nginx – Page 8 – Türker Yıldırım

Multi-stage builds cut the image in half

Deep diveMay 9, 20179 min read

17.05 made the two-Dockerfile trick unnecessary. Named stages, what to copy forward, and why the build cache still rewards the order of instructions.

fail2ban on the application log, not just the server log

NoteApril 13, 20172 min read

SSH and HTTP basic auth are covered by shipped filters. A brute force against the application’s own login form is invisible to both, because it is a 200…

nginx HTTP/2 server push, and why it disappoints

NoteApril 5, 20171 min read

HTTP/2 push lets the server send a resource before the browser asks, which sounds like it should remove a round trip and in practice often sends something the…

Rate limit a location in nginx

SnippetMarch 9, 20171 min read

HTTP caching headers the application controls

NoteFebruary 14, 20171 min read

A reverse proxy or CDN caches what the response tells it to cache, which means the decision belongs in the application and usually is not made at all…

nginx map is a lookup table, not a conditional

NoteJanuary 18, 20172 min read

if inside a location is famously unreliable, and most uses of it are really a lookup — this value maps to that value — which map expresses directly…

The REST API in core, and the plugin it replaces

Deep diveDecember 21, 201610 min read

4.7 shipped the content endpoints. What moving off the feature plugin involves, why authentication is still the unsolved half, and the read API every site now exposes.

Redirect HTTP to HTTPS in nginx

SnippetDecember 8, 20161 min read

HTTP/2 in nginx needs TLS and a recent build

NoteNovember 29, 20161 min read

HTTP/2 does not require encryption in the specification and does in every browser, so in practice it arrives with the certificate. nginx 1.9.5 replaced the SPDY module with…

OCSP stapling removes a round trip from the handshake

NoteNovember 3, 20161 min read

Without stapling, the browser checks whether a certificate has been revoked by contacting the issuing authority itself — an extra DNS lookup and request, to a third party,…