http_upstream module

The module is used to define groups of servers that can be referenced by the proxy_pass, fastcgi_pass, uwsgi_pass, scgi_pass, memcached_pass and grpc_pass directives.

Example Configuration

upstream backend {
    zone backend 1m;
    server backend1.example.com       weight=5;
    server backend2.example.com:8080;
    server backend3.example.com       service=_example._tcp resolve;
    server unix:/tmp/backend3;

    server backup1.example.com:8080   backup;
    server backup2.example.com:8080   backup;
}

resolver 127.0.0.53 status_zone=resolver;

server {
    location / {
        proxy_pass http://backend;
    }
}

Directives

upstream

Syntax:

upstream name { … }

Default:

—

Context:

http

Defines a group of servers. Servers can listen on different ports. In addition, servers listening on TCP and UNIX domain sockets can be mixed.

Example:

upstream backend {
    server backend1.example.com weight=5;
    server 127.0.0.1:8080       max_fails=3 fail_timeout=30s;
    server unix:/tmp/backend3;

    server backup1.example.com  backup;
}

By default, requests are distributed between the servers using a weighted round-robin balancing method. In the above example, each 7 requests will be distributed as follows: 5 requests go to backend1.example.com and one request to each of the second and third servers.

If an error occurs during communication with a server, the request will be passed to the next server, and so on until all of the functioning servers will be tried. If a successful response could not be obtained from any of the servers, the client will receive the result of the communication with the last server.

server

Syntax:

server address [parameters];

Default:

—

Context:

upstream

Defines the address and other parameters of a server. The address can be specified as a domain name or IP address, with an optional port, or as a UNIX domain socket path specified after the unix: prefix. If a port is not specified, the port 80 is used. A domain name that resolves to several IP addresses defines multiple servers at once.

The following parameters can be defined:

weight=number	sets the weight of the server by default, 1.
max_conns=number	limits the maximum number of simultaneous active connections to the proxied server. Default value is 0, meaning there is no limit. If the server group does not reside in the shared memory, the limitation works per each worker process.

Note

If idle keepalive connections, multiple workers, and the shared memory are enabled, the total number of active and idle connections to the proxied server may exceed the max_conns value.

max_fails=number — sets the number of unsuccessful attempts to communicate with the server that should happen in the duration set by fail_timeout to consider the server unavailable; it is then retried after the same duration.

What is considered an unsuccessful attempt is defined by the proxy_next_upstream, fastcgi_next_upstream, uwsgi_next_upstream, scgi_next_upstream, memcached_next_upstream, and grpc_next_upstream directives.

When max_fails is reached, the peer is also considered unhealthy by the upstream_probe probes; it won’t receive client requests until the probes consider it healthy again.

Note

If there’s only one server in an upstream, max_fails has no effect and will be ignored.

max_fails=1	the default number of unsuccessful attempts
max_fails=0	disables the accounting of attempts

fail_timeout=time — sets the period of time during which a number of unsuccessful attempts to communicate with the server (max_fails) should happen to consider the server unavailable. The server then becomes unavailable for the same amount of time before it is retried.

By default, this is set to 10 seconds.

Note

If there’s only one server in an upstream, fail_timeout has no effect and will be ignored.

backup	marks the server as a backup server. It will be passed requests when the primary servers are unavailable.
down	marks the server as permanently unavailable.
drain	sets the server to draining; this means it receives only requests from the sessions that were bound earlier with sticky. Otherwise it behaves similarly to down.

Caution

The parameter backup cannot be used along with the hash, ip_hash, and random load balancing methods.

The down and drain options are mutually exclusive.

New in version 1.1.0.

resolve

enables monitoring changes to the list of IP addresses that corresponds to a domain name, updating it without a configuration reload. The group should be stored in a shared memory zone; also, you need to define a resolver.

service=name

enables resolving DNS SRV records and sets the service name. For this parameter to work, specify the resolve server parameter, providing a hostname without a port number. If there are no dots in the service name, the name is formed according to the RFC standard: the service name is prefixed with _, then _tcp is added after a dot. Thus, the service name http will result in _http._tcp. Angie resolves the SRV records by combining the normalized service name and the hostname and obtaining the list of servers for the combination via DNS, along with their priorities and weights. Top-priority SRV records (ones that share the minimum priority value) resolve into primary servers, and other records become backup servers. If backup is set with server, top-priority SRV records resolve into backup servers, and other records are ignored. Weight influences the selection of servers by the assigned capacity: higher weights receive more requests. If set by both the server directive and the SRV record, the weight set by server is used.

