7 ms·
Nginx 1.13 released with TLS 1.3 support
- nerdbaggy 10y agoI don't understand why all these free open source projects are using nginx when it hides so many great features behind the premium option. HAProxy also has a lua module and you even has monitoring abilities for free unlike nginx edit: a project like Kong could easily be done with haproxy as far as I know and you can actually monitor your server. https://getkong.org https://getkong.org
- viraptor 10y agoBecause you rarely need those premium options. And when you're big enough to need it, you can pay. Sounds like a win-win to me.
- newsat13 10y agoI have been using nginx since forever for all my personal projects. I cannot say I have missed any feature not in opensource edition. In fact, I didn't even know they had a premium edition for a long time. What killer feature do normal projects require that is not in opensource edition?
- SteveNuts 10y agoper-vhost metrics is the big one for us. We're not going to pay $2,500 just to get them though. If you enable the stub status, that gives you metrics for the master process and not any of the virtual hosts.
- lebinh 10y agoI wrote something out of our need for better monitoring/metrics for Nginx here: https://luameter.com/ https://luameter.com/ And quite a few people are using it for per-vhost metrics use case just like you said. Also if you prefer something simpler and open source I also wrote this https://github.com/lebinh/ngxtop https://github.com/lebinh/ngxtop
- deleted 10y ago[deleted]
- user5994461 10y agoSecond project is a hack that's reading log scripts. That's not comparable to a proper monitoring page and exposing its stats by statsd (or similar) for integration with a real monitoring system. nginx free edition is a black box, hence the criticism.
- vbtechguy 10y agoI've had basic nginx vhost stats in my Centmin Mod LEMP stack installer for ages - not as detailed but works https://centminmod.com/nginx.html#vhoststats https://centminmod.com/nginx.html#vhoststats. Using nginx module https://github.com/vozlt/nginx-module-vts https://github.com/vozlt/nginx-module-vts and TLS v1.3 works fine for me too https://community.centminmod.com/posts/48818/ https://community.centminmod.com/posts/48818/
- tomschlick 10y agoBecause Nginx "just works" and I don't think it's a bad thing that they are trying to make a living from all their hard work. Especially when the premium features are mostly stuff that businesses need.
- deleted 10y ago[deleted]
- jbergstroem 10y agoI think its because nginx was (and for most, still is) generational [compared to apache] in terms of core features and ease of configuration. I can see how caddy would be the next alternative though: more – "modern" if you may – features (money quote: built-in letsencrypt) but more importantly even simpler configuration. edit: This is also where your use case makes it easy to see why nginx (or caddy) won't cut it.
- TheAceOfHearts 10y agoNeat, thanks for mentioning Caddy [0]. I hadn't heard about it before now, and just from looking over their docs it looks very promising. Their website is superb, with simple explanations of what the tool does and transparent pricing for their paid options. The only thing I'm initially a tiny bit weary about is their claim of it being production ready. Being used by thousands of sites is an amazing feat, but how big are the loads on these sites? Production-ready can mean completely different things depending on what you're building. I think it'd be a nice improvement to see a bit more data backing up that claim. Just from a quick google search it looks like there's a decent number of articles comparing it with nginx, so I guess I"ll stat digging in a bit deeper. [0] https://caddyserver.com https://caddyserver.com
- mholt 10y agoYeah, "production-ready" is definitely true about Caddy, but I know saying a program is "production-ready" is like saying a program is "secure" -- what does that even mean?? I like to tell people it's production-ready if it's a good fit for your website and workflow. Many people are using Caddy in production. There's so much variance it's hard to pin it down in a simple phrase, so we have to settle with a term that's "good enough", which I think the most fitting is "production-ready." And upfront, I'll say: Careful with chasing benchmarks. They don't transfer well (or at all), and most people (including me) don't know how to run them properly. Just test with your own staging setups and see if it works well enough for what you need. Anyway, thanks for your feedback about the site -- definitely taking it into account.
- 10y ago
- m-p-3 10y agoSo far, my usage never required any of the premium options. And I suppose a corporation can afford to pay those if needed and support the development.
- stephenr 10y agoYou clearly aren't a me-too cool kid. Most tech decisions these days seem to be more about cargo culting than actual suitability for the task.
- feld 10y agoYou could say the exact same thing about Varnish. In fact I say your money would be better spent on premium Varnish than on premium Nginx.
