Hacker News Reader

Comment by TekMol | Hacker News Reader

How well is Gunicorn suited for production?

Do you need to put another server in front of it for https or has Gunicorn https handling built in?

All the companies I ever worked for used Gunicorn to serve Python apps. You can put Nginx/Traefik/whatever in front of it for load balancing but you don't have to.

Gunicorn does support https. They still seem to recommend using a different server in front of it.

If you put Apache or Nginx in front of it, why not leave out Gunicorn completely?

Apache has mod_wsgi, nginx not so much.

mod_wsgi is a much less flexible setup when it comes to mixing and matching different python versions

Python has an interface called WSGI (web server gateway interface), with both Apache and Nginx you need either a none standard module for that interface or to reverse proxy to a second server that does.

So same number of moving parts either way.

How is libapache2-mod-wsgi-py3 "none standard"?

I meant it’s not built in as standard when you install apache, it’s an extra thing to install (even if it runs in process).

Gunicorn is not just a static content server (actually I don’t think it can serve static content out of the box?) but a wsgi-compliant application server. You can’t leave it out because then, how would your python web backend run?

For apache, there is libapache2-mod-wsgi-py3

Seems easier to just "apt install libapache2-mod-wsgi-py3" and put a "WSGIScriptAlias" directive into your apache config than to run another piece of software?

I think it depends on how your whole stack looks. If you are running on a PAAS such as Heroku, have load balancers or are even using something like ClourFlare I don’t this it’s necessary to have something in front of Gunicorn.

I wouldn’t leave Gunicorn “naked” for want of a better word, or use it for static files though.

Here’s why according to their docs:

> Although there are many HTTP proxies available, we strongly advise that you use Nginx. If you choose another proxy server you need to make sure that it buffers slow clients when you use default Gunicorn workers. Without this buffering Gunicorn will be easily susceptible to denial-of-service attacks.

https://docs.gunicorn.org/en/stable/deploy.html

I was tempted to write "you always need to put a many-years-battle-tested specialized server in front, if you mean protection from attacks", but nowadays even these servers get so many new features and rewrites so often, that it's pretty valid to doubt their maturity.. And being written in C is always a time bomb.

But probably it's still a good idea to use them.

Reply on news.ycombinator.com