11 ms·

Nginx-1.14.0 stable version has been released

collinmanderson 9y ago
> nginx-1.14.0 stable version has been released, incorporating new features and bug fixes from the 1.13.x mainline branch - including the mirror module, HTTP/2 push, the gRPC proxy module, and more.
EmilStenstrom 9y ago
They really need proper release notes, it's very hard to find a list of the changes in this new version...
- judge2020 9y ago
  Nothing so far on http://nginx.org/en/CHANGES http://nginx.org/en/CHANGES.
- Piskvorrr 9y ago
  https://nginx.org/en/CHANGES-1.14 https://nginx.org/en/CHANGES-1.14 ^^^ Hard to find, though.
  - richardwhiuk 9y ago
    That just says: *) 1.14.x stable branch. which doesn't mean anything...
    - judofyr 9y ago
      It's because Nginx uses even numbers for stable releases (very few changes) and odd versions for mainline releases (production-ready, but frequently improved/changed). 1.14.0 is the exact same version of 1.13.12.
- deleted 9y ago
  [deleted]
TechTeam12 9y ago
>http2_push /static/css/main.css; Silly question, but what's the use case for the HTTP/2 Push? Their example with pushing doesn't make sense to me. Why would you want to push static content?
- libre-man 9y ago
  So that the files can be downloaded before the html is parsed if I recall correctly.
  - deleted 9y ago
    [deleted]
- wincent 9y ago
  You push it along with the initial page, before the browser has even requested it.
- lazopm 9y ago
  It's a way to preemptively send assets to the client before they request them.
  - blattimwind 9y ago
    Pretty much the same effect is granted to any HTTP version by simply including stylesheets or scripts verbatim into the HTML.
    - Piskvorrr 9y ago
      That's anything but "simple" - you might want to reuse those stylesheets/scripts on other pages as well, for example; if you inline them into HTML, you're now wasting far more bandwidth, as you're unconditionally pushing them with every HTML response.
- kijin 9y ago
  That command probably goes in a "location" block that matches the set of HTML pages that use main.css. Normally, the browser parses HTML, finds a <link> tag that mentions main.css, and then requests main.css. With HTTP/2 push, by the time the browser has finished parsing the <link> tag, main.css has already been delivered. If the browser already has main.css in its cache, it can reject the push.
sho 9y ago
gRPC support is very welcome! I've used gRPC internally but have felt a bit uncomfortable exposing a server directly to the internet for outside client use. Not to mention difficulties deploying in a downtime-free manner. gRPC + TLS in nginx will allow connections from outside that I'm comfortable with. Great improvement!
- munjal116 9y ago
  Agreed, added benefit -- much easier to expose gRPC services through Kubernetes Ingress.
andonisus 9y ago
gRpc support is amazing! I just wish this had been announced a week earlier, as I just spent a good amount of development time creating a service that subverts our NGINX server to create gRpc connections to desired microservices. It will be nice to just target the service by name directly instead of having to query Consul for their host IP addresses and ports.
rlpb 9y ago
Ubuntu 18.04 is scheduled to be released tomorrow and includes nginx 1.14.0.
- rhacker 9y ago
  that's crazy fast
- currysausage 9y ago
  Using the Nginx-provided repos for a few years now without isues: https://nginx.org/en/linux_packages.html#stable https://nginx.org/en/linux_packages.html#stable
LinuxBender 9y ago
It appears that the default build does not check for libc support of Full RELRO and PIE. Are there any plans to add checks for this, or is it assumed that everyone sets the right CFLAGS and LDFLAGS? I know that Debian, Ubuntu, Gentoo, Alpine and Fedora package build specs do this by default today. The reason I ask is that I see a lot of people build this themselves and run it from docker. I am concerned that they are not getting the various libc protections that should be enabled on internet facing daemons. i.e. stack-protector, fortify source, full relro, pie, ssp buffer limits, etc..
- LinuxBender 9y ago
  I forgot to mention, if you want to check your existing daemons for these protections, either apt/yum install "checksec", or grab the script from it's maintainer [1] to check running daemons or files. [1] - https://www.trapkit.de/tools/checksec.html https://www.trapkit.de/tools/checksec.html
notaplumber 9y ago
Updated chroot(2) patch from OpenBSD ports: https://raw.githubusercontent.com/rnagy/nginx_chroot_patch/master/nginx-1.14.0-chroot.patch https://raw.githubusercontent.com/rnagy/nginx_chroot_patch/m...
zedpm 9y ago
The mirror module is exciting. Sometimes it's nice to have no-consequences testing of production traffic in a staging environment. Unless you have something like Envoy and its shadowing functionality [0] to handle the mirroring, you end up using a tool like GoReplay [1] to duplicate the traffic to another environment and ignore the responses. This looks like a cleaner and simpler way to accomplish the task. [0] https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/route/route.proto.html?highlight=shadow#route-routeaction-requestmirrorpolicy https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/ro... [1] https://goreplay.org/ https://goreplay.org/
sandstrom 9y ago
Anyone with experience migrating a http service from nginx to Caddy or Træfik? Did it work out well or did you end up having to revert back to nginx? If so, what was missing? https://traefik.io/ https://traefik.io/ https://caddyserver.com/ https://caddyserver.com/
- ComputerGuru 9y ago
  I only have one question, why? I can understand picking one over the other start, but what motivation could you possibly have to actively ditch nginx altogether?
  - joshribakoff 9y ago
    Nginx struggles at basic stuff like load balancing to microservice backends because of trivial stuff like DNS caching when running inside container orchestration platforms https://serverfault.com/questions/240476/how-to-force-nginx-to-resolve-dns-of-a-dynamic-hostname-everytime-when-doing-p https://serverfault.com/questions/240476/how-to-force-nginx-... With the new ingress in Kubernetes & lets encrypt plugin, you probably do not need nginx anymore, if you're adopting containers. In fact, it can be a hindrance to adopting container orchestration systems.
    - e12e 9y ago
      Sounds like it's more haproxy vs traefik or nginx vs Caddy. If you don't need a Web server, you should probably be using haproxy already;)
      - joshribakoff 9y ago
        Haproxy, Nginx, kubernetes all implement layer 4 & layer 7 load balancing. If you are aspiring to writing cloud native applications, there is not very compelling reasons to run reverse proxies in my opinion. If its possible to offload that responsibility to the cloud platform vs running your own infrastructure, that is highly desirable for some people.
    - 9y ago

