Mastering NGINX - Second Edition

Table of Contents

Mastering NGINX - Second Edition

Credits

About the Author

About the Reviewer

www.PacktPub.com

eBooks, discount offers, and more

Why subscribe?

Preface

What this book covers

What you need for this book

Who this book is for

Conventions

Reader feedback

Customer support

Downloading the example code

Downloading the color images of this book

Errata

Piracy

Questions

1. Installing NGINX and Third-Party Modules

Installing NGINX using a package manager

Installing NGINX on CentOS

Installing NGINX on Debian

Installing NGINX from source

Preparing a build environment

Compiling from source

Table – Common configure options

Table – Configure options for optimization

Configuring for web or mail service

Configure options for a mail proxy

Table: Mail configure options

Configure options to specify paths

Table – HTTP configuration options

Configuring SSL support

Enabling various modules

Table – HTTP module configure options

Disabling unused modules

Table – Disable configure options

Finding and installing third-party modules

Adding support for Lua

Putting it all together

Summary

2. A Configuration Guide

The basic configuration format

NGINX global configuration parameters

Using the include files

The HTTP server section

Client directives

File I/O directives

Hash directives

Socket directives

Sample configuration

The virtual server section

Locations – where, when, and how

Full sample configuration

Summary

3. Using the mail Module

Basic proxy service

The mail server configuration section

POP3 service

IMAP service

SMTP service

Using SSL/TLS

Complete mail example

Authentication service

Combining with memcached

Interpreting log files

Operating system limits

Summary

4. NGINX as a Reverse Proxy

Introducing reverse proxying

The proxy module

Legacy servers with cookies

The upstream module

Keepalive connections

Types of upstream servers

Single upstream server

Multiple upstream servers

Non-HTTP upstream servers

Memcached upstream servers

FastCGI upstream servers

SCGI upstream servers

The uWSGI upstream servers

Load-balancing

Load-balancing algorithms

Converting an if-fy configuration to a more modern interpretation

Using error documents to handle upstream problems

Determining the client's real IP address

Summary

5. Reverse Proxy Advanced Topics

Security through separation

Encrypting traffic with SSL

Authenticating clients using SSL

Blocking traffic based on originating IP address

Isolating application components for scalability

Reverse proxy performance tuning

Buffering data

Caching data

Storing data

Compressing data

Summary

6. The NGINX HTTP Server

NGINX's architecture

The HTTP core module

The server directive

Logging in NGINX

Finding files

Name resolution

Interacting with the client

Using limits to prevent abuse

Restricting access

Streaming media files

Predefined variables

SPDY and HTTP/2

Using NGINX with PHP-FPM

An example Drupal configuration

Wiring NGINX and uWSGI together

An example Django configuration

Summary

7. NGINX for the Application Developer

Caching integration

No application caching

Caching in the database

Caching in the filesystem

Changing content on-the-fly

Using the addition module

The sub module

The xslt module

Using Server Side Includes

Decision-making in NGINX

Creating a secure link

Generating images

Tracking website visitors

Preventing inadvertent code execution

Summary

8. Integrating Lua with NGINX

The ngx_lua module

Integrating with Lua

Logging with Lua

Summary

9. Troubleshooting Techniques

Analyzing log files

The formats of the error_log file

Error log file entry examples

Configuring advanced logging

Debug logging

Switching binaries at runtime

Using access logs for debugging

Common configuration errors

Using if instead of try_files

Using if as a hostname switch

Not using the server context to best effect

Operating system limits

File descriptor limits

Network limits

Performance problems

Using the Stub Status module

Summary

A. Directive Reference

B. The Rewrite Rule Guide

Introducing the rewrite module

Creating new rewrite rules

Translating from Apache

Rule #1 – Replacing directory and file existence checks with try_files

Rule #2 – Replacing matches against REQUEST_URI with a location

Rule #3 – Replacing matches against HTTP_HOST with a server

Rule #4 – Replacing RewriteCond with if for variable checks

Summary

C. The NGINX Community

NGINX Plus

Mailing list

IRC channel

Web resources

Writing a good bug report

Summary

D. Persisting Solaris Network Tunings

Index

Mastering NGINX - Second Edition

Mastering NGINX - Second Edition

Copyright © 2016 Packt Publishing

All rights reserved. No part of this book may be reproduced, stored in a retrieval system, or transmitted in any form or by any means, without the prior written permission of the publisher, except in the case of brief quotations embedded in critical articles or reviews.

