Hello friends in the aaPanel community,
I am currently managing the servers for a payment aggregation platform (using CodeIgniter) that relies heavily on API integration. Over the past few days, our servers have been continuously hit by DDoS (L7) attacks, causing CPU usage to spike to 100% and causing 503 Service Unavailable errors.
Environment Specifications:
OS: AlmaLinux
Panel: aaPanel 7.46.0
Web Server: Apache (planning to migrate to Nginx if recommended)
Application: CodeIgniter (PHP-FPM)
Proxy/DNS: Cloudflare (Free Version)
Attack Characteristics as Recorded in Logs:
- The attacker targeted specific endpoints (such as /api/..., /mitra/, and root/) using millions of simultaneous requests.
- They used fake user agents (ranging from Axios and MSIE 7.0 to modern browsers like Chrome/Mac OS).
- Initially, they targeted the VPS's public IP address to bypass Cloudflare
Mitigation Steps I've Taken:
Cloudflare WAF: I've blocked User-Agent bots (axios, python, curl), implemented Rate Limiting, and implemented Geo-blocking (only allowing traffic from Indonesia/ID).
Question for the Community:
Although attacks have significantly subsided thanks to firewalld and Cloudflare, I'd like to ask for suggestions on best practices for strengthening my server within aaPanel itself:
Tuning Web Server: Are there any specific settings in the aaPanel Apache menu (such as MaxKeepAliveRequests, Timeout, or LimitRequestFields) that I should change to minimize the impact of a DDoS attack?
Nginx Migration: I've been advised that Nginx is much more robust in handling concurrent connections than Apache. Is switching to Nginx in aaPanel the most appropriate step in my case?
aaPanel WAF Plugin: Do I still need to install and activate aaPanel's built-in WAF plugin (like Nginx/Apache WAF), or will that just overload the CPU and conflict with Cloudflare's WAF?
PHP-FPM Tuning: What's the best way to set the Max children and server limits in PHP-FPM via aaPanel to prevent the server from crashing (503) when the request queue suddenly spikes?
.
