Skip to content

Add status endpoint #333

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
wants to merge 4 commits into from
Closed

Add status endpoint #333

Show file tree
Hide file tree
Changes from 3 commits
Commits
Show all changes
4 commits
Select commit Hold shift + click to select a range
450d3f1
add status endpoint
pixeleet Apr 4, 2017
6dec5a9
add StatusEndpoint to model
pixeleet Apr 4, 2017
041b2c3
add statusEndpoint for default app too
pixeleet Apr 4, 2017
5015154
restrict to localhost
pixeleet Apr 4, 2017
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
2 changes: 2 additions & 0 deletions model/model.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -65,6 +65,7 @@ type RouterConfig struct {
HTTP2Enabled bool `key:"http2Enabled" constraint:"(?i)^(true|false)$"`
LogFormat string `key:"logFormat"`
ProxyBuffersConfig *ProxyBuffersConfig `key:"proxyBuffers"`
StatusEndpoint bool `key:"statusEndpoint" constraint:"(?i)^(true|false)$"`
}

func newRouterConfig() (*RouterConfig, error) {
Expand Down Expand Up @@ -95,6 +96,7 @@ func newRouterConfig() (*RouterConfig, error) {
HTTP2Enabled: true,
LogFormat: `[$time_iso8601] - $app_name - $remote_addr - $remote_user - $status - "$request" - $bytes_sent - "$http_referer" - "$http_user_agent" - "$server_name" - $upstream_addr - $http_host - $upstream_response_time - $request_time`,
ProxyBuffersConfig: proxyBuffersConfig,
StatusEndpoint: false,
}, nil
}

Expand Down
11 changes: 11 additions & 0 deletions nginx/config.go
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -145,6 +145,12 @@ http {
return 200;
}

{{ if $routerConfig.statusEndpoint }}
location /nginx_status {
stub_status on;
}
{{ end }}

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Can the leading whitespace be made consistent with what's above and below?

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Sure, just a quick question, are you fine with just restricting /nginx_status to 127.0.0.1 for now and deny all? the use case primarily being monitoring this should be fine

Copy link
Contributor

@krancour krancour Apr 4, 2017 •
edited
Loading

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Yes. We've already done that very same thing here: https://github.com/deis/router/blob/master/nginx/config.go#L202-L207

This makes me wonder a few things.

  • Are you aware that lots of router metrics are already available in Grafana? (Just making sure.)
  • Are the metrics that are already exposed at 127.0.0.1:9090/stats something you can work with? i.e. Is this new endpoint needed for something you can't already get?
  • Purely to satisfy my own curiosity, what agent / metric collector would you be running that would be hitting this from the router's own loopback interface?
  • Is 127.0.0.1:9090/nginx_status a better place for this? I ask because the whole purpose of that server block listening on 9090 is to have a block that's guaranteed to never be using PROXY protocol. Anything listening for traffic from the outside world (e.g. the default vhost) may very well have that enabled-- which means it wouldn't be able to handle traffic coming at it from somewhere other than a proxy / LB that also has that enabled.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

1, yes I'm aware, we're using mainly sysdig and the grafana part we skipped from our setup
2, sysdig wants me to have the nginx stub status exposed
3, sysdig cloud for the containers and newrelic for api performance metrics
4, 127.0.0.1:9090/nginx_status works just fine for me! :)

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

127.0.0.1:9090/nginx_status works just fine for me!

Ok. Awesome. Let's start there. If, as time goes on, there is some compelling reason to expose this beyond that, we can take it up then.

location / {
proxy_buffering {{ if $routerConfig.ProxyBuffersConfig.Enabled }}on{{ else }}off{{ end }};
proxy_buffer_size {{ $routerConfig.ProxyBuffersConfig.Size }};
Expand Down Expand Up @@ -186,6 +192,11 @@ http {
location / {
return 404;
}
{{ if $routerConfig.statusEndpoint }}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I see you groomed the commits and force-pushed... I think you lost the model changes that complement this.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

Damn indeed. :) That's stupid.

Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I would consider moving this section up between the health check and the location / block. I know Nginx works by making the best/closest match, but for human readability, it usually makes the most sense to have the more specific patterns listed first so that you can think of unmatched requests as progressively "falling through" the list for a possible match to a more general pattern... if you don't mind.

location /nginx_status {
stub_status on;
}
Copy link
Contributor

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

You still want this to be conditional though, yes? Also, should this location (but not the entire default vhost) be either locked down to a configurable whitelist, or possibly protected with a configurable username/password. I tend to imagine we don't want to expose these stats to the world.

Copy link
Contributor Author

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'll read up on whitelisting in the router, pushed a single commit for the configurability

{{ end }}
}
{{ end }}

Expand Down