Cranking Nginx to 11 - PHPTek 2012

You may see Nginx as the run of the mill web server, geared towards serving up static files and your language of choice but there is so much more to Nginx than that. Under the hood is a treasure trove of additional features and configurations that can help you take things to the next level. This includes having Nginx talk directly to Memcached / Redis (perfect for APIs, without hitting your application), proxy functionality, GeoIP, Lua in the config, MogileFS file serving, improved headers manipulation, and the less useful yet cool ability to query Drizzle / Postgres directly. This is only the tip of the iceberg. I will take you one a journey to explore the hidden corners of Nginx and show you how to crank it up to 11!

Transcript

1. Helgi Þormar Þorbjörnsson PHPTek, Chicago, 25th May, 2012 Cranking Nginx to 11
2. Helgi
3. Co-founded Orchestra.io Helgi
4. Co-founded Orchestra.io Work at EngineYard Helgi
5. Co-founded Orchestra.io Work at EngineYard PEAR Developer Helgi
6. Co-founded Orchestra.io Work at EngineYard PEAR Developer From Iceland Helgi
7. Co-founded Orchestra.io Work at EngineYard PEAR Developer From Iceland @h on Twitter Helgi
8. Nginx Just a web server?
9. No! It’s so much more!
10. ✓ Web Server ✓ Proxy ✓ Cache ✓ Mail Proxy ✓ And more!
12. Extensible
13. Extensible Flexible
14. Extensible Flexible FFFFFFast
15. Important for tweaking
16. Reload (HUP Signal)
17. Reload (HUP Signal) ‣ Reloads config ‣ Starts up new workers ‣ Old workers stop listening ‣ Finish up any work they have
18. Upgrade (USR2 Signal)
19. Upgrade (USR2 Signal) ‣ Live upgrade of Nginx executable ‣ Starts up a new Master ‣ Run in parallel ‣ Old Workers gracefully shutdown ‣ Old Master can be brought back
20. And always run configtest before doing anything!
21. The journey to 11
22. Location Blocks
23. Foundation of most things we will do
24. Most Common Block location / { try_files $uri $uri/ /index.php$is_args$args; }
25. location /helgi/is/awesome { return 202; }
26. Accepts Regex Done by adding ~ in front of the regular expression
27. Accepts Regex # deny access to all .dot-files location ~ /\. { access_log off; log_not_found off; deny all; } # deny access to all backups location ~ ~$ { access_log off; log_not_found off; deny all; }
28. Error Pages
29. Basic Custom 404 error_page 404 /errors/404.html;
30. Basic Custom 404 error_page 404 /errors/404.html; Requires /errors/404.html to be in the document root
31. Basic Custom 404 error_page 404 /errors/404.html; location /errors/404.html { internal; }
32. Basic Custom 404 root /var/www/public; error_page 404 /errors/404.html; location /errors/404.html { internal; root /var/www; }
33. Errors via PHP error_page 404 @four_oh_four; location @four_oh_four { if (!-f "/var/www/errors/404.php") { return 404; } include fastcgi_params; fastcgi_param SCRIPT_FILENAME /var/www/errors/404.php; fastcgi_pass web_workers; }
34. Combo! error_page 404 @four_oh_four; location @four_oh_four { if (-f "/var/www/errors/404.html") { rewrite ^ /errors/404.html last; } if (!-f "/var/www/errors/404.php") { return 404; } include fastcgi_params; fastcgi_param SCRIPT_FILENAME /var/www/errors/404.php; fastcgi_pass web_workers; } error_page 404 /errors/404.html; location /errors/404.html { internal; root /var/www; }
35. 50x and others error_page 500 501 502 503 504 @five_oh_ex; location @five_oh_ex { <all the usual stuff> }
36. 50x and others error_page 500 501 502 503 504 @five_oh_ex; location @five_oh_ex { <all the usual stuff> } Most HTTP codes can be bunched together
37. Facebook
38. Official Solution error_page 405 =200 $uri;
39. My Hack error_page 405 =200 @four_oh_five; location @four_oh_five { if (!-f $request_filename) { return 404; } proxy_method GET; proxy_pass http://localhost:80; }
40. Health Checks
41. Nginx Check location = /health/ping { return 200; }
42. Nginx + FPM [healthcheck] listen = /var/run/php/healthcheck.sock user = www-data pm = static pm.max_children = 1 pm.max_requests = 10000 ping.path = /health/ping ping.response = "pong" PHP FPM Config
43. Nginx + FPM location = /health/ping { fastcgi_pass healthcheck; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; } upstream healthcheck { server unix:/var/run/php/healthcheck.sock; } Nginx Config
