docs: [#234] Evaluate Pingoo as TLS proxy replacement for nginx+certbot#269
Merged
Merged
Conversation
- Add research directory structure for Pingoo evaluation - Document DNS configuration and propagation verification - Create Experiment 1 (Hello World) documentation template - Add cdmon to project dictionary
Results: - Pingoo successfully auto-generated Let's Encrypt certificate - TLS 1.3 with post-quantum key exchange (X25519MLKEM768) - Minimal configuration: ~10 lines YAML vs ~50+ for nginx+certbot - No email required (unlike certbot) Preliminary decision: Switch to Pingoo as primary TLS proxy Pending: WebSocket verification for Grafana (Experiment 4) Added to dictionary: MLKEM, noout, certonly
- Deployed Tracker API with Pingoo TLS proxy on api.torrust-tracker.com - Certificate auto-generated in ~7 seconds - TLS 1.3 with X25519MLKEM768 post-quantum key exchange - Health check endpoint working via HTTPS - Configuration mirrors production setup for easy migration
- Deployed HTTP Tracker with Pingoo TLS proxy on http1.torrust-tracker.com - Certificate auto-generated in ~7 seconds - BitTorrent announce/scrape endpoints work correctly via HTTPS - Binary bencoded responses proxied without corruption
Experiment 4 tested Pingoo with Grafana to verify WebSocket support for Grafana Live real-time streaming feature. Results: - HTTP requests work correctly (dashboard loads, login works) - WebSocket connections FAIL (Grafana Live does not work) Root cause: Pingoo's http_proxy_service.rs explicitly removes the 'Upgrade' header as a hop-by-hop header, which breaks the WebSocket upgrade handshake. Filed issue pingooio/pingoo#23 to confirm this limitation and discuss potential solutions. Final architecture decision: Use hybrid approach - Pingoo for Tracker services (API + HTTP Tracker), nginx for Grafana (WebSocket support).
…limitation - Updated README.md with CLOSED - Not Adopting status - Added rationale: WebSocket limitation makes it unsuitable for Grafana Live - Two proxies (Pingoo + alternative) is overkill for simple setup - Recommend Caddy evaluation as single solution with WebSocket support - Updated conclusion.md with full decision rationale and Caddy comparison - All experiments (1-4) remain documented for future reference
Member
Author
|
ACK c93ce45 |
This file contains hidden or bidirectional Unicode text that may be interpreted or compiled differently than what appears below. To review, open the file in an editor that reveals hidden Unicode characters.
Learn more about bidirectional Unicode characters
Sign up for free
to join this conversation on GitHub.
Already have an account?
Sign in to comment
1 participant
Add this suggestion to a batch that can be applied as a single commit.This suggestion is invalid because no changes were made to the code.Suggestions cannot be applied while the pull request is closed.Suggestions cannot be applied while viewing a subset of changes.Only one suggestion per line can be applied in a batch.Add this suggestion to a batch that can be applied as a single commit.Applying suggestions on deleted lines is not supported.You must change the existing code in this line in order to create a valid suggestion.Outdated suggestions cannot be applied.This suggestion has been applied or marked resolved.Suggestions cannot be applied from pending reviews.Suggestions cannot be applied on multi-line comments.Suggestions cannot be applied while the pull request is queued to merge.Suggestion cannot be applied right now. Please check back later.
Summary
Research evaluation of Pingoo as a simpler alternative to nginx+certbot for automatic HTTPS/TLS termination in Torrust Tracker deployments.
Closes #234
Final Decision
❌ NOT ADOPTING Pingoo - WebSocket limitation makes it unsuitable for our full stack (Grafana Live requires WebSocket support).
Why Not Adopt?
Upgradeheader, breaking WebSocket connections required for Grafana Live dashboardsWe filed pingooio/pingoo#23 to confirm WebSocket support status.
Experiment Results
Root Cause Analysis (Experiment 4)
Pingoo's
http_proxy_service.rsexplicitly filters out theUpgradeheader:This architectural decision means WebSocket connections cannot be established through Pingoo.
Key Findings
Experiments 1-3: All Tracker Services Work ✅
Experiment 4: WebSocket Failure ❌
Upgradeheader by designComparison: Pingoo vs Caddy
Recommendation
Evaluate Caddy as an alternative - it offers:
Test Environment
Documentation Added
docs/research/pingoo-tls-proxy-evaluation/README.mddocs/research/pingoo-tls-proxy-evaluation/phase-1-environment-preparation.mddocs/research/pingoo-tls-proxy-evaluation/experiment-1-hello-world.mddocs/research/pingoo-tls-proxy-evaluation/experiment-2-tracker-api.mddocs/research/pingoo-tls-proxy-evaluation/experiment-3-http-tracker.mddocs/research/pingoo-tls-proxy-evaluation/experiment-4-grafana.mddocs/research/pingoo-tls-proxy-evaluation/conclusion.mdNext Steps