> This is interesting.
>
> If I understood well this allows one to run isolated instances of nginx
> listening on different IPs and also under different user accounts. Is that
> correct?
>
> Jérôme Loyet wrote:
>>
>> You could then imagine many cases in which this option could be usefull.
>
You can do whatever you want :) Scope is only limited by your
imagination :) (almost)
Here is an exemple of what our compagny needs and how I'll make it. I
just warn that this has not been tested.
- One box mutualized with several customers.
- All architectures are the same: NET --> nginx --> apache(with php)
- each customer has its own path and own conf file
- each customer runs with a different user/group
- each customer has an numerical ID (from 1)
- each customer has its own prefix (/data/www/customers/$ID)
- each customer has a frontend listening on *:(8000 + $ID)
- each customer has a backend listening on *:(9000 + $ID)
The idea is to have a template file for nginx.conf. We'll use m4 in
our case. This template will be something like this:
user M4_NGINX_USER M4_NGINX_GROUP;
error_log logs/errors;
pid logs/nginx.pid;
events {
workers 1024;
}
http {
# mime types are common for all users
include /usr/local/nginx/conf/mime.types
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_hide_header Set-Cookie;
proxy_temp_path temp/;
proxy_cache_path cache/ keys_zone=CACHE:10m;
proxy_cache CACHE;
proxy_cache_min_uses 1;
proxy_cache_use_stale error timeout invalid_header http_500 http_502
http_503 http_504;
proxy_cache_valid any M4_NGINX_DEFAULT_TIMEOUT;
server {
listen M4_NGINX_FRONTEND_PORT;
location / {
proxy pass http://M4_NGINX_BACKEND_ADDRESS:M4_NGINX_BACKEND_PORT;
}
location ~* \.(gif|jpg|jpeg)$ {
proxy pass http://M4_NGINX_BACKEND_ADDRESS:M4_NGINX_BACKEND_PORT;
proxy_cache_valid M4_NGINX_IMAGES_TYPE M4_NGINX_IMAGES_TIMEOUT;
}
#
# You can add some macros to generate more locations dynamicaly
# the power of m4:
# http://www.gnu.org/software/m4/manual/m4.html.gz
#
}
}
So this template is generated from few parameters:
M4_CUSTOMER_ID --> 1
M4_NGINX_PREFIX --> /data/www/customers/client/M4_CUSTOMER_ID
M4_NGINX_USER --> client_ M4_CUSTOMER_ID
M4_NGINX_GROUP --> client_ M4_CUSTOMER_ID
M4_NGINX_DEFAULT_TIMEOUT --> 1m
M4_NGINX_FRONTEND_PORT --> eval(8000 + M4_CUSTOMER_ID)
M4_NGINX_BACKEND_ADDRESS --> 127.0.0.1
M4_NGINX_BACKEND_PORT --> eval(9000 + M4_CUSTOMER_ID)
M4_NGINX_IMAGES_TYPE --> any
M4_NGINX_IMAGES_TIMEOUT --> 1d
Via a backoffice interface, the customer can set by his own some
parameters like (default timeout, images_types or images_timeout). The
backend then generate a temporary nginx conf file and:
test the temporary conf file
if the test is not valid {
report error to the user so that he can correct his settings
} else {
backup the old nginx.conf file
replace the nginx.conf file with the temporary one
send HUP signal to nginx
}
At startup each nginx has been launched with something like:
for prefix in /data/www/customers/*; do
test -d $prefix || continue
if /path/to/nginx -t -p $prefix/; then
echo "[info] nginx for customer `basename $prefix` correctly launched"
else
echo "[ERROR] unable to launch nginx for customer `basename
$prefix`" >/dev/stderr
fi
done
in this case I could have specified all my path abolutely as I have a
macro processor which can do the job. But I have other boxes as this
one but without a customer back office access. Each conf is done
manually so with relative path no (or much less) mistakes are
possible. We're using this feature with apache (-d serverroot) for a
long time and it helps us a lot.
Hope this helps
++ Jerome
