Learn NGINX In Action

Runtime internal NGINX: master process, worker process, event-driven execution, graceful reload, signal handling, shared zones, dan failure mode production.

Event Loop and Connection Lifecycle

Event loop dan lifecycle koneksi NGINX: accept, read, parse, route, upstream, buffer, write, keepalive, timeout, backpressure, dan failure modelling.

NGINX Config Language From First Principles

Bahasa konfigurasi NGINX dari first principles: directive, block, context, include, parse-time vs runtime, module ownership, validasi, dan pola konfigurasi production-grade.

Context, Directive, Inheritance

Context, directive inheritance, merge semantics, scope boundary, dan cara menghindari bug konfigurasi NGINX yang muncul akibat salah memahami inheritance.

Request Processing Pipeline

Request processing pipeline NGINX dari listener sampai log: accept connection, virtual server selection, location lookup, rewrite, access, content handler, upstream, response filter, dan observability.

Server Selection, Server Name, and Default Server

Server selection NGINX secara production-grade: listen address/port, default_server, server_name exact/wildcard/regex, Host header, SNI, catch-all, dan hardening virtual host.

Location Matching Algorithm

Algoritma location matching NGINX dari first principles: exact, prefix, ^~, regex, named location, internal redirect, dan failure mode routing production.

Variables, map, geo, and Evaluation Timing

Mental model variable NGINX, map, geo, lazy evaluation, request-time values, dan pola aman untuk routing, policy, cache, dan observability production.

Safe Config Layout for Production

Layout konfigurasi NGINX production-grade: struktur direktori, include boundaries, snippet discipline, environment overlays, config review, validasi CI, dan rollback-friendly design.

NGINX CLI, Signals, Test, Reload, and Rollback

Workflow operasional NGINX: command line, signal, nginx -t, nginx -T, reload aman, graceful shutdown, reopen log, binary upgrade, rollback, dan deployment checklist.

Build, Package, and Module Strategy

Strategi memilih distribusi NGINX untuk production: OS package, official repository, container image, build from source, dynamic module, reproducibility, patching, rollback, dan supply-chain control.

Open Source vs NGINX Plus Boundaries

Batas praktis NGINX Open Source dan NGINX Plus untuk arsitektur production: fitur, trade-off, failure mode, keputusan biaya, operability, dan cara menjaga portability desain.

Production Baseline Lab

Production baseline lab for building a safe, inspectable, reloadable, and extensible NGINX skeleton before using it as a web server, reverse proxy, cache, or load balancer.

Static File Serving Internals

Deep dive into NGINX static file serving internals: URI-to-file mapping, root, alias, index, try_files, internal redirects, permission failures, and production-safe filesystem contracts.

root vs alias Footguns

Deep dive into root vs alias semantics, URI-to-filesystem mapping, path traversal risk, location boundary bugs, and production-safe static file layout patterns.

try_files, Internal Redirects, and SPA Routing

Deep dive into try_files, internal redirects, named locations, SPA fallback routing, frontend/backend boundary design, and production-safe missing-file behavior.

MIME Types, default_type, and Content Negotiation

Deep dive into MIME types, default_type, types blocks, content negotiation boundaries, browser sniffing, security headers, and production-safe content classification in NGINX.

sendfile, AIO, directio, and open_file_cache

Deep dive into NGINX static file performance using sendfile, AIO, directio, tcp_nopush, open_file_cache, filesystem metadata caching, and production tuning trade-offs.

Compression Strategy: gzip, Brotli Optional, and Precompressed Assets

Production-grade compression strategy in NGINX using gzip, gzip_static, optional Brotli modules, precompressed assets, Vary semantics, CPU trade-offs, and safe rollout patterns.

Cache-Control, ETag, and Last-Modified

Deep production treatment of browser cache semantics in NGINX: Cache-Control, Expires, ETag, Last-Modified, conditional requests, immutable assets, HTML revalidation, and cache policy safety.

error_page, Named Location, and Internal Error Flow

Memahami error_page, named location, dan internal location sebagai control-flow error handling di NGINX production, termasuk status code mapping, internal redirect loop, dan observability.

Canonical Redirects, Host Normalization, and Redirect Loop Prevention

Mendesain canonical redirects di NGINX secara production-grade, mencakup HTTP ke HTTPS, host normalization, www/non-www, trailing slash, default server, proxy awareness, SEO, dan redirect loop prevention.

rewrite vs return and Routing Discipline

Rewrite vs return, routing discipline, redirect correctness, internal URI mutation, loop prevention, and production-safe URL normalization in NGINX.

