Node.js in Production

Re:Node.js in Production by yid on Tuesday June 03, 2014 @02:09PM (#7841810)

> Another Note: This runs on port 3000. Making it run on port 80 would be possible using a reverse proxy (such as nginx), but for this setup we will actually run the app servers on port 3000 and the load balancer (on a different server) will run on port 80.

This comes up a lot. In addition to the reverse proxy, you can also:

-- redirect port 80 to port 3000

  iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3000

-- use authbind to grant port 80 access to an unprivileged user http://manpages.ubuntu.com/manpages/hardy/man1/authbind.1.ht...

[ Parent | on HN ]

Re:Node.js in Production by nmjohn on Tuesday June 03, 2014 @03:25PM (#7842220)

I can see how this is useful if you are using a single node.js server as you wouldn't need any proxy in front of it.

However if you are using a load balancer in front of a handful of node.js app servers, does this offer any advantage over just using an arbitrary port > 1024?

[ Parent | on HN ]

Re:Node.js in Production by yid on Tuesday June 03, 2014 @03:52PM (#7842342)

> However if you are using a load balancer in front of a handful of node.js app servers, does this offer any advantage over just using an arbitrary port > 1024

Nope. It's only useful if you're using a single server, e.g. on a $5 DigitalOcean droplet.

[ Parent | on HN ]

Re:Node.js in Production by SkyMarshal on Tuesday June 03, 2014 @03:25PM (#7842219)

Which is a better security setup, reverse proxying port 80 to 3000 via a stripped, hardened nginx/apache on 80, or connecting your unpriviledged app directly to port 80 via iptables or authbind?

[ Parent | on HN ]

Re:Node.js in Production by yid on Tuesday June 03, 2014 @03:51PM (#7842337)

Port 80 is not some magical port, it's just privileged by convention. Routing iptables from port 80 to 3000 does not hurt nor improve your security situation in the least.

[ Parent | on HN ]

Re:Node.js in Production by dickeytk on Tuesday June 03, 2014 @02:27PM (#7841923)

great tip, I'll add this in

[ Parent | on HN ]