Embedded nginx does not support http2

[123dev]

Hi,

It appears that the embedded nginx in version 2.1.1 of AWS does not support http2

/opt/graylog/conf/nginx$ /opt/graylog/embedded/sbin/nginx -V
nginx version: nginx/1.9.14
built by gcc 4.8.4 (Ubuntu 4.8.4-2ubuntu1~14.04.3)
built with OpenSSL 1.0.1t  3 May 2016
TLS SNI support enabled
configure arguments: --prefix=/opt/graylog/embedded --conf-path=/opt/graylog/conf/nginx/nginx.conf --http-log-path=/var/log/graylog/nginx/access.log --error-log-path=/var/log/graylog/nginx/error.log --with-http_ssl_module --with-http_stub_status_module --with-ipv6 --with-debug --with-ld-opt=-L/opt/graylog/embedded/lib --with-cc-opt='-L/opt/graylog/embedded/lib -I/opt/graylog/embedded/include'

seems to be missing --with-http_v2_module

/opt/graylog/conf/nginx$ sudo /opt/graylog/embedded/sbin/nginx -t
nginx: [emerg] the "http2" parameter requires ngx_http_v2_module in /opt/graylog/conf/nginx/nginx.conf:24
nginx: configuration file /opt/graylog/conf/nginx/nginx.conf test failed
ubuntu@graylog-server1:/opt/graylog/conf/nginx$ sudo vi nginx.conf

and if we add the http2 option, it fails.

Any reason why this is left out?
Would be nice to add if possible.

Thanks

[mariussturm]

Hi,
no special reason for leaving it out. It's simply a pretty new protocol and not enabled by default.
What's the use-case, why do you need that? Once it's enabled we have to maintaine possible problems or incompatibilities. So is it really worth it or is it just for the fun of it?

[123dev]

Definitely not for fun of it.
I'm sure you're well aware of the benefits of http2 so no need to rehash.

I'm kind of surprised that you would think that it would be for the fun of it.
Perhaps you know for a fact that the way Graylog is designed, having http2 wouldn't improve the user experience, either because Graylog is already highly optimized that none of those improvements would matter, or because Graylog would bog it down regardless of http2.

[joschi]

@123dev The sources for the OVA are open: https://github.com/Graylog2/omnibus-graylog2

Feel free to provide a pull request to compile nginx with HTTP/2 support.

[mariussturm]

@123dev the problem is that when you enable http/2 for the nginx instance, it's only between your browser and nginx. The connection between nginx and Graylog (the Java process) is still http. So the benefits of http/2 are pretty limited in such a setup.

Until Graylog itself is supporting http/2 I dont see good reasons for investing time into this. Thats why I asked for your special use-case. Maybe there is something in your environment I don't know of. But obviously thats not the case.

Like @joschi said, if you still feel the need of having this prematurely, we are happy the review your PR.

[123dev]

Thanks for the comments gentlemen.
I agree that enabling http2 in nginx does not provide full end to end benefits of http2, without graylog server side code change to provide the full benefits.
Yes server push (which is not a magic bullet) won't be available.
However one would think that, such features as "True multiplexing", "Single persistent connection", "Binary encoding" ... would provide immediate benefits at practically no cost by just including a module in nginx.

Sorry to hear that you think otherwise, and I mean no disrespect, I understand that it's a tough balancing act to decide what to invest your efforts on.
We switched ELB to ALB and are now getting that partially. Though it would have been preferable if the communication between ALB and nginx was http2.

Thanks again.

[malcyon]

Hello,

It's just me replying to old tickets.

@mariussturm Did we used to install our own bundled nginx onto the OVA? When I look at the install scripts, it looks like we just install the default package from the Ubuntu repo:

https://github.com/Graylog2/graylog2-images/blob/4.0/packer/scripts/install_ami.sh#L47-L48
https://github.com/Graylog2/graylog2-images/blob/4.0/packer/scripts/install_ova.sh#L47-L48

And when I install the OVA and run nginx -V, it does have the --with-http_v2_module set. So users that want to use this would just have to update the nginx.conf.