Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

Let's say I have 3 different applications that all do HTTPS. Not all of them are high traffic so I run all 3 on the same "pool" of 3 EC2 instances.

domain1.com/domain2.com/domain3.com all have their A records pointing to Amazon ELB, which forwards :443 and :80 to nginx:80 on all three servers (so yes, ELB does the SSL termination). Because ELB is doing the SSL termination, I have three different ELBs instead of just one. So basically:

              domain1.com  domain2.com  domain3.com
                  |             |            |
                  |             |            |
                  V             V            V
                 ELB1          ELB2        ELB3
                  \             |             /
                   \            |            /
                    \           |           /
                     \          |          /
                      \         |         /
                       \        |        /
                        \_______|_______/
                                |
                                |
                                V
                   ---------------------------
                   nginx      nginx      nginx
                     |          |          |
                     V          V          V
                  php-fpm    php-fpm    php-fpm

Each of the three instances runs both nginx and php-fpm. That way when the load is too high, we just boot up another instance from the same machine image and it just joins the pool. The instances themselves are configured so nginx only connects to php-fpm running on localhost.

I don't know if this is the correct way to be solving this scenario.

  • Should I move SSL termination down to nginx so that I don't need n number of ELBs as HTTPS certificates? How would that affect the cpu utilization?
  • Should I be using a single nginx machine that connects to multiple php-fpm backends? Then I need to worry about scaling two different roles instead of just one.
  • How does this change if I want to start up instances in other regions, for example?

I hope this question is not inappropriate for SF.

share|improve this question
    
How'd you go with this? –  Drew Khoury Oct 14 '13 at 6:57
    
Are any of these answers suitable or did you solve your problem another way? –  Drew Khoury Feb 15 at 4:23
    
Aw, crud. I missed these, sorry. Will answer in detail soon. –  Vic Feb 16 at 18:41
add comment

3 Answers

You could run something like this:

          domain1.com  domain2.com  domain3.com
              \             |             /
               \            |            /
                \           |           /
                 \          |          /
                  \         |         /
                   \        |        /
                    \_______|_______/
                            |
ngix (static pages from local storage, 3 IP addresses, SSL termination)
                            |
                            |
                       ELB (optional)
                            |
                            |
                 -----------------------
                 |          |          |
                 V          V          V
                php        php        php
  • It would be a little bit cheaper, as 1 EC2 reserved small instance + 1 ELB is cheaper than 3 ELB.

  • You could be even cheaper if you could ditch ELB and just use normal DNS round robin (but you'll loose some ELB features like automatic failover).

  • Latency on serving static pages would not be affected by load on php-serving instances.

  • PHP serving would not compete for RAM with static pages OS cache.

  • You could even use apache mod_php instead of php-fpm is you don't need user separation between processes - it should be somewhat faster.

  • It would be cheaper to add more pages to serve (add one more IP instead of one more ELB).

But it also has some drawbacks:

  • You'd have have one more single point of failure (ngix server).

  • More complicated setup.

share|improve this answer
add comment

Should I move SSL termination down to nginx so that I don't need n number of ELBs as HTTPS certificates? How would that affect the cpu utilization?

you could use 1 ELB (or 2, in an active-standby-scenario) if you could make sure that ALL of you visitors are using SNI-aware browsers (see this doc about issues with SNI, e.g., with Windows XP, Android 2.x etc) otherwise you'll need 1 public IP for each ssl-certificate.

i dont know if it is possible to order and use more than 1 IP per EC2-instance; if so, you could simply route that IPs onto your single ssl-offloader/loadbalancer, avoiding the SNI-problem.

Should I be using a single nginx machine that connects to multiple php-fpm backends? Then I need to worry about scaling two different roles instead of just one.

you could, but this really depends on what you are using nginx for; if it is just dump proxy_pass, then centralization might be ok and you could simplify your setup a lot by reducing some layers. but this can only be answered when actually looking at your live-setup.

share|improve this answer
add comment

Should I move SSL termination down to nginx so that I don't need n number of ELBs as HTTPS certificates? How would that affect the cpu utilization?

ELBs are an added expense, (something like $20 per month, plus data) so you should take this into consideration. What features are you using? If you're just after SSL termination you could probably just offload that onto your web/app servers.

If you're getting benefit out of the load balancing and scale features (along with zero maintenance) then you might consider it a worthwhile investment.

1 ELB per domain might be costly for 100 sites, but for only 3 sites it's probably a nice thing to not have to worry about the maintenance overhead.

Should I be using a single nginx machine that connects to multiple php-fpm backends? Then I need to worry about scaling two different roles instead of just one.

Are you proposing this instead of the ELBs or in addition to them? Separation of web servers and app servers to have benefits, as it can be handy to scale independently. This of course adds another maintenance overhead that might not be worth it for 3 sites (that aren't often under heavy load). I wouldn't suggest rushing down this path until you know you're going to need it.

How does this change if I want to start up instances in other regions, for example?

Here's one example of EC2s in multiple regions, using ELB & Route53 in a failover scenario.

http://aws.amazon.com/elasticloadbalancing/

Using Route 53 DNS failover, you can run applications in multiple AWS regions and designate alternate load balancers for failover across regions. In the event that your application is unresponsive, Route 53 will remove the unavailable load balancer endpoint from service and direct traffic to an alternate load balancer in another region.

share|improve this answer
add comment

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.