHub workflow. So you wanted to protect the workflow for the wrong deployment.

So here is the process of running action from one repository to any other repository.

Config Token

You have to need a Personal Access Token (PAT). That token actually works when you pull another repository to the action.

Goto Settings > Developer settings > Personal access tokens (classic)

Generate a token.

Now needed to set up the workflow.

Action:

Here is the GitHub workflow

This workflow actually works as a middleware of project deployment. This workflow defines it runs in ubuntu and then selects any repository. Done.

Select Repository

Here is the workflow from the selected repository

This workflow is the GitHub action repository. It actually acknowledges/commit the arn-ob/github-actions repository for running the arn-ob/ssr-fetch.

Note: It actually based on branch to branch.

Now hope you will get confused. How does it work? So it is better to give you a diagram of the process.

Process Details:

1st github-repo-1 gives a commit then it runs the workflow. So repo-1 workflow yaml has targeted the repository to the github-action repo. repo-1 has committed to the github-action with a blank text file and commits that. So then github-action workflow runs. Then the github-action yaml has a repository of github-repo-1. So the action pulls the github-repo-1 code. Then it runs as it told to the github-action yaml.

Happy Learning…

Manage Multiple ExternalSecret

Arnob — Mon, 08 Jun 2026 16:18:48 +0000

Here I will share how you manage multiple Kubernetes secrets in One or Multiple services/pods.

Here is the story, every pod contains a secret or external secret file. So there are some common secrets in every pod. So I told you this secret is a common secret. So if any secret key changes then you have to change the secret from every pod.

So, here describe how you manage the common secret.

Pod 1 — cart-one-secret

ENV_ONE=1
ENV_TWO=2
COMMON_TYPE=1

Pod 2 — cart-two-secret

ENV_ONE=1
ENV_THREE=3
COMMON_TYPE=1

So here the two pods contain pod-wise secrets.

So here I create a common env.

Secret— common-secret

COMMON_TYPE=1

And Remove the Common Secret from other Pod Secret.

Pod 1 — cart-one-secret

ENV_ONE=1
ENV_TWO=2

Pod 2 — cart-two-secret

ENV_ONE=1
ENV_THREE=3
COMMON_TYPE=1

Now you have to modify the Kubernetes deployment.

apiVersion: apps/v1
kind: Deployment
metadata:
  annotations:
    name: cart-one
spec:
  progressDeadlineSeconds: 600
  replicas: 1
  revisionHistoryLimit: 10
  selector:
    matchLabels:
      app: cart-one
  strategy:
    rollingUpdate:
      maxSurge: 25%
      maxUnavailable: 25%
  template:
    metadata:
      annotations:
        secret.reloader.stakater.com/reload: cart-one-secret
      labels:
        app: cart-one
    spec:
      containers:
        envFrom:
        - secretRef:
            name: cart-one-secret
        image: docker.io/cart/cart-one/136a45d:136a45d
        imagePullPolicy: Always
        name: cart-one
        ports:
        - containerPort: 3000
          name: env
          protocol: TCP
        resources:
          limits:
            cpu: 150m
            memory: 150Mi
          requests:
            cpu: 50m
            memory: 50Mi

At the deployment, there is an envFrom containing the secret key called secretRef. So here in one secretEnv then you have to add common secretEnv.

envFrom:
    - secretRef:
        name: cart-one-secret
    - secretRef:
        name: cart-two-secret

Now the pod (cart-one-deployment) have then two secret env. If You can see the env details from the pod. Exec/run the pod

kubectl exec -it cart-one-57494cf954-9fg6f -- printenv | grep -i COMMON_TYPE=

Output

ENV_ONE=1
ENV_TWO=2
COMMON_TYPE=1

Now if you wanted to reload/re-create-container the pod. At template, metadata modifies the secret

template:
    metadata:
      annotations:
        secret.reloader.stakater.com/reload: cart-one-secret,common-secret

If you change any secret at the common secret then the pod will re-create the pod.

