Advanced Nginx: load balancing, caching and rate limiting
You turn Nginx into a production front end that spreads load across backends, caches responses, limits abuse and gets TLS right.
Level 401 · 17 lessons · 15 practice labs
Lessons
Load balancing
- upstream and balancing methods
- Backend health, backup servers and failover
- Proxy headers and timeouts
- Proxying WebSocket and gRPC
- Short task: spread load over three backends, take one down, users notice nothing
Caching and speed
- Response caching with proxy_cache
- Cache keys, bypassing and purging
- Compression, HTTP/2 and HTTP/3
- Short task: measure and raise the cache hit ratio
Protection
- Request and connection limits: limit_req and limit_conn
- Conditional access with map and geo
- TLS settings: protocols, ciphers and OCSP stapling
- Security headers
- Short task: throttle a flood against the login page without blocking real users
Operations
- JSON logs and timing fields
- Reloads and binary upgrades without downtime
- Capstone: build a cached, protected front end ready for campaign traffic
Practice labs
- Balance load across three backends: Add three app servers to an upstream group and show from a response header that requests rotate.
- Take a failed backend out automatically: Use failure count and timeout settings to remove a dead server from the pool and retry without returning errors to users.
- Set up session stickiness and weighted balancing: Configure hashing that binds a client to one backend and weights sending ten percent of traffic to a new version, and measure the split.
- Add cache headers and compression for static files: Give images and scripts long-lived cache headers, turn on compression for text and verify from the headers.
- Cache backend responses: Set up the proxy cache, expose cache status in a header and verify requests with a session cookie are not cached.
- Serve stale content when the backend fails: Use a micro-cache and stale serving so the site still answers during a backend outage, and measure the gain in a load test.
- Rate-limit the login page: Define a per-address request limit on the login path and show excess requests get 429.
- Tune connection, body and timeout limits: Define and test connection count, body size and timeout limits against slow requests and oversized uploads.
- Protect an internal API with client certificates: Allow the internal admin path only with a client certificate signed by the lab authority and pass the certificate subject upstream.
- Add response timings to the log: Define a log format with request time and upstream response time and list the five slowest requests.
- Expose Nginx status safely for monitoring: Open the status page to local access only and set up a check recording active connections every minute.
- Find which backend the slow responses come from: Analyse the upstream address and timing fields in the log to identify the slow server and confirm by draining it from the pool.
- Split the config into shared snippets: Move repeated TLS and proxy settings into shared files and show every site uses the same snippet.
- Update backends by draining them in turn: Mark each backend down in the pool, update it and return it, proving with continuous requests that no errors occur.
- Tune workers and connections from a load test: Change worker count, connection limit, open file limit and upstream keepalive, measuring the effect of each step with a load test.
About this course
You turn Nginx into a production front end that spreads load across backends, caches responses, limits abuse and gets TLS right.
What you will learn
- Load balancing
- Caching and speed
- Protection
- Operations
Prerequisites
You should have practised the topics of the same path up to level 301.
Lab environment
Lessons run in your own Kali Linux terminal in the browser, connected to a private lab network. Nothing to install.
Frequently asked questions
- Is this course right for my level?
- The course is at level 401; it assumes you know the topics of the lower-level courses.
- Is there anything to install?
- No. Every lesson runs in your own lab environment that opens in the browser.
- How do lessons work?
- Each lesson has 8 to 10 steps and a short quiz. Early steps show the command to type, later steps give less help; if two attempts fail, the solution opens.
- Can I try it for free?
- Yes. The first three lessons of every course are free.