NGINX Cookbook: Advanced Recipes for High-Performance Load Balancing

by Derek DeJonghe

Overview

NGINX is one of the most widely used web servers available today, in part because of itscapabilities as a load balancer and reverse proxy server for HTTP and other network protocols. This revised cookbook provides easy-to-follow examples of real-world problems in application delivery. Practical recipes help you set up and use either the open source or commercial offering to solve problems in various use cases.

For professionals who understand modern web architectures, such as n-tier or microservice designs and common web protocols such as TCP and HTTP, these recipes provide proven solutions for security and software load balancing and for monitoring and maintaining NGINX's application delivery platform. You'll also explore advanced features of both NGINX and NGINX Plus, the free and licensed versions of this server.

You'll find recipes for:

• High-performance load balancing with HTTP, TCP, and UDP
• Securing access through encrypted traffic, secure links, HTTP authentication subrequests, and more
• Deploying NGINX to Google, AWS, and Azure cloud
• Setting up and configuring NGINX Controller
• Installing and configuring the NGINX App Protect module
• Enabling WAF through Controller ADC
• NGINX Instance Manager, Service Mesh, and the njs module

Product Details

ISBN-13:	9781098158392
Publisher:	O'Reilly Media, Incorporated
Publication date:	01/29/2024
Sold by:	Barnes & Noble
Format:	eBook
Pages:	194
File size:	3 MB

About the Author

Derek DeJonghe, an Amazon Web Services Certified Professional, specializes in Linux/Unix-based systems and web applications. His background in web development, system administration, and networking makes him a valuable cloud resource. Derek focuses on infrastructure management, configuration management, and continuous integration. He also develops DevOps tools and maintains the systems, networks, and deployments of multiple multi-tenant SaaS offerings.

