Two phase apply

What happens when you press Apply

1. The whole configuration is built from the database. Not patched, built.
2. It is checked for problems before anything is sent anywhere.
3. Each node stages it beside the live config and runs nginx -t against it, using that node's own binary.
4. Only if every node accepts it does any node swap it in and reload.
5. If any node refuses, every node keeps what it had and you are told exactly what was wrong.

Why every node tests it separately

Because the binaries can differ. A directive that belongs to a module compiled into one build and not the other is valid on one node and fatal on the next. Testing centrally would catch none of that, and the failure would land at the worst moment: after the change had already gone out.

A node that was switched off

It does not block the change. The change goes into that node's queue and is replayed when it comes back, so it catches up rather than quietly drifting. That is the difference between a fleet and two servers that used to agree.

The reload is graceful

On reload, the nginx master reads the new configuration and starts new workers with it. The old workers stop taking new connections but keep serving the requests they already have until those finish, then they exit. No connection is cut and nobody sees an error.

Two things worth knowing. A reload costs a little processor time and briefly runs two sets of workers, so memory goes up for a moment. And if you have very long lived connections, such as WebSockets, the old workers stick around until those close.

Warnings before applying

Some changes get a warning first. The most common is a pool with no healthy servers in it, which means the site would serve errors. A warning is not a refusal: sometimes serving an error page from a pool you are about to fill is exactly what you meant to do.

The habit worth building

Why this is a row we win

On the comparison page, "config tested on every node before any node applies" scores five for us and one for all three competitors. That is not a claim that they are badly built. It is that this specific arrangement, staging on every peer and committing only on unanimous agreement, is unusual, and it is the single thing that makes a two node fleet safe to change on a Friday.

Common questions