Glossary
Every term this software uses, in one sentence each.
44 terms
| Term | What it means |
|---|---|
| Active | The node currently in charge of making changes. Both nodes serve traffic. |
| Agent | The small root program that does the few jobs needing administrator rights, so the web screen does not need them. |
| Allowed surface | A WAF setting that only permits paths your testers actually reached, rather than letting the attack rules decide on their own. |
| Apply | Making your saved changes live on every node at once, after every node has tested them. |
| Backend | One of your application servers, behind the load balancer. |
| Certificate | The file that makes the padlock appear and encrypts traffic between a visitor and the load balancer. |
| Consistent hashing | A way of hashing so that removing one backend moves only its share of visitors rather than nearly everybody. |
| CRS | The OWASP Core Rule Set. The rules the WAF checks requests against. |
| Delegation | Telling the internet that your nodes answer for part of your domain. |
| Draining | A backend state where it finishes what it is doing and takes nothing new. How you retire a server without dropping anybody. |
| EAB | External account binding. The credentials a paid certificate authority gives you so it knows which account, and therefore who to bill. |
| Exclusion | A WAF rule that has been stopped from firing on one specific path, because it was wrong about your application there. |
| Failover | Traffic or responsibility moving to a working node when one fails. |
| Forced standby | A switch that stops a node becoming active without removing it from the fleet. For a machine you are working on. |
| Glue | An address record that lets a nameserver named inside a zone be found at all. |
| GSLB | Global server load balancing. Sending people to a healthy node using DNS. |
| Health check | A regular test of whether a backend is answering properly, run by the manager rather than by nginx. |
| HMAC | A signature made with a shared key, used on every message between nodes. |
| http-01 | The certificate validation method where the authority asks for a file over port 80. |
| dns-01 | The certificate validation method where the authority asks for a DNS record. Needed for wildcards. |
| Let's Encrypt | A service giving out free certificates that renew automatically. |
| Location, or path | A rule for part of a site, such as everything under /api. |
| ML-KEM | The standardized post quantum key encapsulation mechanism, used in the hybrid key exchange this build offers first. |
| ModSecurity | The web application firewall engine. The rules are a separate thing. |
| nginx | The program that actually handles the traffic. This software configures it. |
| Node | One of your load balancer servers. |
| OIDC | OpenID Connect. The protocol used for single sign on. |
| Pool | A named list of backends that a site sends requests to. |
| Profile | A saved set of WAF exclusions that any number of sites can share. |
| Proxy | Passing a request on to another server and returning its answer. |
| Proxy protocol | A short header before the connection data that carries the real client address. Only for backends that expect it. |
| Quorum | More than half the fleet. A node will not make itself active without it. |
| Rate limit | A cap on how many requests one visitor may make in a period. |
| Site | One web address and the rules for it. |
| Slow start | Easing traffic onto a backend that has just come back, so a cold server is not knocked straight down. |
| Standby | A node not currently in charge. It still serves traffic. |
| Staging | Let's Encrypt's practice service. Certificates from it are not trusted by browsers, and the rate limits are far looser. |
| stub_status | nginx's own status endpoint, which gives seven numbers for the whole server. What the dashboard reads. |
| Sticky session | Sending the same visitor back to the same backend every time, using a cookie. |
| Two phase apply | Staging and testing a change on every node before any node commits it. |
| TTL | How long a DNS answer is remembered before being looked up again. |
| Upstream | Another word for a pool, used inside nginx itself. |
| Workload | A machine on the tunnel. One workload is one machine. |
| Zone | Two meanings. A shared memory area for rate limits and caches, and a part of your domain in DNS failover. |