Backend pools
20 answers
The servers behind a site, and how traffic is shared out.
Looking for something specific
The searchable index covers all 326 answers at once and filters as you type.
41 Create a backend pool
- Backend Pools, then New pool.
- Name it after what is in it, such as
shop-web. - Add one row per server, with its address and the port your application listens on.
- Leave the balancing method as round robin.
- Save, then check the members go green before you build a site on top of it.
42 Add a server to an existing pool
Open the pool, press Add a server, put in the address and port, and save. Wait for the health check to turn it green, then apply. Adding it and applying in one go means sending traffic to something you have not confirmed can answer.
43 Take a server out without dropping anybody
Set its state to Draining and apply. It finishes what it is doing and takes nothing new. Watch the connection count fall to zero, then do whatever you came to do.
Turning it off outright drops whatever it was in the middle of.
44 Send more traffic to a bigger server
Set its weight to 2 and it gets twice as much as a server on 1. Weights are a blunt tool, which is fine because the difference between a big box and a small one is usually blunt too.
45 Cap how many connections one backend gets
Set Max connections on that member. 0 means no cap. Useful when a backend has a hard connection limit of its own and you would rather queue at the load balancer than get errors from the application.
46 Use a backup server that only takes traffic when everything else is down
Tick Backup on that member. Be careful: a backup server sits idle and untested until the worst possible moment. It is genuinely good for one thing, which is serving a holding page.
47 Talk to backends over https
Turn on Use TLS for the pool. Leave certificate verification on. If your company issues its own certificates, point the pool at your authority file rather than switching verification off.
A pool that fails the moment you turn on TLS is nearly always the certificate check.
48 Delete a pool
A pool being used by a site cannot be deleted, and the page says which site is using it. Point that site somewhere else first. This is deliberate, since deleting a pool a site depends on would take that site down at the next apply.
49 Choose between round robin and least connections
Round robin unless some requests take much longer than others. If your traffic is a mix of quick API calls and slow uploads, least connections spreads it more evenly because a busy server has more connections open.
50 Pin a visitor to one backend
Two ways, and both are workarounds.
- By address: the same client address always reaches the same server. Simple, and it breaks for anybody behind a large NAT.
- Sticky sessions: a cookie decides. Better behaved, and the first request is still unpinned.
The real fix is to put sessions in redis or your database so any backend can serve any visitor.
51 Stop adding and removing a server reshuffling everybody
Turn on consistent hashing. Without it, taking one server out of a pool of four moves roughly everybody. With it, only the share belonging to that server moves.
52 Ease a recovered server back into service
Turn on slow start on the pool and choose a window. The member comes back at weight 1 and climbs to its configured weight over that window.
Thirty seconds suits most web applications. A JVM wants sixty to a hundred and twenty, because the just in time compiler needs real traffic before it is fast.
53 Give the faster backends more traffic automatically
Turn on adaptive weighting. The health checker is already timing every probe, so it uses those numbers to nudge each weight on a cycle.
It reacts in minutes, not milliseconds. Good for a pool of mixed hardware. For traffic that spikes in seconds, least connections reacts faster on its own.
54 Prove to my backends that a request came from the load balancers
Turn on Backend trust for the pool. nginx then sets a shared secret header on every proxied request, and the GUI gives you the check snippet for nginx, Apache, Express, Django or Spring.
The header is set rather than added, so a client sending it themselves has it thrown away and replaced.
55 Rotate the backend trust token without an outage
- Rotate. A new token is generated but nginx keeps sending the old one. Add the new one to your backends so they accept either.
- Activate. nginx starts sending the new one, which your backends already take. Apply, watch traffic, then delete the old one from your backends.
Doing it in one step means every request in the gap gets a 403.
56 Use the same servers for a site and for a TCP service
You need two pools, one for each. Stream pools and http pools are separate in nginx itself, not by a choice made here, so you will see the same addresses listed twice and that is correct.
195 Point a pool at a website that answers to its own name
Open the pool, Load balancing tab, and set What is on the other end to Another website, on its own name.
Use this when the thing behind the pool is a whole website already, such as a hosted service, an appliance, or another company's site you are fronting. It is told its own name rather than yours, which is what it expects and what its certificate says.
Leave it on the first option for servers running your own application. Those want to be told the name the visitor typed.
196 My application is not at the root of the backend
Visitors ask for /basket and the backend actually wants /shop/basket.
Open the pool, Load balancing tab, and put /shop/ into Where the application
sits on these backends.
A path and nothing else. No scheme, no hostname and no port, because this is saying where the application lives, not how to reach it. The backends are already reachable or they would not be in the pool.
Redirects coming back get the prefix taken off again on the way out, so it never appears in your visitor's address bar. That is the part that makes this better than doing it with a rewrite rule, which fixes the request and leaves the redirects wrong.
Leave it empty when the application is at the root, which is most of the time.
197 Should the prefix go on the pool, the site or the path?
Three places can set it, and they override each other in that order. Which one is right depends on what is actually true:
- The pool, under Load balancing, Where the application sits on
these backends. Use this when it is a fact about the servers. If every site pointed at
this pool has to ask for
/shop/, it belongs here and you set it once. - The site, Settings tab, Proxy, Backend lives under this path. Use this when the same pool is reached two different ways and only this site needs the prefix.
- The path, with Settings for this path only ticked. Use this when only part of one site is affected.
Start at the pool. Putting a fact about the servers on the site means the next site somebody makes against that pool is broken in a way that looks like nothing to do with them.
198 Never let a pool drop below a number of working backends
Open the pool, Load balancing tab, and set Never go below this many healthy.
Health checks can be wrong. A network blip, a slow moment, or a check that is too strict can mark good servers down, and if they all get marked down at once, the site is off for a reason that was never real.
Setting this to 1 or 2 means the pool keeps sending traffic to that many backends even when the checks say otherwise. A server that might be broken is a better answer than a certain error page.