Table of Contents
Preface ix
1 Basics 1
1.0 Introduction 1
1.1 Installing NGINX on Debian/Ubuntu 1
1.2 Installing NGINX on RedHat/CentOS 2
1.3 Installing NGINX Plus 3
1.4 Verifying Your Installation 3
1.5 Key Files, Directories, and Commands 4
1.6 Serving Static Content 6
1.7 Graceful Reload 7
2 High-Performance Load Balancing 9
2.0 Introduction 9
2.1 HTTP Load Balancing 10
2.2 TCP Load Balancing 11
2.3 UDP Load Balancing 13
2.4 Load-Balancing Methods 14
2.5 Sticky Cookie with NGINX Plus 16
2.6 Sticky Learn with NGINX Plus 17
2.7 Sticky Routing with NGINX Plus 18
2.8 Connection Draining with NGINX Plus 19
2.9 Passive Health Checks 20
2.10 Active Health Checks with NGINX Plus 21
2.11 Slow Start with NGINX Plus 23
3 Traffic Management 25
3.0 Introduction 25
3.1 A/B Testing 25
3.2 Using the GeoIP Module and Database 27
3.3 Restricting Access Based on Country 29
3.4 Finding the Original Client 30
3.5 Limiting Connections 31
3.6 Limiting Rate 32
3.7 Limiting Bandwidth 34
4 Massively Scalable Content Caching 35
4.0 Introduction 35
4.1 Caching Zones 35
4.2 Cache Locking 36
4.3 Caching Hash Keys 37
4.4 Cache Bypass 38
4.5 Cache Performance 39
4.6 Cache Purging with NGINX Plus 39
4.7 Cache Slicing 40
5 Programmability and Automation 43
5.0 Introduction 43
5.1 NGINX Plus API 43
5.2 Using the Key-Value Store with NGINX Plus 47
5.3 Using the NJS Module to Expose JavaScript Functionality Within NGINX 49
5.4 Extending NGINX with a Common Programming Language 52
5.5 Installing with Chef 54
5.6 Installing with Ansible 55
5.7 Automating Configurations with Consul Templating 57
6 Authentication 59
6.0 Introduction 59
6.1 HTTP Basic Authentication 59
6.2 Authentication Subrequests 61
6.3 Validating JWTs with NGINX Plus 62
6.4 Creating JSON Web Keys 63
6.5 Validate JSON Web Tokens with NGINX Plus 64
6.6 Automatically Obtaining and Caching JSON Web Key Sets with NGINX Plus 65
6.7 Authenticate Users via Existing OpenID Connect SSO with NGINX Plus 66
7 Security Controls 69
7.0 Introduction 69
7.1 Access Based on IP Address 69
7.2 Allowing Cross-Origin Resource Sharing 70
7.3 Client-Side Encryption 72
7.4 Advanced Client-Side Encryption 73
7.5 Upstream Encryption 75
7.6 Securing a Location 75
7.7 Generating a Secure Link with a Secret 76
7.8 Securing a Location with an Expire Date 77
7.9 Generating an Expiring Link 78
7.10 HTTPS Redirects 80
7.11 Redirecting to HTTPS Where SSL/TLS Is Terminated Before NGINX 80
7.12 HTTP Strict Transport Security 81
7.13 Satisfying Any Number of Security Methods 82
7.14 NGINX Plus Dynamic Application Layer DDoS Mitigation 83
7.15 Installing and Configuring NGINX Plus with the NGINX App Protect WAF Module 84
8 HTTP/2 89
8.0 Introduction 89
8.1 Basic Configuration 89
8.2 gRPC 90
8.3 HTTP/2 Server Push 92
9 Sophisticated Media Streaming 95
9.0 Introduction 95
9.1 Serving MP4 and FLV 95
9.2 Streaming with HLS with NGINX Plus 96
9.3 Streaming with HDS with NGINX Plus 97
9.4 Bandwidth Limits with NGINX Plus 98
10 Cloud Deployments 99
10.0 Introduction 99
10.1 Auto-Provisioning on AWS 99
10.2 Routing to NGINX Nodes Without an AWS ELB 101
10.3 The NLB Sandwich 102
10.4 Deploying from the AWS Marketplace 104
10.5 Creating an NGINX Virtual Machine Image on Azure 105
10.6 Load Balancing Over NGINX Scale Sets on Azure 107
10.7 Deploying Through the Azure Marketplace 108
10.8 Deploying to Google Compute Engine 109
10.9 Creating a Google Compute Image 109
10.10 Creating a Google App Engine Proxy 110
11 Containers/Microservices 113
11.0 Introduction 113
11.1 Using NGINX as an API Gateway 114
11.2 Using DNS SRV Records with NGINX Plus 118
11.3 Using the Official NGINX Image 119
11.4 Creating an NGINX Dockerfile 120
11.5 Building an NGINX Plus Docker Image 122
11.6 Using Environment Variables in NGINX 124
11.7 Kubernetes Ingress Controller 125
11.8 Prometheus Exporter Module 127
11.9 NGINX Service Mesh mTLS 128
12 High-Availability Deployment Modes 131
12.0 Introduction 131
12.1 NGINX Plus HA Mode 131
12.2 Load-Balancing Load Balancers with DNS 132
12.3 Load Balancing on EC2 132
12.4 NGINX Plus Configuration Synchronization 133
12.5 State Sharing with NGINX Plus and Zone Sync 136
13 Advanced Activity Monitoring 139
13.0 Introduction 139
13.1 Enable NGINX Open Source Stub Status 139
13.2 Enabling the NGINX Plus Monitoring Dashboard 140
13.3 Collecting Metrics Using the NGINX Plus API 143
14 Debugging and Troubleshooting with Access Logs, Error Logs, and Request Tracing 147
14.0 Introduction 147
14.1 Configuring Access Logs 147
14.2 Configuring Error Logs 149
14.3 Forwarding to Syslog 150
14.4 Request Tracing 151
14.5 OpenTracing for NGINX 152
15 Performance Tuning 155
15.0 Introduction 155
15.1 Automating Tests with Load Drivers 155
15.2 Keeping Connections Open to Clients 156
15.3 Keeping Connections Open Upstream 157
15.4 Buffering Responses 158
15.5 Buffering Access Logs 159
15.6 OS Tuning 159
16 Introduction to NGINX Instance Manager 161
16.0 Introduction 161
16.1 Setup Overview 161
16.2 Agent Installation 163
16.3 Automating NGINX Discovery, Configuration, and Monitoring with the API 165
17 Introduction to NGINX Controller 167
17.0 Introduction 167
17.1 Setup Overview 167
17.2 Connecting NGINX Plus with Controller 169
17.3 Driving NGINX Controller with the API 170
17.4 Enable WAF Through Controller App Security 171
18 Practical Ops Tips and Conclusion 175
18.0 Introduction 175
18.1 Using Includes for Clean Configs 175
18.2 Debugging Configs 176
Conclusion 179
Index 181
