Nginx sucks at SSL, here's what to do instead

Re:Nginx sucks at SSL, here's what to do instead by jamwt on Monday July 11, 2011 @04:20PM (#2752337)

I'm reading over Matt's work carefully, but my initial inclination is not to merge the bulk of this into stud mainline. I'd rather keep stud simple and protocol-naive and have HAProxy do the HTTP work.

[ Parent | on HN ]

Re:Nginx sucks at SSL, here's what to do instead by jamwt on Monday July 11, 2011 @04:36PM (#2752414)

Which is to say indirectly that I think the right answer is for nginx (and daemons generally) to support the PROXY protocol, or some other agreed-upon standard for a naive upstream proxy to indicate host/port information.

[ Parent | on HN ]

Re:Nginx sucks at SSL, here's what to do instead by sciurus on Monday July 11, 2011 @10:30PM (#2753299)

Could someone link to a description of the PROXY protocol?

[ Parent | on HN ]

Re:Nginx sucks at SSL, here's what to do instead by stock_toaster on Tuesday July 19, 2011 @10:40PM (#2784081)

http://haproxy.1wt.eu/download/1.5/doc/proxy-protocol.txt

[ Parent | on HN ]

Re:Nginx sucks at SSL, here's what to do instead by stock_toaster on Monday July 11, 2011 @07:15PM (#2752871)

I really agree with this. I think keeping stud as simple as possible is a great goal.

[ Parent | on HN ]

Re:Nginx sucks at SSL, here's what to do instead by seiji on Monday July 11, 2011 @06:41PM (#2752791)

I'm reading over Matt's work carefully

Thanks for the consideration!

initial inclination is not to merge the bulk of this into stud mainline

I agree. The HTTP stuff is still too integrated. ifdefs are ugly.

The solution is to do what showed up when I was 99% done working on XFF -- the nice PROXY protocol addition. We just need to get PROXY support into nginx now to obviate my XFF machinations.

[ Parent | on HN ]