3 ms·
> Another Note: This runs on port 3000. Making it run on port 80 would be possible using a reverse proxy (such as nginx), but for this setup we will actually ru
by yid 12y ago
> Another Note: This runs on port 3000. Making it run on port 80 would be possible using a reverse proxy (such as nginx), but for this setup we will actually run the app servers on port 3000 and the load balancer (on a different server) will run on port 80.
This comes up a lot. In addition to the reverse proxy, you can also:
-- redirect port 80 to port 3000
iptables -A PREROUTING -t nat -i eth0 -p tcp --dport 80 -j REDIRECT --to-port 3000
-- use authbind to grant port 80 access to an unprivileged user
http://manpages.ubuntu.com/manpages/hardy/man1/authbind.1.html http://manpages.ubuntu.com/manpages/hardy/man1/authbind.1.ht...
- dickeytk 12y agogreat tip, I'll add this in
- SkyMarshal 12y agoWhich is a better security setup, reverse proxying port 80 to 3000 via a stripped, hardened nginx/apache on 80, or connecting your unpriviledged app directly to port 80 via iptables or authbind?
- yid 12y agoPort 80 is not some magical port, it's just privileged by convention. Routing iptables from port 80 to 3000 does not hurt nor improve your security situation in the least.
- nmjohn 12y agoI can see how this is useful if you are using a single node.js server as you wouldn't need any proxy in front of it. However if you are using a load balancer in front of a handful of node.js app servers, does this offer any advantage over just using an arbitrary port > 1024?
- yid 12y ago> However if you are using a load balancer in front of a handful of node.js app servers, does this offer any advantage over just using an arbitrary port > 1024 Nope. It's only useful if you're using a single server, e.g. on a $5 DigitalOcean droplet.