- felipelemos 10y agoBut varnish lacks some features like dns-backend-resolution that are essential on modern microservices world.
- boyter 10y agoI keep hearing this as being an issue but when I suggest slinging some money at the guy creating it I never get a response. Apparently its a big enough issue to grumble about but not big enough to front some cash to resolve. I agree though. DNS backend lookups for this would be an excellent thing to add.
- ruben_varnish 10y agohttps://docs.varnish-software.com/varnish-cache-plus/vmods/goto/ https://docs.varnish-software.com/varnish-cache-plus/vmods/g... That? Works like a charm. It's available with the on-premise enterprise subscription and on the AWS and Azure clouds as Varnish Plus - Caching Engine: https://aws.amazon.com/marketplace/seller-profile?id=263c0208-6a3a-435d-8728-fa2514202fd0 https://aws.amazon.com/marketplace/seller-profile?id=263c020... https://azuremarketplace.microsoft.com/en-us/marketplace/apps?search=varnish%20plus&page=1 https://azuremarketplace.microsoft.com/en-us/marketplace/app... https://www.varnish-software.com/pricing/varnish-plus/ https://www.varnish-software.com/pricing/varnish-plus/
- feld 10y agoI'm not entirely sure what this is about. Are you saying the list of backends is dynamic and retrieved from DNS? Why would you do this? Why are the backends changing so frequently? This seems like a major design issue. Why not have one backend that's anycasted with equal priority and you can pop backends in and out as you please? Also, why wouldn't you just solve this with SRV records? Just patch Varnish to support SRV properly and magic you get everything you ever wanted including failover and priorities. That's probably a more sane request.
- JTenerife 10y agoInformations about HAProxy on multi-core hardware (TLS de- and encryption are CPU bound) are a bit discouraging. You can assign workers to cores, but there's no shared memory and therefore the official docs warn about some inconsistencies that might occur. There doesn't seem to be a consensus wether to use the multi-core feature or not. Also nginx supports http/2. Regarding the status of the backendservers - I use monitoring with health checks for every backend server anyway. That are the reasons I chose nginx as reverse proxy recently.
- jonathanoliver 10y agoWe've had great success with HAProxy on multi-core without the warnings. The Stack Exchange operations did a blog post about an easy way to do it. Here's a sample config that does multi-core processing really well: https://gist.github.com/joliver/40291313605971545a0c1f6a3040d4c3 https://gist.github.com/joliver/40291313605971545a0c1f6a3040...
- doubleplusgood 10y agoDoes the stats endpoint reflect stats for all processes?
- jonathanoliver 10y agoYes, it aggregates stats for all endpoints.
- doubleplusgood 10y agoPerhaps I mis-remembered that it would only work for one of them. Haven't used HAProxy in a while.
- codinghorror 10y agoLack of http/2 on haproxy by now is terribly limiting and very disappointing.
- paulddraper 10y agoNginx is more a web server. HAProxy is more a proxy/load balancer. Those feature sets overlap, but HAProxy cannot serve files, cannot cache. OTHO, most Nginx load balancer features are premium. Overall, I'd say Nginx has a broader range of features and friendlier configuration. Hence high adoption. Anyone using HAProxy is serious about load balancing.
- sethhochberg 10y agoFor us at $day_job, consistency was also a nice bonus (we recently moved our web load balancers from Varnish to nginx plus, because now we have a single software package which does our SSL termination with HTTP/2, HTTP / TCP / UDP load balancing, serves static assets, caches, and is also the host for our application server itself, Passenger). Of course all of these functions happen across dozens of servers, but we get to use a single config syntax to make all of that happen and only need to track security issues, etc, for a single package. Sure, we could accomplish all of that with some combination of haproxy and/or varnish and/or apache and/or nginx and/or various Ruby/Rack app servers... but we don't have to. Nginx does an acceptably good job of all of those things for our needs right now, and the support they provide for the license cost is pretty reasonable.
- nodesocket 10y agoI am more than willing to pay for NGINX Plus. It supports the authors and company that provides this amazing software. Expecting everything for free and open source is what I despise about the software industry. This anti-capitalist mentality causes great companies with amazing products to go out of business (see RethinkDB) and then everybody both entrepreneurs and developers lose. Slava > And our users clearly thought of us as an open-source developer tools company, because that’s what we really were. Which turned out to be very unfortunate, because the open-source developer tools market is one of the worst markets one could possibly end up in. Thousands of people used RethinkDB, often in business contexts, but most were willing to pay less for the lifetime of usage than the price of a single Starbucks coffee (which is to say, they weren’t willing to pay anything at all).
