nginx for SilverStripe

Why and how you should be using nginx for your SilverStripe sites — SilverStripe Europe 2014

Transcript

1. Philipp Krenn, @xeraa
2. GSoC student 2007 Book 2011 GSoC mentor 2012 SilverStripe Austria meetup
3. Why?
4. there's this russian server nginx. all the porn sites use it. it must be decent. 1 Jonathan Vanasco, http://www.destructuring.net/2006/10/09/nginx/
5. Subversion vs Git
6. I only believe in statistics that I doctored myself. (Winston Churchill) http://w3techs.com/technologies/ cross/web_server/ranking
8. Apache is like Microsoft Word, it has a million options but you only need six.
9. nginx does those six things, and it does five of them 50 times faster than Apache. 1 Chris Lea, http://maisonbisson.com/post/12249/chris- lea-on-nginx-and-wordpress/
10. What?
11. Public launch in 2004 by Igor Sysoev http://www.rambler.ru BSD licensed (two-clause)
12. Stable 1.6.2, Preview 1.7.6 C, cross-platform Commercial support from Nginx Inc.
13. Features Load balancer Reverse proxy TLS/SSL (SNI), SPDY,... support
14. Users WordPress.com app server + load balancer Static content on GitHub SSL termination Wikipedia
15. nginx is a lightweight event-driven reverse proxy for web and mail services. 1 http://nginx.org
16. Great! But...
17. ...it doesn't work the Apache way For example .htaccess
18. Performance For every request, check every directory, read and parse every file Changes effective immediately
19. Example http://example.com/assets/Uploads/ gallery/image.jpg
21. Apache Thread / process-oriented Spawn a process for each connection (1MB+ RAM) Apache 2.4 multi-process mode reduces memory usage
22. Problem 200KB response Milliseconds to generate or retrieve 10s to transmit at 160kbps (20KB/s) 1000 connections :(
23. it's time for web servers to handle ten thousand clients simultaneously 1 Daniel Kegel
24. C10K challenge nginx solution: Event- driven architecture
25. Event-driven Single nonblocking thread (one process per core) — node.js, Redis,... Stable memory usage, no context switches
26. Event-driven Receive request, trigger events in a process Process handles events, returns output http://en.wikipedia.org/wiki/Reactor_pattern
27. http://www.aosabook.org/en/nginx.html#fig.nginx.arch
28. However... PHP is blocking node.js isn't — similar to nginx
29. Details "The Architecture of Open Source Applications" http://www.aosabook.org/en/ nginx.html
30. PHP-FPM FastCGI Process Manager, included in PHP 5.3.3+ Standalone process like MySQL, Memcached,...
31. How?
32. Install (Ubuntu) $ sudo apt-get update && sudo apt-get install nginx php5-fpm -y
33. Base nginx http { include mime.types; default_type application/octet-stream; access_log /var/log/nginx/access.log; error_log /var/log/nginx/error.log debug; sendfile on; keepalive_timeout 65; gzip on;
34. SilverStripe projects server { root /Users/philipp/Sites/silverstripe-30; server_name silverstripe-30.local; include _silverstripe3; } server { root /Users/philipp/Sites/silverstripe-31; server_name silverstripe-31.local; include _silverstripe3; }
35. _silverstripe3 error_page 404 /assets/error-404.html; error_page 500 /assets/error-500.html; location ~* ^.+.(htm|html|jpg|jpeg|gif|png|svg|ico|css| zip|tgz|gz|rar|bz2|doc|docx|xls|xlsx|pdf| ppt|pptx|txt|tar|mid|midi|wav|bmp|rtf|js)$ { access_log off; expires max; }
36. _silverstripe3 location ~* \.php$ { fastcgi_keep_conn on; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/var/run/php-fpm.sock; fastcgi_index index.php; include fastcgi.conf; fastcgi_read_timeout 120; fastcgi_connect_timeout 60; fastcgi_send_timeout 120; fastcgi_buffer_size 64k; fastcgi_buffers 4 65k; fastcgi_busy_buffers_size 128k; }
37. _silverstripe3 location / { try_files $uri @silverstripe; } location @silverstripe { fastcgi_keep_conn on; fastcgi_split_path_info ^(.+\.php)(/.+)$; fastcgi_pass unix:/var/run/php-fpm.sock; fastcgi_index index.php; include fastcgi.conf; fastcgi_read_timeout 120; fastcgi_connect_timeout 60; fastcgi_send_timeout 120; fastcgi_buffer_size 64k; fastcgi_buffers 4 65k; fastcgi_busy_buffers_size 128k; fastcgi_param SCRIPT_FILENAME $document_root/framework/main.php; fastcgi_param SCRIPT_NAME /framework/main.php; fastcgi_param QUERY_STRING url=$uri&$args; }
38. _silverstripe3 # CMS & Framework .htaccess rules location ~ ^/(cms|framework|mysite)/.*\.(php|php[345]|phtml|inc)$ { deny all; } location ~ ^/(cms|framework)/silverstripe_version$ { deny all; } location ~ ^/framework/.*(main|static-main|rpc|tiny_mce_gzip)\.php$ { allow all; }
39. _silverstripe3 # Don't execute scripts in the assets folder location ^~ /assets/ { sendfile on; try_files $uri $uri/ =404; } location ~ ^/silverstripe-cache { deny all; } location ~ ^/logs { deny all; }
40. _silverstripe3 location ~ ^/(vendor|composer.json|composer.lock) { deny all; } location ~ \.yml$ { deny all; } location ~ \.ss$ { satisfy any; allow 127.0.0.1; deny all; } location ~ /\. { deny all; }
41. Show me some benchmarks
43. http://wiki.dreamhost.com/ Web_Server_Performance_Comparison 25,000 requests, 5KB PNG $ ab -n 25000 -c 50 http://example.com/ logo.png Concurrency 50, 100, 500, 1000, 1500, 2000, 2500, 3000
46. Benchmark your projects Build Benchmark Repeat
47. Solution? Is this your bottleneck? Could you configure Apache to be fast (enough)? Is PHP-FPM the solution?
48. Nevertheless...
50. Questions?
51. PS: PHP Secure Configuration Checker
52. https://github.com/sektioneins/pcc SektionEins (Suhoshin) PHP 5.4+ BSD license
53. Security checks Critical: Fix this NOW Example: Register globals
54. Security checks High: You should really look at this Example: Allow URL fopen
55. Security checks Medium: This might be a problem Example: Display errors on
56. Security Checks Low: Boring stuff Example: Execution time > 300s
57. Security checks Maybe: Not sure, check manually Example: Memory limit > 128MB
58. Security checks Comment: Just mentioning it Example: Upload max filesize is the default (8MB)
59. Modes CLI Web
60. Web security 127.0.0.1 mtime < 2d
61. How good / bad are the Ubuntu 14.04 defaults? nginx + PHP-FPM
63. Give it a try https://github.com/xeraa/ppc-test Vagrant — more tomorrow
64. Conclusion: Simple but gets the job done