12 ms·

Nginx v1.10.0 Stable Version Released

76 points by conductor 10y ago

DanielDent 10y ago
Nginx is annoyingly complicated in a microservices environment. IP addresses of upstream servers change, and sometimes DNS doesn't resolve until another service is brought up. Nginx does not work well in such an environment unless you (1) have ugly configuration hacks, (2) add OpenResty/LUA to your configuration, (3) add a watchdog process, or (4) buy their nginx Plus version and keep track of how many instances of nginx you have. I want simple. If you need a webserver that can use DNS, Nginx is a lot of extra work.
- HorizonXP 10y ago
  I use it just fine in my Kubernetes deployment. Nginx resolves via DNS to the microservices I run, without having to do complicated configuration hacks. Would something like that work for you?
  - DanielDent 10y ago
    Depending on how you are using it, Kubernetes may be hiding the problem for you via Kubernetes-managed load balancers. If the IP address of the microservice nginx depends on changes, in a standard nginx config, nginx will not be updated. A Kubernetes health check could also hide this issue.
pritambaral 10y ago
My favourite bits in this release: 1. Fix of the repeated-tries of non-idempotent requests bug. 2. Dynamic modules. 3. HTTP/2!! 4. reuseport in listen. 5. SSLv3 disabled by default. 6. UDP Load Balancing.
- tomschlick 10y ago
  Dynamic modules will be the best thing since sliced bread. I have wanted to use a StatsD plugin for metrics but having to manually compile has kept me from doing so for 2 years. I don't want that technical debt sticking around.
  - zepolen 10y ago
    Sounds like you should be automating more stuff, there is little reason compiling something like nginx should cause technical debt. Especially since nginx versions in stable distros are usually really old versions, and when it comes to security take a while to get patched up.
    - tomschlick 10y ago
      While thats true that it could be more automated, its a whole lot easier to automate an "apt-get install nginx-statsd" than manually compiling and having to make sure it doesn't break between versions. Basically I don't want to "own" the process.
      - vacri 10y ago
        It's like the old joke: New linux users use the default kernel of a distro because it 'just works', power users compile their own kernel to get every drop of performance, and senior users use the default kernel because it 'just works'...
        tomschlick 10y ago
        Yup, plus you get the benefit of thousands of other people running the exact same setup which helps report/fix bugs.
- takeda 10y ago
  > UDP Load Blancing Isn't that just a feature creep? Doesn't look like anything that would be useful in a web server and load balancing of UDP is different than TCP. Layer 3 load balancing (e.g. LVS) would probably be more suitable.
  - pritambaral 10y ago
    Nginx is not a web server. Nginx is a reverse-proxy. Nginx's sees a massive share of its usage as a web server, sure, but – from the very beginning – it was always intended to be a good reverse-proxy. Apart from http, nginx also supports mail (imap, pop3, smtp), stream sockets (tcp and unix), and few third-party ones too (like rtmp). And now, UDP as well. One of most needed features expected of a good reverse-proxy is load-balancing. Nginx is already quite good at it, but lacked UDP load balancing (like HAproxy – another reverse-proxy – does). That is no longer the case, and I'm sure the people that have asked HAproxy to support UDP will be pleased that nginx does it now.
    - MichaelGG 10y ago
      I suppose its support for static content and other HTTP-ish-server features mislead people. I use it, saw the mail stuff and figured it was "weird". Had no idea it could do general TCP proxying.
    - hrez 10y ago
      For reverse-proxy/LB it kinda sucks. No standard healthchecks for a long-long time and nowdays only in commercial version? Yes, you can compile in 3d party plugin but that just underscores the lacking.
      - Forbidden 10y ago
        You're completely wrong. Opensource version has always had in-flight healthchecks that work just perfect, see: https://www.youtube.com/watch?v=yQvcHy_tPjI https://www.youtube.com/watch?v=yQvcHy_tPjI
        10y ago
- toomanythings2 10y ago
  HTTP/2 has been available for a while now. iirc, SSLv3 has also been disabled for a while.
  - pritambaral 10y ago
    TFA is a stable channel announcement. Everything in it has been available for a while now, but under the mainline channel. Like a new release of Ubuntu getting Linux 4.4 while Arch and Gentoo are on 4.5 already.
dchest 10y ago
