Score:0

Lightweight HTTPS reverse proxy

br flag

I have a need similar to this member: Single public IP, multiple HTTPS backends, Certs should stay on the backend servers. The answers to the post list NGINX, haproxy and sniproxy als possible solutions.

My public IP lives on a Debian server with really tight resources (1 vCPU, 512MB RAM), so that's an issue. Which of the listed solutions needs the least resources? Or are there other alternatives? TIA!

anx avatar
fr flag
anx
**Test it**, because the resource usage might differ depending on the amount of data transferred per connection versus the sheer number of connections forwarded.
OttoEisen avatar
br flag
Well that's exactly, what I'm trying to avoid. Yes, I can run VMs with checkpoints and it would "just" take a couple of hours to figure that out. But I thought I'd ask first Also: loads on a public server can be quite unpredictable, with brute-force attacks, password-spraying et al...
Michael Hampton avatar
cz flag
Eh, you can squeeze any of those in there if your traffic level isn't particularly high. But again, you should test if you want to know how they will actually perform.
Score:0
br flag

@anx said "Test it" (in bold, nonetheless) and so I did.
Well, not really, since I don't have the time for that. Since I suspected that the different solution may be apart by orders of magnitude, I saved myself the pain of: Actually configuring things and setting up another system to run a load-test. Especially since the specs of my reverse proxy hint that the backend servers are not high volume.
Instead I installed the packages (just apt install <App>) and did free -m && service <APP> start && free -m && service <APP> stop && free -m. Waiting a few seconds between the steps. I also used Debian 11, which, at the time of writing, is still the testing branch.
Very rudimentary, I know, but it served my purpose. This is the result, formatted as: Application (Disk space used, Additional packages installed by apt, memory used)

sniproxy (298 kB, 2, 1-2 MB)
apache2 (8,634 kB, 6, 3-4 MB)
nginx (20,500 kB, 20, 4-6 MB)
haproxy (4,315 kB, 1, 34-35 MB)

I've included apache since I assume that it also includes a similar functionality, even though it was not mentioned in the linked post. Be aware, this is not scientifically solid, given that I just used free and memory usage by the operating system can of course contribute to the changes.
So, in the UNIX tradition, use a tool, which does one job only (and hopefully does it good). So if you just need a lightweight Layer 4 proxy with SNI support, go with sniproxy. The linked post also mentioned, that it's easy to configure.

anx avatar
fr flag
anx
Certainly those different software packages use different amount of memory while idling, but the interesting part is probably how much memory they use while near peak utilization. You might discover that one software looks heavier at first glance, that is just because it initialized some memory structure a bit oversized for doing nothing, which pays off in efficiency after just a few hundred connections. (Until you care about this, sticking with the solution that seemed easiest to configure to get the job done *is the best solution for you*, whether it has 20mb bigger memory overhead or not)
mangohost

Post an answer

Most people don’t grasp that asking a lot of questions unlocks learning and improves interpersonal bonding. In Alison’s studies, for example, though people could accurately recall how many questions had been asked in their conversations, they didn’t intuit the link between questions and liking. Across four studies, in which participants were engaged in conversations themselves or read transcripts of others’ conversations, people tended not to realize that question asking would influence—or had influenced—the level of amity between the conversationalists.