Hi @cigamit,
Path to ASGI ended with a step four: once uwsgi and daphne were gone, discuss whether nginx still earns its place. #975 landed, so this is that discussion. I built it and measured it rather than guessed, and it turns out to be removable, so what is left is whether you want it done.
What nginx still does
It used to route two backends, and one proxy_pass to uvicorn is all that is left of that. What remains:
- TLS, on 8053 from a certificate the operator mounts, and on 8043 in the compose from a self signed one.
- Static files, serving
/static, /locales and /favicon.ico out of /var/lib/ascender/public/static/.
- Plain HTTP, on 8052 in a deployment and 8013 in the development compose.
- The ingress prefix, stripped here and put back by uvicorn's
--root-path.
- Custom error pages, the
error_page directives built from custom_error_pages in the compose role.
Why the ports are not a blocker
I thought one uvicorn serving one port would be the problem. Reading the operator's own service says otherwise.
- Edge routes, Ingress, nodeport and loadbalancer all target 8052 plain, so the ingress already terminates TLS.
- nginx is plain only in most deployments, so uvicorn on plain 8052 replaces it with nothing to decide.
- Only
passthrough sends TLS into the pod, exposing 443 against 8053, and uvicorn holds a certificate happily.
- Two listeners are a development compose problem alone, where 8013 and 8043 are both served from one nginx.
What I tested
I ran uvicorn on its own with TLS and whitenoise, nothing in front of it, and asked it for each of the jobs above.
- TLS works: uvicorn takes
--ssl-certfile and --ssl-keyfile and serves HTTPS off nginx's own certificate.
- The API works:
/api/v2/ping/ and /api/ both answer 200 with JSON over that connection.
- Static works: whitenoise served a real collected stylesheet, 200 and the right content type.
/favicon.ico and /locales/ 404: both are nginx URL aliases, and whitenoise does not remap a prefix.
What it would take
Five pieces across four repositories, and none of them is hard on its own.
- whitenoise added to
requirements/requirements.in and compiled in, since it is not a dependency today.
- Routes for
/favicon.ico and /locales/, or a UI change to read the locales from /static/awx/locales.
- The custom error pages moved to Django handlers.
[program:nginx] out of the supervisor template, and the make nginx target with it.- The operator and the three installers, handing the certificate to uvicorn instead of mounting an nginx config.
How I would do it
- Move the locales URL under
/static rather than adding a Django route, since the alias is the only reason it fails.
- Give uvicorn both modes: plain where the ingress terminates, TLS for
passthrough, one or the other in the compose.
Two things I found on the way
- Both nginx configs declare an upstream nothing uses:
runserver in the compose one, uwsgi in the operator's.
- The compose favicon alias points at a path in no branch, unlike the operator's, which is correct.
Do you want this done?
Pull requests