- sandGorgon 10y agoI wish there was a paid version without the heavy duty support cost built into it . The pricing scale up is massive. The cost of a single license in the lowest paid tier is 2500$. I understand it's because of the support cost - but it makes the adoption very hard. You cannot go from 0$ to 10,000$ overnight. And that's the problem.
- susi22 10y agoThat's why I'm pretty excited about what agentzh bring to the table with the commercialization (just a few weeks old) of OpenResty Inc.
- walterbell 10y agoAre they going to compete with Nginx premium features? From http://openresty.org http://openresty.org: > OpenResty® is not an Nginx fork. It is just a software bundle. Most of the patches applied to the Nginx core in OpenResty® have already been submitted to the official Nginx team and most of the patches submitted have also been accepted. We are trying hard not to fork Nginx and always to use the latest best Nginx core from the official Nginx team.
- kev009 10y agonginx is nearly optimal for content serving (see Netflix presentations) and TLS origination or termination. It's actually somewhat weak in the features they charge for.
- throw2016 10y agoI agree with you in principle, ideally there should be no feature separation but supported versions. But given the current culture of even large profitable companies just using open source projects without giving back - see the HN story about Github and Redis - and let alone contributing but even giving credit, some open source companies have no way to earn any revenue. They may then have to resort to this to support their development which ultimately benefits all users. Nginx is a highly regarded, widely used and high performance web server. As a long time user I would not grudge them trying to make some money to support and improve the project. As is Haproxy. I think there is room to accommodate both models and we are just incredibly lucky to have 2 such high performance projects available as open source.
- jnsaff2 10y agoI wanted to like HAproxy but the lack of support for in-place zero downtime config reloads without resorting to witchcraft was a showstopper. Use case for us a service discovery load balancer for Mesos/Marathon where frontend/backend config can change as often as every few seconds. Never had any issues with nginx.
- kawsper 10y agoCould you elaborate on how you use Nginx as a service discovery load balancer?
- jnsaff2 10y agoI think most of the ideas are presented here: https://github.com/martensson/nixy https://github.com/martensson/nixy In essence there is a wrapper that: - reads service information and current backend instances out of service catalog (either Marathon or Consul) - writes nginx configuration - runs nginx configtest - tells nginx to reload its configuration Nixy referenced above takes service information directly from Marathon event stream but I usually have Consul so I use homebaked consul-template + nginx solution.
- user5994461 10y ago>> where frontend/backend config can change as often as every few seconds That's a red flag. Don't make architectures where you depend on crazy requirements like that.
- jnsaff2 10y agoOk, I will go tell the 200 or so developers that they can only deploy to test/staging once an hour or so instead of, like .. whenever they need. This is a PaaS supporting many micro-services. There is a hold-off to not reload more than once a second just as an insurance against runaway processes but beyond that nginx handles this without any sweat. Frequent reloads are currently in the non-prod cluster only but I don't see any reason why it would be an issue in prod as well.
- therealmarv 10y agoWhen it is so easy to do in haproxy why nobody has done it? (which proofs it's not so easy)
- coldtea 10y ago>I don't understand why all these free open source projects are using nginx when it hides so many great features behind the premium option. Because the free version covers all the things they need, and they feel nginx creators also have a right to make some bucks?
- jimktrains2 10y agonginx can do a lot more than HAProxy. Don't get me wrong, for what it does HAProxy is fast, stable, and wonderful, but it's not a cgi or page server.
- ptman 10y agoThere exists Tengine, a fork of nginx, which IIRC features some of nginx paid features for free. I wonder how closely it tracks nginx and what the differences are http://tengine.taobao.org/ http://tengine.taobao.org/ https://github.com/alibaba/tengine https://github.com/alibaba/tengine
- jaas 10y agoGood news. Now they should add ACME support directly to nginx so it can get and manage TLS certificates seamlessly for you.
