is it possible/smart to query backend service for configuration data?

jonathan · 2016-03-19T10:03:20+00:00

Hello! On Thu, Mar 24, 2016 at 1:04 PM, Mark Moseley wrote: > I've seen where my lookup succeeds but then something else fails along the > way (malfor...

is it possible/smart to query backend service for configuration data?

jonathan

openresty is great. i've protoyped a system that handles virtual host configurations with custom ssl very quickly, caching the config data in redis and nginx itself.

in order to make this work, i have a python script that pre-generates all the data loaded it into redis.

i know i could generate this on-the-fly using between the postgres module and lua, but I was wondering if I could request the configuration data from an backend service that generates json.

no one seems to do this in the forum, but it looks like the ngx.location.capture could query an upstream location (via proxypass or uwsgi), or i could use the 3rd party lua-resty-http to query another service. openresty has a json parser too.

agentzh

Hello!

On Fri, Mar 18, 2016 at 7:03 PM,  jonathan wrote:
> openresty is great.  i've protoyped a system that handles virtual host
> configurations with custom ssl very quickly, caching the config data in
> redis and nginx itself.
>
> in order to make this work, i have a python script that pre-generates all
> the data loaded it into redis.
>
> i know i could generate this on-the-fly using between the postgres module
> and lua, but I was wondering if I could request the configuration data from
> an backend service that generates json.
>
> no one seems to do this in the forum, but it looks like the
> ngx.location.capture could query an upstream location (via proxypass or
> uwsgi), or i could use the 3rd party lua-resty-http to query another
> service.  openresty has a json parser too.
>

CloudFlare does something like this all the time in its Lua CDN
network globally.

BTW, because you mention redis, OpenResty comes with a lua-resty-redis
library that can talk to redis nonblockingly.

Regards,
-agentzh

jonathan

Oh great!

Do you know which would be a better approach

1. subrequest to a proxypass section

2. one of the external http requests

I've been playing with the redis openresty library.

Right now my prototype is basically doing this (python-ish pseudocode):

def get_certificate():

certificate = shared_cache.get(certificate)

if not certificate:

certificate = redis.get(certificate)

if certificate:

shared_cache.save(certificate)

return certificate

this requires me to preload the redis cache

my hope is to avoid preloading the cache and use an upstream provider for failover

agentzh

Hello!

On Thu, Mar 24, 2016 at 1:44 PM,  <jon...@findmeon.com> wrote:
> Do you know which would be a better approach
>
>     1.  subrequest to a proxypass section
>     2.  one of the external http requests
>

I don't quite understand your 2). Are you talking about those
lua-resty-http* libraries? If yes, then 2) is preferred. There has
been alot of discussions on this topic in the mailing list archive
IIRC.

Regards,
-agentzh

jonathan

On Saturday, March 26, 2016 at 5:12:52 PM UTC-4, agentzh wrote:

I don't quite understand your 2). Are you talking about those
lua-resty-http* libraries? If yes, then 2) is preferred. There has
been alot of discussions on this topic in the mailing list archive
IIRC.

Yes! that was it. thank you!

I put together a package in Pyramid (python) to act as a configuration system for nginx/openresty ssl needs. It also acts as a client to the LetsEncrypt certificate authority, and primes a redis cache. I will be integrating it onto our staging tomorrow, then release under MIT license.

jonathan

It seems like it isn't possible to failover a redis miss onto an http query.

I get an error "API disabled in the context of ssl_certificate_by_lua*" if I use either:

* location.capure
* lua-resty-http

does anyone know which library can allow for an http fetch (if any) within a ssl_certificate block ?

akalipetis

Hello and sorry for the late reply.

Actually, Ceryx[0] is a project we have developed on top of OpenResty, which queries a Redis backend on the fly for host configuration.

Ceryx features a subset of what you're willing to do but may help you in your implementation of you could extend it to meet your needs.

Hope this helps.

Best,

Antonis

[0] - https://github.com/sourcelair/ceryx

On Tuesday, March 29, 2016 at 1:35:54 AM UTC+3, jona...@findmeon.com wrote:

It seems like it isn't possible to failover a redis miss onto an http query.

I get an error "API disabled in the context of ssl_certificate_by_lua*" if I use either:

* location.capure
* lua-resty-http

does anyone know which library can allow for an http fetch (if any) within a ssl_certificate block ?

jonathan

Thanks Antonis,

I've actually got 95% of my project done. Querying Redis was very easy.

The only thing left I want to do, is to query an HTTP server if Redis has a miss. My project can "prime" the Redis cache with all the necessary info, but that means I must maintain the full set of data in-memory in Redis (and then duplicate parts into the nginx cache). This isn't much of an issue for now – I don't have much data yet – but I'd like to figure out a way to fallback onto HTTP. That doesn't seem possible during the SSL Handshake on the current version of openresty.

akalipetis

No problem jonathan,

I haven't seen the HTTP library to help you on that, but I believe the dataset should not be that big to be an issue.

There's also Kong[0] if you'd like a database persisted solution.

Anyway, good luck with the rest 5% :)

[0] - https://github.com/Mashape/kong

On Tue, Mar 29, 2016 at 7:27 PM <jon...@findmeon.com> wrote:

Thanks Antonis,

I've actually got 95% of my project done. Querying Redis was very easy.

The only thing left I want to do, is to query an HTTP server if Redis has a miss. My project can "prime" the Redis cache with all the necessary info, but that means I must maintain the full set of data in-memory in Redis (and then duplicate parts into the nginx cache). This isn't much of an issue for now – I don't have much data yet – but I'd like to figure out a way to fallback onto HTTP. That doesn't seem possible during the SSL Handshake on the current version of openresty.

.

expedituz

Hello.
My server needs to non-blockingly request data from another http-server in the context of ssl_certificate_by_lua_* too.

jonathan, can you tell which solution you have chosen? 

But if there is no way,  what is the concept of changes in the nginx/lua-nginx-module's code required to maintain subrequests in "ssl_certificate_by_lua_*" context?

agentzh

Hello!

On Wed, Mar 30, 2016 at 1:59 AM, Dslt wrote:
> My server needs to non-blockingly request data from another http-server in the context of ssl_certificate_by_lua_* too.
>
> jonathan, can you tell which solution you have chosen?
>
> But if there is no way,  what is the concept of changes in the nginx/lua-nginx-module's code required to maintain subrequests in "ssl_certificate_by_lua_*" context?

Cosockets are enabled in the context of ssl_certificate_by_lua*. Just
use one of the lua-resty-http* libraries based on cosockets out there.
They are nonblocking.

Regards,
-agentzh

jonathan

ah, i was using a non-coroutine one (i think)

i'm using this one now, and it works! https://github.com/pintsized/lua-resty-http

i'm nearly done with my project now!