If you create a common secret from another pod cart-two. Then use the same process as cart-one.

Happy Learning…

Kubernetes RBAC User Permission Manage

Arnob — Mon, 08 Jun 2026 16:17:52 +0000

Kubernetes RBAC stands for Role-Based Access Control. It is a security mechanism Kubernetes provides to control and manage access to resources within a cluster. RBAC allows cluster administrators to define fine-grained permissions and roles for individual users or groups, enabling them to access and perform specific actions on various resources.

Here I will share how you manage permission based on the user. I will give full details of how you handle the user permission. you can ignore it if you already have users.

First, you have to create a policy. Go to “IAM dashboard”

Now you have to go to the Policies Page

Now create policies

{
    "Version": "2012-10-17",
    "Statement": [        {
            "Effect": "Allow",
            "Action": […

Kubernetes ElasticSearch Indices Snapshot And Restore Using AWS S3

Arnob — Mon, 08 Jun 2026 16:15:40 +0000

ElasticSearch deployed in Kubernetes, so here I will describe everything about snapshots and restoring indices by using AWS S3.

At AWS S3, we need to give permission S3 Access IAM Policy

Here policy name AmazonS3BucketAccess

{
    "Version": "2012-10-17",
    "Statement": [        {
            "Action": [                "s3:*"
            ],
            "Effect": "Allow",
            "Resource": [                "arn:aws:s3:::es-aws-s3-bucket"
            ]
        },
        {
            "Action": [                "s3:*"
            ],
            "Effect": "Allow",
            "Resource": [                "arn:aws:s3:::es-aws-s3-bucket/*"
            ]
        }
    ]
}

AWS S3 configuration done. Now need to configure kubectl elastic search.

Now install ECK (Elastic Cloud on Kubernetes) resources

kubectl create -f https://download.elastic.co/downloads/eck/2.5.0/crds.yaml

Then

kubectl apply -f https://download.elastic.co/downloads/eck/2.5.0/operator.yaml

Now need to give aws access and aws secret to elasticsearch keystore. You can’t find the keystore at kibana UI. You need to add the Keystore at deployment.

Need to configure at deployment.

Need to install a repository-s3 plugin at Kubernetes

- name: install-plugins
  command:
    - sh
    - -c
    - |
      bin/elasticsearch-plugin install --batch repository-s3

Now add the AWS Access Key and Secret Access with mapping with elastic search keystore.

- name: add-aws-keys
  env:
  - name: AWS_ACCESS_KEY_ID
    value: <AWS_ACCESS_KEY_ID>
  - name: AWS_SECRET_ACCESS_KEY
    value: <AWS_SECRET_ACCESS_KEY>
  command:
    - sh
    - -c
    - |
      echo $AWS_ACCESS_KEY_ID | bin/elasticsearch-keystore add --stdin --force s3.client.default.access_key
      echo $AWS_SECRET_ACCESS_KEY | bin/elasticsearch-keystore add --stdin --force s3.client.default.secret_key

Here is the ElasticSearch deployment yaml.

After the deployment, you need to wait for 1–2 minutes to get deployment in service.

Snapshot

Create a _snapshort PUT request from Kibana Dev Tools. Here at AWS S3 bucket gives a bucket name.

PUT /_snapshot/s3_repository?verify=false&pretty
{
  "type": "s3",
  "settings": {
    "bucket": "es-aws-s3-bucket",
    "region": "ap-northeast-3"
  }
}

Response

{
  "acknowledged": true
}

After create the repository, need to check the verification status

If it give connected. Done. If not then check the AWS S3 bucket access key, secret access key, also the AWS S3 IAM role.

Now needs to back up the indices (index) to AWS S3 Buckets.

