8.9 The safe change workflow

By Ravindra Bagale Last updated: 18 October 2026

Pay attention – this habit is exactly the difference between a professional and a beginner:

sudo cp site.conf site.conf.bak                  # 1. backup (name must not end in .conf)
sudo nano /etc/nginx/conf.d/site.conf            # 2. edit
sudo nginx -t                                    # 3. test syntax
sudo service nginx reload                        # 4. reload (no downtime)
curl -I -H "Host: example.com" http://localhost  # 5. verify from inside
sudo tail -n 20 /var/log/nginx/error.log         # 6. check the log

For Apache, replace step 3 with sudo apachectl configtest (Ubuntu: sudo apache2ctl configtest) and step 4 with sudo service httpd reload (Ubuntu: sudo service apache2 reload). If something breaks, copy the .bak back, test and reload. You'll be online again in seconds.

reload vs restart

reload re-reads the configuration while keeping existing connections, and refuses to apply a broken config. restart stops everything first. Use restart only when a module or port change needs it, or when reload doesn't pick up a change.

Ravindra Bagale's Tip

Many students take a .bak but then edit the .bak file by mistake, and say "the change doesn't show". Check in sudo nginx -T which file is really loaded. And always test first, then reload – not restart.

Ravindra Bagale's Tip – मराठी

खूप students .bak घेतात पण edit चुकून .bak file मध्येच करतात, आणि मग "बदल दिसत नाही" म्हणतात. sudo nginx -T मध्ये खरंच कोणती file load आहे ते बघा. आणि नेहमी आधी test, मग reload – restart नाही.

Ravindra Bagale's Tip – हिंदी

बहुत students .bak लेते हैं पर edit गलती से .bak file में ही करते हैं, और फिर कहते हैं "बदलाव दिख नहीं रहा". sudo nginx -T में देखो कि सच में कौन सी file load है. और हमेशा पहले test, फिर reload – restart नहीं.

Lab

Chala, ha saha-step workflow Amul-style dairy chya site file var purna kara: backup, nano ne ek comment add kara, sudo nginx -t, sudo service nginx reload, curl -I http://localhost, aani error log. Pratyek step cha output thodkyat liha.

Why this workflow matters

Most outages are caused by changes. A safe workflow turns a risky edit into a boring one. The six steps above work for any server.

If any step fails, copy the backup back, test and reload. You are online again in seconds.

The same workflow on other servers

The idea never changes: back up, edit, test, apply gently, verify.

Tomcat

Back up server.xml, edit it, then restart (Tomcat has no config test). Watch catalina.out.

sudo cp conf/server.xml conf/server.xml.bak
sudo systemctl restart tomcat
sudo tail -f logs/catalina.out

What you see:

INFO [main] org.apache.catalina.startup.Catalina.start Server startup in [2345] milliseconds

PHP-FPM

Test the pool config before reloading.

sudo php-fpm -t && sudo systemctl reload php-fpm

What you see:

configuration file /etc/php-fpm.conf test is successful

Gunicorn (Python)

Graceful reload with HUP keeps workers serving.

sudo systemctl reload gunicorn

What you see:

(workers restarted one by one)

Node.js / PM2

Zero-downtime reload in cluster mode.

pm2 reload app

What you see:

[PM2] [app](0) ✓

ASP.NET Core (Kestrel)

Validate appsettings.json in CI. Restart the systemd unit, then curl the health endpoint.

sudo systemctl restart api && curl -s localhost:5000/health

What you see:

Healthy

MySQL / PostgreSQL config

Back up my.cnf or postgresql.conf. PostgreSQL can reload many settings without a restart.

sudo -u postgres psql -c "SELECT pg_reload_conf();"

What you see:

 pg_reload_conf
----------------
 t

AWS / Azure / GCP

Infrastructure as code with a plan step is the same habit: terraform plan before apply.

terraform plan

What you see:

Plan: 0 to add, 1 to change, 0 to destroy.

Summary

Server	Test	Gentle apply
nginx	nginx -t	reload
Apache	configtest	reload (graceful)
PHP-FPM	php-fpm -t	reload
Gunicorn	—	HUP reload
PM2	—	pm2 reload
PostgreSQL	—	pg_reload_conf()
Terraform	plan	apply

Real examples

Global: large outages have been traced back to a configuration change pushed widely without staged rollout. Cloud providers' public post-incident reviews often list "config change" as the trigger. Indian company (sample): a Zomato-style team requires every nginx change to go through a pull request, where CI runs nginx -t inside a container. Everyday: you save a copy of a document before making big edits.

Recap

Back up, edit, test, reload, verify, read logs.
Every server has its own "test" and "gentle apply".