Reverse proxy websockets (SSL), traffic through Stunnel to many node.js apps

Question

I'm looking for some ideas...

I have a series of robust node.js apps that need to be delivered to specific users (post authentication), virtually no file serving, only the initial delivery of the index. The rest of the communication is all done via socket.io.

• ClientA (login) needs to be connected to an application on lets say :90001
• ClientB (login) on :90002
• ClientC (login) on :90003

*All HTTP/1.1 ws need to be secure

I have tried a few configurations:

• stunnel/varnish/nginx
• stunnel/haproxy
• stunnel/nginx

I was thinking a good approach would be to somehow use redis to store sessions and validate against a cookie, however that would most likely be done by (using node) exposing node.js on the frontend.

questions:

What are the risks in using node-http-proxy as the front piece?

Is this something that i should deem possible (to have one piece that "securely" redirects ws traffic and manages specific sessions to many independent/exclusive backends).

I am aware that nginx 1.3 (in dev) is to support ws, is this worth holding out for?

Has anyone had any thorough experience with yao's tcp_proxy module for nginx (reliability / scalability)?

Answer 1

I can't say I have done this before, but I can offer some ideas perhaps:

1 node authentication server which takes login details and sets a cookie specific to the server the user should connect to. It then redirects to the index page at which point, haproxy can direct the request based on the cookie. See this question https://serverfault.com/questions/75385/is-there-a-way-to-configure-haproxy-to-send-traffic-based-on-a-cookie

Alternatively, you could have the above authentication on all servers instead of just one. Haproxy would have to be configured to balance across all nodes if there is no relevant cookie header. Each node would do the set-cookie + redirect and subsequent requests should end up on the specific node instance.

bts, haproxy 1.5 dev now has built in support for SSL, so no need for stunnel anymore.