Every effort has been made in the preparation of this book to ensure the accuracy of the information presented. However, the information contained in this book is sold without warranty, either express or implied. Neither the author, nor Packt Publishing, and its dealers and distributors will be held liable for any damages caused or alleged to be caused directly or indirectly by this book.

Packt Publishing has endeavored to provide trademark information about all of the companies and products mentioned in this book by the appropriate use of capitals. However, Packt Publishing cannot guarantee the accuracy of this information.

First published: March 2013

Second edition: July 2016

Production reference: 1220716

Published by Packt Publishing Ltd.

Livery Place

35 Livery Street

Birmingham B3 2PB, UK.

ISBN 978-1-78217-331-1

www.packtpub.com

Credits

Author

Dimitri Aivaliotis

Reviewer

Markus Jelsma

Acquisition Editor

Kevin Colaco

Content Development Editor

Rashmi Suvarna

Technical Editors

Naveenkumar Jain

Novina Kewalramani

Copy Editor

Vikrant Phadke

Project Coordinator

Judie Jose

Proofreader

Safis Editing

Indexer

Hemangini Bari

Graphics

Kirk D'Penha

Production Coordinator

Shantanu N. Zagade

Cover Work

Shantanu N. Zagade

About the Author

Dimitri Aivaliotis is a production engineer in Silicon Valley. His career has taken him from building a Linux-based computer network for a school up through multi-datacenter, high-availability infrastructures for banks and popular websites. He has spent over a decade solving his customers' problems and learned NGINX along the way.

Dimitri graduated summa cum laude with a BS in Physics from Rensselaer Polytechnic Institute and received an MS in Management Information Systems at Florida State University.

One would think that a second edition should be easy to write, correcting the errors of the first and updating the content. On the one hand, there is much less to write from scratch, but on the other hand, everything must be re-evaluated. It's not as easy as it may seem 
at first.

I'd like to thank all the reviewers for keeping me honest and pointing out where things are not clear. Any remaining errors are, of course, my own.

Thank you Packt for giving me this opportunity to have another go at writing this book.

Thank you Nginx Inc. for creating a product so flexible and performant that it's still in wide use today.

About the Reviewer

Markus Jelsma is the CTO and co-owner of Openindex B.V, a Dutch company specializing in open source search and crawl solutions. As a committer and PMC member of Apache Nutch, he's an expert in search engine technology and web crawling solutions.

www.PacktPub.com

eBooks, discount offers, and more

Did you know that Packt offers eBook versions of every book published, with PDF and ePub files available? You can upgrade to the eBook version at www.PacktPub.com and as a print book customer, you are entitled to a discount on the eBook copy. Get in touch with us at for more details.

At www.PacktPub.com, you can also read a collection of free technical articles, sign up for a range of free newsletters and receive exclusive discounts and offers on Packt books and eBooks.

https://www2.packtpub.com/books/subscription/packtlib

Do you need instant solutions to your IT questions? PacktLib is Packt's online digital book library. Here, you can search, access, and read Packt's entire library of books.

Why subscribe?

Fully searchable across every book published by Packt

Copy and paste, print, and bookmark content

On demand and accessible via a web browser

For Katja. You mean the world to me.

Preface

NGINX is a high-performance web server designed to use very few system resources. There are many how-to guides and example configurations floating around the Web. This guide will serve to clarify the murky waters of NGINX configuration. In doing so, you will learn how to tune NGINX for various situations, what some of the more obscure configuration options do, and how to design a decent configuration to match your needs.

