What Is New in NGINX 1.7
This release introduces significant enhancements to the core HTTP and TCP/UDP proxy functionality. The key additions focus on dynamic modules, improved load balancing, and better logging capabilities.
| Category | Changes |
|---|---|
| New Features | Dynamic modules support, backend SSL certificate verification, access log buffering |
| Core Enhancements | TCP/UDP load balancing, hash and least_conn load balancing methods for TCP |
| Bug Fixes | Fixes for memory leaks, resolver issues, and specific proxy module behaviors |
How does dynamic module loading change the game?
NGINX 1.7.11 marks the initial introduction of dynamic module loading. This allows you to compile modules as shared objects and load them using the new load_module directive in your nginx.conf file.
In practice, this means you can add or update modules without having to recompile the entire NGINX binary from source. It significantly streamlines module management, though the ecosystem of truly dynamic modules was still young at this point.
What's new for TCP and UDP load balancing?
This version solidifies the stream module for proxying and load balancing TCP and UDP traffic. The least_conn and hash load balancing methods are now available for TCP, giving you more control over how connections are distributed to upstream server groups.
This is a big deal for database load balancing, custom protocols, or any non-HTTP service. You get the same robust load balancing features that were previously reserved for HTTP traffic.
Why is backend SSL certificate verification important?
NGINX 1.7.0 added the proxy_ssl_verify and fastcgi_ssl_verify directives. This allows NGINX to verify the certificate of the upstream server it's connecting to, which is crucial for securing backends.
Before this, NGINX would blindly trust any upstream server. Now you can enforce that your backend services present a valid, trusted certificate, preventing potential man-in-the-middle attacks on internal connections.
How does access log buffering improve performance?
The new buffer=size parameter for the access_log directive allows you to buffer log writes instead of writing each entry immediately. This reduces the number of I/O operations, which can be a significant performance gain on high-traffic servers.
You trade a small risk of losing recent log entries in a crash for a much higher throughput. For most production setups, the performance benefit far outweighs the risk.
FAQ
Can I just drop a dynamic module into an existing NGINX 1.6 installation?
No. Dynamic modules must be compiled against the exact same version of NGINX they will run on. You need to build them for NGINX 1.7.x specifically.
Does the TCP hash load balancing method support consistent hashing?
No, the initial implementation in 1.7.2 uses a basic hash that doesn't gracefully handle upstream server changes. The consistent hash variant came in later versions.
I use FastCGI. Do I get the new SSL verification features?
Yes. The fastcgi_ssl_verify directive was introduced alongside proxy_ssl_verify, allowing you to verify certificates for your PHP-FPM or other FastCGI backends.
Is the stream module stable enough for production use?
The core TCP/UDP proxy functionality is robust. However, some of the newer features like additional load balancing methods were still being battle-tested at this stage.
What happens if my access log buffer fills up before it's flushed?
If the buffer space is insufficient, NGINX will write the message immediately to avoid losing data, so your logs remain accurate even under extreme load.