NGINX Cookbook Advanced Recipes for High Performance Load Balancing (Derek DeJonghe)（Z-Library）

# NGINX Cookbook: Advanced Recipes for High Performance Load Balancing ## 【One-Line Pitch】 A practical recipe collection for NGINX Open Source and NGINX Plus, covering everything from basic installation to advanced load balancing, caching, security, and cloud deployment. Ideal for DevOps engineers, system administrators, and backend developers who need concrete, copy-paste-ready solutions for real-world NGINX challenges. ## 【Book Arc】 - **Opening (~0%–10%)**: Installation and basics — covers setting up NGINX on Debian/Ubuntu and RedHat/CentOS, understanding key files and directories like `/etc/nginx/nginx.conf` and `/etc/nginx/conf.d/`, and the graceful reload mechanism (`nginx -s reload`) for zero-downtime configuration changes. - **Early (~10%–23%)**: High-performance load balancing — dives into TCP/UDP load balancing, multiple algorithms (least connections, least time, generic hash, IP hash, random), and sticky routing for session persistence, with a focus on heterogeneous workloads and scaling. - **Early (~23%–32%)**: Health checks and traffic management — covers active/passive health checks for HTTP and TCP upstreams, split clients for A/B testing and canary releases, GeoIP-based access control, and rate limiting to protect against abuse. - **Middle (~32%–48%)**: Content caching and programmability — explains caching zones, cache keys, cache bypass techniques, and cache slicing for large files, plus the NGINX Plus API for dynamic upstream reconfiguration in cloud-native environments. - **Late (~48%–100%)**: Security, HTTP/2, media streaming, and cloud deployments — covers IP-based access control, CORS, SSL/TLS encryption, secure links with expiration, HTTPS redirects, HSTS, DDoS mitigation, HTTP/2 configuration with gRPC support, MP4/HLS/HDS streaming, and deployment patterns on AWS, Azure, and Google Cloud. ## 【Key Takeaways】 - **Graceful reload is essential for high-uptime environments** (Early): `nginx -s reload` lets you change configuration without dropping packets, enabling live configuration management and zero-downtime updates in dynamic infrastructure. - **Load-balancing algorithms should match your workload** (Early): Round-robin isn't always optimal — `least_conn` suits heterogeneous pools, `least_time` considers response speed, `hash` provides control for caching, and `IP hash` ensures session persistence for stateful applications. - **Active health checks go beyond simple connectivity** (Early): NGINX Plus can verify HTTP status codes, headers, and response bodies with `match` blocks, ensuring upstream servers are truly serving correct content, not just accepting connections. - **Split clients enable safe canary releases** (Early): The `split_clients` directive hashes client identifiers to route a percentage of traffic to different upstream pools, limiting blast radius when deploying new application versions. - **Rate limiting protects against abuse and overload** (Middle): Using `limit_req_zone` with binary client IP as the key, plus burst and nodelay parameters, controls request rates and returns 429 status codes when limits are exceeded. - **Caching transforms NGINX into your own CDN** (Middle): With caching zones, flexible cache keys, and bypass mechanisms, you can serve content closer to users, reduce upstream load, and even serve cached responses during upstream failures. - **The NGINX Plus API enables dynamic reconfiguration** (Middle): Through RESTful API calls, you can add, drain, and remove upstream servers on the fly — critical for auto-scaling environments where server pools change frequently. - **Security controls are layered and configurable** (Late): From IP-based access and CORS headers to SSL/TLS termination, secure links with expiration, HSTS, and DDoS mitigation, NGINX provides multiple security mechanisms that can be combined with `satisfy any` logic. ## 【Reading Tips】 - **Skim Chapter 1 if you're experienced**: The installation and basic configuration sections are straightforward; focus on the graceful reload and directory structure if you're new to NGINX. - **Deep-read Chapter 2 for load balancing**: This is the core value of the book — pay close attention to the algorithm comparisons and when to use each method, especially `least_time` and `hash` with the `consistent` parameter. - **Use Chapter 4 as a reference when building caching layers**: The cache key and bypass sections are particularly valuable for debugging and for designing cache hierarchies in production. - **Note the NGINX Open Source vs. Plus distinction**: Many advanced features (active health checks, the API, sticky routing) require NGINX Plus — check which recipes apply to your setup before implementing. - **Skip cloud-specific sections if not applicable**: Chapter 10 covers AWS, Azure, and GCP deployments; read only the sections relevant to your cloud provider. ## 【Coverage Limits】 The excerpts cover roughly the first half of the book (through Chapter 5) plus the table of contents for later chapters. Detailed content on security controls, HTTP/2, media streaming, and cloud deployments is listed but not fully excerpted. ##