1

We are currently using nginx but we need to proxy upstream to haproxy using HTTP 1.1, which nginx's proxy module does not support.

Is there an reliable, event-driven alternative to nginx that supports HTTP 1.1, SSL, and client-side keep-alive?

Improve this question
1

3 Answers 3

Reset to default
1

Do you really need http/1.1 on the server side or do you want keep-alive ? 1.1 does not bring much, basically only the chunked encoding and "expect: 100-continue". Chunked encoding is nice when the server compresses but that's not often the case. Now if you think you need keep-alive, just consider the network latency between your nginx and haproxy. If both are on the same LAN, you really don't need keep-alive at all, as the cost of establishing a connection is extremely small. Many people chain nginx and haproxy together without any issue, so I think that you could really keep your nginx.

Alternatively, you could use stunnel in front of haproxy to handle SSL only. You'd then get client-side keep-alive and HTTP/1.1 directly from haproxy.

Improve this answer
7
  • We are thinking of using stunnel. Why is chunked encoding only good when the server compresses?
    – user41356
    Feb 18, 2011 at 6:15
  • @Willy Our goal is to use chunked encoding.
    – user41356
    Feb 18, 2011 at 6:22
  • -1 for "1.1 does not bring much" (I'd mark it down more if I could!)
    – symcbean
    Feb 18, 2011 at 13:51
  • @user41356: I've not said chunked encoding is only good when the server compresses, but that in this situation it's particularly useful. It has other uses but they are less common.
    – Willy Tarreau
    Feb 22, 2011 at 5:38
  • 1
    @Willy - presumably you are using nginx for performance reasons - HTTP/1.1 adds the 'Cache-Control', 'Varies', lots of changes to conditional requests, improved compression. Then there's also the functional stuff - better handling of content encoding, a formal definition of how to handle redirects....its all in the spec.
    – symcbean
    Feb 22, 2011 at 11:49
1

Thanks to Microsoft's non-standard implementation of SSL (have a google for 'Microsoft SSL close-notify') Keep-alive and SSL are not a happy mix when using a MSIE browser. But there are some indications that MS may be getting better in more recent versions.

In the case of mod_ssl, you can configure different behaviours based on the user-agent. This needs to be done at the place where the SSL is terminated - since it needs to decode the SSL to find the user-agent - then decide whether or not to allow the keep-alive. Since stunnel knows nothing about HTTP, you can't allow for this on the proxy.

So you could try just dropping in stunnel (but it won't do any caching) and hope for the best (keep-alives are configured on the webserver).

Without researching it more, it doesn't make a lot of sense to me to have keep-alives enabled using a non-cacheing proxy and to run the servers behind ha-proxy - all the latter will do is basic load-balancing - you're undermining the failover.

While the advice in HTTP/1.1 was to limit the number of connections per server name to 2, most browser developers have cottoned on to the fact that this does nothing to limit the load on servers - the only effect is to slow down the client by forcing serial requests. So there's less reason to use keep-alive than formerly.

So if you want selective control over keep-alive, then I think the only option would be apache + mod_ssl + mod_proxy

Improve this answer
0

You can try varnish or maybe pound.

Improve this answer
1
  • varnish doesn't support SSL
    – Robert Zaremba
    Jan 3, 2013 at 15:30

You must log in to answer this question.

Not the answer you're looking for? Browse other questions tagged .