Automate DDoS‑Resistant Nginx Clusters with Ansible in Minutes

Facing increasingly aggressive DDoS attacks, manual deployment of protection is inefficient. This guide shows how to use Ansible to automatically deploy a Nginx cluster equipped with multi‑layer DDoS defense, achieving rapid, consistent, and observable infrastructure.

Why this solution boosts operational efficiency

❌ Manual Nginx installation on a single server takes excessive time.

❌ Reactive handling of DDoS attacks leads to emergency fixes.

❌ Inconsistent cluster configuration makes troubleshooting difficult.

❌ Slow scaling cannot keep up with business demand.

Solution advantages:

🚀 Deploy 20 Nginx servers in about 5 minutes.

🛡️ Built‑in multi‑layer DDoS protection.

🔧 Standardized configuration, batch management.

📊 Automated monitoring and alerting.

Architecture diagram

┌─────────────────┐
            │   Load Balancer │
            │    (Nginx LB)   │
            └─────────┬───────┘
                      │
        ┌─────────────┼─────────────┐
        │             │             │
┌───────▼───┐  ┌──────▼───┐  ┌───────▼───┐
│ Nginx-01 │  │ Nginx-02 │  │ Nginx-03 │
│ (DDoS)   │  │ (DDoS)   │  │ (DDoS)   │
└──────────┘  └──────────┘  └──────────┘

Environment preparation

Server requirements

# Minimum configuration (double for production)
CPU: 2 cores
Memory: 4GB
Disk: 50GB SSD
Network: 100Mbps

# OS requirements
OS: CentOS 7/8, Ubuntu 18.04/20.04
Python: 3.6+

Required software

# Install Ansible on the control node
curl -fsSL https://get.docker.com | bash
pip3 install ansible

# Verify version
ansible --version

Core Playbook

1. Main playbook file (nginx-cluster-deploy.yml)

# nginx-cluster-deploy.yml
---
- name: Deploy Nginx Cluster with DDoS Protection
  hosts: nginx_servers
  become: yes
  vars:
    nginx_version: "1.20.2"
    max_connections: 1024
    rate_limit: "10r/s"
  roles:
    - common
    - nginx-install
    - ddos-protection
    - monitoring

2. DDoS protection role (roles/ddos-protection/tasks/main.yml)

# roles/ddos-protection/tasks/main.yml
---
- name: Configure rate limiting
  blockinfile:
    path: /etc/nginx/nginx.conf
    marker: "# {mark} ANSIBLE MANAGED - RATE LIMITING"
    insertafter: "http {"
    block: |
      # Limit request rate
      limit_req_zone $binary_remote_addr zone=login:10m rate={{ rate_limit }};
      limit_req_zone $binary_remote_addr zone=api:10m rate=5r/s;

      # Limit connections
      limit_conn_zone $binary_remote_addr zone=conn_limit_per_ip:10m;
      limit_conn_zone $server_name zone=conn_limit_per_server:10m;

- name: Setup DDoS protection rules
  copy:
    dest: /etc/nginx/conf.d/ddos-protection.conf
    content: |
      # DDoS protection configuration
      server {
          client_body_buffer_size 1K;
          client_header_buffer_size 1k;
          client_max_body_size 1k;
          large_client_header_buffers 2 1k;

          client_body_timeout 10;
          client_header_timeout 10;
          keepalive_timeout 5 5;
          send_timeout 10;

          limit_req zone=login burst=5 nodelay;
          limit_conn conn_limit_per_ip 10;
          limit_conn conn_limit_per_server 100;

          if ($http_user_agent ~* "BadBot|Scrapy|HttpClient") {
              return 403;
          }

          allow 192.168.1.0/24;
          # deny all; # use with caution in production
      }

3. Smart load‑balancing configuration (roles/nginx-install/templates/upstream.conf.j2)

# upstream backend_servers {
    # health checks
    {% for host in groups['nginx_servers'] %}
    server {{ hostvars[host]['ansible_default_ipv4']['address'] }}:80 max_fails=3 fail_timeout=30s;
    {% endfor %}

    least_conn;
    keepalive 32;
}

server {
    listen 80;
    server_name {{ domain_name }};

    # Security headers
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        proxy_pass http://backend_servers;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        # Prevent cache poisoning
        proxy_buffering on;
        proxy_buffer_size 128k;
        proxy_buffers 4 256k;
    }

    # Static file caching
    location ~*\.(jpg|jpeg|png|gif|ico|css|js)$ {
        expires 1y;
        add_header Cache-Control "public, immutable";
    }
}

