Hacker News Reader

Comment by foxfluff | Hacker News Reader

Gunicorn does support https. They still seem to recommend using a different server in front of it.

Here’s why according to their docs:

> Although there are many HTTP proxies available, we strongly advise that you use Nginx. If you choose another proxy server you need to make sure that it buffers slow clients when you use default Gunicorn workers. Without this buffering Gunicorn will be easily susceptible to denial-of-service attacks.

https://docs.gunicorn.org/en/stable/deploy.html

I think it depends on how your whole stack looks. If you are running on a PAAS such as Heroku, have load balancers or are even using something like ClourFlare I don’t this it’s necessary to have something in front of Gunicorn.

I wouldn’t leave Gunicorn “naked” for want of a better word, or use it for static files though.

If you put Apache or Nginx in front of it, why not leave out Gunicorn completely?

Apache has mod_wsgi, nginx not so much.

mod_wsgi is a much less flexible setup when it comes to mixing and matching different python versions

Python has an interface called WSGI (web server gateway interface), with both Apache and Nginx you need either a none standard module for that interface or to reverse proxy to a second server that does.

So same number of moving parts either way.

How is libapache2-mod-wsgi-py3 "none standard"?

I meant it’s not built in as standard when you install apache, it’s an extra thing to install (even if it runs in process).

Gunicorn is not just a static content server (actually I don’t think it can serve static content out of the box?) but a wsgi-compliant application server. You can’t leave it out because then, how would your python web backend run?

For apache, there is libapache2-mod-wsgi-py3

Seems easier to just "apt install libapache2-mod-wsgi-py3" and put a "WSGIScriptAlias" directive into your apache config than to run another piece of software?

Reply on news.ycombinator.com