CORS and OPTIONS Preflight at the Edge

Production-grade CORS handling in NGINX, including OPTIONS preflight, origin allowlists, credentials, Vary, edge policy boundaries, and failure modes.

Static Site Hardening

Production-grade static site hardening in NGINX, including directory listing control, hidden files, source leakage, symlink escape, security headers, upload boundaries, and static asset incident playbooks.

Multi-Tenant Static Hosting

Production-grade multi-tenant static hosting with NGINX, including host-based isolation, path-based risks, wildcard domains, per-tenant roots, cache/log separation, deployment models, and operational guardrails.

Static Assets Production Lab

End-to-end production lab for serving static assets with NGINX, including immutable assets, SPA fallback, MIME safety, compression, browser caching, hardened locations, deployment layout, smoke tests, and rollback.

Reverse Proxy Mental Model

Reverse proxy mental model for production NGINX, covering edge contracts, upstream contracts, request/response transformation, buffering, trust boundaries, failure semantics, retries, timeouts, and ownership boundaries.

proxy_pass Semantics: Slash, URI Replacement, Variables, and Regex

Deep practical guide to proxy_pass URI semantics, trailing slash behavior, URI replacement, regex and named location traps, variables, rewrite interactions, and production-safe reverse proxy routing.

Forwarded Headers, Real IP, and Trust Boundaries

Production-grade guide to forwarded headers, real client IP restoration, trust boundaries, Host and scheme propagation, PROXY protocol, spoofing risks, and safe reverse proxy identity design.

Proxy Buffering, Temp Files, and Streaming

Production-grade guide to NGINX proxy buffering, response buffers, request buffering, temporary files, streaming, slow clients, memory and disk pressure, and safe reverse proxy behavior.

Timeouts for Real Systems

Production-grade guide to NGINX reverse proxy timeout design, connect/send/read/client/keepalive timeouts, 502/504 behavior, retries, streaming exceptions, latency budgets, and failure propagation.

Request Body Size, Upload, and Backpressure

Production-grade guide to NGINX request body handling, upload size limits, buffering, temporary files, proxy_request_buffering, slow clients, streaming uploads, and backpressure design.

Response Header Control

Production-grade guide to NGINX response header control, proxy_set_header, proxy_hide_header, proxy_pass_header, proxy_ignore_headers, add_header, expires, cookie rewriting, inheritance traps, and edge contract design.

WebSocket and Server-Sent Events Proxying

Deep practical guide to proxying WebSocket and Server-Sent Events through NGINX, including Upgrade semantics, long-lived connections, buffering, timeout design, load balancing, observability, and production failure modes.

gRPC Proxying

Production-oriented guide to gRPC proxying with NGINX, covering HTTP/2 requirements, grpc_pass semantics, TLS termination, deadlines, retries, status mapping, observability, health checks, and failure modelling.

FastCGI, uWSGI, SCGI, and PHP-FPM

Production-oriented guide to FastCGI, uWSGI, SCGI, and PHP-FPM behind NGINX, covering protocol boundaries, params safety, script path correctness, buffering, timeouts, pools, observability, and failure modelling.

Upstream Keepalive and Connection Reuse

Production-oriented guide to upstream keepalive and connection reuse in NGINX, covering worker-local pools, HTTP versioning, Connection header handling, backend saturation, port exhaustion, DNS/service discovery, TLS upstream, sizing, observability, and rollout strategy.

DNS Resolution and Dynamic Upstreams

DNS resolution, service discovery, dynamic upstreams, resolver semantics, TTL behavior, Kubernetes and cloud DNS traps, and production patterns for safe dynamic backend discovery in NGINX.

Retry Semantics, Idempotency, and Duplicate Write Prevention

Retry semantics in NGINX reverse proxy, proxy_next_upstream, idempotency, duplicate writes, retry budgets, upstream failure classification, and production-safe retry policy design.

Request Routing with map, split_clients, Header, Cookie, and Canary

Production-grade request routing with NGINX map, split_clients, header and cookie based routing, canary traffic, shadow-safe routing boundaries, and policy-table driven configuration.

API Gateway Patterns with NGINX: Routing, Shielding, and Policy Edge

API Gateway patterns with NGINX Open Source and NGINX Plus boundaries, including routing, policy enforcement, authentication delegation, rate limiting, request shielding, observability, versioning, and failure modelling.