You will no longer feel the need to copy-paste a configuration snippet because you will understand how to construct a configuration file to do exactly what you want it to do. This is a process and there will be bumps along the way, but with the tips explained in this book, you will feel comfortable writing an NGINX configuration file by hand. In case something doesn't work as expected, you will be able to debug the problem yourself, or at least be capable of asking for help without feeling like you haven't given it a try yourself.

This book is written in a modular fashion. It is laid out to help you get to the information you need as quickly as possible. Each chapter is pretty much a standalone piece. Feel free to jump in anywhere you feel you need to get more in-depth about a particular topic. If you feel you have missed something major, go back and read the earlier chapters. They are constructed in a way to help you grow your configuration piece by piece.

What this book covers

Chapter 1, Installing NGINX and Third-Party Modules, teaches you how to install NGINX on your operating system of choice and how to include third-party modules in your installation.

Chapter 2, A Configuration Guide, explains the NGINX configuration file format. You will learn what each of the different contexts is for, how to configure global parameters, and what a location is used for.

Chapter 3, Using the mail Module, explores NGINX's mail proxy module, detailing all aspects of its configuration. An example authentication service is included in the code for this chapter.

Chapter 4, NGINX as a Reverse Proxy, introduces the concept of a reverse proxy and describes how NGINX fills that role.

Chapter 5, Reverse Proxy Advanced Topics, delves deeper into using NGINX as a reverse proxy to solve scaling issues and performance problems.

Chapter 6, The NGINX HTTP Server, describes how to use the various modules included with NGINX to solve common webserving problems.

Chapter 7, NGINX for the Application Developer, shows how NGINX can be integrated with your application to deliver content to your users more quickly.

Chapter 8, Integrating Lua with NGINX, provides a brief look at how to extend NGINX functionality using the embedded Lua scripting language.

Chapter 9, Troubleshooting Techniques, investigates some common configuration problems, how to debug a problem once it arises, and makes some suggestions for performance tuning.

Appendix A, Directive Reference, provides a handy reference for the configuration directives used throughout the book, as well as a selection of others not previously covered.

Appendix B, The Rewrite Rule Guide, describes how to use the NGINX rewrite module and describes a few simple steps for converting Apache-style rewrite rules into ones NGINX can process.

Appendix C, The NGINX Community, introduces you to the online resources available to seek more information.

Appendix D, Persisting Solaris Network Tunings, details what is necessary to persist different network tuning changes under Solaris 10 and above.

What you need for this book

Any modern Linux PC should be sufficient to run the code samples in the book. The installation instructions are given in each chapter that uses code samples. Basically, it boils down to:

The build environment (compiler, header files, and so on)

NGINX (the most recent version should be fine)

Ruby (best installed from https://rvm.io)

Perl (the default version should be fine)

Who this book is for

You are an experienced systems administrator or systems engineer, familiar with installing and configuring servers to meet specific needs. You do not need experience using NGINX.

Conventions

In this book, you will find a number of text styles that distinguish between different kinds of information. Here are some examples of these styles and an explanation of their meaning.

Code words in text, database table names, folder names, filenames, file extensions, pathnames, dummy URLs, user input, and Twitter handles are shown as follows: This section will be placed at the top of the nginx.conf configuration file.

A block of code is set as follows:

http {

    include      /opt/local/etc/nginx/mime.types;

    default_type  application/octet-stream;

    sendfile on;

    tcp_nopush on;

    tcp_nodelay on;

    keepalive_timeout  65;

    server_names_hash_max_size 1024;

}

Any command-line input or output is written as follows:

$ mkdir $HOME/build $ cd $HOME/build && tar xzf nginx-.tar.gz

New terms and important words are shown in bold. Words that you see on the screen, for example, in menus or dialog boxes, appear in the text like this: Clicking the Next button moves you to the next screen.

