Take the 2-minute tour ×
Server Fault is a question and answer site for professional system and network administrators. It's 100% free, no registration required.

We are currently using nginx but we need to proxy upstream to haproxy using HTTP 1.1, which nginx's proxy module does not support.

Is there an reliable, event-driven alternative to nginx that supports HTTP 1.1, SSL, and client-side keep-alive?

share|improve this question
    
In the meantime, nginx has added support for all these features‌​. This question is moot. –  Dan Dascalescu Feb 11 '13 at 9:08

3 Answers 3

You can try varnish or maybe pound.

share|improve this answer
    
varnish doesn't support SSL –  Robert Zaremba Jan 3 '13 at 15:30

Thanks to Microsoft's non-standard implementation of SSL (have a google for 'Microsoft SSL close-notify') Keep-alive and SSL are not a happy mix when using a MSIE browser. But there are some indications that MS may be getting better in more recent versions.

In the case of mod_ssl, you can configure different behaviours based on the user-agent. This needs to be done at the place where the SSL is terminated - since it needs to decode the SSL to find the user-agent - then decide whether or not to allow the keep-alive. Since stunnel knows nothing about HTTP, you can't allow for this on the proxy.

So you could try just dropping in stunnel (but it won't do any caching) and hope for the best (keep-alives are configured on the webserver).

Without researching it more, it doesn't make a lot of sense to me to have keep-alives enabled using a non-cacheing proxy and to run the servers behind ha-proxy - all the latter will do is basic load-balancing - you're undermining the failover.

While the advice in HTTP/1.1 was to limit the number of connections per server name to 2, most browser developers have cottoned on to the fact that this does nothing to limit the load on servers - the only effect is to slow down the client by forcing serial requests. So there's less reason to use keep-alive than formerly.

So if you want selective control over keep-alive, then I think the only option would be apache + mod_ssl + mod_proxy

share|improve this answer

Do you really need http/1.1 on the server side or do you want keep-alive ? 1.1 does not bring much, basically only the chunked encoding and "expect: 100-continue". Chunked encoding is nice when the server compresses but that's not often the case. Now if you think you need keep-alive, just consider the network latency between your nginx and haproxy. If both are on the same LAN, you really don't need keep-alive at all, as the cost of establishing a connection is extremely small. Many people chain nginx and haproxy together without any issue, so I think that you could really keep your nginx.

Alternatively, you could use stunnel in front of haproxy to handle SSL only. You'd then get client-side keep-alive and HTTP/1.1 directly from haproxy.

share|improve this answer
    
We are thinking of using stunnel. Why is chunked encoding only good when the server compresses? –  user41356 Feb 18 '11 at 6:15
    
@Willy Our goal is to use chunked encoding. –  user41356 Feb 18 '11 at 6:22
    
-1 for "1.1 does not bring much" (I'd mark it down more if I could!) –  symcbean Feb 18 '11 at 13:51
    
@user41356: I've not said chunked encoding is only good when the server compresses, but that in this situation it's particularly useful. It has other uses but they are less common. –  Willy Tarreau Feb 22 '11 at 5:38
1  
@Willy - presumably you are using nginx for performance reasons - HTTP/1.1 adds the 'Cache-Control', 'Varies', lots of changes to conditional requests, improved compression. Then there's also the functional stuff - better handling of content encoding, a formal definition of how to handle redirects....its all in the spec. –  symcbean Feb 22 '11 at 11:49

Your Answer

 
discard

By posting your answer, you agree to the privacy policy and terms of service.

Not the answer you're looking for? Browse other questions tagged or ask your own question.