Nginx as a TLS Termination proxy for WebSockets

nginx-ws-tls-termination.conf

map $http_upgrade $connection_upgrade {
    default upgrade;
    '' close;
}

upstream server_cluster {
    # sticky connections are critical for non-WebSocket Socket.io
    #   http://socket.io/docs/using-multiple-nodes/
    ip_hash;

    # assume 8 CPU box,
    #   with 1 CPU reserved for nginx + TLS processing
    #   basic nginx health_check impl will omit missing hosts
    server 127.0.0.1:3201;
    server 127.0.0.1:3202;
    server 127.0.0.1:3203;
    server 127.0.0.1:3204;
    server 127.0.0.1:3205;
    server 127.0.0.1:3206;
    server 127.0.0.1:3207;
}

server {
    listen 443;

    # ...

    ssl on;
    ssl_certificate /Users/dfoley/src/server/ssl/certs/server.crt;
    ssl_certificate_key /Users/dfoley/src/server/ssl/keys/server.key;

    location /server/ {
        proxy_pass http://server_cluster;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_cache_bypass $http_upgrade;
        proxy_buffering off;
        proxy_ignore_client_abort off;
    }

    # ...
}