Note

Warnings or important notes appear in a box like this.

Tip

Tips and tricks appear like this.

Reader feedback

Feedback from our readers is always welcome. Let us know what you think about this book—what you liked or disliked. Reader feedback is important for us as it helps us develop titles that you will really get the most out of.

To send us general feedback, simply e-mail <feedback@packtpub.com>, and mention the book's title in the subject of your message.

If there is a topic that you have expertise in and you are interested in either writing or contributing to a book, see our author guide at www.packtpub.com/authors.

Customer support

Now that you are the proud owner of a Packt book, we have a number of things to help you to get the most from your purchase.

Downloading the example code

You can download the example code files for this book from your account at http://www.packtpub.com. If you purchased this book elsewhere, you can visit http://www.packtpub.com/support and register to have the files e-mailed directly to you.

You can download the code files by following these steps:

Log in or register to our website using your e-mail address and password.

Hover the mouse pointer on the SUPPORT tab at the top.

Click on Code Downloads & Errata.

Enter the name of the book in the Search box.

Select the book for which you're looking to download the code files.

Choose from the drop-down menu where you purchased this book from.

Click on Code Download.

Once the file is downloaded, please make sure that you unzip or extract the folder using the latest version of:

WinRAR / 7-Zip for Windows

Zipeg / iZip / UnRarX for Mac

7-Zip / PeaZip for Linux

Downloading the color images of this book

We also provide you with a PDF file that has color images of the screenshots/diagrams used in this book. The color images will help you better understand the changes in the output. You can download this file from http://www.packtpub.com/sites/default/files/downloads/Bookname_ColorImages.pdf.

Errata

Although we have taken every care to ensure the accuracy of our content, mistakes do happen. If you find a mistake in one of our books—maybe a mistake in the text or the code—we would be grateful if you could report this to us. By doing so, you can save other readers from frustration and help us improve subsequent versions of this book. If you find any errata, please report them by visiting http://www.packtpub.com/submit-errata, selecting your book, clicking on the Errata Submission Form link, and entering the details of your errata. Once your errata are verified, your submission will be accepted and the errata will be uploaded to our website or added to any list of existing errata under the Errata section of that title.

To view the previously submitted errata, go to https://www.packtpub.com/books/content/support and enter the name of the book in the search field. The required information will appear under the Errata section.

Piracy

Piracy of copyrighted material on the Internet is an ongoing problem across all media. At Packt, we take the protection of our copyright and licenses very seriously. If you come across any illegal copies of our works in any form on the Internet, please provide us with the location address or website name immediately so that we can pursue a remedy.

Please contact us at <copyright@packtpub.com> with a link to the suspected pirated material.

We appreciate your help in protecting our authors and our ability to bring you valuable content.

Questions

If you have a problem with any aspect of this book, you can contact us at <questions@packtpub.com>, and we will do our best to address the problem.

Chapter 1. Installing NGINX and Third-Party Modules

NGINX was first conceived to be an HTTP server. It was created to solve the C10K problem, described by Daniel Kegel on http://www.kegel.com/c10k.html, in designing a web server to handle 10,000 simultaneous connections. NGINX can do this through its event-based connection-handling mechanism and will use the OS-appropriate event mechanism in order to achieve this goal.

Before we begin exploring how to configure NGINX, we will first install it. This chapter details how to install NGINX and how to get the correct modules installed and configured. NGINX is modular by design and there is a rich community of third-party module developers who have added functionality to the core NGINX server by creating modules that can be compiled into the server and installed along with it.

In this chapter, we will cover the following topics:

Installing NGINX using a package manager

Installing NGINX from source

Configuring for a web or mail service

Configuring SSL support

Enabling various modules

Finding and installing third-party modules

Adding support for Lua

Putting it all together

Installing NGINX using a package manager

Chances are that your operating system of choice already provides nginx as a package. Installing it is as simple as using your package manager's commands:

Linux (deb-based)

sudo apt-get install nginx

Linux (rpm-based)

sudo yum install nginx

FreeBSD

sudo pkg_install -r nginx

Note

The sudo command is representative of what you need to execute on your operating system to achieve superuser (root) privileges. If your operating system supports role-based access control (RBAC), then you would use a different command, such as pfexec, to achieve the same goal.