Reverse Proxy Production Lab

Production reverse proxy lab for Java, Node.js, and Go backends, covering topology, configuration layout, upstream contracts, headers, buffering, timeouts, health endpoints, smoke tests, reload, rollback, and failure drills.

HTTP Load Balancing Mental Model

Mental model for HTTP load balancing with NGINX, including scheduling domains, request distribution, capacity, fairness, passive health checks, failure semantics, upstream state, retries, keepalive interaction, and why load balancing is not the same as resilience.

Round Robin, Least Connections, IP Hash, and Generic Hash

Deep dive into NGINX HTTP load balancing algorithms: round robin, least connections, IP hash, generic hash, and the operational consequences of choosing each method.

Weights, Capacity Modelling, and Hotspot Avoidance

Production-grade capacity modelling for NGINX upstreams: weights, backend capacity, max connections, hot spot avoidance, canary ramping, and overload-safe load balancing design.

Passive Health Checks in NGINX Open Source

Passive health checks in NGINX Open Source: max_fails, fail_timeout, upstream failure inference, retry coupling, limitations, observability, and production-safe failure design.

Active Health Checks and NGINX Plus Boundary

Active health checks and the NGINX Plus boundary: periodic probes, match blocks, mandatory checks, slow start, gRPC/TCP/UDP health checks, operational risks, and Open Source alternatives.

Session Affinity, Sticky Sessions, and Stateful Backend Risk

Session affinity, sticky routing, and stateful backend risk in NGINX: ip_hash, hash, sticky cookie, sticky route, sticky learn, route-bound draining, and migration paths away from accidental statefulness.

Slow Start, Draining, and Upstream Recovery

Slow start, draining, and upstream recovery in NGINX: recovering failed servers safely, reducing cold-start overload, draining sticky backends, and designing deployment playbooks with Open Source and NGINX Plus boundaries.

Canary, Blue-Green, Header-Based Routing, and Progressive Delivery

Progressive delivery with NGINX: rate splitting, canary, blue-green, header and cookie override, route labels, rollback switches, observability, and production-safe rollout discipline.

Circuit-Breaker-Like Patterns in NGINX

7 min

Circuit-breaker-like resilience patterns in NGINX: what NGINX can and cannot do, failure classification, passive health checks, retries, rate limits, load shedding, stale cache fallback, backup upstreams, kill switches, and external control-plane integration.

Queueing, Overload, and Load Shedding

Queueing, overload, load shedding, and latency collapse patterns for NGINX as a production edge tier.

Load Balancing Observability

Observability for NGINX upstream load balancing using logs, upstream variables, latency decomposition, retry inference, and failure diagnosis.

Load Balancing Production Lab

Production lab for NGINX HTTP load balancing with upstream groups, retries, health semantics, overload controls, observability, and failure injection.

Proxy Cache Mental Model

Mental model for NGINX proxy cache as an edge data store with keys, freshness, storage, validation, bypass rules, poisoning risks, and observability.

Cache Zone, Cache Key, Path, and Storage Layout

Deep dive into NGINX proxy cache zone, cache key, disk path layout, shared memory metadata, loader/manager processes, storage sizing, and cache filesystem operations.

cache_bypass, no_cache, and Revalidation

Deep dive into NGINX proxy cache bypass, no-cache, cache validity, origin cache headers, revalidation, stale controls, authorization boundaries, and route-level cache correctness.

Stale Cache, Cache Lock, Background Update, and Thundering Herd

Deep dive stale cache, proxy_cache_lock, background update, cache revalidation, and thundering herd control in production NGINX.

Cache Key Design and Cache Poisoning Defense

Production guide to NGINX cache key design, query normalization, tenant isolation, Vary handling, poisoning defense, and cache correctness testing.

Private, User-Specific, and Authenticated Cache

Production guide to private, user-specific, and authenticated caching in NGINX without leaking identity-scoped data across users, tenants, or authorization boundaries.

Range, Slice, Large Object, and Media Delivery

Production guide to byte-range requests, slice caching, large-object caching, media delivery, storage pressure, and correctness risks in NGINX.

Cache Purge Patterns: Open Source Workaround vs Plus Capability

Production guide to cache invalidation, purge strategies, Open Source workarounds, NGINX Plus proxy_cache_purge, wildcard purge, security, and operational runbooks.