PUT _snapshot/s3_repository/backup
{
  "indices": "*",
  "ignore_unavailable": true,
  "include_global_state": false,
  "partial": false
}

Response

{
  "accepted": true
}

Also, you can create a Snapshot Policy from kibana

Snapshot Policy Create

Here need to give a snapshot details

Give a Policy name like snapshot-policy

Giving Snapshot Name like . This means it will take the snapshot in present day.

Note: If you wanted to take the snapshot previous day then you have to give the snapshot name .

The created Repository will be shown here. On the 1st you create the s3_repository

Giving the snapshot schedule.

Here give your snapshot setting.

Snapshot retention, you can configure deleting snapshots after some days/m

If your setting is good then it creates the policy

Policy created. Or you can create a policy by using DevTools

PUT /_slm/policy/snapshot-policy
{
  "schedule": "0 30 1 * * ?",   // Set a time when the snapshot should be taken, for example, 01:30 UTC
  "name": "<snapshot-{now/d-1d}>",
  "repository": "s3_repository",
  "config": {
    "indices": "<logstash-{now/d-1d}>",
    "ignore_unavailable": true,
    "include_global_state": false
  }
}

If you need to this policy then you see that snapshot setting at selected data streams and indices.

Selected Data streams and indices see the index patterns at the setting page.

Here the policy details view.

Need to check the AWS S3 Buckets Objects, Are indices(index) backup or not

Indices are backed up in AWS S3.

When the schedule snapshot is taken, the snapshot history looks like this

Restore

Here I show you, how you restore the backup.

If you using KGL(Kibana Query Language) then

POST _snapshot/s3_repository/backup/_restore
{
  "indices": "logstash-2023.09.26",
}

If you had some naming indices then you can rename the indices

POST _snapshot/s3_repository/backup/_restore
{
  "indices": "logstash-2023.09.26",
  "rename_pattern": "logstash-(.+)", 
  "rename_replacement": "logstash-ret-$1"
}

Here the rename pattern is the selected indices pattern to which you want to change the name. The rename will place the replacement rename before the $1.

Here $1 is the first group from your regular expression. The (.+) is regex (regular expression) consists of a sequence of sub-expressions. In this example, [0–9] and +. The […], known as a character class (or bracket list), encloses a list of characters. It matches any SINGLE character in the list.

Response

{
  "acknowledged": true
}

After restoring the indices, if you search the indices

GET _cat/indices

You see the logstash-2023.09.26 is restore to logstash-ret-2023.09.26.

Restoring Done.

PUT _snapshot/s3_repository/backup if this response give this message then

{
  "error": {
    "root_cause": [      {
        "type": "repository_exception",
        "reason": "[s3_repository] Could not determine repository generation from root blobs"
      }
    ],
    "type": "repository_exception",
    "reason": "[s3_repository] Could not determine repository generation from root blobs",
    "caused_by": {
      "type": "i_o_exception",
      "reason": "Exception when listing blobs by prefix [index-]",
      "caused_by": {
        "type": "amazon_s3_exception",
        "reason": "The request signature we calculated does not match the signature you provided. Check your key and signing method. (Service: Amazon S3; Status Code: 403; Error Code: SignatureDoesNotMatch; Request ID: EPKD1F7TRQEFYRJQ; S3 Extended Request ID: x9cP0DSRbIzQlUExCjnmTItFJlkhEXx3wFMMVKUTMH+Nxeu6aQAApWmEJdUGwaH6bX9p8VWAAhs=; Proxy: null)"
      }
    }
  },
  "status": 500
}

This means your ElasticSearch not connecting with AWS S3.
You have to check the AWS S3 Access keys. If not solve the problem, then you have to add another access key, it will solve the problem

Thank you.

Happy Learning ….

AWS Lambda Introduction & Create A Serverless Function

Arnob — Mon, 08 Jun 2026 16:14:53 +0000

What is Lambda

AWS Lambda is an event-driven, serverless computing platform provided by Amazon as a part of Amazon Web Services. It is a computing service that runs code in response to events and automatically manages the computing resources required by that code.

