We are currently using nginx but we need to proxy upstream to haproxy using HTTP 1.1, which nginx's proxy module does not support.
Is there an reliable, event-driven alternative to nginx that supports HTTP 1.1, SSL, and client-side keep-alive?
Thanks to Microsoft's non-standard implementation of SSL (have a google for 'Microsoft SSL close-notify') Keep-alive and SSL are not a happy mix when using a MSIE browser. But there are some indications that MS may be getting better in more recent versions.
In the case of mod_ssl, you can configure different behaviours based on the user-agent. This needs to be done at the place where the SSL is terminated - since it needs to decode the SSL to find the user-agent - then decide whether or not to allow the keep-alive. Since stunnel knows nothing about HTTP, you can't allow for this on the proxy.
So you could try just dropping in stunnel (but it won't do any caching) and hope for the best (keep-alives are configured on the webserver).
Without researching it more, it doesn't make a lot of sense to me to have keep-alives enabled using a non-cacheing proxy and to run the servers behind ha-proxy - all the latter will do is basic load-balancing - you're undermining the failover.
While the advice in HTTP/1.1 was to limit the number of connections per server name to 2, most browser developers have cottoned on to the fact that this does nothing to limit the load on servers - the only effect is to slow down the client by forcing serial requests. So there's less reason to use keep-alive than formerly.
So if you want selective control over keep-alive, then I think the only option would be apache + mod_ssl + mod_proxy
Do you really need http/1.1 on the server side or do you want keep-alive ? 1.1 does not bring much, basically only the chunked encoding and "expect: 100-continue". Chunked encoding is nice when the server compresses but that's not often the case. Now if you think you need keep-alive, just consider the network latency between your nginx and haproxy. If both are on the same LAN, you really don't need keep-alive at all, as the cost of establishing a connection is extremely small. Many people chain nginx and haproxy together without any issue, so I think that you could really keep your nginx.
Alternatively, you could use stunnel in front of haproxy to handle SSL only. You'd then get client-side keep-alive and HTTP/1.1 directly from haproxy.
|show 2 more comments|