Note that accepting HTTP/2 connections over TLS requires the “Application-Layer Protocol Negotiation” (ALPN) TLS extension support, which is available only since OpenSSL version 1.0.2. Using the “Next Protocol Negotiation” (NPN) TLS extension for this purpose (available since OpenSSL version 1.0.1) is not guaranteed. http://nginx.org/en/docs/http/ngx_http_v2_module.html http://nginx.org/en/docs/http/ngx_http_v2_module.html Hmm, so Ubuntu 14.04 LTS won't support it (ships OpenSSL 1.0.1f), need to upgrade to 16.04.
- jzelinskie 10y ago
  I've manually compiled and tested HTTP2 support on 14.04 LTS (OpenSSL 1.0.1f) for the past few months and it's worked fine. I wish they had elaborated on "is not guaranteed".
  - pritambaral 10y ago
    The requirement for ALPN is a client-side requirement. Chrome is dropping NPN and moving to ALPN in recent releases[0]. 0: http://blog.chromium.org/2016/02/transitioning-from-spdy-to-http2.html http://blog.chromium.org/2016/02/transitioning-from-spdy-to-...
- pritambaral 10y ago
  Nor Debian Stable's version of OpenSSL. At work, we use Debian stable with openssl picked specifically from unstable. apt-pinning FTW!
  - takeda 10y ago
    > apt-pinning FTW! You should take look at OpenSuSE's zypper. - 3 sat solver for dependencies (not just greedy algorithm; If there are conflicts it can propose you possible solutions that include uninstalling upgrading/downgrading packages) - packages stick by default to the repositories they were installed from - patches (i.e. sets of updated packages to address specific issue) it tells you what was fixed. You can for example only install patches that fix specific security issue, by using --cve opetion. - zypper ps tells you which processes need to be restarted after upgrade to make changes effective - OBS (Open Build System), basically it's like a github for packages. You upload spec files and it generates packages for you. You can fork someone's definitions and make customizations etc. The repo is searchable from http://software.opensuse.org http://software.opensuse.org. This actually supports other distributions and packaging systems, but unfortunately most packages there are for SuSE.
emgee3 10y ago
I have a love-hate relationship with nginx. I love that it's fast and rock solid. But recently I keep on getting tripped up when the directive I'm trying to configure is only available in the paid plan, the pricing of which puts it out of (my) reach. Also, there really should be separate docs for the open source vs paid plan. That said, I do plan on kicking the tires on the HTTP/2 support.
- pritambaral 10y ago
  > the directive I'm trying to configure is only available in the paid plan Sadly, this is how the developers of nginx can earn and continue to make good software. Some of the new features in this release has been directly supported by the commercial edition, and some has been open sourced after being made for the commercial edition because clients demanded them. Also, the nginx team is open to a feature being sponsored by a third-party, non-client in order to add it to the open source edition. Some of the significant features in nginx have been built this way (http/2, spdy, websocket support etc.) If nothing, even patching or writing modules for nginx is not that hard (assuming you know how to develop, and in C). It is one of the more well-designed codebases. (Some others are: Redis, Postgres, Git). > there really should be separate docs for the open source vs paid plan I thought nginx.org contained only open-source info, save for an occasional ad about the paid offering. Is there any documentation on nginx.org that doesn't apply to the open source edition?
  - Maxious 10y ago
    http://nginx.org/en/docs/http/ngx_http_upstream_module.html http://nginx.org/en/docs/http/ngx_http_upstream_module.html "Dynamically configurable group, available as part of our commercial subscription:" "Additionally, the following parameters are available as part of our commercial subscription:" "This directive is available as part of our commercial subscription."
  - emgee3 10y ago
    I may not have been clear, but I understand and fully support their right to charge for software and services. I just haven't worked on any projects for which their prices fit in to the calculation. As to documentation on nginx.org that doesn't apply to the open source edition, see http://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky http://nginx.org/en/docs/http/ngx_http_upstream_module.html#... -- there are quite a few more, that's just the last one I tried to use.
Thaxll 10y ago
UDP loadbalancing is huge, since HAProxy can't do it you had to do it with LVS.
- takeda 10y ago
  Feels like feature creep. What would you use UDP load balancing for? Layer 3 load balancing is probably the best approach for load balancing UDP traffic. Edit: If you have to downvote, go ahead, but at least state why you don't agree, so I can know why I'm wrong and can revise my opinion.
  - mholt 10y ago
    I'll upvote you b/c I have the same question.