> nginx-1.14.0 stable version has been released, incorporating new features and bug fixes from the 1.13.x mainline branch - including the mirror module, HTTP/2 push, the gRPC proxy module, and more.

EmilStenstrom 9y ago

They really need proper release notes, it's very hard to find a list of the changes in this new version...

judge2020 9y ago
Nothing so far on http://nginx.org/en/CHANGES http://nginx.org/en/CHANGES.
Piskvorrr 9y ago
https://nginx.org/en/CHANGES-1.14 https://nginx.org/en/CHANGES-1.14 ^^^ Hard to find, though.
- richardwhiuk 9y ago
  That just says: *) 1.14.x stable branch. which doesn't mean anything...
  - judofyr 9y ago
    It's because Nginx uses even numbers for stable releases (very few changes) and odd versions for mainline releases (production-ready, but frequently improved/changed). 1.14.0 is the exact same version of 1.13.12.
deleted 9y ago
[deleted]

TechTeam12 9y ago

>http2_push /static/css/main.css; Silly question, but what's the use case for the HTTP/2 Push? Their example with pushing doesn't make sense to me. Why would you want to push static content?

libre-man 9y ago
So that the files can be downloaded before the html is parsed if I recall correctly.
- deleted 9y ago
  [deleted]
wincent 9y ago
You push it along with the initial page, before the browser has even requested it.
lazopm 9y ago
It's a way to preemptively send assets to the client before they request them.
- blattimwind 9y ago
  Pretty much the same effect is granted to any HTTP version by simply including stylesheets or scripts verbatim into the HTML.
  - Piskvorrr 9y ago
    That's anything but "simple" - you might want to reuse those stylesheets/scripts on other pages as well, for example; if you inline them into HTML, you're now wasting far more bandwidth, as you're unconditionally pushing them with every HTML response.
kijin 9y ago
That command probably goes in a "location" block that matches the set of HTML pages that use main.css. Normally, the browser parses HTML, finds a <link> tag that mentions main.css, and then requests main.css. With HTTP/2 push, by the time the browser has finished parsing the <link> tag, main.css has already been delivered. If the browser already has main.css in its cache, it can reject the push.

