Live data from Hacker News

Nginx 1.6.0 stable released

nginx.org

51–60 of 114 posts

Re: Nginx 1.6.0 stable released

#51
post #35

I figure this is as good of place as any to ask my question: Where can I find someone to hire that is able to write Nginx cofigs well. I have spent literally 40ish hours trying to create a Nginx conf that holds up to my OCD. I have been told numerous times on IRC that I am too picky and clean urls are a challenge to write. I am college student and System Administration isn't even my job! Help!

You should let your web framework of choice do that. You should be able to find any directives you need to add to your nginx conf in your framework's docs. Typically they will use a Front Controller (eg: app.php or index.php), so you need a directive to map all the dynamic traffic (ie. usually not images or other static files) to that file. Everything else is done by the framework.

I am designing this Ngnix conf for use on small vanilla sites and static generated sites like Jekyll. (Yes I know Jekyll puts all blog posts in separate folders to solve the URL issue, but I don't want that).

Re: Nginx 1.6.0 stable released

#52

I wish there were better authentication options with Nginx. The ngx_http_auth_request_module is limited: First, it assumes that the authentication agent doesn't need to talk to the user. Second, it doesn't cache the authentication. Perhaps nginx might instead check all requests for a particular signed cookie, verify the signature, if the signature matches, verify that the cookie isn't too old, and then unpack variabl…

Granted, it's more work for you, but this is pretty straight-forward to do with with access_by_lua (and the associated nginx APIs).

Re: Nginx 1.6.0 stable released

#53
post #50

I wish there were better authentication options with Nginx. The ngx_http_auth_request_module is limited: First, it assumes that the authentication agent doesn't need to talk to the user. Second, it doesn't cache the authentication. Perhaps nginx might instead check all requests for a particular signed cookie, verify the signature, if the signature matches, verify that the cookie isn't too old, and then unpack variabl…

>Perhaps nginx might instead check all requests for a particular signed cookie... That's called session handling, which is something you want to implement in your web application, not your web server. http://en.wikipedia.org/wiki/HTTP#HTTP_session_state http://en.wikipedia.org/wiki/Stateless_protocol

[deleted]

Re: Nginx 1.6.0 stable released

#54
post #13

Slightly OT: Does anyone know if packages for Ubuntu 14.04 are coming soon? We're using the official (mainline) repository[1] on Ubuntu 12.04, but Trusty doesn't seem to be supported yet. I've always preferred the official repository because I didn't want to start compiling nginx just for stuff like SPDY support. [1]: http://nginx.org/en/linux_packages.html

It's a good idea to be comfortable compiling/packaging your infra from source (including interpreters, libraries, etc), if only for the ability to quickly apply and deploy emergency patches. To demonstrate the importance of that capability, look no farther than Heartbleed. While distros are usually pretty good about updating critical software, they shouldn't be your only line of defense, except perhaps if you have a…

I agree, although I'd stick with packages for almost anything as it's just too much work to keep up with every release of every piece of software in your stack (except for, as you mentioned, special circumstances like Geartbleed). Plus, since in this case the repository is managed by nginx.org, it's hard to beat them to a new release even if you compile from source.

Re: Nginx 1.6.0 stable released

#55
post #49

Earlier quoted context omitted.

It is a lot to get into now, but here is a taste. foo.com/index > foo.com foo.com/ > foo.com foo.com/folder/index > foo.com/folder/ foo.com/bar.html > foo.com/bar foo.com/bar.htm > foo.com/bar foo.com/bar.php > foo.com/bar www.foo.com/ ANY OF THE ABOVE TESTS > foo.com/* other rules: Never add trailing slash unless it is an index file of a directory. Order: .PHP,.HTML,.HTM. Use h5bp/server-configs-nginx as a base. PHP…

foo.com/* -> www.foo.com/* seems "cleaner" to me than your opposite, due to the issues with cookie leaking, CDN hosting, "normal user" expectations, etc. Like, please appreciate that your usage of "cleaner" is at best subjective ;P. (And I don't quite understand how you are intending to do "foo.com/ -> foo.com"... all URLs must have a path: you can't just GET, you have to GET /.)

I understand the redirecting to non-www is subjective, however I find less characters in the URL is cleaner. Also for a majority of my projects cookies are not used, so it is not a big deal to use a non-www base url.(Static blogs and simple vanilla sites for various school projects, etc).

Also as far as foo.com/ -> foo.com, I was referring to the URL, not the acutal path.

example: https://www.google.com/ redirects to https://www.google.com correct? Maybe I am missing something...

