Nginx advanced configuration

From Training Material
Jump to: navigation, search
Title

Nginx advanced configuration
Author
Bernard Szlachta (NobleProg Ltd)
Subfooter

Nginx advanced configuration          Bernard Szlachta (NobleProg Ltd)

Overview ⌘

  • So far we have only configured virtual hosts
  • Less commonly, you may need to configure global server options
  • /etc/nginx/nginx.conf

nginx architecture: Master Process ⌘

  • Reads configurations
  • Handles sockets
  • Opens log files
  • Accepts signals (eg, to re-read configuration)

nginx architecture: Worker process ⌘

  • Single thread
  • Runs in an event loop
  • Handles incoming connections

Tuning worker processes ⌘

  • Rule of thumb: number of worker processes should be the same as number of cores
  • If much time is spent blocked on io (see vmstat), worker processes should be increased further

Worker connections ⌘

  • Number of concurrent connections available can be calculated:
worker_processes * max_connections = max clients
  • Default value is 1024; if necessary, typically can be raised with only positive effects. 4096 sensible

Logging ⌘

  • Logging can be set per vhost or globally
  • Log formats are defined in nginx.conf under http
log_format vhost '$host $remote_addr - $remote_user [$time_local]'
'"$request" $status $body_bytes_sent '
'"$http_referer" "$http_user_agent"';

Rate limiting/DoS mitigation ⌘

  • DoS - denial of service
  • Often takes the form of simply flooding the server with requests, hoping to saturate CPU resources and/or bandwidth
  • nginx has a number of features to mitigate such an attack

Limiting concurrent connections ⌘

  • nginx has a limit on the number of concurrent connections
  • We can prevent a single IP from tying up too many
  • NB - it is normal for a web browser to create up to 8 concurrent connections
  limit_zone   one  $binary_remote_addr  10m;
  server {
    location / {
      limit_conn   one  8;
    }
  }

Preventing repeated connections from the same IP ⌘

   limit_req_zone  $binary_remote_addr  zone=one:10m   rate=1r/s;
   server {
     location /search/ {
       limit_req zone=one burst=5
     }
   }
  • allows a user no more than 1 request per second on average, with bursts up to 5

Limiting bandwidth usage ⌘

  • By default, nginx will send as fast as it can
  • nginx has a range of options for tuning this

Limiting bandwidth usage - streaming ⌘

  • When streaming video/audio from a server, generally you want to give the client a reasonable buffer, then maintain this buffer
  • Can be achieved with an initial fast connection, then rate limiting after

Streaming bandwidth limit example ⌘

 location /streamfiles {
   limit_conn connections 1;
   limit_rate_after 16m;
   limit_rate 512k;
 }
  • Limit each user to a single connection to files under this path
  • Allow them to download the first 16MB at maximum speed
  • After that, limit to 512KB (kiloBYTES, not kilobits) per second

Media streaming ⌘

  • nginx has support for pseudo-streaming for mp4 and flv files
  • Client can seek to a specific location in the file
 location /flash-videos {
    flv;
  }
  location /mp4-videos {
    mp4;
  }