Nginx Cloudflare: Why does one NGINX worker take all the load?

Very nice reading

---

https://blog.cloudflare.com/the-sad-state-of-linux-socket-balancing/

 

Didn't know about that manual edit also

Let's hope it will work well with https also

George do you plan to add reuseport support out of the box for https also?

 

On one of my servers i got this error:

Code:

On one of my servers i got this error:

[CODE]-- Unit nginx.service has begun starting up.
Oct 30 22:33:08 server.mydomain.com nginx[17311]: Starting nginx: nginx: [emerg] duplicate listen options for 0.0.0.0:443 in /usr/local/nginx/conf/conf.d/test.mydomain.com.ssl.conf:11
Oct 30 22:33:08 server.mydomain.com nginx[17311]: [FAILED]
Oct 30 22:33:08 server.mydomain.com systemd[1]: nginx.service: control process exited, code=exited status=1
Oct 30 22:33:08 server.mydomain.com systemd[1]: Failed to start SYSV: Nginx is an HTTP(S) server, HTTP(S) reverse proxy and IMAP/POP3 proxy server.
-- Subject: Unit nginx.service has failed
-- Defined-By: systemd
-- Support: http://lists.freedesktop.org/mailman/listinfo/systemd-devel
--
-- Unit nginx.service has failed.
--
-- The result is failed.
Oct 30 22:33:08 server.mydomain.com systemd[1]: Unit nginx.service entered failed state.
Oct 30 22:33:08 server.mydomain.com systemd[1]: nginx.service failed.
Oct 30 22:33:08 server.mydomain.com polkitd[676]: Unregistered Authentication Agent for unix-process:17305:68303076 (system bus name :1.37902, object path /org/freedesktop/PolicyKit1/AuthenticationAgent, locale en_US.UTF-8) (disconnected from bus)

But i can't find any duplicated lines on config line 11:

Code:

# redirect from www to non-www  forced SSL
# uncomment, save file and restart Nginx to enable
# if unsure use return 302 before using return 301
# server {
#       listen   80;
#       server_name test.mydomain.com www.test.mydomain.com;
#       return 302 https://$server_name$request_uri;
# }

server {
  listen 443 ssl http2 backlog=2048 reuseport;
  server_name test.mydomain.com www.test.mydomain.com;

  ssl_dhparam /usr/local/nginx/conf/ssl/test.mydomain.com/dhparam.pem;
  ssl_certificate      /usr/local/nginx/conf/ssl/test.mydomain.com/test.mydomain.com.crt;
  ssl_certificate_key  /usr/local/nginx/conf/ssl/test.mydomain.com/test.mydomain.com.key;
  include /usr/local/nginx/conf/ssl_include.conf;

  http2_max_field_size 16k;
  http2_max_header_size 32k;
  # mozilla recommended
  ssl_ciphers EECDH+CHACHA20:EECDH+CHACHA20-draft:EECDH+ECDSA+AESGCM:EECDH+aRSA+AESGCM:EECDH+ECDSA+SHA256:EECDH+ECDSA+SHA384:EECDH+aRSA+SHA256:EECDH+aRSA+SHA384:EECDH+AES128:!aNULL:!eNULL:!LOW:!3DES:!MD5:!EXP:!PSK:!SRP:!DSS:!RC4:!EDH-DSS-DES-CBC3-SHA:!EDH-RSA-DES-CBC3-SHA:!KRB5-DES-CBC3-SHA:!CAMELLIA;
  ssl_prefer_server_ciphers   on;
  #add_header Alternate-Protocol  443:npn-spdy/3;

  # before enabling HSTS line below read centminmod.com/nginx_domain_dns_setup.html#hsts
  #add_header Strict-Transport-Security "max-age=31536000; includeSubdomains;";
  #add_header X-Frame-Options SAMEORIGIN;
  #add_header X-Xss-Protection "1; mode=block" always;
  #add_header X-Content-Type-Options "nosniff" always;
  #spdy_headers_comp 5;
  ssl_buffer_size 1369;
  ssl_session_tickets on;
 
  # enable ocsp stapling
  #resolver 8.8.8.8 8.8.4.4 valid=10m;
  #resolver_timeout 10s;
  #ssl_stapling on;
  #ssl_stapling_verify on;
  #ssl_trusted_certificate /usr/local/nginx/conf/ssl/test.mydomain.com/test.mydomain.com-trusted.crt;

# ngx_pagespeed & ngx_pagespeed handler
#include /usr/local/nginx/conf/pagespeed.conf;
#include /usr/local/nginx/conf/pagespeedhandler.conf;
#include /usr/local/nginx/conf/pagespeedstatslog.conf;

  # limit_conn limit_per_ip 16;
  # ssi  on;

  access_log /home/nginx/domains/test.mydomain.com/log/access.log combined buffer=256k flush=5m;
  error_log /home/nginx/domains/test.mydomain.com/log/error.log;

  #include /usr/local/nginx/conf/autoprotect/test.mydomain.com/autoprotect-test.mydomain.com.conf;
  root /home/nginx/domains/test.mydomain.com/public;
  # uncomment cloudflare.conf include if using cloudflare for
  # server and/or vhost site
  include /usr/local/nginx/conf/cloudflare.conf;
  #include /usr/local/nginx/conf/503include-main.conf;

  location / {
  #include /usr/local/nginx/conf/503include-only.conf;

# block common exploits, sql injections etc
#include /usr/local/nginx/conf/block.conf;

  # Enables directory listings when index file not found
  #autoindex  on;

  # Shows file listing times as local time
  #autoindex_localtime on;

  # Wordpress Permalinks example
  try_files $uri $uri/ /index.php?q=$uri&$args;

  }

  include /usr/local/nginx/conf/pre-staticfiles-local-test.mydomain.com.conf;
  include /usr/local/nginx/conf/pre-staticfiles-global.conf;
  include /usr/local/nginx/conf/staticfiles.conf;
  include /usr/local/nginx/conf/php.conf;
 
  include /usr/local/nginx/conf/drop.conf;
  #include /usr/local/nginx/conf/errorpage.conf;
  include /usr/local/nginx/conf/vts_server.conf;
}

 

Code:

/usr/local/nginx/conf/conf.d/mydomain.com.ssl.conf:11:  listen 443 ssl http2 backlog=2048 reuseport;
/usr/local/nginx/conf/conf.d/test.mydomain.com.ssl.conf:11:  listen 443 ssl http2 backlog=2048 reuseport;
/usr/local/nginx/conf/conf.d/anotherdomain.com.ssl.conf:11:  listen 443 ssl http2 backlog=2048 reuseport;
/usr/local/nginx/conf/conf.d/virtual.conf:3:            listen   80 default_server backlog=2048 reuseport fastopen=256;

It is a dedicated server