76 points by conductor 10y ago

Nginx is annoyingly complicated in a microservices environment. IP addresses of upstream servers change, and sometimes DNS doesn't resolve until another service is brought up. Nginx does not work well in such an environment unless you (1) have ugly configuration hacks, (2) add OpenResty/LUA to your configuration, (3) add a watchdog process, or (4) buy their nginx Plus version and keep track of how many instances of nginx you have. I want simple. If you need a webserver that can use DNS, Nginx is a lot of extra work.

HorizonXP 10y ago
I use it just fine in my Kubernetes deployment. Nginx resolves via DNS to the microservices I run, without having to do complicated configuration hacks. Would something like that work for you?
- DanielDent 10y ago
  Depending on how you are using it, Kubernetes may be hiding the problem for you via Kubernetes-managed load balancers. If the IP address of the microservice nginx depends on changes, in a standard nginx config, nginx will not be updated. A Kubernetes health check could also hide this issue.

pritambaral 10y ago

My favourite bits in this release: 1. Fix of the repeated-tries of non-idempotent requests bug. 2. Dynamic modules. 3. HTTP/2!! 4. reuseport in listen. 5. SSLv3 disabled by default. 6. UDP Load Balancing.

tomschlick 10y ago
Dynamic modules will be the best thing since sliced bread. I have wanted to use a StatsD plugin for metrics but having to manually compile has kept me from doing so for 2 years. I don't want that technical debt sticking around.
- zepolen 10y ago
  Sounds like you should be automating more stuff, there is little reason compiling something like nginx should cause technical debt. Especially since nginx versions in stable distros are usually really old versions, and when it comes to security take a while to get patched up.
  - tomschlick 10y ago
    While thats true that it could be more automated, its a whole lot easier to automate an "apt-get install nginx-statsd" than manually compiling and having to make sure it doesn't break between versions. Basically I don't want to "own" the process.
    - vacri 10y ago
      It's like the old joke: New linux users use the default kernel of a distro because it 'just works', power users compile their own kernel to get every drop of performance, and senior users use the default kernel because it 'just works'...
      - tomschlick 10y ago
        Yup, plus you get the benefit of thousands of other people running the exact same setup which helps report/fix bugs.
takeda 10y ago
> UDP Load Blancing Isn't that just a feature creep? Doesn't look like anything that would be useful in a web server and load balancing of UDP is different than TCP. Layer 3 load balancing (e.g. LVS) would probably be more suitable.
- pritambaral 10y ago
  Nginx is not a web server. Nginx is a reverse-proxy. Nginx's sees a massive share of its usage as a web server, sure, but – from the very beginning – it was always intended to be a good reverse-proxy. Apart from http, nginx also supports mail (imap, pop3, smtp), stream sockets (tcp and unix), and few third-party ones too (like rtmp). And now, UDP as well. One of most needed features expected of a good reverse-proxy is load-balancing. Nginx is already quite good at it, but lacked UDP load balancing (like HAproxy – another reverse-proxy – does). That is no longer the case, and I'm sure the people that have asked HAproxy to support UDP will be pleased that nginx does it now.
  - MichaelGG 10y ago
    I suppose its support for static content and other HTTP-ish-server features mislead people. I use it, saw the mail stuff and figured it was "weird". Had no idea it could do general TCP proxying.
  - hrez 10y ago
    For reverse-proxy/LB it kinda sucks. No standard healthchecks for a long-long time and nowdays only in commercial version? Yes, you can compile in 3d party plugin but that just underscores the lacking.
    - Forbidden 10y ago
      You're completely wrong. Opensource version has always had in-flight healthchecks that work just perfect, see: https://www.youtube.com/watch?v=yQvcHy_tPjI https://www.youtube.com/watch?v=yQvcHy_tPjI
      - 10y ago
toomanythings2 10y ago
HTTP/2 has been available for a while now. iirc, SSLv3 has also been disabled for a while.
- pritambaral 10y ago
  TFA is a stable channel announcement. Everything in it has been available for a while now, but under the mainline channel. Like a new release of Ubuntu getting Linux 4.4 while Arch and Gentoo are on 4.5 already.