Cache Observability: HIT/MISS/BYPASS/STALE and Root Cause

Production guide to NGINX cache observability, X-Cache-Status, upstream cache variables, HIT/MISS/BYPASS/STALE debugging, logs, metrics, dashboards, and RCA workflows.

CDN-Like Architecture with NGINX

Design a CDN-like private edge architecture with NGINX: cache hierarchy, origin shield, multi-region edge, invalidation, stale fallback, observability, and failure modelling.

Content Cache Production Lab

7 min

A production-style lab for NGINX content caching: edge cache, origin shield, static and API cache policies, bypass/no-cache, stale fallback, cache lock, observability, smoke tests, and failure drills.

TLS Termination Mental Model

A production-oriented mental model for TLS termination in NGINX: trust boundaries, handshake lifecycle, re-encryption, mTLS, forwarded protocol semantics, certificate ownership, operational risk, and debugging.

Certificates, Chain, SNI, and Name-Based HTTPS

A deep practical guide to certificates, certificate chains, SNI, SAN/wildcard names, name-based HTTPS, default 443 servers, certificate file layout, validation, rotation, and debugging in NGINX.

Modern TLS Configuration

A deep practical guide to modern TLS configuration in NGINX: protocol selection, cipher suites, TLS 1.2/1.3 behavior, session reuse, tickets, 0-RTT risk, compatibility, observability, testing, and safe rollout.

OCSP Stapling, HSTS, and Security Headers

A practical production guide to OCSP stapling, HSTS, and security headers in NGINX: certificate status, resolver requirements, header inheritance, preload risk, CSP boundaries, rollout strategy, and debugging.

Mutual TLS: Client Certificate Auth and Upstream Identity

A practical production guide to mutual TLS in NGINX: client certificate verification, trust boundaries, certificate variables, route-level enforcement patterns, upstream mTLS, identity forwarding, revocation, observability, and failure modes.

ACME/Certbot Automation: Renewal, Reload, and Failure Mode

A practical production guide to ACME and Certbot automation with NGINX: HTTP-01 and DNS-01 challenges, renewal hooks, safe reloads, certificate layout, rotation, rate-limit aware operations, monitoring, and failure drills.

HTTP/2 Configuration: Performance, Multiplexing, and Risk Boundaries

A production-focused guide to HTTP/2 on NGINX: client-side protocol negotiation, ALPN, TLS requirements, stream concurrency, header limits, reverse proxy boundaries, gRPC implications, observability, testing, and rollout risk controls.

HTTP/3 and QUIC: Experimental Edge, Build Requirements, and Rollout Strategy

A production-focused guide to HTTP/3 and QUIC on NGINX: experimental module boundary, UDP listener design, Alt-Svc advertisement, TLS 1.3 requirements, 0-RTT risk, connection migration, observability, testing, rollout strategy, and rollback discipline.

Basic Auth, JWT-ish Edge Checks, and External Auth Patterns

A production-focused guide to Basic Auth, JWT-ish edge checks, auth_request, external authorization, identity forwarding, auth caching, error mapping, and security boundaries in NGINX.

Access Control with allow/deny, geo, map, and CIDR Policy

A production-focused guide to NGINX access control with allow/deny, satisfy, geo, map, real IP trust boundaries, CIDR policy, route-specific network rules, generated policy files, and operational testing.

Rate Limiting and Connection Limiting: Token Bucket at the Edge

Rate limiting dan connection limiting di NGINX sebagai kontrol overload, abuse, fairness, dan blast-radius dengan model leaky bucket, shared memory zones, dry run, route-specific policy, dan observability production.

Header Normalization, Request Smuggling Defense, and Proxy Ambiguity

Request smuggling, header normalization, parser ambiguity, HTTP/1.1 to upstream boundaries, invalid headers, buffer limits, forwarded identity, and practical NGINX hardening patterns for reverse proxy deployments.

WAF Options: ModSecurity, F5 WAF, Plus, and Realistic Boundaries

WAF options around NGINX: native NGINX controls, ModSecurity connector realities, F5 WAF for NGINX, NGINX Plus boundaries, policy lifecycle, false positives, failure modes, and practical decision matrix.

Hardened TLS Reverse Proxy with mTLS and Rate Limit

Production-style security hardening lab for NGINX reverse proxy with TLS termination, HTTP to HTTPS redirect, mTLS-protected admin route, upstream TLS identity propagation, rate limiting, security headers, structured logs, smoke tests, and failure drills.

