Skip to content

perf: enable TLS session resumption and 0-RTT in ingress nginx #17

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

Sign up for GitHub

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Closed
Evrard-Nil wants to merge 1 commit into from
Closed

perf: enable TLS session resumption and 0-RTT in ingress nginx #17

Show file tree
Hide file tree
Changes from all commits
Commits
Show all changes
1 commit
Select commit
File filter

Filter by extension

Filter by extension
Conversations
Failed to load comments.
Loading
Jump to
Jump to file
Failed to load files.
Loading
Diff view
Diff view
19 changes: 15 additions & 4 deletions scripts/entrypoint.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -93,6 +93,8 @@ limit_req_status 429;
${PROXY_CMD}_set_header X-Real-IP \$remote_addr;
${PROXY_CMD}_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
${PROXY_CMD}_set_header X-Forwarded-Proto \$scheme;
# Forward TLS 0-RTT indicator so backends can reject Early-Data on non-idempotent methods
${PROXY_CMD}_set_header Early-Data \$ssl_early_data;

# Timeout configuration
${PROXY_CMD}_read_timeout 600;
Expand Down Expand Up @@ -137,16 +139,21 @@ server {
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

# SSL session configuration
# SSL session configuration — shared cache + tickets for 1-RTT resumption.
# 50m ~= 200k sessions, far more than any single CVM needs.
# ssl_session_tickets: nginx rotates ticket keys on reload — sufficient for a
# single-replica CVM. Cluster deployments would need an external rotated key file.
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_session_tickets on;

# SSL buffer size (optimized for TLS 1.3)
ssl_buffer_size 4k;

# Disable SSL renegotiation
ssl_early_data off;
# TLS 1.3 0-RTT — saves the final RTT on resumed sessions.
# WARNING: 0-RTT data is replayable. The Early-Data header is forwarded to
# backends below so they can reject 0-RTT on non-idempotent methods.
ssl_early_data on;
${client_max_body_size_conf}

# WebSocket support - handles both /ws/ and /socket.io/ paths
Expand All @@ -161,6 +168,8 @@ ${client_max_body_size_conf}
${PROXY_CMD}_set_header X-Real-IP \$remote_addr;
${PROXY_CMD}_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
${PROXY_CMD}_set_header X-Forwarded-Proto \$scheme;
# Forward TLS 0-RTT indicator so backends can reject Early-Data on non-idempotent methods
${PROXY_CMD}_set_header Early-Data \$ssl_early_data;

${PROXY_CMD}_cache_bypass \$http_upgrade;

Expand All @@ -178,6 +187,8 @@ ${rate_limit_location_conf}
${PROXY_CMD}_set_header X-Real-IP \$remote_addr;
${PROXY_CMD}_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
${PROXY_CMD}_set_header X-Forwarded-Proto \$scheme;
# Forward TLS 0-RTT indicator so backends can reject Early-Data on non-idempotent methods
${PROXY_CMD}_set_header Early-Data \$ssl_early_data;

# Timeout configuration for long-running requests
${PROXY_CMD}_read_timeout 600; # 10 minutes
Expand Down
19 changes: 15 additions & 4 deletions scripts/generate-nginx-upstream.sh
View file
Open in desktop
Original file line number Diff line number Diff line change
Expand Up @@ -108,6 +108,8 @@ ${KEEPALIVE_HEADERS}
${PROXY_CMD}_set_header X-Real-IP \$remote_addr;
${PROXY_CMD}_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
${PROXY_CMD}_set_header X-Forwarded-Proto \$scheme;
# Forward TLS 0-RTT indicator so backends can reject Early-Data on non-idempotent methods
${PROXY_CMD}_set_header Early-Data \$ssl_early_data;

# Timeout configuration
${PROXY_CMD}_read_timeout 600;
Expand Down Expand Up @@ -171,16 +173,21 @@ server {
resolver 8.8.8.8 8.8.4.4 valid=300s;
resolver_timeout 5s;

# SSL session configuration
# SSL session configuration — shared cache + tickets for 1-RTT resumption.
# 50m ~= 200k sessions, far more than any single CVM needs.
# ssl_session_tickets: nginx rotates ticket keys on reload — sufficient for a
# single-replica CVM. Cluster deployments would need an external rotated key file.
ssl_session_timeout 1d;
ssl_session_cache shared:SSL:50m;
ssl_session_tickets off;
ssl_session_tickets on;

# SSL buffer size (optimized for TLS 1.3)
ssl_buffer_size 4k;

# Disable SSL renegotiation
ssl_early_data off;
# TLS 1.3 0-RTT — saves the final RTT on resumed sessions.
# WARNING: 0-RTT data is replayable. The Early-Data header is forwarded to
# backends below so they can reject 0-RTT on non-idempotent methods.
ssl_early_data on;
${CLIENT_MAX_BODY_SIZE_CONF}

# WebSocket support - handles both /ws/ and /socket.io/ paths
Expand All @@ -195,6 +202,8 @@ ${CLIENT_MAX_BODY_SIZE_CONF}
${PROXY_CMD}_set_header X-Real-IP \$remote_addr;
${PROXY_CMD}_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
${PROXY_CMD}_set_header X-Forwarded-Proto \$scheme;
# Forward TLS 0-RTT indicator so backends can reject Early-Data on non-idempotent methods
${PROXY_CMD}_set_header Early-Data \$ssl_early_data;

${PROXY_CMD}_cache_bypass \$http_upgrade;

Expand All @@ -217,6 +226,8 @@ ${KEEPALIVE_HEADERS}
${PROXY_CMD}_set_header X-Real-IP \$remote_addr;
${PROXY_CMD}_set_header X-Forwarded-For \$proxy_add_x_forwarded_for;
${PROXY_CMD}_set_header X-Forwarded-Proto \$scheme;
# Forward TLS 0-RTT indicator so backends can reject Early-Data on non-idempotent methods
${PROXY_CMD}_set_header Early-Data \$ssl_early_data;

# Timeout configuration for long-running requests
${PROXY_CMD}_read_timeout 600; # 10 minutes
Expand Down
Loading