DevOps
nginx
nginx is a fast web server and reverse proxy that also works as a load balancer and HTTP cache.
What it is
nginx was created by Igor Sysoev and the first public release came in 2004. It is built on an asynchronous event model, so it serves thousands of connections with few processes and little memory. It is now developed by F5.
Typical roles: serving static files, being a reverse proxy in front of an app (Node, Python, PHP-FPM), terminating TLS, balancing load across servers, caching responses and rate limiting.
Configuration is text blocks server and location in nginx.conf. Changes apply without downtime via nginx -s reload.
Use it when
- You need a reverse proxy and TLS termination in front of an app.
- You serve static files or cache responses.
- You balance load across several servers.
- You need high performance with many connections.
Avoid it when
- You want automatic certificates out of the box with no setup: Caddy is simpler.
- A container environment with dynamic service discovery: Traefik or an ingress controller is handier.
Key concepts
- server / location
- Config blocks: server describes a virtual host, location holds rules for paths.
- Reverse proxy
- Accepts client requests and forwards them to an app via proxy_pass.
- upstream
- A group of backend servers among which nginx balances load.
- Event loop
- An asynchronous model: a few workers serve many connections without a thread per connection.
Example
Interview questions
1. What is a reverse proxy and why use one?
A server in front of an app that accepts client requests and forwards them. It can terminate TLS, balance load, cache, compress and shield the backend from direct access.
2. Why is nginx faster than a thread-per-connection model?
It uses an asynchronous event model: a few workers handle many connections via epoll, so it does not spend memory and context switches on each client.
3. How do you update configuration without downtime?
Check the config with nginx -t and run nginx -s reload. The master process starts new workers with the new config, while old ones finish current requests and exit.
Interview questions from the bank
- A Node service sits behind an AWS ALB. At low traffic occasional 502s slip through, there is nothing in the application logs, and CPU is low. What mechanism do you suspect first, and how do you verify it?SeniorNode.js
- A WebSocket chat behind Nginx. Complaints: connections drop exactly every minute when the chat is quiet. And after every deploy one of three Node processes holds 80% of all connections. Explain both effects and fix the config.MiddleSystem design
- Stack: a mobile client with a 10 s timeout, Nginx, Node, Postgres. When the database slows down, Node has thousands of requests in flight, memory grows, and Postgres has queries hanging that have been running for 5 minutes already. Here are the settings. What is wrong with the timeouts and how do you build a budget?SeniorSystem design
- After upload a file must be checked with an antivirus, images need three thumbnails, and videos need a preview. ClamAV scans tens of MB/s per core, while ffmpeg on video works for minutes. Design this pipeline and the serving: where the queues are, how to keep video from blocking images, when a file becomes available and how to serve 20 Gbit/s of downloads.SeniorSystem design
- Why do you need Service and Ingress in Kubernetes?JuniorDevOps
- TLS is terminated at Nginx, and the app listens on localhost behind it. What should you pay attention to in the configuration?MiddleWeb security
Comparisons with this technology
Related technologies
- CaddyCaddy is a web server and reverse proxy written in Go with automatic HTTPS and very simple configuration.
- TraefikTraefik is a cloud-native reverse proxy and edge router that discovers services in Docker and Kubernetes and configures routes itself.
- DockerDocker packages an application with its dependencies into a container that runs the same on a laptop, a server and the cloud.
- AnsibleAnsible is an agentless automation tool: YAML playbooks configure servers and deploy software over SSH.
Logos belong to their owners and are used for identification only. Icons: Simple Icons (CC0), Devicon (MIT).