Anyone know what the diffs are between the last STABLE release (1.0.15) and 1.2.0? If you're in production, isn't that the path you'd be following?

Surprisingly I can't seem to find that info.

Unfortunately these changes aren't summarized. The differences are all the 'feature' bullets in the changes webpage from 1.1.0 to 1.2.0. I've assembled these below:

  - the $connection_requests variable.
  - $tcpinfo_rtt, $tcpinfo_rttvar, $tcpinfo_snd_cwnd and $tcpinfo_rcv_space variables.  
  - the "worker_cpu_affinity" directive now works on FreeBSD.
  - the "xslt_param" and "xslt_string_param" directives.  Thanks to Samuel Behan.  
  - the "from" parameter of the "disable_symlinks" directive.
  - the "return" and "error_page" directives can now be used to return 307 redirections.  
  - the "disable_symlinks" directive.
  - the "proxy_cookie_domain" and "proxy_cookie_path" directives.  
  - multiple "limit_req" limits may be used simultaneously.
  - the "TLSv1.1" and "TLSv1.2" parameters of the "ssl_protocols" directive.  
  - the "proxy/fastcgi/scgi/uwsgi_cache_lock", "proxy/fastcgi/scgi/uwsgi_cache_lock_timeout" directives.  
  - the "pcre_jit" directive.
  - the "if" SSI command supports captures in regular expressions.  
  - the "so_keepalive" parameter of the "listen" directive.  Thanks to Vsevolod Stakhov.  
  - the "if_not_empty" parameter of the "fastcgi/scgi/uwsgi_param" directives.  
  - the $https variable.
  - the "proxy_redirect" directive supports variables in the first parameter.
  - the "proxy_redirect" directive supports regular expressions.  
  - the "valid" parameter of the "resolver" directive. By default TTL returned by a DNS server is used.
  - support for multiple "limit_conn" limits on the same level.  
  - the "image_filter_sharpen" directive.  
  - support of several DNS servers in the "resolver" directive.  Thanks to Kirill A. Korinskiy.
  - "proxy/fastcgi/scgi/uwsgi_ignore_headers" directives support the following additional values: X-Accel-Limit-Rate,
  - decrease of memory consumption if SSL is used.  
  - the "uwsgi_buffering" and "scgi_buffering" directives.  Thanks to Peter Smit.
  - the ngx_http_upstream_keepalive module.  
  - the "proxy_http_version" directive.  
  - the "fastcgi_keep_conn" directive.  
  - the "worker_aio_requests" directive.  
  - the module ngx_http_mp4_module.  
  - the "max_ranges" directive.  
  - now shared zones and caches use POSIX semaphores on Solaris.  Thanks to Den Ivanov.
  - accept filters are now supported on NetBSD.  
  - cache loader run time decrease.  
  - "loader_files", "loader_sleep", and "loader_threshold" options of the "proxy/fastcgi/scgi/uwsgi_cache_path" directives.
  - loading time decrease of configuration with large number of HTTPS sites.
  - now nginx supports ECDHE key exchange ciphers.  Thanks to Adrian Kotelba.
  - the "lingering_close" directive.  Thanks to Maxim Dounin.

This isn't quite accurate. Some of these features are in the 1.0.x releases too.

Also, I think there are bugfixes (and maybe security patches?) in 1.2.x that weren't in 1.0.x.

I'm just surprised that there isn't a coalesced list of changes for going from stable->stable release.

If I was in wide production, I'd want more guidance on what changed, and when I should be upgrading.

You're right; it looks like a few of these features like the max range directive were also included in 1.0.

Bug fixes and security patches are applied to both stable and dev branches. Some of the recent buffer overflow patches only affect features added in 1.1.

Hopefully future changelogs can be more comprehensive and usable now that nginx has venture funding.

Interesting--does the above-mentioned feature mean that nginx can finally be put in front of a websocket server (e.g., socket.io)?

I'm not sure if understanding HTTP/1.1 is enough to bridge a websocket connection between client and backend websocket server. However, there is a 3rd party tcp proxy module for nginx that allows proxying websockets:

https://github.com/yaoweibin/nginx_tcp_proxy_module

WebSockets aren't HTTP — fake header is not enough to fool HTTP-compliant servers/proxies. You could try HTTPS WebSockets with TLS 1.1 SNI vhosts.

I recommend using Server-Sent Events instead. You get nearly same API for realtime server->client push, and they're HTTP-compatible:

http://html5doctor.com/server-sent-events/ http://speakerdeck.com/u/pornel/p/server-sent-events

If you use TCP proxying, you have no way to react on HTTP headers. So either your Websocket server runs on a different port or interface or you have to proxy _all_ traffic on that port to your websocket backend.

This is fantastic, I was just talking about this on HN a few days ago: http://news.ycombinator.com/reply?id=3865966&whence=thre...

I think it's capable of doing this, but I read that you have to disable the http proxy cache or something similar.

edit: that's for version 1.0.X though, not sure about 1.1