Loading…
Topic
nginx
8 posts about nginx. Every summary links to the original.
- 8 posts
- 2 companies
The Good Stuff
Paid picks we use ourselves. Links carry a referral code — a subscription through one earns us a commission at no extra cost to you.
Newest first
Posts
How Shopify Dynamically Routes Storefront Traffic
Shopify’s Storefront Renderer team rewrote the storefront implementation beginning in 2019 and needed a way to shift traffic between the legacy and new versions while migrating features. Using nginx with OpenResty, Lua modules, a control plane, and the spy chatbot, they moved routing rules from a Lua file into JSON payloads that could be created, updated, enabled, disabled, and deleted without a CI or deployment cycle. Rules selected shops and request subsets through filters, then controlled rendering and verification rates, including forward verification, reverse verification, and self-verification in the nearest region. During nginx request processing, matching occurs in the rewrite phase; verification is scheduled with timers in the log phase so duplicate requests run asynchronously after the client response path. The system supported gradual rollouts, parity checks, and resilience testing under Redis failures, while the team planned to simplify routing after the new storefront served almost all traffic.
The 5-hour CDN
The post presents a five-hour path to building a functional content delivery network as a distributed caching proxy rather than a Google-scale infrastructure project. It defines the architecture as NGINX instances deployed across cities, with DNS rules or Anycast directing users to regions and hash-based load balancing assigning URLs to cache shards. Health checks and multi-location monitoring detect failed or slow regions, while peer caches, origin-access protection, and request coalescing address redundancy, security, and cache-miss spikes. The design can improve cache ratios and reduce origin load, but cross-region proxying can add latency, and distributed invalidation remains unresolved; app-specific workloads may be better served by distributing the application itself. The conclusion is that existing NGINX features and modest scripting make a simple CDN practical, while advanced capabilities such as image optimization, WAF, rate limiting, and bot detection remain possible extensions.
Always Be Connecting (with HTTPS)
The post explains how to ensure users reach an HTTPS version of an application running behind Fly’s edge proxies, particularly when a custom domain and certificate are attached. Fly’s default fly.dev behavior redirects HTTP automatically, but custom certificates do not activate that upgrade because connection behavior remains under the application owner’s control. The recommended method checks the X-Forwarded-Proto header, which records whether the original client connection used http or https, and returns a 301 redirect to the same URL with an https scheme when needed. Examples implement the check in Go middleware, Express middleware for Node, and Nginx configuration; the post also notes that non-Fly deployments can inspect the request and URL scheme instead, while Fly was considering future automation.
How Shopify Reduced Storefront Response Times with a Rewrite
Shopify rewrote the server-side Storefront Renderer, which loads Liquid themes and storefront data before returning HTML, because the legacy Rails-monolith implementation had developed stricter performance demands and rising time-to-first-byte as traffic grew. The new single-purpose application separates storefront traffic from checkout, admin, and API traffic, uses active-active replication with dedicated read replicas, and adds mechanisms for high-load resilience. During migration, a Ruby verifier compares status codes, headers, and bodies from both implementations, while a custom Lua module on OpenResty samples production traffic and routes requests based on verification results. The rollout had reached more than 90% feature parity, and the new implementation averaged 4x faster server response times, with ongoing work aimed at full parity and retiring the legacy system.
A Brief History of TLS Certificates at Shopify
Shopify’s TLS certificate infrastructure evolved from a handful of manually renewed certificates for administration and checkout traffic to an automated system supporting more than 1M merchants. The initial Shopify Plus implementation added domains to shared Subject Alternative Name (SAN) certificates, but manual provisioning, certificate-authority limits, extra IP requirements, and the inability to rely on SNI made the approach labor-intensive and error-prone. Notary automated certificate-authority API requests, domain verification, delivery, and renewals, storing one certificate and unique private key per domain in a relational database. OpenResty Lua middleware dynamically loaded certificates through ssl_certificate_by_lua, while an in-memory LRU cache reduced handshake latency; theme processing replaced HTTP asset references to prevent mixed-content warnings. After reaching all-merchant encrypted storefronts in February 2016, Shopify migrated much of its certificate use to Let’s Encrypt and later a cloud edge, ultimately returning to Notary-issued certificates uploaded to both edge networks to simplify synchronization.
How to do Custom Domains with Fly
Custom Domains with Fly is an application guide for using Fly to proxy traffic or serve applications across multiple custom domains. It explains how to configure an NGINX server for external sites and how to attach host and domain names to Fly applications with the flyctl command line. For automated workflows, it describes the Fly GraphQL API operations for adding, removing, checking, and deleting hosts and associated certificates, and points to a repository of ready-rolled Node applications demonstrating the API. The guide's speed run retrieves an app's IPv4 and IPv6 addresses, adds corresponding A and AAAA DNS records, creates a certificate with flyctl, and uses another command to monitor issuance. The resulting setup provides auto-renewing Let's Encrypt TLS certificates, edge TLS, and HTTP/2 support; the guide also states that Fly applications have no limit on attached certificates and can scale on demand.
A New Kubectl Plugin for Kubernetes Ingress Controller ingress-nginx
Shopify contributed a kubectl plugin to ingress-nginx, an open-source Kubernetes Ingress controller built on NGINX, because debugging and upgrading the heavily used controller often required long, frustrating sequences of kubectl commands. The plugin’s lint subcommand identifies ingress configuration that may need changes for a new release, while richer ingress listings expose individual paths, target services, and TLS configuration. It also wraps common kubectl operations, automatically selects an ingress pod, and helps inspect generated nginx.conf and dynamic configuration managed with openresty lua-nginx-module. The author reports substantially faster upgrades and debugging, comparing a rollout to version 0.24.1 with an earlier upgrade to 0.22.0 that took days, while acknowledging that growing Kubernetes expertise also contributed. Released with ingress-nginx 0.24.0, the plugin should also be compatible with 0.23.0.
Iterating Towards a More Scalable Ingress
Shopify’s infrastructure uses Kubernetes to serve millions of requests per minute, and its growth exposed ingress performance problems during frequent application deployments. After replacing Google Cloud Load Balancer Controller (glbc) with endpoint-aware ingress-nginx, the Edgescale team focused on reducing the NGINX reloads that caused latency increases. They added dynamic configuration: the controller POSTs endpoint lists to an NGINX HTTP endpoint, where lua-nginx-module updates an in-memory shared dictionary instead of regenerating the configuration file and reloading NGINX. Reload avoidance preserves keepalive connections and load-balancing state while reducing the resource effects of replacing worker processes. Tests found ingress-nginx outperformed glbc by multiple orders of magnitude at the 99.99th latency percentile or higher, while dynamic configuration produced its largest gains during deploys, especially beyond the 80th percentile.
Related topics
All topics →Weekly digest
The best engineering reads, once a week.