44. Rewrite Module
45. Regex (PCRE)
46. Responsible for all if statements, file exists checks, returns and more.
47. Can work with most Nginx variables such as http_cookie, user agent, uri and countless others.
48. last break redirect permanent
49. last break redirect permanent Finish rewrite and evaluates all rewrites again
50. last break redirect permanent Finish rewrite and evaluates all rewrites again Finish rewrite does no further rewrite processing
51. last break redirect permanent Finish rewrite and evaluates all rewrites again Finish rewrite does no further rewrite processing Returns a 302 on the rewrite
52. last break redirect permanent Finish rewrite and evaluates all rewrites again Finish rewrite does no further rewrite processing Returns a 302 on the rewrite Returns a 301 on the rewrite
53. last break redirect permanent Finish rewrite and evaluates all rewrites again Finish rewrite does no further rewrite processing Returns a 302 on the rewrite Returns a 301 on the rewrite
54. Forward Domains How to send www.helgi.ws to helgi.ws
55. server { server_name www.helgi.ws; rewrite ^/(.*)$ helgi.ws/$1 permanent; } Forward Domains How to send www.helgi.ws to helgi.ws
56. server { server_name www.helgi.ws; rewrite ^/(.*)$ helgi.ws/$1 permanent; } server { server_name www.helgi.ws; rewrite ^ helgi.ws$request_uri permanent; } Forward Domains How to send www.helgi.ws to helgi.ws
57. server { server_name www.helgi.ws; rewrite ^/(.*)$ helgi.ws/$1 permanent; } server { server_name www.helgi.ws; rewrite ^ helgi.ws$request_uri permanent; } Forward Domains How to send www.helgi.ws to helgi.ws
58. Forward Domains server { server_name www.helgi.ws; return 301 $scheme://helgi.ws$request_uri; } The Correct Way™
59. Moving on!
60. upstream web_workers { server unix:/var/run/php/www1.sock; } location ~ \.php$ { if (!-f $request_filename) { return 404; } fastcgi_pass web_workers; fastcgi_index index.php; fastcgi_intercept_errors off; include fastcgi_params; fastcgi_param SCRIPT_FILENAME $document_root$fastcgi_script_name; fastcgi_param SERVER_NAME $host; }
61. SSL
62. ssl_certificate /etc/nginx/ssl/foo.crt; ssl_certificate_key /etc/nginx/ssl/foo.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM; ssl_ecdh_curve secp521r1; Brain esplodes! Boom!
63. Lets break it down
64. ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM; ssl_certificate /etc/nginx/ssl/foo.crt; ssl_certificate_key /etc/nginx/ssl/foo.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_ecdh_curve secp521r1;
65. ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM; ssl_certificate /etc/nginx/ssl/foo.crt; ssl_certificate_key /etc/nginx/ssl/foo.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_ecdh_curve secp521r1; Protocol
66. ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM; ssl_certificate /etc/nginx/ssl/foo.crt; ssl_certificate_key /etc/nginx/ssl/foo.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_ecdh_curve secp521r1; Cache
67. ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM; ssl_certificate /etc/nginx/ssl/foo.crt; ssl_certificate_key /etc/nginx/ssl/foo.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_ecdh_curve secp521r1; Cache 1m of shared cache stores ~4000 connections
68. BEAST
69. CBC-mode ciphers can be exploited. Allowing the attacker to decrypt your traffic.
70. 75% of popular sites still vulnerable according to SSL Pulse https://www.trustworthyinternet.org/ssl-pulse/
71. ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM; ssl_certificate /etc/nginx/ssl/foo.crt; ssl_certificate_key /etc/nginx/ssl/foo.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_ecdh_curve secp521r1; Protocol
