lua-nginx-module

"small embeddable dynamic languages" are usually used to configure or program other larger compiled applications. This is bes understood by example: https://create.roblox.com/docs/tutorials/scripting/basic-scr... - make a mini game in Roblox https://github.com/openresty/lua-nginx-module?tab=readme-ov-... - configure and extend NGINX https://wezfurlong.org/wezterm/config/lua/general.html - make your terminal more useful (my personal config changes the tab color based on the process name - https://github.com/bbkane/dotfiles/blob/master/wezterm/dot-c... https://m.youtube.com/watch?v=MQBr9hwf0BY - configure your text editor

There are a few additional ways to extend nginx without writing a module in C. - JavaScript: https://nginx.org/en/docs/njs/ and https://github.com/nginx/njs-examples - Lua: https://github.com/openresty/lua-nginx-module - Rust: https://github.com/nginxinc/ngx-rust

That said, popular websites on/for Tor are free of JavaScript and they have implemented everything (such as captchas, or the "JavaScript is enabled" warning, and so forth) using pure HTML and CSS. They do use OpenResty[1], too, which is NGINX + Lua. Good stuff. [1] https://openresty.org/, https://github.com/openresty/lua-nginx-module

Here's an example of how I'm using it. Basically to log part of the response body to API requests. log_format main '$remote_addr - - [$time_local] "$request" ' '$status $body_bytes_sent "$host" ' '"$http_user_agent" $http_content_length $request_time ' '"$resp_body" *$connection $connection_requests'; server { set $resp_body ""; location ~ "^/api/v1/...$" { # Append response to resp_body until it reaches max_len. # - ngx.arg[1] is input chunk. # - ngx.arg[2] is eof flag (response is done). # - ngx.ctx.resp_body holds partial result between calls # - ngx.var.resp_body holds final result. # From: # - https://gist.github.com/morhekil/1ff0e902ed4de2adcb7a #

Do you mean with respect to balancing when endpoints come/go (e.g. a POD goes up/down)? Or something else? In this case, it depends on the ingress controller used. The default nginx ingress case has some docs: https://kubernetes.github.io/ingress-nginx/how-it-works/ Note that nginx-ingress has limitations as a side effect of its Lua balancer vs normal nginx. As an example, it does NOT do TLS-resume on the nginx<->service hop. Normal nginx would, but the lua balancer lacks the necessary code [1]. In some high volume scenarios, this can cause trouble on the backend. [1] https://github.com/openresty/lua-nginx-module/pull/1312

Hi from the Pages team! This was such a great find and can't thank you enough for helping ensure Private Pages is as secure as possible. This report helped uncover: - A bug in Openresty where `ngx.redirect` didn't handle unsafe characters [1]. While the fix is now in the latest version of Openresty, a quick patch was to build the URL safely before using it in the redirect. - You should check for case sensitivity when reading `__Host` prefixed cookies, and verify the values against your expected format. It's possible for both `__HOST-Foo` and `__Host-Foo` cookies to exist, and only the `__Host` prefix requires the `Secure` and `HttpOnly` attributes [2]. In our case we strip all cookies at the edge using Varnish (VCL) to ensure no user-supplied cookies make it to our origin, and now we also ignore any "Secure" cookies that don't appear to h

Can you describe your use-case? If you are talking about the ability to select a certificate on the fly via `ssl_certificate_by_lua_block`[1] we are not aware of such functionality. If you are missing something, I would highly encourage you discuss it with the community on a github! From Oleg Guba, Traffic Team TL, co-author, and person driving the deployment: * ListenerFilters + NetworkFilters are flexible enough, that some of the custom logic could be just moved to the config. From Ruslan Nigmatullin, our head Envoy developer: If you are talking more about a custom verification code there is already couple of ways to do that: * Client TLS auth Network Filter: https://www.envoyproxy.io/docs/envoy/latest/configuration/li... * Alternatively, if you are writing C++ extension you can use Network::ReadFilter, Network::ConnectionCallbacks. [1

We use NGINX + Lua [1] to collect real-time diagnostic and performance data from physical machines while they operate. We collect about 150,000 data points (HTTP requests) per second with 2 NGINX servers and 2 Redis servers. We've benchmarked this particular server group up to almost a million req/s before it started to break down (median resp time > 100ms). [1] https://github.com/openresty/lua-nginx-module

There's a patch for LuaJIT that increases the limit. It comes pre-applied with the LuaJIT that installs with openresty. https://github.com/openresty/lua-nginx-module/issues/1019

Could someone explain to me why would I choose this over https://github.com/openresty/lua-nginx-module ? It supports LuaJIT and while I suppose it is possible to write faster C code by hand than JIT translated Lua it'd be hard and I'd fear the maintainability of hand optimized C code.

Take a look at OpenResty, which is nginx scriptable with lua. https://openresty.org/en/ https://github.com/openresty/lua-nginx-module#access_by_lua

LuaJIT is such an amazing piece of software - apparently to such an extent that only Mike Pall fully understands some of its internals. Besides being much faster than the official Lua VM, it offers extended features like the FFI library [1]. Kong[2] uses it extensively, by leveraging the underlying OpenResty[3] framework. [1] http://luajit.org/ext_ffi.html [2] https://github.com/Mashape/kong [3] https://github.com/openresty/lua-nginx-module

This can be done with lua-nginx-module [1] and its 'balancer_by_lua' directive [2]. There are projects like the one I'm working on [3] that implement dynamic proxies using OpenResty. [1]: https://github.com/openresty/lua-nginx-module [2]: https://github.com/openresty/lua-nginx-module#balancer_by_lu... [3]: https://github.com/3scale/apicast/

I can't speak for Apache configurations, but on-the-fly cert lookup is possible in nginx using the lua_nginx module[1] - IIRC that feature was developed by Cloudflare, to power their SSL termination. [1]: https://github.com/openresty/lua-nginx-module/#ssl_certifica...

Openresty is fantastic. On a static website I did last year I implemented some basic login with it and some Elasticsearch full text search. If you just need some very simple REST API and don't want to start with a full blown backend server you can just script some pretty powerful stuff with it. Since a few weeks ago Openresty also has "..._by_lua_block" directives that allow you to just write some lua straight into the config without having to escape the lua code: https://github.com/openresty/lua-nginx-module#synopsis A more comprehensive guide: https://openresty.org/download/agentzh-nginx-tutorials-en.ht...