Putting together some of what other people here were trying to do and my own pet project I present this:
[
gitlab.com]
https://gitlab.com/gruntledw/HentaiAtHome/#overviewIt's a GraalVM native-image compiled and dockerized version of the H@H client with additional (command-line optional) features and instructions to allow nginx to terminate the TLS connections.
Why? All the advantages of offloading work to a modern widely used webserver:
- HTTP/2 support
- Range support
- Better generic logging/metrics support
- Ability to add extra TLS related items "for free", like HSTS headers and OCSP stapling
- Lower CPU usage
It also looked like an interesting and fun side project.
Command line features that were added:
- Ability to disable TLS (since nginx is handling it)
- Ability to get requester IP from an nginx supplied header (so that origin checks and client side logging still work)
- X-Accel-Redirect support: cached file service can be delegated to nginx (but is still controlled by the client)
- HTTP Keepalive support. (Note: this is only useful because of the nginx proxy, real end users would not benefit from connecting to a H@H client directly with keepalives)
Limitations:
- if the TLS disable option is supplied, bandwidth/connection/request-flood protection are disabled. This could be fixed, but nginx can be configured to handle it instead, so why bother.
Concretely, what I got:
- Substantial whole system CPU usage reduction (compared to an OpenJDK 8 docker image base). It's difficult to give precise numbers, but I got ~50% lower user CPU usage on a system with a bunch of lightly used other services
- Mild memory savings, including the cost of running a new web server. If you already have one, that could be more substantial.
I currently have 3 clients running this code, and it looks fairly stable
Other notes:
Using SNI to select which cert to send (and sending a cert other than the H@H cert by default) will absolutely trash your quality, despite your trust being pegged at +1000 (result so far with <100 static ranges, if that matters).