dchest 10y ago

Note that accepting HTTP/2 connections over TLS requires the “Application-Layer Protocol Negotiation” (ALPN) TLS extension support, which is available only since OpenSSL version 1.0.2. Using the “Next Protocol Negotiation” (NPN) TLS extension for this purpose (available since OpenSSL version 1.0.1) is not guaranteed. http://nginx.org/en/docs/http/ngx_http_v2_module.html http://nginx.org/en/docs/http/ngx_http_v2_module.html Hmm, so Ubuntu 14.04 LTS won't support it (ships OpenSSL 1.0.1f), need to upgrade to 16.04.

jzelinskie 10y ago
I've manually compiled and tested HTTP2 support on 14.04 LTS (OpenSSL 1.0.1f) for the past few months and it's worked fine. I wish they had elaborated on "is not guaranteed".
- pritambaral 10y ago
  The requirement for ALPN is a client-side requirement. Chrome is dropping NPN and moving to ALPN in recent releases[0]. 0: http://blog.chromium.org/2016/02/transitioning-from-spdy-to-http2.html http://blog.chromium.org/2016/02/transitioning-from-spdy-to-...
pritambaral 10y ago
Nor Debian Stable's version of OpenSSL. At work, we use Debian stable with openssl picked specifically from unstable. apt-pinning FTW!
- takeda 10y ago
  > apt-pinning FTW! You should take look at OpenSuSE's zypper. - 3 sat solver for dependencies (not just greedy algorithm; If there are conflicts it can propose you possible solutions that include uninstalling upgrading/downgrading packages) - packages stick by default to the repositories they were installed from - patches (i.e. sets of updated packages to address specific issue) it tells you what was fixed. You can for example only install patches that fix specific security issue, by using --cve opetion. - zypper ps tells you which processes need to be restarted after upgrade to make changes effective - OBS (Open Build System), basically it's like a github for packages. You upload spec files and it generates packages for you. You can fork someone's definitions and make customizations etc. The repo is searchable from http://software.opensuse.org http://software.opensuse.org. This actually supports other distributions and packaging systems, but unfortunately most packages there are for SuSE.

emgee3 10y ago

I have a love-hate relationship with nginx. I love that it's fast and rock solid. But recently I keep on getting tripped up when the directive I'm trying to configure is only available in the paid plan, the pricing of which puts it out of (my) reach. Also, there really should be separate docs for the open source vs paid plan. That said, I do plan on kicking the tires on the HTTP/2 support.

pritambaral 10y ago
> the directive I'm trying to configure is only available in the paid plan Sadly, this is how the developers of nginx can earn and continue to make good software. Some of the new features in this release has been directly supported by the commercial edition, and some has been open sourced after being made for the commercial edition because clients demanded them. Also, the nginx team is open to a feature being sponsored by a third-party, non-client in order to add it to the open source edition. Some of the significant features in nginx have been built this way (http/2, spdy, websocket support etc.) If nothing, even patching or writing modules for nginx is not that hard (assuming you know how to develop, and in C). It is one of the more well-designed codebases. (Some others are: Redis, Postgres, Git). > there really should be separate docs for the open source vs paid plan I thought nginx.org contained only open-source info, save for an occasional ad about the paid offering. Is there any documentation on nginx.org that doesn't apply to the open source edition?
- Maxious 10y ago
  http://nginx.org/en/docs/http/ngx_http_upstream_module.html http://nginx.org/en/docs/http/ngx_http_upstream_module.html "Dynamically configurable group, available as part of our commercial subscription:" "Additionally, the following parameters are available as part of our commercial subscription:" "This directive is available as part of our commercial subscription."
- emgee3 10y ago
  I may not have been clear, but I understand and fully support their right to charge for software and services. I just haven't worked on any projects for which their prices fit in to the calculation. As to documentation on nginx.org that doesn't apply to the open source edition, see http://nginx.org/en/docs/http/ngx_http_upstream_module.html#sticky http://nginx.org/en/docs/http/ngx_http_upstream_module.html#... -- there are quite a few more, that's just the last one I tried to use.

Thaxll 10y ago

UDP loadbalancing is huge, since HAProxy can't do it you had to do it with LVS.

takeda 10y ago
Feels like feature creep. What would you use UDP load balancing for? Layer 3 load balancing is probably the best approach for load balancing UDP traffic. Edit: If you have to downvote, go ahead, but at least state why you don't agree, so I can know why I'm wrong and can revise my opinion.
- mholt 10y ago
  I'll upvote you b/c I have the same question.