4 ms·

How do you handle https if you don't? Do you use certs directly in code? Also, do you use LetsEncrypt or do you actually pay for certs? I have been developing

How do you handle https if you don't? Do you use certs directly in code? Also, do you use LetsEncrypt or do you actually pay for certs? I have been developing websites all my grown life and I always put them behind a reverse-proxy. That has never been the culprit of any slowdowns in my experience and nginx is very, very fast and supports everything you may want to have. I usually nowadays reach for caddy just because it's so much simpler and fast enough.

winrid 3y ago
Some of our infra at FastComments handles the SSL termination itself, it's really nice owning that in the app layer and removing another component. Yes, we use LetsEncrypt. Those are Java vertx apps. Good thing I didn't move them to rust I guess? But this seems like too weird of an issue to be true.
Shish2k 3y ago
> How do you handle https if you don't? All of the code is here: https://github.com/shish/shm-cached/blob/main/src/tcp.rs https://github.com/shish/shm-cached/blob/main/src/tcp.rs Two async functions - one listens on port 80, and forwards requests into the business logic; one listens on port 443 (grabbing a certificate from Let’s Encrypt if it doesn’t have an up-to-date one in the cache), decrypts the SSL, and forwards requests into the business logic. Before I gave up and wrote my own software I tried various combinations of nginx, varnish, hitch, haproxy, squid, traefik, and I’m sure more that I’m forgetting. Most of them worked ok in most cases (and I’m still happily using `varnish -> nginx -> app server` for other parts of the site) -- but for one reason or another they each had issues handling tens of thousands of requests per second on a tiny potato of a server D: (If any of them worked then yes I would go ahead and use them - but it wouldn’t stop me feeling bad about needing to have a whole extra reverse-proxy layer just because my web framework doesn’t know how to close idle TCP connections :P) (Incidentally if somebody knows of a CDN or cloud service that’ll serve ~3Gbps of NSFW content for <$800/mo, I would be more than happy to quit writing my own software to run on hand-managed bare-metal servers :P)
- piperswe 3y ago
  Cloudflare R2 might work well for you for serving the image files themselves, there's a per-request fee ($0.36/million GETs) but no bandwidth fees. AFAIK there's no restriction on NSFW content on any Cloudflare service, as long as it's legal. Disclaimer: I work for CF, but not on a team related to R2. I'm just speaking as a CF enthusiast here.
  - Shish2k 3y ago
    Interesting~ Last time I spoke to somebody from CF we were too big for the regular plans and too small for the “call us on the phone and we’ll discuss a custom contract” plan, but it has been a couple of years so maybe worth looking at the newer services :)
    - piperswe 3y ago
      I'd say R2's definitely worth a look, since it works quite well standalone (without other CF services). If the public pricing works well for you, there's no real benefit to an Enterprise contract or anything; the product should Just Work and arbitrarily scale.

winrid 3y ago

Some of our infra at FastComments handles the SSL termination itself, it's really nice owning that in the app layer and removing another component. Yes, we use LetsEncrypt. Those are Java vertx apps. Good thing I didn't move them to rust I guess? But this seems like too weird of an issue to be true.

Shish2k 3y ago

> How do you handle https if you don't? All of the code is here: https://github.com/shish/shm-cached/blob/main/src/tcp.rs https://github.com/shish/shm-cached/blob/main/src/tcp.rs Two async functions - one listens on port 80, and forwards requests into the business logic; one listens on port 443 (grabbing a certificate from Let’s Encrypt if it doesn’t have an up-to-date one in the cache), decrypts the SSL, and forwards requests into the business logic. Before I gave up and wrote my own software I tried various combinations of nginx, varnish, hitch, haproxy, squid, traefik, and I’m sure more that I’m forgetting. Most of them worked ok in most cases (and I’m still happily using `varnish -> nginx -> app server` for other parts of the site) -- but for one reason or another they each had issues handling tens of thousands of requests per second on a tiny potato of a server D: (If any of them worked then yes I would go ahead and use them - but it wouldn’t stop me feeling bad about needing to have a whole extra reverse-proxy layer just because my web framework doesn’t know how to close idle TCP connections :P) (Incidentally if somebody knows of a CDN or cloud service that’ll serve ~3Gbps of NSFW content for <$800/mo, I would be more than happy to quit writing my own software to run on hand-managed bare-metal servers :P)

piperswe 3y ago
Cloudflare R2 might work well for you for serving the image files themselves, there's a per-request fee ($0.36/million GETs) but no bandwidth fees. AFAIK there's no restriction on NSFW content on any Cloudflare service, as long as it's legal. Disclaimer: I work for CF, but not on a team related to R2. I'm just speaking as a CF enthusiast here.
- Shish2k 3y ago
  Interesting~ Last time I spoke to somebody from CF we were too big for the regular plans and too small for the “call us on the phone and we’ll discuss a custom contract” plan, but it has been a couple of years so maybe worth looking at the newer services :)
  - piperswe 3y ago
    I'd say R2's definitely worth a look, since it works quite well standalone (without other CF services). If the public pricing works well for you, there's no real benefit to an Enterprise contract or anything; the product should Just Work and arbitrarily scale.