How it works

AWS Lambda is a serverless, event-driven compute service that lets you run code for virtually any type of application or backend service without provisioning or managing servers. You can trigger Lambda from over 200 AWS services and software as a service (SaaS) applications, and only pay for what you use.

I share those infromation from AWS Lambd 😁

Create a Lambda Function

Here i use Serverless for Lambda function. By using Serverless make easier to create and deploy a serverless function.

Install a serverless package.

npm install -g serverless

After installing the serverless. Run serverless from terminal

serverless

output

Now select a project type. Here i select AWS — Node.js — HTTP API . Here i project name aws-node-http-api-project .

Here i don’t need to serverless dashboard because we not need the serverless dashboard so we set to No. And we not need to deploy it also selected No.

Now open the project code at Visual Studio Code

The file list

At serverless.yaml there region is not given. Better you have to define the region. If you not give any region then it default region us-east-1 will be deployed.

service: aws-node-http-api-project
frameworkVersion: '3'
provider:
  name: aws
  runtime: nodejs18.x
  region: ap-southeast-1 # Region is Singapore
functions:
  api:
    handler: index.handler
    events:
      - httpApi:
          path: /
          method: get

The Index.js is like a hello World 😁

module.exports.handler = async (event) => {
  return {
    statusCode: 200,
    body: JSON.stringify(
      {
        message: "Go Serverless v3.0! Your function executed successfully!",
        input: event,
      },
      null,
      2
    ),
  };
};

So now deploy the serverless.

serverless deploy

Here had a profile so use my profile for deploy.

serverless deploy --aws-profile arn

So visit the site using the link [https://n7bu0mlvah.execute-api.ap-southeast-1.amazonaws.com](https://n7bu0mlvah.execute-api.ap-southeast-1.amazonaws.com/)

Lambda Function deployed.

Hope so you learn, how to deploy a lambda function by using serverless framework.

Happy Learning ….

Configuring Lambda Function For Custom Domain By Using API Gateway

Arnob — Mon, 08 Jun 2026 16:14:08 +0000

Here Configuring a custom domain for AWS Lambda Function with API Gateway.

Create Lambda Function

At first create a lambda function. Here i just create a normal hello-world function.

Here the function

export const handler = async (event) => {
  // TODO implement
  const response = {
    statusCode: 200,
    body: JSON.stringify('Hello from Lambda!'),
  };
  return response;
};

This is the hello world function. Now this function need to connect custom domain.

Create API Gateway

Go to Lambda function add a API Gateway

After clicking the add trigger button, Search API Gateway. Select that

At Intent, Select Create a new API and Security is open, Then click Add Button.

Then at Configuration > Triggers, a API Gateway came.

You can visit the link

Here the API Gateway creating is Done. Now need to add custom domain.

Add Custom Domain

If you don’t mapping with Cloudflare and AWS Certificate Manager . Then you have to map it 1st.

AWS Certificate Manager

Click Request a Certificate

Click Next

Then you see the Certificates list. Click on the id

Note: This Domain Already Issued. I just show to process.

Then copy the CNAME Name and CNAME Value. Then add to the cloudflare dns record

After add the record. Wait 5 min, it will be issued.

Add API Gateway

Now add a custom Domain Names

Create a Domain

Then Click Create Domain Name Button.

Note: It will be created. I already create this domain. So here getting the error message.

Then goto Custom Domain Names. Select the domain

Copy the API Gateway domain name. Then goto Cloudflare. Add a record

Done. Now wait for 5 min. It will sync the DNS Record.

Custom Domain Mapping Done.

How To Read S3 File/Image Using Lambda Functions

Arnob — Mon, 08 Jun 2026 16:13:25 +0000

Here i share how you preview image using API Gateway, S3 and Lambda Function. This function build on Node.js 18.x

Create A Lambda Function

Give a function name, Runtime, Architecture.

After creating the function. Need to Add trigger with S3 and API Gateway

Add Trigger at S3 and API Gateways

Here 1st i adding S3 as a trigger with this function.

Give the selected bucker name and event type. After that click Add.

2nd adding the API Gateway

At API Gateway, create intent as a create a new API , Set API Type is HTTP API , At Security, Select Open. Then Click Add Button.

Trigger configuration done.

Adding Code

Now Add Code at index.js

const AWS = require('aws-sdk');
const s3 = new AWS.S3();
exports.handler = async (event, context) => {

  const bucketName = '<BUCKET_NAME>';
  const imageKey = '<IMAGE_KEY/NAME>'; // Replace 'your-image-key.jpg' with your actual image key

  try {
    const params = {
      Bucket: bucketName,
      Key: imageKey,
    };

     const s3Object = await s3.getObject(params).promise();
    if (!s3Object || !s3Object.Body) {
      return {
        statusCode: 404,
        body: JSON.stringify({ message: 'Image not found' })
      };
    }
    const imageData = Buffer.from(s3Object.Body, 'binary').toString('base64') ;
    return {
      statusCode: 200,
      headers: {
        'Content-Type': 'image/jpeg'
      },
      isBase64Encoded: true,
      body: imageData

    };
  } catch (error) {
    return {
      statusCode: 500,
      body: JSON.stringify(error.message)
    };
  }
};

Here a a require package needed. But you can’t add node_modules at Lambda function. Need to create a layer.

Goto Lambda Function > Layer (At Additional resources)

Creating a layer

Give a function name, upload the zip file, select the Compatible architectures and select the compatible runtimes. Then Create Layer.

After that, you need to add that layer to lambda function.

Adding Layer

At the Code Section, the bottom you find the Layers section.

Click Add a layer

Select Custom Layers, there it shows your created layers. Add that layer then click Add Button.

Then 1 layer has added.

Now goto Configuration > Click Triggers

Here you see a API Gateway endpoint and S3 bucket

When you click the link, you see the image,

Happy Coding…

Here a Payoneer Refer Link

Images Resizing From S3 Using Lambda Function and CloudFront

Arnob — Mon, 08 Jun 2026 16:12:47 +0000

Change the image size on the fly from S3 Object, also using CDN for serving the image.

Story: Images are store in S3. The recruitment is view any image any size on the fly and send to the response using recommend size. The resizing image will serve at CDN using CloudFront.

Lambda Function Deployment

For lambda function i use Serverless Apps. 1st need to create a node package.

npm init

Output

{
  "name": "image-resizer-function",
  "version": "1.0.0",
  "description": "Image Resizer Function",
  "main": "index.js",
  "keywords": [],
  "author": "",
  "license": "ISC",
}

Now install serverless

npm install serverless -g

After install the serverless. Create a Serverless app, At terminal

serverless

Select HTTP API.

Project created.

Now adding the code to that index.js

At Lambda Function Preview

Here added 2 packages. So need to add 2 layer at Lambda Function.

If you deploy this project that project will get Internal Server Error. Now we can deploy this function. Then add the layer to that function.

Lambda Function Deployment

Here the Serverless yaml config

service: aws-node-http-api-project
frameworkVersion: '3'
provider:
  name: aws
  runtime: nodejs18.x
  region: us-east-1
functions:
  api:
    handler: index.handler
    events:
      - httpApi:
          path: /{pathA}
          method: get
      - httpApi:
          path: /{pathA}/{pathB}
          method: get
      - httpApi:
          path: /{pathA}/{pathB}/{pathC}
          method: get

Need to run this at terminal

serverless deploy

Output

The AWS Lambda Console

Here a Serverless add a API Gateway. Now adding a S3 Bucket with Lambda Function.

S3 Bucket Creating and Manage

Here the bucket name is img-resizer-v1

The Object Ownership ACLs Enabled*.*

Allow Public Access.

Creating Done.

Now edit the bucket policy

Bucket > img-resizer-v1 > Edit Bucket Policy

{
    "Version": "2012-10-17",
    "Statement": [        {
            "Sid": "PublicReadGetObject",
            "Effect": "Allow",
            "Principal": "*",
            "Action": "s3:*",
            "Resource": "arn:aws:s3:::img-resizer-v1/*"
        }
    ]
}

Now uploading some images at Buckets.

Connecting Lambda function with S3

Click Add Trigger

Select S3

Select the Selected bucket. Then Click Add

Add Layer

Now Add Layer at the function. At the bottom get the layer section.

Click Add Layer. At Choose a layer select Custom Layers.

Note: Now you add the layer i will share later.

Add aws-sdk and sharp with this layer.

At Function 2 Layer added.

Testing

Now test the Lambda Function. At the Configuration Tab. Select Triggers. You will see the API Gateway. There you will find a API Endpoint

For testing view the image from API Gateway link.

For testing the image resizing. Given the image size width is 500px

https://u4kqo8jrjd.execute-api.us-east-1.amazonaws.com/image.png?w=500

Working 😁. I think it will return some error 😅.

Now Applying CloudFront with Lambda Function

Applying Cloudfront CDN

Creating a Distributions.

Select Origin Domain, which is given URL by API Gateway

u4kqo8jrjd.execute-api.us-east-1.amazonaws.com

Protocol is HTTPS only.

At Default cache behavior, Viewer protocol policy is HTTPS Only.

At Cache key and origin requests, Cache policy is Caching Optimized

For creating image resizing parameter need to create a cache policy and origin request policy.

Goto Policy Tab, Creating cache policy and origin request policy

Then click Origin Request Tab. Create origin request policy

Click Create Button.

At CloudFront page click refresh button, newly created policy will show there,

At Web Application Firewall (WAF) Select Do Not Enable Security Protections

At Settings, if you wanted to add domain, you need to create a Certificate, then add the sub-domain with CloudFront.

Goto AWS Certificate Manager > Certificates

Give the Domain Name

image-resizer.arn-ob.xyz

Click Request.

Click Certificate ID

Add the DNS to CNAME name and value to Cloudflare

Click Save. It will take some time to validate the Domain. Now it status is Pending Validation.

After 2–3 min. It will issued.

Now add the sub-domain to CloudFront

All Done. Click Create Distribution. Now it will take 5–10 min for deploying CDN.

Now connect the sub-domain with CloudFront.

Domain mapping done with CloudFront CDN.

Tesitng

Original Image

Resizing Image

Image Resizing Done. 😁

So here we use CloudFront CDN, Now testing the image return response time.

Here CloudFront CDN working Good. 😁

The project repository:
https://github.com/arn-ob/aws-img-resizer-s3-lambda-cdn

Thank you for Reading…

Configure Kubernetes & Manage Other Domains by using Nginx Proxy Manager

Arnob — Mon, 08 Jun 2026 16:12:10 +0000

Here I used CNAME instead of an IP because I needed to run both Proxy Manager and Kubernetes, but both use port 80. One had to run on port 80 directly, and the other through CNAME. Since I hadn’t used CNAME before, I had to learn and test it and finally, I got it working.

What is Nginx Proxy Manager?

Expose your web services easily with free SSL from Let’s Encrypt.
Built with security in mind, it’s perfect for home or private networks.
You can manage Proxy Hosts, Redirection Hosts, Streams.