This example will look up the _http._tcp.backend.example.com record:

server backend.example.com service=http resolve;

New in version 1.2.0.

sid=id

sets the server ID within the group. If the parameter is omitted, the ID is set to the hexadecimal MD5 hash value of either the IP address and port or the UNIX domain socket path.

New in version 1.4.0.

slow_start=time

sets the time to recover the weight for a server that goes back online, if load balancing uses the round-robin or least_conn method. If the value is set and the server is again considered available and healthy as defined by max_fails and upstream_probe, the server will steadily recover its designated weight within the allocated timeframe. If the value isn’t set, the server in a similar situation will recover its designated weight immediately.

Note

If there’s only one server in an upstream, slow_start has no effect and will be ignored.

zone

Syntax:

zone name [size];

Default:

—

Context:

upstream

Defines the name and size of the shared memory zone that keeps the group’s configuration and run-time state that are shared between worker processes. Several groups may share the same zone. In this case, it is enough to specify the size only once.

hash

Syntax:

hash key [consistent];

Default:

—

Context:

upstream

Specifies a load balancing method for a server group where the client-server mapping is based on the hashed key value. The key can contain text, variables, and their combinations. Note that adding or removing a server from the group may result in remapping most of the keys to different servers. The method is compatible with the Cache::Memcached Perl library.

If the consistent parameter is specified, the ketama consistent hashing method will be used instead. The method ensures that only a few keys will be remapped to different servers when a server is added to or removed from the group. This helps to achieve a higher cache hit ratio for caching servers. The method is compatible with the Cache::Memcached::Fast Perl library with the ketama_points parameter set to 160.

ip_hash

Syntax:

ip_hash;

Default:

—

Context:

upstream

Specifies that a group should use a load balancing method where requests are distributed between servers based on client IP addresses. The first three octets of the client IPv4 address, or the entire IPv6 address, are used as a hashing key. The method ensures that requests from the same client will always be passed to the same server except when this server is unavailable. In the latter case client requests will be passed to another server. Most probably, it will always be the same server as well.

If one of the servers needs to be temporarily removed, it should be marked with the down parameter in order to preserve the current hashing of client IP addresses.

upstream backend {
    ip_hash;

    server backend1.example.com;
    server backend2.example.com;
    server backend3.example.com down;
    server backend4.example.com;
}

keepalive

Syntax:

keepalive connections;

Default:

—

Context:

upstream

Activates the cache for connections to upstream servers.

The connections parameter sets the maximum number of idle keepalive connections to upstream servers that are preserved in the cache of each worker process. When this number is exceeded, the least recently used connections are closed.

Note

It should be particularly noted that the keepalive directive does not limit the total number of connections to upstream servers that an Angie worker process can open. The connections parameter should be set to a number small enough to let upstream servers process new incoming connections as well.

Attention

The keepalive directive must be used after all directives that set the load balancing method; otherwise, it won’t work.

Example configuration of memcached upstream with keepalive connections:

upstream memcached_backend {
    server 127.0.0.1:11211;
    server 10.0.0.2:11211;

    keepalive 32;
}

server {
    #...

    location /memcached/ {
        set $memcached_key $uri;
        memcached_pass memcached_backend;
    }

}

For HTTP, the proxy_http_version directive should be set to “1.1” and the “Connection” header field should be cleared:

upstream http_backend {
    server 127.0.0.1:8080;

    keepalive 16;
}

server {
    #...

    location /http/ {
        proxy_pass http://http_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    #    ...
    }
}

Note

Alternatively, HTTP/1.0 persistent connections can be used by passing the “Connection: Keep-Alive” header field to an upstream server, though this method is not recommended.

For FastCGI servers, it is required to set fastcgi_keep_conn for keepalive connections to work:

upstream fastcgi_backend {
    server 127.0.0.1:9000;

    keepalive 8;
}

server {
    #...

    location /fastcgi/ {
        fastcgi_pass fastcgi_backend;
        fastcgi_keep_conn on;
    #    ...
    }
}

Note

SCGI and uwsgi protocols do not have a notion of keepalive connections.

keepalive_requests

Syntax:

keepalive_requests number;

Default:

keepalive_requests 1000;

Context:

upstream

Sets the maximum number of requests that can be served through one keepalive connection. After the maximum number of requests is made, the connection is closed.