Re: Nginx 1.6.0 stable released

#56
post #50

I wish there were better authentication options with Nginx. The ngx_http_auth_request_module is limited: First, it assumes that the authentication agent doesn't need to talk to the user. Second, it doesn't cache the authentication. Perhaps nginx might instead check all requests for a particular signed cookie, verify the signature, if the signature matches, verify that the cookie isn't too old, and then unpack variabl…

>Perhaps nginx might instead check all requests for a particular signed cookie... That's called session handling, which is something you want to implement in your web application, not your web server. http://en.wikipedia.org/wiki/HTTP#HTTP_session_state http://en.wikipedia.org/wiki/Stateless_protocol

In some cases it would be useful to perform session handling like this in nginx. I like the idea of building a reverse proxy which handles authentication and sessions, in front of a backend web page which wasn't designed to handle it. Something like giving access to an old internal intranet without having to change the app.

Re: Nginx 1.6.0 stable released

#57

I figure this is as good of place as any to ask my question: Where can I find someone to hire that is able to write Nginx cofigs well. I have spent literally 40ish hours trying to create a Nginx conf that holds up to my OCD. I have been told numerous times on IRC that I am too picky and clean urls are a challenge to write. I am college student and System Administration isn't even my job! Help!

Try odesk? If you have a clear spec for what you want you can probably get a fixed-price bid.

Even the word "odesk" leaves a bad taste in my mouth. I have heard a lot of bad things about these kinds of freelance sites.

Re: Nginx 1.6.0 stable released

#58
post #48
post #13

Slightly OT: Does anyone know if packages for Ubuntu 14.04 are coming soon? We're using the official (mainline) repository[1] on Ubuntu 12.04, but Trusty doesn't seem to be supported yet. I've always preferred the official repository because I didn't want to start compiling nginx just for stuff like SPDY support. [1]: http://nginx.org/en/linux_packages.html

I don't know, these things are always outdated so I always install from source.

In my experience the official packages are always up-to-date, as soon as I receive the release announcement, apt-get update will have the latest version ready.

Re: Nginx 1.6.0 stable released

#59
post #38

I figure this is as good of place as any to ask my question: Where can I find someone to hire that is able to write Nginx cofigs well. I have spent literally 40ish hours trying to create a Nginx conf that holds up to my OCD. I have been told numerous times on IRC that I am too picky and clean urls are a challenge to write. I am college student and System Administration isn't even my job! Help!

You didn't really specify what you meant by clean URLs but, maybe this will be helpful to you or someone else. I have a static site served via nginx, but I don't like seeing .html in the URLs. It's a little tricky serving a static site without the .html extension because you may have a directory and an html page with the same name. The way to deal with that is to actually use the .html extension in the file system bu…

By the way, the nginx wiki says that you should avoid ifs when possible: http://wiki.nginx.org/IfIsEvil

Wouldn't something like this accomplish the same thing? (Sorry if I'm totally wrong, I'm not really good)

   location /google/ {

   }
   location /y_key_/ {

   }
   location ~ \.html$ {
      return 404;
   }
   location = /index {
      return 404;
   }
   location / {
      try_files $uri @rewrite
   }
   location @rewrite {
      rewrite ^/$ /index.html break;
      rewrite .* $uri.html break;
   }

Re: Nginx 1.6.0 stable released

#60
post #50

I wish there were better authentication options with Nginx. The ngx_http_auth_request_module is limited: First, it assumes that the authentication agent doesn't need to talk to the user. Second, it doesn't cache the authentication. Perhaps nginx might instead check all requests for a particular signed cookie, verify the signature, if the signature matches, verify that the cookie isn't too old, and then unpack variabl…

>Perhaps nginx might instead check all requests for a particular signed cookie... That's called session handling, which is something you want to implement in your web application, not your web server. http://en.wikipedia.org/wiki/HTTP#HTTP_session_state http://en.wikipedia.org/wiki/Stateless_protocol

Unless you want to use Nginx as an SSL-offloading proxy for a bunch of internal apps that you want to protect from the public but your apps themselves don't use the session in any way? Yes, we can use Lua and effectively write our own, but one of the reasons I've considered Apache again is that there's now a plugin for OAuth 2 + OpenID Connect ;-) https://github.com/pingidentity/mod_auth_openidc

That said, even before this, Apache supported a million different mod_auth_* at http://httpd.apache.org/docs/2.4/mod/ including authentication caching http://httpd.apache.org/docs/2.4/mod/mod_authn_socache.html for modules that don't supply their own cache.

Post reply on HN