---
title: "nginx"
description: "4 posts about nginx, summarised, each linking to the original."
---

# nginx
> 4 posts about nginx, summarised, each linking to the original.

## Articles

### [How Shopify Dynamically Routes Storefront Traffic](https://yomu.fyi/post/how-shopify-dynamically-routes-storefront-traffic.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Apr 9, 2021

Shopify’s Storefront Renderer team rewrote the storefront implementation beginning in 2019 and needed a way to shift traffic between the legacy and new versions while migrating features. Using nginx with OpenResty, Lua modules, a control plane, and the spy chatbot, they moved routing rules from a Lua file into JSON payloads that could be created, updated, enabled, disabled, and deleted without a CI or deployment cycle. Rules selected shops and request subsets through filters, then controlled rendering and verification rates, including forward verification, reverse verification, and self-verification in the nearest region. During nginx request processing, matching occurs in the rewrite phase; verification is scheduled with timers in the log phase so duplicate requests run asynchronously after the client response path. The system supported gradual rollouts, parity checks, and resilience testing under Redis failures, while the team planned to simplify routing after the new storefront served almost all traffic.


### [How Shopify Reduced Storefront Response Times with a Rewrite](https://yomu.fyi/post/how-shopify-reduced-storefront-response-times-with-a-rewrite.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: Aug 20, 2020

Shopify rewrote the server-side Storefront Renderer, which loads Liquid themes and storefront data before returning HTML, because the legacy Rails-monolith implementation had developed stricter performance demands and rising time-to-first-byte as traffic grew. The new single-purpose application separates storefront traffic from checkout, admin, and API traffic, uses active-active replication with dedicated read replicas, and adds mechanisms for high-load resilience. During migration, a Ruby verifier compares status codes, headers, and bodies from both implementations, while a custom Lua module on OpenResty samples production traffic and routes requests based on verification results. The rollout had reached more than 90% feature parity, and the new implementation averaged 4x faster server response times, with ongoing work aimed at full parity and retiring the legacy system.


### [A Brief History of TLS Certificates at Shopify](https://yomu.fyi/post/a-brief-history-of-tls-certificates-at-shopify.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: May 14, 2020

Shopify’s TLS certificate infrastructure evolved from a handful of manually renewed certificates for administration and checkout traffic to an automated system supporting more than 1M merchants. The initial Shopify Plus implementation added domains to shared Subject Alternative Name (SAN) certificates, but manual provisioning, certificate-authority limits, extra IP requirements, and the inability to rely on SNI made the approach labor-intensive and error-prone. Notary automated certificate-authority API requests, domain verification, delivery, and renewals, storing one certificate and unique private key per domain in a relational database. OpenResty Lua middleware dynamically loaded certificates through ssl\_certificate\_by\_lua, while an in-memory LRU cache reduced handshake latency; theme processing replaced HTTP asset references to prevent mixed-content warnings. After reaching all-merchant encrypted storefronts in February 2016, Shopify migrated much of its certificate use to Let’s Encrypt and later a cloud edge, ultimately returning to Notary-issued certificates uploaded to both edge networks to simplify synchronization.


### [A New Kubectl Plugin for Kubernetes Ingress Controller ingress-nginx](https://yomu.fyi/post/a-new-kubectl-plugin-for-kubernetes-ingress-controller-ingress-nginx.md)
- Company: [Shopify](https://yomu.fyi/company/shopify.md)
- Author: 2023-10-18
- Published: May 1, 2019

Shopify contributed a kubectl plugin to ingress-nginx, an open-source Kubernetes Ingress controller built on NGINX, because debugging and upgrading the heavily used controller often required long, frustrating sequences of kubectl commands. The plugin’s lint subcommand identifies ingress configuration that may need changes for a new release, while richer ingress listings expose individual paths, target services, and TLS configuration. It also wraps common kubectl operations, automatically selects an ingress pod, and helps inspect generated nginx.conf and dynamic configuration managed with openresty lua-nginx-module. The author reports substantially faster upgrades and debugging, comparing a rollout to version 0.24.1 with an earlier upgrade to 0.22.0 that took days, while acknowledging that growing Kubernetes expertise also contributed. Released with ingress-nginx 0.24.0, the plugin should also be compatible with 0.23.0.