Table of Contents

Preface ix

1 Basics 1

1.0 Introduction 1

1.1 Installing NGINX on Debian/Ubuntu 1

1.2 Installing NGINX on RedHat/CentOS 2

1.3 Installing NGINX Plus 3

1.4 Verifying Your Installation 3

1.5 Key Files, Directories, and Commands 4

1.6 Serving Static Content 6

1.7 Graceful Reload 7

2 High-Performance Load Balancing 9

2.0 Introduction 9

2.1 HTTP Load Balancing 10

2.2 TCP Load Balancing 11

2.3 UDP Load Balancing 13

2.4 Load-Balancing Methods 14

2.5 Sticky Cookie with NGINX Plus 16

2.6 Sticky Learn with NGINX Plus 17

2.7 Sticky Routing with NGINX Plus 18

2.8 Connection Draining with NGINX Plus 19

2.9 Passive Health Checks 20

2.10 Active Health Checks with NGINX Plus 21

2.11 Slow Start with NGINX Plus 23

3 Traffic Management 25

3.0 Introduction 25

3.1 A/B Testing 25

3.2 Using the GeoIP Module and Database 27

3.3 Restricting Access Based on Country 29

3.4 Finding the Original Client 30

3.5 Limiting Connections 31

3.6 Limiting Rate 32

3.7 Limiting Bandwidth 34

4 Massively Scalable Content Caching 35

4.0 Introduction 35

4.1 Caching Zones 35

4.2 Cache Locking 36

4.3 Caching Hash Keys 37

4.4 Cache Bypass 38

4.5 Cache Performance 39

4.6 Cache Purging with NGINX Plus 39

4.7 Cache Slicing 40

5 Programmability and Automation 43

5.0 Introduction 43

5.1 NGINX Plus API 43

5.2 Using the Key-Value Store with NGINX Plus 47

5.3 Using the NJS Module to Expose JavaScript Functionality Within NGINX 49

5.4 Extending NGINX with a Common Programming Language 52

5.5 Installing with Chef 54

5.6 Installing with Ansible 55

5.7 Automating Configurations with Consul Templating 57

6 Authentication 59

6.0 Introduction 59

6.1 HTTP Basic Authentication 59

6.2 Authentication Subrequests 61

6.3 Validating JWTs with NGINX Plus 62

6.4 Creating JSON Web Keys 63

6.5 Validate JSON Web Tokens with NGINX Plus 64

6.6 Automatically Obtaining and Caching JSON Web Key Sets with NGINX Plus 65

6.7 Authenticate Users via Existing OpenID Connect SSO with NGINX Plus 66

7 Security Controls 69

7.0 Introduction 69

7.1 Access Based on IP Address 69

7.2 Allowing Cross-Origin Resource Sharing 70

7.3 Client-Side Encryption 72

7.4 Advanced Client-Side Encryption 73

7.5 Upstream Encryption 75

7.6 Securing a Location 75

7.7 Generating a Secure Link with a Secret 76

7.8 Securing a Location with an Expire Date 77

7.9 Generating an Expiring Link 78

7.10 HTTPS Redirects 80

7.11 Redirecting to HTTPS Where SSL/TLS Is Terminated Before NGINX 80

7.12 HTTP Strict Transport Security 81

7.13 Satisfying Any Number of Security Methods 82

7.14 NGINX Plus Dynamic Application Layer DDoS Mitigation 83

7.15 Installing and Configuring NGINX Plus with the NGINX App Protect WAF Module 84

8 HTTP/2 89

8.0 Introduction 89

8.1 Basic Configuration 89

8.2 gRPC 90

8.3 HTTP/2 Server Push 92

9 Sophisticated Media Streaming 95

9.0 Introduction 95

9.1 Serving MP4 and FLV 95

9.2 Streaming with HLS with NGINX Plus 96

9.3 Streaming with HDS with NGINX Plus 97

9.4 Bandwidth Limits with NGINX Plus 98

10 Cloud Deployments 99

10.0 Introduction 99

10.1 Auto-Provisioning on AWS 99

10.2 Routing to NGINX Nodes Without an AWS ELB 101

10.3 The NLB Sandwich 102

10.4 Deploying from the AWS Marketplace 104

10.5 Creating an NGINX Virtual Machine Image on Azure 105

10.6 Load Balancing Over NGINX Scale Sets on Azure 107

10.7 Deploying Through the Azure Marketplace 108

10.8 Deploying to Google Compute Engine 109

10.9 Creating a Google Compute Image 109

10.10 Creating a Google App Engine Proxy 110

11 Containers/Microservices 113

11.0 Introduction 113

11.1 Using NGINX as an API Gateway 114

11.2 Using DNS SRV Records with NGINX Plus 118

11.3 Using the Official NGINX Image 119

11.4 Creating an NGINX Dockerfile 120

11.5 Building an NGINX Plus Docker Image 122

11.6 Using Environment Variables in NGINX 124

11.7 Kubernetes Ingress Controller 125

11.8 Prometheus Exporter Module 127

11.9 NGINX Service Mesh mTLS 128

12 High-Availability Deployment Modes 131

12.0 Introduction 131

12.1 NGINX Plus HA Mode 131

12.2 Load-Balancing Load Balancers with DNS 132

12.3 Load Balancing on EC2 132

12.4 NGINX Plus Configuration Synchronization 133

12.5 State Sharing with NGINX Plus and Zone Sync 136

13 Advanced Activity Monitoring 139

13.0 Introduction 139

13.1 Enable NGINX Open Source Stub Status 139

13.2 Enabling the NGINX Plus Monitoring Dashboard 140

13.3 Collecting Metrics Using the NGINX Plus API 143

14 Debugging and Troubleshooting with Access Logs, Error Logs, and Request Tracing 147

14.0 Introduction 147

14.1 Configuring Access Logs 147

14.2 Configuring Error Logs 149

14.3 Forwarding to Syslog 150

14.4 Request Tracing 151

14.5 OpenTracing for NGINX 152

15 Performance Tuning 155

15.0 Introduction 155

15.1 Automating Tests with Load Drivers 155

15.2 Keeping Connections Open to Clients 156

15.3 Keeping Connections Open Upstream 157

15.4 Buffering Responses 158

15.5 Buffering Access Logs 159

15.6 OS Tuning 159

16 Introduction to NGINX Instance Manager 161

16.0 Introduction 161

16.1 Setup Overview 161

16.2 Agent Installation 163

16.3 Automating NGINX Discovery, Configuration, and Monitoring with the API 165

17 Introduction to NGINX Controller 167

17.0 Introduction 167

17.1 Setup Overview 167

17.2 Connecting NGINX Plus with Controller 169

17.3 Driving NGINX Controller with the API 170

17.4 Enable WAF Through Controller App Security 171

18 Practical Ops Tips and Conclusion 175

18.0 Introduction 175

18.1 Using Includes for Clean Configs 175

18.2 Debugging Configs 176

Conclusion 179

Index 181