Closing connections periodically is necessary to free per-connection memory allocations. Therefore, using too high maximum number of requests could result in excessive memory usage and not recommended.

keepalive_time

Syntax:

keepalive_time time;

Default:

keepalive_time 1h;

Context:

upstream

Limits the maximum time during which requests can be processed through one keepalive connection. After this time is reached, the connection is closed following the subsequent request processing.

keepalive_timeout

Syntax:

keepalive_timeout time;

Default:

keepalive_timeout 60s;

Context:

upstream

Sets a timeout during which an idle keepalive connection to an upstream server will stay open.

bind_conn

Important

The directive is PRO-only.

Syntax:

bind_conn value;

Default:

—

Context:

upstream

Enables binding the server connection to the client when the value, which is set as a string of variables, becomes anything other than "" and "0".

Attention

The bind_conn directive must be used after all directives that set the load balancing method; otherwise, it won’t work. If sticky is also used, bind_conn should appear after sticky.

Attention

When using the directive, configure the http_proxy module to allow keepalive connections, for example:

proxy_http_version 1.1;
proxy_set_header Connection "";

A typical use case for the directive is proxying NTLM-authenticated connections, where the client should be bound to the server when the negotiation starts:

map $http_authorization   $ntlm {
    ~*^N(?:TLM|egotiate)  1;
}

upstream ntlm_backend {
    server 127.0.0.1:8080;
    bind_conn $ntlm;
}

server {
    # ...
    location / {
        proxy_pass http://ntlm_backend;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        # ...
    }
}

least_conn

Syntax:

least_conn;

Default:

—

Context:

upstream

Specifies that a group should use a load balancing method where a request is passed to the server with the least number of active connections, taking into account weights of servers. If there are several such servers, they are tried in turn using a weighted round-robin balancing method.

random

Syntax:

random [two];

Default:

—

Context:

upstream

Specifies that a group should use a load balancing method where a request is passed to a randomly selected server, taking into account weights of servers.

The optional two parameter instructs Angie to randomly select two servers and then choose a server using the specified method. The default method is least_conn which passes a request to a server with the least number of active connections.

sticky

New in version 1.2.0.

Syntax:

sticky cookie name [attr=value]…;
sticky route $variable…;
sticky learn zone=zone create=$variable1… lookup=$cookie1… [header] [timeout=time];

Default:

—

Context:

upstream

Configures the binding of client sessions to proxied servers in the mode specified by the first parameter; to drain requests from servers that have sticky defined, use the drain option in the server block.

Attention

The sticky directive must be used after all directives that set the load balancing method; otherwise, it won’t work. If bind_conn is also used, bind_conn should appear after sticky.

cookie moderoute modelearn mode (PRO 1.4.0+)

In this mode, a client’s request, not yet bound to any server, is sent to a server chosen according to the configured load balancing method. The data about the chosen server is then saved in a cookie, which Angie creates specifically for this purpose.

The cookie’s name (name) is set by the sticky directive itself, and the value (value) corresponds to the sid parameter of the server directive (note that the parameter is additionally hashed if the sticky_secret directive is set).

Subsequent requests from a client containing the corresponding cookie are forwarded to the server associated with the cookie’s value, i.e., having the specified sid. If selecting a server fails or the chosen server cannot handle the request, another server will be selected according to the configured load balancing method.

The directive allows assigning attributes to such a cookie; the only attribute set by default is path=/. Attribute values are specified as strings with variables. To remove an attribute, set an empty value for it: attr=. For example, sticky cookie path= creates a cookie without the path attribute.

Here, Angie creates a cookie named srv_id with a one-hour lifespan and a variable-specified domain:

upstream backend {
    server backend1.example.com:8080;
    server backend2.example.com:8080;

    sticky cookie srv_id domain=$my_domain max-age=3600;
}

sticky_strict

New in version 1.2.0.

Syntax:

sticky_strict on | off;

Default:

sticky_strict off;

Context:

upstream

When enabled, makes Angie to return http 502 error to the client if desired server is not available instead of using any other available, as in case when no server in upstream is available.

sticky_secret

New in version 1.2.0.

