SSL optomisations...

  ssl_session_timeout 2h;
  ssl_session_cache shared:SSL:10m;
  ssl_session_tickets off; # For TLS... see below

22:01 < dstufft> yea we use 2h
22:01 < dstufft> https://github.com/python/psf-salt/blob/master/salt/haproxy/config/haproxy.cfg.jinja#L38-L40
22:03 < dstufft> ranguard: you might also want to disable TLS tickets unless you regularly restart nginx.
                 Similarly to sessions the "lifetime" of the TLS ticket is how long the same emphereal
                 key is used, sadly Nginx (and all the OSS server software i'm aware of) doesn't
                 automatically rotate the key used to encrypt the TLS tickets, so if you keep tickets on
                 in nginx your PFS sessions will more or less be once per nginx reboot
22:04 < dstufft> (the downside here is that TLS tickets is another type of session resumption, which is
                 again faster than doing a full handshake, but is slower than session id resumption, so
                 turning it off means that you might lose some resumptions)
22:04 < dstufft> (TLs tickets vs session id is basically, for session ids the server stores some state
                 about the connection, for TLS tickets the server just stores an encryption key which it
                 uses to encrypt all the state and then sends that bag of encrypted stuff to the client)