Ludo's questions

We're evaluating GKE and I'm wondering about the recommended strategy for dividing clusters. We have approx 20 sites for different clients in production at the mo. Should each project have its own separate clusters? One for prod and one for stage? Should we just have two giant cluster, one for prod and one for stage for all projects?

It's tempting to think that it would be nice to have one giant cluster with all of the prod sites on, so that they could all share resources most efficiently, but similarly that means a problem with the cluster would take everyone down at once. I don't really know how common this is.

Probably a side question, but when we upgraded our cluster we're experimenting on (with 2 nodes) the site running on it experienced 4 minutes of downtime. The GKE UI does say that it may experience downtime if there's not too many nodes, but it doesn't specify how many - I guess this should be a consideration in how to divide the clusters too.

Thanks for any help.

I have Jenkins sitting behind Nginx, with Nginx taking care of authentication, but Jenkins is still listening on port 8080 externally, so by accessing the box on port 8080 people can bypass Nginx.

How can I tell it to stop listening for remote connections and just accept connections locally?

It looks like it might be something to do with this ajp13ListenAddress param, but I can't figure out how to set that in the init.d script installed with Jenkins.

Thanks loads for any help!

Ludo.

(Looks like there's no Jenkins tag yet and I can't create it as I don't have rep)

I'm running a Django app, using uWsgi behind Nginx. I've been doing some performance tuning and load testing using ApacheBench and have discovered something unexpected which I wonder if someone could explain for me. In my Nginx config I have a rewrite directive which catches lots of different URL permutations and then forwards them to the canonical URL I wish to use, eg, it traps www.mysite.com/whatever, www.mysite.co.uk/whatever and forwards them all to http://mysite.com/whatever.

If I load test against any of the URLs listed with a redirect (ie, NOT the canonical URL which it is eventually forwarded to), it can serve 15000 concurrent connections without breaking a sweat.

If I load test against the canonical URL, which the above test I would have expected got forwarded to anyway, it can't handle nearly as much. It will drop about 4000 of the 15000 requests, and can only handle about 9000 reliably.

This is the command line I'm using to test:

ab -c15000 -n15000 http://www.mysite.com/somepath/

and

ab -c15000 -n15000 http://mysite.com/somepath/

I've tried several different types - it makes no different which order I do them in. This doesn't make sense to me - I can understand why the requests involving a redirect may not handle quite so many concurrent connections, but it's happening the other way round. Can anyone explain? I'd really prefer it if the canonical URL was the one which could handle more traffic.

I'll post my Nginx config below.

Thanks loads for any help!

server {
    server_name www.somesite.com  somesite.net www.somesite.net somesite.co.uk www.somesite.co.uk;
    rewrite ^(.*) http://somesite.com$1 permanent;
}

server {
    root   /home/django/domains/somesite.com/live/somesite/;

    server_name  somesite.com somesite-live.myserver.somesite.com;

    access_log  /home/django/domains/somesite.com/live/log/nginx.log;

    location / {
        uwsgi_pass unix:////tmp/somesite-live.sock;
        include    uwsgi_params;
    }

    location /media {
        try_files $uri $uri/ /index.html;
    }

    location /site_media {
        try_files $uri $uri/ /index.html;
    }

    location = /favicon.ico {
        empty_gif;
    }
}

I'd like to allow one of my users to execute commands as another user on my Ubuntu Lucid server.

I'm struggling with finding the syntax for the sudoers file to do this. Say I'm connecting to the box with a user called 'ludo', and I want ludo to be able to execute commands as the 'django' user. eg:

sudo -u django

I'd like to be able to execute /any/ commands as the django user, and without prompting for a passsword. All the examples I find are for a restricted subset. I did attempt something but got a syntax error upon exiting visudo so I bottled it.

Thanks :)

Could someone please describe to me the pros and cons of using a Unix socket file vs a tcp/ip localhost:port when setting up services on a server (Ubuntu, FWIW)?

In this particular instance it's for a Python WSGI server (uWSGI) but I'm just interested in general (eg, I know you can set up MySQL in both ways).

I realise that using tcp/ip means that the services can be exposed to other machines, but I'm just interested in whether there are any performance tradeoffs when accessing services locally.

Cheers.