72. But stronger encryptions are slower!
73. AES128-SHA
74. AES128-SHA Traffic can be recorded and decoded at later time
75. Diffie-Hellman DHE
76. Elliptic Curve ECDHE
77. Elliptic Curve ECDHE ECDHE
78. Elliptic Curve Improves the DHE performance... A LOT
79. ssl_prefer_server_ciphers on; ssl_ciphers ECDHE-RSA-AES256-SHA384:AES256- SHA256:RC4:HIGH:!MD5:!aNULL:!EDH:!AESGCM; ssl_certificate /etc/nginx/ssl/foo.crt; ssl_certificate_key /etc/nginx/ssl/foo.key; ssl_protocols SSLv3 TLSv1 TLSv1.1 TLSv1.2; ssl_session_cache shared:SSL:10m; ssl_ecdh_curve secp521r1; Protocol 224bit = 2048bit RSA Key 521bit = 4096bit RSA Key
80. Strict Transport Security Header
81. add_header Strict-Transport-Security "max-age=31536000; includeSubDomains";
82. Check SSL rating on SSLLabs.com
83. Headers
84. By default only add and expires
85. add_header add_header Set-Cookie "_orchestra=1; Max-Age=2; Path=/";
86. expires location ~* ^.+\.(jpg|js|jpeg|png)$ { expires 1h; } location ~* helgi.jpg$ { expires epoch; } location ~* kittie.jpg$ { expires max; }
87. wiki.nginx.org/NginxHttpHeadersMoreModule Introducing
88. more_set_headers 'Server: My-Temple'; # set and clear output headers location /bar { more_set_headers 'X-MyHeader: blah' 'X-MyHeader2: foo'; more_set_headers -t 'text/plain text/css' 'Content-Type: text/foo'; more_set_headers -s '400 404 500 503' -s 413 'Foo: Bar'; more_clear_headers 'Transfer-Encoding' 'Content-Type'; } # set output headers location /type { more_set_headers 'Content-Type: text/plain'; }
89. # set input headers location /foo { more_set_input_headers 'Host: ShoelessJoes'; more_set_input_headers -t 'text/plain' 'X-Tek: bah'; } # replace input header X-Tek *only* if it already exists more_set_input_headers -r 'X-Tek: howdy';
90. Load Balaning
91. upstream web_workers { server www1.example.com; server www2.example.com; server www3.example.com; server www4.example.com; } Simple Round Robin
92. upstream web_workers { ip_hash; server www1.example.com; server www2.example.com; server www3.example.com; server www4.example.com; } Consistent IP Routing
93. upstream web_workers { server www1.example.com; server www2.example.com weight=2 max_fails=2 fail_timeout=15; server www3.example.com weight=4 max_fails=3; server www4.example.com weight=4 max_fails=4 fail_timeout=20; keepalive 8; } Different Weights weight and ip_hash don’t mix.
94. Cache
95. http { proxy_set_header X-Real-IP $remote_addr; proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for; proxy_set_header Host $http_host; proxy_cache_path /dev/shm/nginx levels=1:2 keys_zone=my-cache:8m max_size=2g inactive=600m; proxy_temp_path /dev/shm/nginx/tmp; proxy_cache_use_stale updating; server { location / { proxy_pass http://example.net; proxy_cache my-cache; proxy_cache_valid 200 302 60m; proxy_cache_valid 404 1m; } } }
96. Modules
97. cd /path/to/your/nginx/source ./configure --add-module=/usr/local/nginx/mod/headers-more/ make make install How to compile modules into nginx
98. Blue Sky thinking!
99. Memcache
100. Nginx PHP Memcache
101. Nginx PHP Memcache
102. location / { if ($request_method != GET) { rewrite . @fallback last; } # append an extenstion for proper MIME type detection if ($args ~* format=json) { rewrite ^/$uri/?(.*)$ /$uri.json$1 break; } if ($args ~* format=xml) { rewrite ^/$uri/?(.*)$ /$uri.xml$1 break; } if ($args ~* format=html) { default_type text/html; add_header "Content" "text/html; charset=utf8"; charset utf-8; } set $memcached_key nginx_prefix$uri; memcached_pass memcache_backend; error_page 500 404 405 = @fallback; } location @fallback { /* pass to FastCGI */ }
103. MySQL
104. JSON + CSV Output
105. engineyardjaunt.eventbrite.com Tonight:
106. Questions? @h helgi@engineyard.com Please rate at joind.in/6491