Deploying Nginx Proxy Manager To VM

1st you have to install docker. For using the NPM.
Create an docker-compose.yml

services:
  app:
    image: 'jc21/nginx-proxy-manager:latest'
    restart: unless-stopped
    ports:
      - '80:80' # Public HTTP Port
      - '443:443' # Public HTTPS Port
      - '81:81' # Admin Web Port
    environment:
      # Mysql/Maria connection parameters:
      DB_MYSQL_HOST: "db"
      DB_MYSQL_PORT: 3306
      DB_MYSQL_USER: "npm"
      DB_MYSQL_PASSWORD: "npm"
      DB_MYSQL_NAME: "npm"

    volumes:
      - ./data:/data
      - ./letsencrypt:/etc/letsencrypt
    depends_on:
      - db
  db:
    image: 'jc21/mariadb-aria:latest'
    restart: unless-stopped
    environment:
      MYSQL_ROOT_PASSWORD: 'npm'
      MYSQL_DATABASE: 'npm'
      MYSQL_USER: 'npm'
      MYSQL_PASSWORD: 'npm'
      MARIADB_AUTO_UPGRADE: '1'
    volumes:
      - ./mysql:/var/lib/mysql

Run the docker compose

docker compose up -d

https://nginxproxymanager.com/screenshots/login.png

The Default Administrator User

Email:    admin@example.com
Password: changeme

Change the password and email after login

Also you can modify in docker-compose.yml

environment:
      INITIAL_ADMIN_EMAIL: my@example.com
      INITIAL_ADMIN_PASSWORD: mypassword1

After Login

Now Creating an Proxy Host

Note: The dashboard will empty, Here i sharing my dashboard.

Networking:

Now its time to configure the Network. We will make the 80 port with Proxy manager also kubernetes. So my router is mikrotik

First Step: We are going to configure Proxy Manager

Check and get proxy manager ip

Here is the ip is 192.168.88.180

Now target the ip to mikrotik. At Mikrotik goto IP > Firewall > NAT

Add an NAT rules

Note: Please add your public ip at Dst. Address (change from X.X.X.X to public ip).

Then add the local ip at Action.

After that need to create and Proxy Host at Proxy Manager, Goto Dashboard, Click Add Proxy Host button.

Note: I configure that previously so here is the edit tab.

Here is the details:
Sub-Domain: proxy.arn-ob.xyz
Scheme: http
Forward IP: 192.168.88.180
Forward Port: 80

No need to configure the SSL.

Now goto Cloudflare, Add that sub domain to DNS

This now using CNAME, for other sub domain at Cloudflare

Another config are need, that is Cloudflare SSL/TLS. Make sure the Current encryption mode is Full

Networking Part is Done.

Proxy Manager Configure

Now adding kubernetes nginx ingress ip to nginx proxy manager.

Now getting ip from vm. Goto VM open terminal type

ip a

At output you will find the ip. Copy that.

Now check the ingress is it giving private ip or not

VM ip and kubernetes ingress not same, its ok. In the behind i using MetalLB. It will manage the internal networking.

Then Goto Dashboard, Click Add Proxy Host button

Give the Domain Name, Scheme, Forward Hostname/IP, Forward Port

Here the details:

Domain Name: nginx.arn-ob.xyz
Scheme: http
Forward Hostname/IP: 192.168.88.175 (kubernetes ingress ip)
Forward Port: 80

Now add the SSL from Let’s Encrypt, Go to SSL Tab, Then you see this

Here the config

Request a SSL Certificate. Also enable HTTP/2 Support. Then give the check mark of I Agree. Then Save.

If give an Internal Error. Then Check you enable 80 port or your router NAT config which based on proxy manager private IP with public IP

Then Add the record to Cloudflare DNS

Remember we add the proxy.arn-ob.xyz sub-domain with External IP.

Now for nginx.arn-ob.xyz sub-domain mapping Content with the proxy.arn-ob.xyz as type as CNAME.

Now hit the browser with the domain nginx.arn-ob.xyz. Hope you will see this screen

Thank you for Reading.

CNAME Cross-User Banned Issue

Arnob — Mon, 08 Jun 2026 16:11:32 +0000

I will share how to solve the CNAME Cross-User Banned issue

The “CNAME Cross-User Banned” error usually happens on AWS CloudFront (but also in other CDN providers) when you try to associate a custom domain (CNAME/alternate domain name) with a distribution, but that domain is already registered with another account.

