Enable HTTPS WebSockets

ScriptaGames / zorbio

A 3D multiplayer WebGL game

MIT License

8 stars 1 forks source link

Enable HTTPS WebSockets #248

Closed mwcz closed 6 years ago

mwcz commented 8 years ago

In this interview, Ben Adams said:

We have to go over HTTPS because WebSockets don't work well for everybody over HTTP because not every intermediary--all the browsers understand it--the intermediaries, the proxies and routers, don't. Some of them interfere with the communication and will break it. So that's why it's all over HTTPS but is is essentially WebSockets between us and the browser.

Q: Doesn't HTTPS affect performance?

That was somewhere we had a worry. Probably of anything the fact that we had to go over HTTPS was our biggest worry. But no, we've had no problems.

Jared-Sprague commented 6 years ago

Got this working locally with a self-signed cert. Next step test against a test NodeBalancer using a clouldflare cert.

mwcz commented 6 years ago

Awesome!

On Dec 10, 2017 11:20 AM, "Jared Sprague" notifications@github.com wrote:

Got this working locally with a self-signed cert. Next step test against a test NodeBalancer using a clouldflare cert.

— You are receiving this because you authored the thread. Reply to this email directly, view it on GitHub https://github.com/Jared-Sprague/zorbio/issues/248#issuecomment-350559571, or mute the thread https://github.com/notifications/unsubscribe-auth/AAWQRwpZEctCAOk2RndtzqpE6NglB2J3ks5s_ATMgaJpZM4HzA2c .

Jared-Sprague commented 6 years ago

@mwcz It's working!! Test it out at: https://ci.zorb.io/ If you look at the WS in the Network tab in chrome you'll see it's using wss:// which is the websocket secure protocol that uses TLS.

It took some weird juggling on Cloudflare, but I think it's going to work!

Jared-Sprague commented 6 years ago

Infrastructure scripts I need to modify in order for this to work with automated deployment:

[x] test that nodebalancer node can work with https wss on port 31000 in ci.zorb.io
[x] linode stack script
[x] zorbio.sh start stop script for the systemd service
[x] config.js set default https listen port to 31000
[x] create_node.sh script for provisioning
[x] ansible playbooks for provision.yaml add copy origin cert tls stuff
[x] static host apache config for origin-tls
[x] check zorbio-deploy.yaml
[x] check rpm create spec

Jared-Sprague commented 6 years ago

Deploy steps:

[x] may have to manually remove old zorbio.conf on static host
[x] CloudFlare DNS for *.zorb.io balancers

Jared-Sprague commented 6 years ago

This is now done in prod whew! we no longer have any un-encrypted routes in prod