Tune an NGINX static file server for performance

NGINX file server configuration

You’ll now review a tuned file server configuration based on the configuration in the set up a static file server section of the Learn how to deploy NGINX Learning Path.

Use this example configuration as a starting point, then size each directive for your workload and validate the result with repeatable measurements.

Top-level nginx.conf

The following is a tuned top-level configuration file (/etc/nginx/nginx.conf):

    

        
        
user www-data;
worker_processes auto;
worker_rlimit_nofile 1000000;
pid /run/nginx.pid;

events {
  worker_connections 512;
}

http {
  ##
  # Basic Settings
  ##
  sendfile on;
  tcp_nopush on;
  keepalive_timeout 75;
  keepalive_requests 1000000000;

  include /etc/nginx/mime.types;
  default_type application/octet-stream;

  ##
  # Logging Settings
  ##
  access_log off;
  error_log /var/log/nginx/error.log;

  ##
  # Virtual Host Configs
  ##
  include /etc/nginx/conf.d/*.conf;
}

    

The full NGINX directive index and variable index are useful references when you tune configuration files.

The following are performance-relevant directives:

• worker_processes : Selects how many worker processes NGINX starts. auto starts one worker process per available CPU, which is a good starting point for most deployments.

• worker_rlimit_nofile : Selects the maximum number of files that can be opened by NGINX worker processes. If your deployment needs to sustain a large number of open connections, this should be set relatively high.

  If this value is too low, connections can fail or be rejected. That said, 1000000 is likely excessive for many deployments.

  This directive changes the open-file limit for NGINX worker processes, so you can raise the worker limit without relying on a separate ulimit setting in the service startup environment.

• worker_connections : Selects the number of simultaneous worker connections that can be opened by a worker process.

  The default is 512, so this directive can be removed from the example configuration. It’s shown here because deployments that need to sustain a large number of connections might also need a higher worker_connections value.

• sendfile : Allows NGINX to copy data from one file descriptor to another without copying the data into a user-space buffer first, which can improve static file serving performance.

• tcp_nopush : Delays packet sending so NGINX can send response headers and file data together when sendfile is enabled, which can improve static file serving efficiency.

• keepalive_timeout : The default is 75s, so this directive can be removed from the example configuration. Increase this value only when your deployment needs to hold idle keepalive connections open for longer.

• keepalive_requests : Sets the number of requests that can be served through a single connection before it’s closed by NGINX.

  The default is 1000, which can be too small for some use cases. If individual clients make many requests over a single connection, increasing this value can reduce connection reestablishment overhead.

  Avoid setting this higher than needed. NGINX closes keepalive connections periodically to free per-connection memory, so very high values can increase memory use.

• access_log : Access logging can add significant write overhead in high-request-rate workloads. If you need access logs, consider buffering them instead of turning logging off.

• error_log : Error logging usually has little performance impact unless NGINX is writing frequent messages. If errors are reported, fix them.

File server configuration

The following is a tuned file server configuration file (/etc/nginx/conf.d/fileserver.conf):

    

        
        
# HTTPS file server
server {
  listen 443 ssl reuseport backlog=65535;
  root /usr/share/nginx/html;
  index index.html index.htm;
  server_name $hostname;

  open_file_cache max=1000;

  ssl_certificate /etc/nginx/ssl/ecdsa.crt;
  ssl_certificate_key /etc/nginx/ssl/ecdsa.key;
  ssl_ciphers ECDHE-ECDSA-AES256-GCM-SHA384;

  location / {
    limit_except GET {
      deny all;
    }
    try_files $uri $uri/ =404;
  }
}

    

The following are performance-relevant directives:

• listen : Selects the port and protocol of the file server. reuseport allows NGINX to distribute incoming connections across worker processes. backlog sets the maximum length of the pending connection queue. Align it with net.core.somaxconn, and keep it at least 512.

• open_file_cache : Configures a cache that stores information about open file descriptors. It can improve performance when NGINX serves a repeated set of files.

• ssl_ciphers : The cipher suite used for HTTPS can greatly impact performance. It’s important to understand both the security and performance implications of the chosen cipher suite.

  The TLS library used by NGINX and how it was built can also affect cipher performance. For more information, see the Kernel, compiler, and libraries section of this Learning Path.

• server_name and try_files : The example uses NGINX variables such as $hostname and $uri. For a full list of built-in variables, see the NGINX variable index .

What you’ve learned and what’s next

You’ve now reviewed optimizable top-level and static file server directives that affect worker limits, keepalive behavior, file serving, logging, and TLS choices.

Next, you’ll apply the same top-level NGINX settings to a reverse proxy and API gateway configuration, and review directives specific to such workloads.