Syntax:

sticky_secret string;

Default:

—

Context:

upstream

Adds the string as the salt value to the MD5 hashing function for the sticky directive in cookie and route modes. The string may contain variables, for example, $remote_addr:

upstream backend {
    server backend1.example.com:8080;
    server backend2.example.com:8080;

    sticky cookie cookie_name;
    sticky_secret my_secret.$remote_addr;
}

Salt is appended to the value being hashed; to verify the hashing mechanism independently:

$ echo -n "<VALUE><SALT>" | md5sum

Built-in Variables

The http_upstream module supports the following Built-in variables:

$upstream_addr

keeps the IP address and port, or the path to the UNIX domain socket of the upstream server. If several servers were contacted during request processing, their addresses are separated by commas, e.g. :

192.168.1.1:80, 192.168.1.2:80, unix:/tmp/sock

If an internal redirect from one server group to another happens, initiated by “X-Accel-Redirect” or error_page, then the server addresses from different groups are separated by colons, e.g.:

192.168.1.1:80, 192.168.1.2:80, unix:/tmp/sock : 192.168.10.1:80, 192.168.10.2:80

If a server cannot be selected, the variable keeps the name of the server group.

$upstream_bytes_received

number of bytes received from an upstream server. Values from several connections are separated by commas and colons like addresses in the $upstream_addr variable.

$upstream_bytes_sent

number of bytes sent to an upstream server. Values from several connections are separated by commas and colons like addresses in the $upstream_addr variable.

$upstream_cache_status

keeps the status of accessing a response cache. The status can be either MISS, BYPASS, EXPIRED, STALE, UPDATING, REVALIDATED or HIT:

• MISS: The response isn’t found in the cache, and the request is forwarded to the upstream server.

• BYPASS: The cache is bypassed, and the request is directly forwarded to the upstream server.

• EXPIRED: The cached response is stale, and a new request for the updated content is sent to the upstream server.

• STALE: The cached response is stale, but will be served to the clients until an update has been eventually fetched from the upstream server.

• UPDATING: The cached response is stale, but will be served to the clients until the currently ongoing update from the upstream server has been finished.

• REVALIDATED: The cached response is stale, but is successfully revalidated and doesn’t need an update from the upstream server.

• HIT: The response was served from the cache.

If the cache was bypassed entirely without accessing it, the variable isn’t set.

$upstream_connect_time

keeps time spent on establishing a connection with the upstream server; the time is kept in seconds with millisecond resolution. In case of SSL, includes time spent on handshake. Times of several connections are separated by commas and colons like addresses in the $upstream_addr variable.

$upstream_cookie_ name

cookie with the specified name sent by the upstream server in the “Set-Cookie” response header field. Only the cookies from the response of the last server are saved.

$upstream_header_time

keeps time spent on receiving the response header from the upstream server; the time is kept in seconds with millisecond resolution. Times of several responses are separated by commas and colons like addresses in the $upstream_addr variable.

$upstream_http_ name

keep server response header fields. For example, the “Server” response header field is available through the $upstream_http_server variable. The rules of converting header field names to variable names are the same as for the variables that start with the “$http_” prefix. Only the header fields from the response of the last server are saved.

$upstream_probe_body (PRO)

keeps the peer response body, received during an upstream_probe; its size is limited by max_body.

$upstream_queue_time

keeps time the request spent in the queue before a server was selected; the time is kept in seconds with millisecond resolution. Times of several selection attempts are separated by commas and colons, like addresses in the $upstream_addr variable.

$upstream_response_length

keeps the length of the response obtained from the upstream server; the length is kept in bytes. Lengths of several responses are separated by commas and colons like addresses in the $upstream_addr variable.

$upstream_response_time

keeps time spent on receiving the response from the upstream server; the time is kept in seconds with millisecond resolution. Times of several responses are separated by commas and colons like addresses in the $upstream_addr variable.

$upstream_status

keeps status code of the response obtained from the upstream server. Status codes of several responses are separated by commas and colons like addresses in the $upstream_addr variable. If a server cannot be selected, the variable keeps the 502 (Bad Gateway) status code.

$upstream_sticky_status

Status of sticky request.

''	the request to the upstream with no sticky enabled
NEW	request without sticky information
HIT	request with sticky information was routed to desired backend
MISS	request with sticky information was routed to backend selected by balancing algorithm

Values from several connections are separated by commas and colons like addresses in the $upstream_addr variable.

$upstream_trailer_ name

keeps fields from the end of the response obtained from the upstream server.