News for hackers. Stuff that matters.
Re:Nginx 1.13 released with TLS 1.3 support by jnsaff2 on Wednesday April 26, 2017 @02:51AM (#14200991)
I wanted to like HAproxy but the lack of support for in-place zero downtime config reloads without resorting to witchcraft was a showstopper. Use case for us a service discovery load balancer for Mesos/Marathon where frontend/backend config can change as often as every few seconds. Never had any issues with nginx.
Re:Nginx 1.13 released with TLS 1.3 support by kawsper on Wednesday April 26, 2017 @03:43AM (#14201204)
Could you elaborate on how you use Nginx as a service discovery load balancer?
Re:Nginx 1.13 released with TLS 1.3 support by jnsaff2 on Wednesday April 26, 2017 @06:30AM (#14201916)
I think most of the ideas are presented here: https://github.com/martensson/nixy

In essence there is a wrapper that:

- reads service information and current backend instances out of service catalog (either Marathon or Consul)

- writes nginx configuration

- runs nginx configtest

- tells nginx to reload its configuration

Nixy referenced above takes service information directly from Marathon event stream but I usually have Consul so I use homebaked consul-template + nginx solution.

Re:Nginx 1.13 released with TLS 1.3 support by user5994461 on Wednesday April 26, 2017 @07:00AM (#14202036)
>> where frontend/backend config can change as often as every few seconds

That's a red flag. Don't make architectures where you depend on crazy requirements like that.

Re:Nginx 1.13 released with TLS 1.3 support by jnsaff2 on Thursday April 27, 2017 @04:34AM (#14210053)
Ok, I will go tell the 200 or so developers that they can only deploy to test/staging once an hour or so instead of, like .. whenever they need.

This is a PaaS supporting many micro-services. There is a hold-off to not reload more than once a second just as an insurance against runaway processes but beyond that nginx handles this without any sweat.

Frequent reloads are currently in the non-prod cluster only but I don't see any reason why it would be an issue in prod as well.

Re:Nginx 1.13 released with TLS 1.3 support by user5994461 on Thursday April 27, 2017 @07:08PM (#14215600)
Depends what you handle. Some services really don't like being forcefully disconnected and not everything is a short lived HTTP(S) request.

P.S. I am in finance, assume my requirements are severely more extreme than yours. Just like my errors.

Re:Nginx 1.13 released with TLS 1.3 support by jnsaff2 on Wednesday May 03, 2017 @06:39AM (#14254499)
That's why we switched to nginx as it is perfectly fine reloading configuration without dropping existing connections. HAproxy can not do that. There is a black magic approach to having two HAproxies listening on the same port so there would always be something listening and connections could be drained, but it's dicey.