Matrix-appservice-irc: Support TLS (Freenode)
This needs to be turned on. We didn't previously because it interacted badly with ident, but now we're on IPv6 this isn't an issue (since we don't use ident).
kegsay
All 9 comments
We seem to be hitting a throttling/limiting problem when we enable TLS on our IPv6 connections. New connections end up ETIMEOUTing after aprox 1000 connections, and then they seem to trickle in 5 minute gaps. Need to talk to Freenode staff before we can enable this again.
kegsay
on 9 Nov 2016
Was @freenode ever contacted? I recall this issue being noticed last week.
Mikaela
on 9 Nov 2016
Not yet.
kegsay
on 9 Nov 2016
Haven't forgotten about this - I need to work on https://github.com/matrix-org/matrix-appservice-irc/issues/272 first before we can realistically re-enable this.
kegsay
on 20 Dec 2016
FYI I think I know why Freenode falls over on TLS: https://github.com/matrix-org/matrix-appservice-irc/issues/352
kegsay
on 27 Jan 2017
All outstanding issues preventing us from trying TLS again on Freenode have been fixed. I would like to analyse the CPU usage of the bridge prior to deploying this on Freenode given TLS is computationally expensive: I'm particularly worried about startup times and reconnection times.
kegsay
on 1 Mar 2017
I would like to analyse the CPU usage of the bridge prior to deploying this on Freenode given TLS is computationally expensive
As of today, I have added support for doing 10 second cpu profiles via SIGUSR2. I'm using this to debug general cpu spin problems, but will also use this to profile general background levels of work to see if turning on TLS will exacerbate anything. See #404 for spin issues.
kegsay
on 28 Mar 2017
CPU usage with #404 fixes applied is down a lot at startup and BAU runtime (50% and 10% respectively). This is good news because it means setting up TLS at startup for all 9k connections will have a lot of headroom.
As a result, I intend to turn on TLS at the next Freenode bridge restart (1-2 weeks) so this issue can finally be closed. It's worth noting that all the other bridges have been using TLS for ages (oftc, moznet, snoonet, gimpnet), it's just Freenode that has caused us logistical problems.
kegsay
on 4 Apr 2017
This happened. It works. :tada:
kegsay
on 12 Apr 2017
Related issues
colemickens
路
4Comments
Half-Shot
路
5Comments
jkhsjdhjs
路
6Comments
vivia
路
3Comments
joepie91
路
3Comments
Most helpful comment
CPU usage with #404 fixes applied is down a lot at startup and BAU runtime (50% and 10% respectively). This is good news because it means setting up TLS at startup for all 9k connections will have a lot of headroom.
As a result, I intend to turn on TLS at the next Freenode bridge restart (1-2 weeks) so this issue can finally be closed. It's worth noting that all the other bridges have been using TLS for ages (oftc, moznet, snoonet, gimpnet), it's just Freenode that has caused us logistical problems.