Hacker News Reader

Comment by jbergstroem | Hacker News Reader

One key missing piece in nginx is a way to interact with the configuration without having to edit the config file. This is such a vital piece of a modern infrastructure; where backends are added/removed on demand.

You can interact with haproxy via lua[1] or use etcd to have traefik load its configuration[2].

Seeing how [as others also mentioned] nginx seems to favor pro customers in terms of functionality, it would only seem wise to choose another proxy/load balancer for your next project.

[1]: http://www.arpalert.org/src/haproxy-lua-api/1.7/#Proxy.serve...

[2]: https://docs.traefik.io/toml/#etcd-backend

View on HN

This can be done with lua-nginx-module [1] and its 'balancer_by_lua' directive [2].

There are projects like the one I'm working on [3] that implement dynamic proxies using OpenResty.

[1]: https://github.com/openresty/lua-nginx-module [2]: https://github.com/openresty/lua-nginx-module#balancer_by_lu... [3]: https://github.com/3scale/apicast/

nginx can reload the config files without closing the listening port or interrupting any existing requests. haproxy can't do that. So you can actually live-update on-demand much more of the nginx configuration than you can the haproxy configuration.

> haproxy can't do that.

HAProxy reloads don't interrupt existing connections (unless you want it to).

There is a ~microsecond downtime in accepting new connections. https://engineeringblog.yelp.com/2015/04/true-zero-downtime-...

Logging in to machines to update configs doesn't scale well. You often end up building your own framework/api "only" to edit the config file.

Or paying $2500/instance/year for nginx plus.

Executing a template, writing it to a file, and sending SIGHUP, is not that hugely different from composing a request and writing it to a control socket.

Maybe nginx isn't better than haproxy for many purposes. But updating configuration isn't the reason :)

Ansible is working great for me.

If that's a problem for you, then use a pull-style config management tool (eg puppet) over a push-style one (eg ansible).

If you're at a scale where logging into each server from your control node 'hurts', then you're still going to hurt with all the config other than nginx anyway.

This doesn't work well for modern websites using push-style updates, e.g. via websockets. Old nginx processes might never close after the reload, as connections are very long-lived. If reloads happen often this leads to memory exhaustion. So this is a bad solution to rely on.

Websockets are indeed a complication, I'm guessing for haproxy also. But it seems nginx has a recently added feature which can fix this:

https://nginx.org/en/docs/ngx_core_module.html#worker_shutdo...

NGINX plus provides a simple http API to add and remove backends to an upstream block. They also have persistence of these changes.

See https://www.nginx.com/products/on-the-fly-reconfiguration/

Disclaimer: nginx plus is about $1900 per server. HaProxy is free.

You can hot reload config files that you have already tested for correctness. No dropped connections.

Been using Traefik under light load on Kubernetes with automatic acme let's encrypt support. Very happpy with the ease of use so far and it even exposes Prometheus metrics.

Apache httpd 2.4 has supported dynamic reconfiguration of backends for years now without leveraging Lua-hacks:

https://httpd.apache.org/docs/2.4/howto/reverse_proxy.html#m...

I did use that one which actually works pretty well, although you should manage Go skills a little bit.

https://github.com/martensson/nixy

Reply on news.ycombinator.com