Blog
Mert Özen's blog posts on software development, backend, frontend, and DevOps.
HTTPS, Security Headers, Rate Limiting and Load Balancing in Nginx
With real runs: TLS termination in Nginx, HTTP/3 with http2 on and listen quic, security headers that don't disappear thanks to add_header_inherit merge, HSTS from a single place, 429s with limit_req, and round robin spreading unevenly without an upstream zone. ip_hash, the sticky cookie that came with 1.29.6 and passive health checks with max_fails: when an instance dies the client sees no error, but non-idempotent requests and unhealthy yet running processes need separate handling.
Load Balancing: L4 vs L7, Algorithms, Health Checks and Sticky Sessions
A load balancer's algorithm decides the latency users see when one instance slows down: in a real YARP experiment round robin pushes p99 to 4.6 seconds, while LeastRequests and power of two choices cut traffic to the slow instance by themselves and keep p99 at 300 ms. Only a health check removes a crashed instance (133 errors down to 35); the post also covers L4 vs L7, the cost of sticky sessions, connection draining and global load balancing with GeoDNS and anycast.