5 ms·

One key missing piece in nginx is a way to interact with the configuration without having to edit the config file. This is such a vital piece of a modern infras

One key missing piece in nginx is a way to interact with the configuration without having to edit the config file. This is such a vital piece of a modern infrastructure; where backends are added/removed on demand. You can interact with haproxy via lua[1] or use etcd to have traefik load its configuration[2]. Seeing how [as others also mentioned] nginx seems to favor pro customers in terms of functionality, it would only seem wise to choose another proxy/load balancer for your next project. [1]: http://www.arpalert.org/src/haproxy-lua-api/1.7/#Proxy.servers http://www.arpalert.org/src/haproxy-lua-api/1.7/#Proxy.serve... [2]: https://docs.traefik.io/toml/#etcd-backend https://docs.traefik.io/toml/#etcd-backend

nodesocket 10y ago
NGINX plus provides a simple http API to add and remove backends to an upstream block. They also have persistence of these changes. See https://www.nginx.com/products/on-the-fly-reconfiguration/ https://www.nginx.com/products/on-the-fly-reconfiguration/
- user5994461 10y ago
  Disclaimer: nginx plus is about $1900 per server. HaProxy is free.
oconnore 10y ago
You can hot reload config files that you have already tested for correctness. No dropped connections.
ploxiln 10y ago
nginx can reload the config files without closing the listening port or interrupting any existing requests. haproxy can't do that. So you can actually live-update on-demand much more of the nginx configuration than you can the haproxy configuration.
- paulddraper 10y ago
  > haproxy can't do that. HAProxy reloads don't interrupt existing connections (unless you want it to). There is a ~microsecond downtime in accepting new connections. https://engineeringblog.yelp.com/2015/04/true-zero-downtime-haproxy-reloads.html https://engineeringblog.yelp.com/2015/04/true-zero-downtime-...
- jbergstroem 10y ago
  Logging in to machines to update configs doesn't scale well. You often end up building your own framework/api "only" to edit the config file. Or paying $2500/instance/year for nginx plus.
  - ploxiln 10y ago
    Executing a template, writing it to a file, and sending SIGHUP, is not that hugely different from composing a request and writing it to a control socket. Maybe nginx isn't better than haproxy for many purposes. But updating configuration isn't the reason :)
  - deckiedan 10y ago
    Ansible is working great for me.
  - vacri 10y ago
    If that's a problem for you, then use a pull-style config management tool (eg puppet) over a push-style one (eg ansible). If you're at a scale where logging into each server from your control node 'hurts', then you're still going to hurt with all the config other than nginx anyway.
  - deleted 10y ago
    [deleted]
- onestone 10y ago
  This doesn't work well for modern websites using push-style updates, e.g. via websockets. Old nginx processes might never close after the reload, as connections are very long-lived. If reloads happen often this leads to memory exhaustion. So this is a bad solution to rely on.
_mikz 10y ago
This can be done with lua-nginx-module [1] and its 'balancer_by_lua' directive [2]. There are projects like the one I'm working on [3] that implement dynamic proxies using OpenResty. [1]: https://github.com/openresty/lua-nginx-module https://github.com/openresty/lua-nginx-module [2]: https://github.com/openresty/lua-nginx-module#balancer_by_lua_block https://github.com/openresty/lua-nginx-module#balancer_by_lu... [3]: https://github.com/3scale/apicast/ https://github.com/3scale/apicast/
deleted 10y ago
[deleted]
dstroot 10y ago
Been using Traefik under light load on Kubernetes with automatic acme let's encrypt support. Very happpy with the ease of use so far and it even exposes Prometheus metrics.
dstroot 10y ago
Been using Traefik under light load on Kubernetes with automatic acme let's encrypt support. Very happpy with the ease of use so far and it even exposes Prometheus metrics.
Opteron67 10y ago
I did use that one which actually works pretty well, although you should manage Go skills a little bit. https://github.com/martensson/nixy https://github.com/martensson/nixy
jimjag 10y ago
Apache httpd 2.4 has supported dynamic reconfiguration of backends for years now without leveraging Lua-hacks: https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#manager https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#m...

nodesocket 10y ago

NGINX plus provides a simple http API to add and remove backends to an upstream block. They also have persistence of these changes. See https://www.nginx.com/products/on-the-fly-reconfiguration/ https://www.nginx.com/products/on-the-fly-reconfiguration/

user5994461 10y ago
Disclaimer: nginx plus is about $1900 per server. HaProxy is free.

oconnore 10y ago

You can hot reload config files that you have already tested for correctness. No dropped connections.

ploxiln 10y ago

nginx can reload the config files without closing the listening port or interrupting any existing requests. haproxy can't do that. So you can actually live-update on-demand much more of the nginx configuration than you can the haproxy configuration.

paulddraper 10y ago
> haproxy can't do that. HAProxy reloads don't interrupt existing connections (unless you want it to). There is a ~microsecond downtime in accepting new connections. https://engineeringblog.yelp.com/2015/04/true-zero-downtime-haproxy-reloads.html https://engineeringblog.yelp.com/2015/04/true-zero-downtime-...
jbergstroem 10y ago
Logging in to machines to update configs doesn't scale well. You often end up building your own framework/api "only" to edit the config file. Or paying $2500/instance/year for nginx plus.
- ploxiln 10y ago
  Executing a template, writing it to a file, and sending SIGHUP, is not that hugely different from composing a request and writing it to a control socket. Maybe nginx isn't better than haproxy for many purposes. But updating configuration isn't the reason :)
- deckiedan 10y ago
  Ansible is working great for me.
- vacri 10y ago
  If that's a problem for you, then use a pull-style config management tool (eg puppet) over a push-style one (eg ansible). If you're at a scale where logging into each server from your control node 'hurts', then you're still going to hurt with all the config other than nginx anyway.
- deleted 10y ago
  [deleted]
onestone 10y ago
This doesn't work well for modern websites using push-style updates, e.g. via websockets. Old nginx processes might never close after the reload, as connections are very long-lived. If reloads happen often this leads to memory exhaustion. So this is a bad solution to rely on.

_mikz 10y ago

This can be done with lua-nginx-module [1] and its 'balancer_by_lua' directive [2]. There are projects like the one I'm working on [3] that implement dynamic proxies using OpenResty. [1]: https://github.com/openresty/lua-nginx-module https://github.com/openresty/lua-nginx-module [2]: https://github.com/openresty/lua-nginx-module#balancer_by_lua_block https://github.com/openresty/lua-nginx-module#balancer_by_lu... [3]: https://github.com/3scale/apicast/ https://github.com/3scale/apicast/

deleted 10y ago

[deleted]

dstroot 10y ago

Been using Traefik under light load on Kubernetes with automatic acme let's encrypt support. Very happpy with the ease of use so far and it even exposes Prometheus metrics.

dstroot 10y ago

Been using Traefik under light load on Kubernetes with automatic acme let's encrypt support. Very happpy with the ease of use so far and it even exposes Prometheus metrics.

Opteron67 10y ago

I did use that one which actually works pretty well, although you should manage Go skills a little bit. https://github.com/martensson/nixy https://github.com/martensson/nixy

jimjag 10y ago

Apache httpd 2.4 has supported dynamic reconfiguration of backends for years now without leveraging Lua-hacks: https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#manager https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#m...