Post #2300575
2026-05-09 08:04 UTC
@ska@social.treehouse.systems @bt@mastodon.bsd.cafe Obviously terminating TLS on the server would be ideal, but if that ends up not being viable, I wonder if routing the backhaul over Wireguard would help?
That would make sure the server proxy traffic is encrypted, but also wireguard can transparently handle changes of IP address (as long as both ends don't change at the same time!). Which might help if your ISP changes your address on you
Replies (1)
-
@ska@social.treehouse.systems 2026-05-09 12:58
@rachelplusplus@tech.lgbt @bt@mastodon.bsd.cafe Honestly, I believe it's totally viable even on an RPiZ. The TLS process on my machine (x86_64, statically linked) takes 76 kB of Private_Dirty memory per connection. Add a little overhead for dynamic linking and a little more for ARM code, but we're looking at under 100 kB of Private_Dirty per connection. bearssl is fantastic.