3 ms·

How well is Gunicorn suited for production? Do you need to put another server in front of it for https or has Gunicorn https handling built in?

by TekMol 5y ago

foxfluff 5y ago
Gunicorn does support https. They still seem to recommend using a different server in front of it.
- samwillis 5y ago
  I think it depends on how your whole stack looks. If you are running on a PAAS such as Heroku, have load balancers or are even using something like ClourFlare I don’t this it’s necessary to have something in front of Gunicorn. I wouldn’t leave Gunicorn “naked” for want of a better word, or use it for static files though.
- TekMol 5y ago
  If you put Apache or Nginx in front of it, why not leave out Gunicorn completely?
  - deniska 5y ago
    Apache has mod_wsgi, nginx not so much. mod_wsgi is a much less flexible setup when it comes to mixing and matching different python versions
  - samwillis 5y ago
    Python has an interface called WSGI (web server gateway interface), with both Apache and Nginx you need either a none standard module for that interface or to reverse proxy to a second server that does. So same number of moving parts either way.
    - TekMol 5y ago
      How is libapache2-mod-wsgi-py3 "none standard"?
      - samwillis 5y ago
        I meant it’s not built in as standard when you install apache, it’s an extra thing to install (even if it runs in process).
  - loloquwowndueo 5y ago
    Gunicorn is not just a static content server (actually I don’t think it can serve static content out of the box?) but a wsgi-compliant application server. You can’t leave it out because then, how would your python web backend run?
    - TekMol 5y ago
      For apache, there is libapache2-mod-wsgi-py3 Seems easier to just "apt install libapache2-mod-wsgi-py3" and put a "WSGIScriptAlias" directive into your apache config than to run another piece of software?
- ochoseis 5y ago
  Here’s why according to their docs: > Although there are many HTTP proxies available, we strongly advise that you use Nginx. If you choose another proxy server you need to make sure that it buffers slow clients when you use default Gunicorn workers. Without this buffering Gunicorn will be easily susceptible to denial-of-service attacks. https://docs.gunicorn.org/en/stable/deploy.html https://docs.gunicorn.org/en/stable/deploy.html
fillest 5y ago
I was tempted to write "you always need to put a many-years-battle-tested specialized server in front, if you mean protection from attacks", but nowadays even these servers get so many new features and rewrites so often, that it's pretty valid to doubt their maturity.. And being written in C is always a time bomb. But probably it's still a good idea to use them.
odiroot 5y ago
All the companies I ever worked for used Gunicorn to serve Python apps. You can put Nginx/Traefik/whatever in front of it for load balancing but you don't have to.

How well is Gunicorn suited for production? Do you need to put another server in front of it for https or has Gunicorn https handling built in?

by TekMol 5y ago

How well is Gunicorn suited for production? Do you need to put another server in front of it for https or has Gunicorn https handling built in?

foxfluff 5y ago

Gunicorn does support https. They still seem to recommend using a different server in front of it.

samwillis 5y ago
I think it depends on how your whole stack looks. If you are running on a PAAS such as Heroku, have load balancers or are even using something like ClourFlare I don’t this it’s necessary to have something in front of Gunicorn. I wouldn’t leave Gunicorn “naked” for want of a better word, or use it for static files though.
TekMol 5y ago
If you put Apache or Nginx in front of it, why not leave out Gunicorn completely?
- deniska 5y ago
  Apache has mod_wsgi, nginx not so much. mod_wsgi is a much less flexible setup when it comes to mixing and matching different python versions
- samwillis 5y ago
  Python has an interface called WSGI (web server gateway interface), with both Apache and Nginx you need either a none standard module for that interface or to reverse proxy to a second server that does. So same number of moving parts either way.
  - TekMol 5y ago
    How is libapache2-mod-wsgi-py3 "none standard"?
    - samwillis 5y ago
      I meant it’s not built in as standard when you install apache, it’s an extra thing to install (even if it runs in process).
- loloquwowndueo 5y ago
  Gunicorn is not just a static content server (actually I don’t think it can serve static content out of the box?) but a wsgi-compliant application server. You can’t leave it out because then, how would your python web backend run?
  - TekMol 5y ago
    For apache, there is libapache2-mod-wsgi-py3 Seems easier to just "apt install libapache2-mod-wsgi-py3" and put a "WSGIScriptAlias" directive into your apache config than to run another piece of software?
ochoseis 5y ago
Here’s why according to their docs: > Although there are many HTTP proxies available, we strongly advise that you use Nginx. If you choose another proxy server you need to make sure that it buffers slow clients when you use default Gunicorn workers. Without this buffering Gunicorn will be easily susceptible to denial-of-service attacks. https://docs.gunicorn.org/en/stable/deploy.html https://docs.gunicorn.org/en/stable/deploy.html

fillest 5y ago

I was tempted to write "you always need to put a many-years-battle-tested specialized server in front, if you mean protection from attacks", but nowadays even these servers get so many new features and rewrites so often, that it's pretty valid to doubt their maturity.. And being written in C is always a time bomb. But probably it's still a good idea to use them.

odiroot 5y ago

All the companies I ever worked for used Gunicorn to serve Python apps. You can put Nginx/Traefik/whatever in front of it for load balancing but you don't have to.