Skip to content

Instantly share code, notes, and snippets.

@cantremember
Created April 30, 2017 20:21
Show Gist options
  • Star 3 You must be signed in to star a gist
  • Fork 1 You must be signed in to fork a gist
  • Save cantremember/5fda0e8189106df6a7cb0497048f487d to your computer and use it in GitHub Desktop.
Save cantremember/5fda0e8189106df6a7cb0497048f487d to your computer and use it in GitHub Desktop.
Nginx as a TLS Termination proxy for WebSockets
map $http_upgrade $connection_upgrade {
default upgrade;
'' close;
}
upstream server_cluster {
# sticky connections are critical for non-WebSocket Socket.io
# http://socket.io/docs/using-multiple-nodes/
ip_hash;
# assume 8 CPU box,
# with 1 CPU reserved for nginx + TLS processing
# basic nginx health_check impl will omit missing hosts
server 127.0.0.1:3201;
server 127.0.0.1:3202;
server 127.0.0.1:3203;
server 127.0.0.1:3204;
server 127.0.0.1:3205;
server 127.0.0.1:3206;
server 127.0.0.1:3207;
}
server {
listen 443;
# ...
ssl on;
ssl_certificate /Users/dfoley/src/server/ssl/certs/server.crt;
ssl_certificate_key /Users/dfoley/src/server/ssl/keys/server.key;
location /server/ {
proxy_pass http://server_cluster;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_cache_bypass $http_upgrade;
proxy_buffering off;
proxy_ignore_client_abort off;
}
# ...
}
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment