Skip to content

play: Enable TLS SNI for Dgraph Play queries #266

New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Merged
merged 2 commits into from
May 4, 2021
Merged

Conversation

danielmai
Copy link
Contributor

@danielmai danielmai commented May 4, 2021

This sets proxy_ssl_server_name so that the SNI is used in the TLS proxy connection.

Without this, nginx won't be able to connect to the upstream backends. These logs show up in error.log:

2021/05/04 15:48:55 [error] 22269#22269: *42 no live upstreams while connecting to upstream, client: 172.69.79.178, server: play.dgraph.io, request: "GET /health HTTP/1.1", upstream: "https://crooked-advertisement.us-west-2.aws.cloud.dgraph.io/health", host: "play.dgraph.io", referrer: "https://play.dgraph.io/?latest"

<...nginx reload...>

2021/05/04 15:51:10 [error] 23517#23517: *120 SSL_do_handshake() failed (SSL: error:14094438:SSL routines:ssl3_read_bytes:tlsv1 alert internal error:SSL alert number 80) while SSL handshaking to upstream, client: $IP, server: play.dgraph.io, request: "POST /query?timeout=20s HTTP/1.1", upstream: "https://$IP:443/query?timeout=20s&be=true", host: "play.dgraph.io", referrer: "https://play.dgraph.io/?latest"

This fixes connection issues for queries running in:

This PR also bumps up the limit requests on Play so that more traffic can get through.

References:

This change is Reviewable

@danielmai danielmai changed the title play: Enable TLS SNI for Dgraph Cloud backend proxy. play: Enable TLS SNI for Dgraph Play queries May 4, 2021
Copy link
Contributor Author

@danielmai danielmai left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

I'm not sure why proxy_ssl_server_name has only now started to be set, but it does address the issues in the error log.

Reviewable status: 0 of 1 files reviewed, all discussions resolved

Copy link

@roshbhatia roshbhatia left a comment

Choose a reason for hiding this comment

The reason will be displayed to describe this comment to others. Learn more.

lgtm

@danielmai danielmai merged commit 17b167b into master May 4, 2021
@danielmai danielmai deleted the danielmai/fix-ratel branch May 4, 2021 17:39
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Labels
None yet
Development

Successfully merging this pull request may close these issues.

2 participants