- deleted 10y ago[deleted]
- infinisil 10y agoYou may be interested in NixOS' way. This is all what you need in your configuration.nix to get a webserver running with an SSL certificate from Let's Encrypt, including automatic refreshes before expired and everything: services.nginx = { enable = true; virtualHosts."example.com" = { root = "/webroot"; enableACME = true; }; }; http://nixos.org/nixos/options.html#services.nginx http://nixos.org/nixos/options.html#services.nginx
- thresh 10y agoIs ACME an Internet standard yet? Are there any TLS CA that support it, other than LetsEncrypt?
- chronial 10y agoYou should have a look at caddy. Its an alternative to nginx that does exactly that.
- floatboth 10y agoYou can do that with the Lua plugin: https://github.com/GUI/lua-resty-auto-ssl https://github.com/GUI/lua-resty-auto-ssl
- tomschlick 10y agoAnyone know how quickly it will get pushed to the PPA here?: http://ppa.launchpad.net/nginx/development/ubuntu http://ppa.launchpad.net/nginx/development/ubuntu
- alfredxing 10y agoIf you want to use a precompiled version from a repository, nginx has its own, which always stays up to date: http://nginx.org/en/linux_packages.html http://nginx.org/en/linux_packages.html
- smackdab 10y agoWon't help, since you need to link it to OpenSSL 1.1.1-dev.
- deleted 10y ago[deleted]
- aorth 10y agoThat PPA looks pretty outdated—I recommend using the one provided by nginx itself. Note, though, that none of these builds will (even the official ones) will have TLSv1.3 support as this needs the yet-to-be-released OpenSSL 1.1.1, which no current Linux distribution uses. Recently released Ubuntu Zesty (17.04) uses OpenSSL 1.0.2, and upcoming Debian Stretch (9) release uses 1.1.0. http://packages.ubuntu.com/zesty/openssl http://packages.ubuntu.com/zesty/openssl https://packages.debian.org/stretch/openssl https://packages.debian.org/stretch/openssl
- slivanes 10y agoRight now, nginx 1.13.x requires compiling against OpenSSL 1.1.1 or newer to get TLSv1.3 supported in browsers. You need to compile the "draft-18" branch of OpenSSL as current browsers are on draft-18 (master is on draft-19).
- newman314 10y agogit clone https://github.com/openssl/openssl.git -b tls1.3-draft-18 openssl-1.1.1-tls1.3-draft-18
- voidz 10y agoIs this like, the fine print?
- therealmarv 10y agothat's the biggest weakness of nginx.... the whole compile stuff in a right way to get things/features really running there. And don't tell me it's easy to recompile nginx... you have to know a lot of nginx and switches to get the compiler setup well done.
- avar 10y agoThen don't write a compile-recipe from scratch, but take e.g. your distro's packaging script & just add the switch you need. This is easy and relatively fool-proof.
- Neil44 10y agoApache is also a giant pain in the ass to get http2 support, you have to basically chuck out the distro packages and do everything from scratch (including OpenSSL) unless you're on a bleeding edge distro.
- virtualwhys 10y agoNot to mention that http2 is buggy in 2.4.25 (fixes in 2.4.26 will be out in May). And yes, without a bleeding edge distro good luck. Building apache from source is not only very straightforward but a great way to maximimize httpd performance (all modules static, only include the modules you need). OpenSSL on the other hand, that's distro specific, and definitely more involved.
- skyisblue 10y agoAre there any browsers that support TLS 1.3 yet?
- hannob 10y agoMozilla and Chrome do, but disabled by default. Chrome recently tried to enable it and they had to notice that a bunch of crap-devices by bluecoat prevented it from working: https://bugs.chromium.org/p/chromium/issues/detail?id=694593 https://bugs.chromium.org/p/chromium/issues/detail?id=694593
- tialaramex 10y agoYes, with the caveat that TLS 1.3 is not finished. So nobody (including nginx) has a completed TLS 1.3, but they all have drafts which are presumed to be close to the final thing. Builds of at least Firefox and Chrome / Chromium with TLS 1.3 exist in the wild if you're interested in testing this out. In particular you should look at this if you have middle boxes such as a "transparent" TLS proxy or "traffic inspection" feature in a corporate or educational network. It is very likely these boxes have defects regarding TLS 1.3 because all of them are garbage built by idiots. If you find out early you might be able to plan for what to do about that before the proverbial impact with a fan.
- floatboth 10y agoStill no server push though? :(