sho 9y ago

gRPC support is very welcome! I've used gRPC internally but have felt a bit uncomfortable exposing a server directly to the internet for outside client use. Not to mention difficulties deploying in a downtime-free manner. gRPC + TLS in nginx will allow connections from outside that I'm comfortable with. Great improvement!

munjal116 9y ago
Agreed, added benefit -- much easier to expose gRPC services through Kubernetes Ingress.

andonisus 9y ago

gRpc support is amazing! I just wish this had been announced a week earlier, as I just spent a good amount of development time creating a service that subverts our NGINX server to create gRpc connections to desired microservices. It will be nice to just target the service by name directly instead of having to query Consul for their host IP addresses and ports.

rlpb 9y ago

Ubuntu 18.04 is scheduled to be released tomorrow and includes nginx 1.14.0.

rhacker 9y ago
that's crazy fast
currysausage 9y ago
Using the Nginx-provided repos for a few years now without isues: https://nginx.org/en/linux_packages.html#stable https://nginx.org/en/linux_packages.html#stable

LinuxBender 9y ago

It appears that the default build does not check for libc support of Full RELRO and PIE. Are there any plans to add checks for this, or is it assumed that everyone sets the right CFLAGS and LDFLAGS? I know that Debian, Ubuntu, Gentoo, Alpine and Fedora package build specs do this by default today. The reason I ask is that I see a lot of people build this themselves and run it from docker. I am concerned that they are not getting the various libc protections that should be enabled on internet facing daemons. i.e. stack-protector, fortify source, full relro, pie, ssp buffer limits, etc..

LinuxBender 9y ago
I forgot to mention, if you want to check your existing daemons for these protections, either apt/yum install "checksec", or grab the script from it's maintainer [1] to check running daemons or files. [1] - https://www.trapkit.de/tools/checksec.html https://www.trapkit.de/tools/checksec.html

notaplumber 9y ago

Updated chroot(2) patch from OpenBSD ports: https://raw.githubusercontent.com/rnagy/nginx_chroot_patch/master/nginx-1.14.0-chroot.patch https://raw.githubusercontent.com/rnagy/nginx_chroot_patch/m...

zedpm 9y ago

The mirror module is exciting. Sometimes it's nice to have no-consequences testing of production traffic in a staging environment. Unless you have something like Envoy and its shadowing functionality [0] to handle the mirroring, you end up using a tool like GoReplay [1] to duplicate the traffic to another environment and ignore the responses. This looks like a cleaner and simpler way to accomplish the task. [0] https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/route/route.proto.html?highlight=shadow#route-routeaction-requestmirrorpolicy https://www.envoyproxy.io/docs/envoy/latest/api-v2/api/v2/ro... [1] https://goreplay.org/ https://goreplay.org/

sandstrom 9y ago

Anyone with experience migrating a http service from nginx to Caddy or Træfik? Did it work out well or did you end up having to revert back to nginx? If so, what was missing? https://traefik.io/ https://traefik.io/ https://caddyserver.com/ https://caddyserver.com/

ComputerGuru 9y ago
I only have one question, why? I can understand picking one over the other start, but what motivation could you possibly have to actively ditch nginx altogether?
- joshribakoff 9y ago
  Nginx struggles at basic stuff like load balancing to microservice backends because of trivial stuff like DNS caching when running inside container orchestration platforms https://serverfault.com/questions/240476/how-to-force-nginx-to-resolve-dns-of-a-dynamic-hostname-everytime-when-doing-p https://serverfault.com/questions/240476/how-to-force-nginx-... With the new ingress in Kubernetes & lets encrypt plugin, you probably do not need nginx anymore, if you're adopting containers. In fact, it can be a hindrance to adopting container orchestration systems.
  - e12e 9y ago
    Sounds like it's more haproxy vs traefik or nginx vs Caddy. If you don't need a Web server, you should probably be using haproxy already;)
    - joshribakoff 9y ago
      Haproxy, Nginx, kubernetes all implement layer 4 & layer 7 load balancing. If you are aspiring to writing cloud native applications, there is not very compelling reasons to run reverse proxies in my opinion. If its possible to offload that responsibility to the cloud platform vs running your own infrastructure, that is highly desirable for some people.
  - 9y ago