This is a security restriction to prevent CNAME hijacking (so someone else cannot claim your domain and serve content under it without authorization). But you configure that for right.

Here i am using Proxy Manager. So i need to connect other domain using proxy manager

So How i got that error:

You have Nginx Proxy Manager (NPM) running.
It listens on port 80 with the hostname proxy.pxydomain.xyz.
You then added another domain (anotherdomain.xyz) into Proxy Manager.
In DNS, instead of pointing anotherdomain.xyz directly with an A record to your server’s IP, you created a CNAME like this:

anotherdomain.xyz     CNAME    proxy.pxydomain.xyz

Now you’re getting the CNAME Cross-User Banned error.

Why this happens

The error isn’t from your DNS itself — it’s usually from Cloudflare, AWS CloudFront, or another CDN/proxy layer in front of your setup.

Cloudflare in particular blocks “CNAME flattening” if the target (proxy.pxydomain.xyz) doesn’t belong to your account or doesn’t resolve in a way Cloudflare accepts.
AWS CloudFront also blocks if the CNAME target (proxy.pxydomain.xyz) is registered with a distribution in another AWS account.

So, the issue comes from your DNS proxy/CDN provider not allowing you to CNAME one apex/root domain (**anotherdomain.xyz**) to another domain (**proxy.pxydomain.xyz**) unless you prove ownership of both.

Here the solutions:

Option 1 — Use A/AAAA record directly

Instead of CNAME:

anotherdomain.xyz  A     <your server IP>

Then let Nginx Proxy Manager handle the domain internally. This is the simplest and avoids the CNAME restriction

Option 2 — Use CNAME only for subdomains

Some providers (like Cloudflare) don’t allow CNAME at the root domain (anotherdomain.xyz). But they allow it for subdomains, e.g.:

www.anotherdomain.xyz  CNAME  proxy.pxydomain.xyz

Then redirect anotherdomain.xyz → [www.](http://www.greatmind.xyz.)anotherdomain[.xyz](http://www.greatmind.xyz.).

Option 3 — Same CDN account

If you’re using Cloudflare:

Add both domains (**pxydomain.xyz** and **anotherdomain.xyz**) to the same Cloudflare account/zone.
Then Cloudflare won’t block the CNAME because it sees you own both.

Option 4 — Disable CDN proxying

If Cloudflare is the culprit:

Go to your DNS settings in Cloudflare.
Switch the orange cloud ☁️ (proxy) → to gray (DNS only).
This bypasses the restriction but loses Cloudflare proxy/CDN features.

Done.

Here i am using Option 4. And It works 😀

How to connect ProxMox with Proxy Manager

Arnob — Mon, 08 Jun 2026 16:10:56 +0000

Here i share how to use Proxmox in Proxy Manager, you’re essentially trying to proxy Proxmox’s web interface or API (port 8006) through your reverse proxy securely — so you can access it via a domain like https://proxmox.example.com instead of https://192.168.0.1:8006

Here’s how to do it cleanly depending on your proxy setup:

Nginx Proxy Manager (NPM) Configuration

Step 1: Add a new Proxy Host

Open Nginx Proxy Manager dashboard → click “Add Proxy Host”.
In the Details tab:
- Domain Names: proxmox.example.com
- Scheme: https
- Forward Hostname / IP:
- Forward Port: 8006
- Enable — Block Common Exploits
- Enable -Websockets Support
- Disable — Cache Assets

Step 2: SSL

Go to the SSL tab.
Select:
- SSL Certificate: Request a new Let’s Encrypt certificate.
- Enable Force SSL and HTTP/2 Support.

Step 3: Custom Nginx config (important)

In NPM, under “Advanced”, add:

proxy_ssl_verify off;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-Proto $scheme;

This disables SSL verification for Proxmox’s backend self-signed cert and ensures WebSocket/Console access works.

Done.