Using websocket with NoTLS behind a TLS terminating proxy

[fnoehWM]

Hello NATS community,

I am seeking some guidance.

When running the nats_server with NoTLS this warning is logged:
Websocket not configured with TLS. DO NOT USE IN PRODUCTION!

However, using a reverse proxy for TLS termination is a common setup for http-services. Nevertheless, the warning cannot be disabled.

So is using a TLS terminating proxy discouraged for nats websocket connections?
Are there any alternative solutions besides:

• setting up a TLS connection between the proxy and nats-server?
• not using the proxy and setting up the nats-server with its own TLS?
• using a unix domain socket between the proxy and server? Is this even possible?

Thank you in advance for any insights!

[betamos]

Agreed, a bit of alarm fatigue here. Seems completely safe to use behind a TLS terminating proxy.

Perhaps time to clean up some of the server startup noise? (I mean we all love the Jetstream ASCII art but some of us are trying to save 1kB of bandwidth here, lol)

[derekcollison]

You can turn that off in embedded servers, not sure if you can configure it with normal flags / config or not. /cc @ripienaar

[ripienaar]

Indeed this warning and banner cannot be disabled at present on the normal nats server, it's probably low priority to resolve though unless someone wants to send a PR