Inventory configuration

# hosts.ini
[nginx_servers]
nginx-01 ansible_host=192.168.1.10
nginx-02 ansible_host=192.168.1.11
nginx-03 ansible_host=192.168.1.12

[nginx_servers:vars]
ansible_user=root
ansible_ssh_private_key_file=~/.ssh/id_rsa

Deployment commands

# Syntax check
ansible-playbook -i hosts.ini nginx-cluster-deploy.yml --syntax-check

# Dry run (recommended)
ansible-playbook -i hosts.ini nginx-cluster-deploy.yml --check

# Actual deployment
ansible-playbook -i hosts.ini nginx-cluster-deploy.yml

# Deploy specific tag
ansible-playbook -i hosts.ini nginx-cluster-deploy.yml --tags "ddos-protection"

Monitoring and alerting

Prometheus node_exporter installation

# roles/monitoring/tasks/main.yml
- name: Install node_exporter
  get_url:
    url: "https://github.com/prometheus/node_exporter/releases/download/v1.3.1/node_exporter-1.3.1.linux-amd64.tar.gz"
    dest: /tmp/node_exporter.tar.gz

- name: Setup Nginx status monitoring
  blockinfile:
    path: /etc/nginx/nginx.conf
    marker: "# {mark} MONITORING"
    block: |
      server {
          listen 8080;
          location /nginx_status {
              stub_status on;
              access_log off;
              allow 127.0.0.1;
              deny all;
          }
      }

Alert rules for DDoS detection

# groups:
- name: ddos_detection
  rules:
  - alert: HighRequestRate
    expr: rate(nginx_http_requests_total[5m]) > 100
    for: 2m
    labels:
      severity: warning
    annotations:
      summary: "Detected unusually high request rate"

  - alert: TooManyConnections
    expr: nginx_connections_active > 1000
    for: 1m
    labels:
      severity: critical
    annotations:
      summary: "Connection count abnormal, possible DDoS attack"

Advanced optimization

1. Dynamic scaling playbook (scale-up.yml)

# scale-up.yml
- name: Dynamic Scale Up Nginx Cluster
  hosts: localhost
  vars:
    new_servers: "{{ new_server_list.split(',') }}"
  tasks:
    - name: Add servers to inventory
      add_host:
        name: "{{ item }}"
        groups: nginx_servers
      loop: "{{ new_servers }}"

    - name: Deploy to new servers
      include: nginx-cluster-deploy.yml

2. Automatic failover script (health-check.sh)

#!/bin/bash
# health-check.sh
for server in $(ansible nginx_servers --list-hosts | grep -v hosts); do
    if ! curl -f http://$server/nginx_status > /dev/null 2>&1; then
        echo "Server $server is down, removing from load balancer"
        ansible-playbook -i hosts.ini remove-server.yml -e "failed_server=$server"
    fi
done

Performance testing

Stress test scripts

# Using ApacheBench
ab -n 10000 -c 100 http://your-domain.com/

# Using wrk for DDoS simulation
wrk -t12 -c400 -d30s --script=ddos-test.lua http://your-domain.com/

# ddos-test.lua example
wrk.method = "POST"
wrk.body = "test=data"
wrk.headers["Content-Type"] = "application/x-www-form-urlencoded"

Expected results

Requests/sec: 5000+ (single node)
Response time: <100ms (99%)
Success rate: 99.9%
DDoS protection: effective interception of malicious requests

Troubleshooting guide

# 1. Ansible connection failure
ansible nginx_servers -m ping
# Check SSH keys and network connectivity

# 2. Nginx start failure
ansible nginx_servers -m shell -a "nginx -t"
# Verify configuration syntax

# 3. Performance diagnosis
ansible nginx_servers -m shell -a "top -bn1 | head -20"
# Check system resource usage

# 4. Log analysis
ansible nginx_servers -m shell -a "tail -100 /var/log/nginx/error.log"

Deployment outcomes

✅ Seconds‑level deployment: 20 servers ready in 5 minutes.

✅ Automatic protection: DDoS attacks blocked with ~99.9% effectiveness.

✅ Intelligent monitoring: Real‑time alerts and automatic fault handling.

✅ Elastic scaling: One‑command expansion of the cluster.

✅ Unified configuration: Identical settings across all nodes.

Future extensions

Containerized deployment : Integrate Docker and Kubernetes.

CI/CD integration : Automate deployment via GitLab pipelines.

Multi‑cloud management : Unified control of AWS, Alibaba Cloud, and Tencent Cloud.

AI‑driven protection : Apply machine‑learning models to identify attack patterns.

Edge computing : Deploy CDN + edge servers for latency‑critical services.

Technical references: GitHub – https://github.com/raymond999999, Gitee – https://gitee.com/raymond9.