Re: Throttle requests with limit_req rate based on header from response to auth subrequest

2018-08-30 Thread jarstewa
Hmm, I notice this from the map documentation: > Since variables are evaluated only when they are used, the mere declaration even of a large number of “map” variables does not add any extra costs to request processing. Here is what I suspect: 1) The limit_req directive is being processed befor

Re: Throttle requests with limit_req rate based on header from response to auth subrequest

2018-08-30 Thread jarstewa
Digging into this some more today, I've continued to find what seems to be odd behavior. If I remove all of the limit_req directives, then the mapped variables based on the upstream are always present: { "upstream_http_tier": "", "tier": "02x", "http_tier": "", "key_two": "",

Re: Ignore Certificate Errors

2018-08-30 Thread Maxim Dounin
Hello! On Thu, Aug 30, 2018 at 09:09:44AM -0700, Roger Fischer wrote: > Hello, > > is there a way to make NGINX more forgiving on TLS certificate errors? Or > would that have to be done in OpenSSL instead? > > When I use openssl s_client, I get the following errors from the upstream > server:

Re: Throttle requests with limit_req rate based on header from response to auth subrequest

2018-08-30 Thread jarstewa
Francis Daly Wrote: --- > On Wed, Aug 29, 2018 at 07:14:01PM -0400, jarstewa wrote: > > Hi there, > > I do not know the answer, and I have not tested the code you provided. > > But, one suggestion which might be quick for you to test: > > what

Ignore Certificate Errors

2018-08-30 Thread Roger Fischer
Hello, is there a way to make NGINX more forgiving on TLS certificate errors? Or would that have to be done in OpenSSL instead? When I use openssl s_client, I get the following errors from the upstream server: 140226185430680:error:0407006A:rsa routines:RSA_padding_check_PKCS1_type_1:block ty

Re: mirror delay

2018-08-30 Thread Roman Arutyunyan
Hi, On Thu, Aug 30, 2018 at 05:19:53PM +0300, Eylon Saadon wrote: > hi, > thanks for the quick response! > I'm not using sendfile or tcp_nopush. > just to make sure. I should disable the keepalive for the mirror location. > and do it like so? No, for the primary location. This will help us under

Re: mirror delay

2018-08-30 Thread Eylon Saadon
hi, thanks for the quick response! I'm not using sendfile or tcp_nopush. just to make sure. I should disable the keepalive for the mirror location. and do it like so? server { resolver 8.8.8.8; listen 80; location / { proxy_set_header Host $host; proxy_pass http://server:9000; }

Re: mirror delay

2018-08-30 Thread Roman Arutyunyan
Hi, On Thu, Aug 30, 2018 at 04:34:29PM +0300, Eylon Saadon wrote: > Hi, > I'm using the mirror module in my "production" nginx in order to mirror > real traffic to a test envrionment. > I don't want this mirroring to affect the latency of the production > environment, but it looks like the nginx i

mirror delay

2018-08-30 Thread Eylon Saadon
Hi, I'm using the mirror module in my "production" nginx in order to mirror real traffic to a test envrionment. I don't want this mirroring to affect the latency of the production environment, but it looks like the nginx is waiting for the response from the test environment. is there a way to avoid

Re: Throttle requests with limit_req rate based on header from response to auth subrequest

2018-08-30 Thread Francis Daly
On Wed, Aug 29, 2018 at 07:14:01PM -0400, jarstewa wrote: Hi there, I do not know the answer, and I have not tested the code you provided. But, one suggestion which might be quick for you to test: what happens if you change all of your variable names so that they do not start with a digit? As

Re: nginx prevent file download

2018-08-30 Thread Francis Daly
On Wed, Aug 29, 2018 at 09:15:26PM +0530, Kaushal Shriyan wrote: Hi there, > When i hit > http://example.com/web.config on the browser, the web.config file gets > downloaded. It is not working. > > location ~* \.(config)$ { > deny all; > } It works for me. Are you sure that the config file