Stream Module Mental Model

Stream module mental model untuk memahami NGINX sebagai Layer 4 proxy/load balancer, berbeda dari HTTP reverse proxy karena tidak melihat URI, header, cookie, method, atau response code.

TCP Load Balancing

Production-grade TCP load balancing dengan NGINX stream untuk PostgreSQL, MySQL, Redis, LDAP, MQTT, dan custom TCP services, termasuk upstream design, timeout, passive health, identity, observability, dan failure modelling.

UDP Load Balancing

UDP load balancing dengan NGINX stream module: mental model, DNS/syslog/RADIUS/NTP patterns, proxy_requests, proxy_responses, timeout, identity, observability, dan failure modelling.

Stream SSL Termination and Passthrough

Stream SSL termination versus TLS passthrough dengan NGINX: kapan terminate, kapan pass through, SNI routing, ssl_preread, upstream TLS, observability, security boundary, dan failure modes.

PROXY Protocol: Real Client IP across L4/L7 Boundaries

PROXY protocol, real client IP propagation, trust boundaries, and cross-layer identity handling for NGINX stream and HTTP systems.

SNI Routing at Layer 4 without HTTP Termination

SNI-based Layer 4 routing with NGINX stream ssl_preread, TLS passthrough, ALPN routing, operational constraints, and failure modelling.

Stream Observability and Debugging

Stream observability and debugging for TCP/UDP proxying with NGINX, including log design, stream variables, packet-level reasoning, failure taxonomy, and production investigation playbooks.

Stream Production Lab

Production lab for NGINX stream TCP/UDP edge proxying with PROXY protocol, TLS passthrough, SNI routing, structured logs, smoke tests, and failure drills.

Access Log, Error Log, and log_format for RCA

Access log, error log, dan log_format sebagai telemetry layer untuk root-cause analysis production NGINX.

JSON Logs, Correlation ID, and Trace Context

JSON logs, correlation ID, dan trace context untuk menghubungkan NGINX edge logs dengan application logs, metrics, dan distributed traces.

stub_status, Status API, and Metrics Boundary

Deep operational guide to NGINX metrics boundaries: stub_status, NGINX Plus API, exporters, metrics design, alerting, and why logs and metrics answer different questions.

Debug Log, debug_connection, and Request-Level Investigation

Production-grade guide to NGINX debug logging, debug_connection, request-level investigation, safe rollout, and root-cause workflows without drowning production in logs.

Performance Model: CPU, Memory, Disk, Network, and Bottleneck Taxonomy

Performance model NGINX production dari CPU, memory, disk, network, queueing, bottleneck taxonomy, observability, dan diagnostic workflow agar tuning tidak berbasis mitos.

Kernel and OS Tuning for NGINX

Kernel dan OS tuning untuk NGINX production: file descriptors, worker limits, socket queues, TCP behavior, disk/filesystem, cgroup, container, NUMA, dan safe rollout methodology.

Benchmarking Methodology: wrk, vegeta, k6, Flame Graph, and False Confidence

19 min

Benchmarking methodology for NGINX production systems: workload modelling, measurement correctness, wrk/k6/vegeta usage, latency distribution, coordinated omission, flame graphs, profiling boundaries, and benchmark governance.

Capacity Planning and SLO Design for Edge Tier

Capacity planning and SLO design for NGINX edge tier: service envelopes, throughput/latency/error budgets, saturation points, autoscaling signals, headroom, overload boundaries, and operational decision models.

Common Incidents and Playbooks

21 min

Common production incidents and playbooks for NGINX: 502, 504, 499, latency spikes, cache poisoning, certificate expiry, reload failures, disk pressure, DNS issues, and upstream collapse.

100

Observability Production Lab

Production observability lab for NGINX with structured JSON logs, stub_status, Prometheus exporter, dashboards, alert rules, smoke tests, and incident drills.

101

systemd, Packages, and Container Images

Deployment substrates for production NGINX: systemd, Linux packages, source builds, container images, immutable delivery, and operational trade-offs.

102

Config Generation, Templating, and Validation

Production-grade NGINX configuration generation, templating, validation, CI testing, drift control, and platform engineering workflows.

103

NGINX Ingress Controller In Action

NGINX Ingress Controller in production: Ingress, annotations, ConfigMap, generated NGINX config, TLS, gRPC, WebSocket, TCP/UDP, observability, hardening, and operational failure modes.

104

NGINX Gateway Fabric and Gateway API