I am running an HTTP service and want to put nginx
in front for SSL termination. This can be done in two ways; either as a stream
proxy
stream {
server {
listen 443 ssl;
ssl_certificate /certs/fullchain.pem;
ssl_certificate_key /certs/privkey.pem;
proxy_pass ip-for-backend-service:80;
}
}
or as an http
proxy
http {
server {
listen 443 ssl;
ssl_certificate /certs/fullchain.pem;
ssl_certificate_key /certs/privkey.pem;
location / {
proxy_pass http://ip-for-backend-service:80;
proxy_set_header ...;
}
}
}
From a quick glance it seems like that the configuration of the stream
proxy is much simpler since you don't have to add a bunch of extra headers (proxy_set_header
etc) and other configuration.
I am trying to understand the pros and cons between these two methods, and in particular I have the following questions:
Will either method leak more information about the backend service? For example, will the
ip-for-backend-service
be visible?Will either method result in better protection from attacks? I guess if the backend service has flaws it will be visible/exploitable through both options?
Which option is more efficient? I think that the
stream
option might be faster since it just routes the traffic and there is no http-server in the middle?