These commands will install NGINX into standard locations, specific to your operating system. This is the preferred installation method if you need to use your operating system's packages.

The NGINX core team also provides binaries of the stable version, available from http://nginx.org/en/download.html. Users of distributions without an nginx package (such as CentOS) can use the following instructions to install pre-tested and pre-compiled binaries.

Installing NGINX on CentOS

Add the NGINX repository to your yum configuration by creating the following file:

sudo vi /etc/yum.repos.d/nginx.repo [nginx] name=nginx repo baseurl=http://nginx.org/packages/centos/7/$basearch/ gpgcheck=0 enabled=1

Then install nginx by executing the following command:

sudo yum install nginx

Alternative instructions for installing an nginx-release package are available at the preceding URL.

Installing NGINX on Debian

Let's install NGINX on Debian using the following steps:

Install the NGINX signing key by downloading it from http://nginx.org/keys/nginx_signing.key and adding it to the apt keyring:

sudo apt-key add nginx_signing.key

Append the nginx.org repository to the end of /etc/apt/sources.list:

vi /etc/apt/sources.list

deb http://nginx.org/packages/debian/ jessie nginx

deb-src http://nginx.org/packages/debian/ jessie nginx

Then install nginx by executing the following command:

sudo apt-get updatesudo apt-get install nginx

If your operating system does not include nginx in its list of available packages, the version is too old for what you would like to do, the packages at nginx.org don't serve your needs, you would like to use the development release of NGINX, or if you want to enable/disable specific modules, then compiling NGINX from source is the only other option.

Installing NGINX from source

NGINX downloads are available for two separate branches of NGINX code—mainline and stable. The mainline branch is the one in which active development is taking place. Here is where new features will be found and integrated before finding their way into the stable branch. When a mainline version is released, it has undergone the same QA and a similar set of functional tests as the stable branch, so either branch may be used on production systems. The major difference between the two branches lies in the support of third-party modules. The internal API may change in the mainline release, whereas it stays the same on the stable branch, so backward compatibility for third-party modules is only available for stable releases.

Preparing a build environment

In order to compile NGINX from source, certain requirements need to be met on your system. Besides a compiler, you also need the OpenSSL and Perl Compatible Regular Expressions (PCRE) libraries and development headers if you want to enable SSL support and be able to use the rewrite module, respectively. The rewrite module is enabled by default, so if you don't have PCRE libraries and headers, you'll need to disable the rewrite module during the configuration phase. Depending on your system, these requirements may already be met in the default installation. If not, you will need to both locate the appropriate package and install it, or download the source, unpack it, and point NGINX's configure script to this location.

NGINX will attempt to build a dependent library statically if you include a --with-= option to configure. You might do this if you want to ensure that NGINX is not dependent on any other part of the system and/or would like to squeeze that extra bit of performance out of your nginx binary. If you are using features of external libraries that are only available from a certain version onwards (for example, the next protocol negotiation TLS extension available from OpenSSL Version 1.0.1), then you have to specify the path to the unpacked sources of that particular version.

There are other, optional, packages that you can provide support for, if you like. These include MD5 and SHA-1 hashing algorithm support, zlib compression, and libatomic library support. The hashing algorithms are used in many places in NGINX, for example, to compute the hash of a URI to determine a cache key. The zlib compression library is used for delivering gzipped content. If the atomic_ops library is available, NGINX will use its atomic memory update operations to implement high-performance memory-locking code.

Compiling from source

NGINX can be downloaded from http://nginx.org/en/download.html. Here you will find the source of either branch in .tar.gz, or .zip