isNaN1247's questions

I'm using nginx as a reverse-proxy over my existing web server. I only want to manage a single set of custom error pages, and ideally within nginx as this is the level closest to the client.

Now I'm fine with using the error_pages and proxy_intercept_errors settings. However:

1. In the case of 400 (Bad Request) errors I need the underlying web server to be able to through some JSON body content, detailing why the request was bad. And so I need a way of disabling proxy_intercept_errors for 400 status codes only.

2. I never want to show the default nginx error pages, for any status code. Now from what I can see, in order to achieve this I would need to explicitally list out every possible status code imaginable, and have an error page for it? Rather than just wildcarding all errors above 500 for example.

My questions are - Are the above 2 issues resolvable within nginx itself? If not, is there an obvious solution to the issues above?

We're using stunnel and HAProxy for our load balancing needs.

In nginx you can enable a maintenance state, based on the existance of a file on a child server (see Configure nginx to serve a 503 if a file exists).

Is it possible to put a server node into 'maintenance mode' based on the existance of a file, when using HAProxy?

Background

I'm hosting a static site on S3, with CloudFront over the top. The issue I have is with my HTML files.

According to CloudFront's FAQ:

Amazon CloudFront uses these cache control headers to determine how frequently it needs to check the origin for an updated version of that file

What I've done so far

With this in mind I've set the HTML files in my S3 Bucket to add in the following headers:

Cache-Control: no-cache, no-store, max-age=0, must-revalidate
Expires: Fri, 01 Jan 1990 00:00:00 GMT

On my first call to my samplefile.htm, I see the following response headers (I've excluded obvious headers (e.g. Content-Type) in order to keep to the point:

Cache-Control:no-cache, no-store, max-age=0, must-revalidate
Date:Sat, 10 Dec 2011 14:16:51 GMT
ETag:"a5890ace30a3e84d9118196c161aeec2"
Expires:Fri, 01 Jan 1990 00:00:00 GMT
Last-Modified:Sat, 10 Dec 2011 14:16:43 GMT
Server:AmazonS3
X-Cache:Miss from cloudfront

As you can see, my Cache-Control header is in there. The problem is, if I update this file and refresh I get the cached content (rather than the latest file), and I can see that CloudFront is serving its cached version by looking at the response headers:

X-Cache:Hit from cloudfront

Summary/question

With the above in mind, how can I achieve automatic retrieval of the latest HTML when using CloudFront?

As per its FAQ I should be able to do this with Cache-Control headers, but I can't seem to get this working.

Following the answers below

In the end I decided to change my www CNAME to point to my S3 bucket directly. Then added a new CNAME called "static", which points to CloudFront.

This means that HTML is direct from S3, which then has all its CSS/JS/IMG references pointing to static.mydomain.com

My haproxy.cfg has a frontend which then redirects to a bunch of backends,

here is a sample backend (note that connections into this have already been through stunnel to rip out SSL:

backend thenameofit        
reqadd          X-Forwarded-Proto:\ https
reqadd          FRONT_END_HTTPS:\ on
server myserver1 serverhostnamex:80 weight 1 maxconn 5000 check
server myserver2 serverhostnamey:80 weight 1 maxconn 5000 check
appsession ASP.NET_SessionId len 100 timeout 3h

I'm sure I'm simply missing a setting somewhere, but I must be missing it when reading the config documentation.

I'm using HAProxy 1.4.13.

I've written a simple Windows Service which polls a UNC path every few [5] seconds. When it finds a particular sub-directory in that folder it moves it.

The code doesn't have any locking functionality built in, and if I run the process on a local path all is well.

If I try and access the network path when the service is running Windows states that the path cannot be found, the moment I stop the service its available again.

All my code is just wrapped in a simple:

if(Directory.Exists("xxxxx")) { }

Is there any standard mechanism that can keep a 'watched' directory unlocked? BTW - the user account that is running the service is LocalSystem

Many thanks

I'm using Microsoft's Web Farm Framework, and I'm trying to use the Workflow features of version 2.0 to fire a custom command when 'Remove from Load Balancing' is selected.

Based on the linked article, I think I should be able to simply create my command using the Workflow Builder (currently I'm just testing with a simple mkdir c:\bob as my command), and then add ArrDisableLoadBalancing as a dependant.

This should [again I think!] mean that the command is fired immediately before ArrDisableLoadBalancing.

However this just does not work, the command itself is fine as I can use the 'Server Operations' option to fire it manually.

Does anyone have an ideas? There is very little literature on people successfully setting something like this up. So I fear I may have mis-read WFF's workflow capability.

I have haproxy running as my load-balancer and from the stats web interface that comes with haproxy, I can put a web server into maintenance mode (and bring it back out again) - which is great!

However, I also want to be able to perform that same action from the command line (for use in some automated deployment workflows). Is this possible, and if so how?

Many thanks

The front-end of our set-up runs via:-

• A Linux load balancer - running HAProxy for load-balancing with stunnel in front for SSL connections.
• This serves 2 x Windows Server boxes running IIS 7.5

I need a way of ensuring that the 2 IIS boxes are always in sync (i.e. if I change a setting on one, then within a matter of moments, the second should be automatically updated).

Having looked around the Microsoft Web Farm Framework seems the best solution for this, however I'm not sure if this plays nicely (or duplicates functionality) of the HAProxy level in front of it?

Many thanks in advance.

We have a load-balancer setup, in which an HTTPS Request flows through the following steps:-

Client -> DNS -> stunnel on Load-Balancer -> HAProxy on LB -> Web-Server

This setup works perfectly when stunnel is listening to the local IP of the Load-Balancer.

However in our setup we have 2 load-balancers and we want to be able to listen to a virtual IP, which only ever exists on one LB at a time (keepalived flips the IP to the second LB if the first one falls over).

HAProxy has no problem in doing this (and I can ping the assigned virtual IP on the load-balancer I'm testing), but it seems stunnel hates the concept.

Has anyone achieved this before (below is my stunnel config - as you can see I'm actually listening for ALL traffic on 443):-

cert= /etc/ssl/certs/mycert.crt
key = /etc/ssl/certs/mykey.key
;setuid = nobody
;setgid = nogroup

pid = /etc/stunnel/stunnel.pid
debug = 3
output = /etc/stunnel/stunnel.log

socket=l:TCP_NODELAY=1
socket=r:TCP_NODELAY=1

[https]
accept=443
connect=127.0.0.1:8443
TIMEOUTclose=0
xforwardedfor=yes

Sorry for the long-winded question!