# Retetele de remediere `go` si `nginx`, masurate cap la cap, 2026-10-18 04:28Z-04:31Z

Pana azi `remediere.mjs` spunea despre profilul `nginx` "the server directive from the nginx documentation, not measured by us on a
real nginx" si despre `go` "from the Go 1.24 release notes; not measured by us (the Go on the test machine is 1.22)". Masurat azi, cu
EXACT fragmentele pe care le scrie reteta pentru `hndl-exposed` + `tls12-accepted` + `hsts-missing` (setarile: grupurile
`X25519MLKEM768:X25519`, versiunea minima 1.3, HSTS un an), fiecare server pornit pe 127.0.0.1 si sondat cu Node 24 (`tls-sonda.mjs`:
o strangere de mana reala cu grupurile oferite si, optional, cu versiunea maxima) si cu `curl -k` pentru antet:

| | Go (`go/main.go`, laptop) | nginx (`masoara-nginx-rpc2.sh`, container pe rpc2) |
|---|---|---|
| serverul | Go **1.26.5** windows/amd64, `&tls.Config{MinVersion: tls.VersionTLS13, CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}}`, `w.Header().Set("Strict-Transport-Security", "max-age=31536000")` | **nginx 1.31.7** din `nginx:alpine`, "built with OpenSSL 3.5.8 (running with OpenSSL 3.5.9)"; `ssl_ecdh_curve X25519MLKEM768:X25519; ssl_protocols TLSv1.3; add_header Strict-Transport-Security "max-age=31536000" always;`; `nginx -t` ok |
| client care ofera numai `X25519MLKEM768` | reusit (TLSv1.3, TLS_AES_128_GCM_SHA256) | reusit (TLSv1.3, grup raportat `X25519MLKEM768`) |
| client care ofera numai `X25519` (rezerva din reteta) | reusit, grup `X25519` | reusit, grup `X25519` |
| client `X25519MLKEM768:X25519` | reusit | reusit, grupul ales `X25519MLKEM768` |
| client TLS 1.2 | **refuzat** `ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION` | **refuzat** `ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION` |
| HSTS | `Strict-Transport-Security: max-age=31536000` | `Strict-Transport-Security: max-age=31536000` |
| scanerul AERE pe server (`scaneaza-local.mjs`, `scaneazaAdresa` pe 127.0.0.1) | `pqKeyExchange X25519MLKEM768, prefersPqWhenOffered true, tls12Accepted false, hsts true`; scor 70 numai din certificatul de proba (autosemnat, 2 zile: `cert-expiring`, `chain-untrusted`) | NEMASURAT cu scanerul (modulul nu e instalat pe rpc2 in forma importabila); sondele si curl-ul acopera aceleasi fapte |
| curatenie | serverul oprit, binarul sters | container si imagine sterse; RPC-ul local 11 -> 13 ms |

Ce NU s-a masurat la 04:31Z: Apache si HAProxy (masurate apoi la 05:18Z-05:25Z, mai jos), un nginx de productie cu configuratia
lui intreaga (aici un singur `server {}` de proba), Go sub Windows numai (Linux NEMASURAT; Go-ul din WSL e 1.22, sub 1.24), clienti
reali (browsere) spre aceste servere. Jurnalele: `masoara-go.log`, `masoara-nginx.log`.

## Apache si HAProxy, masurate 2026-10-18 05:18Z-05:25Z (`masoara-apache-haproxy-rpc2.sh`, `masoara-haproxy2-rpc2.sh`)

Aceleasi conditii: containere pe rpc2 (`httpd:alpine`, `haproxy:alpine`, OpenSSL-ul lui Alpine), publicate NUMAI pe 127.0.0.1, EXACT
fragmentele retetei, aceeasi sonda, curatenie la sfarsit (containere si imagini sterse, RPC-ul local 13 -> 10 ms).

| | Apache (`httpd:alpine`) | HAProxy (`haproxy:alpine`) |
|---|---|---|
| serverul | **Apache/2.4.69 (Unix) OpenSSL/3.5.9** (randul de pornire AH00489 din jurnal, chiar preconditia retetei); `httpd -t`: Syntax OK; `SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519`, `SSLProtocol -all +TLSv1.3`, `Header always set Strict-Transport-Security "max-age=31536000"` intr-un `<VirtualHost *:8447>` | **HAProxy 3.4.7** (2026-10-14), "Built with / Running on SSL library version : OpenSSL 3.5.9"; `haproxy -c -f` cod 0; `ssl-default-bind-curves X25519MLKEM768:X25519` si `ssl-default-bind-options ssl-min-ver TLSv1.3` in `global`, `http-response set-header Strict-Transport-Security "max-age=31536000"` in frontend |
| hibrid singur / clasic singur / hibrid + clasic | reusit / reusit / reusit (TLSv1.3) | reusit / reusit / reusit (TLSv1.3) |
| client TLS 1.2 | **refuzat** `ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION` | **refuzat** `ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION` |
| HSTS | `Strict-Transport-Security: max-age=31536000` | `strict-transport-security: max-age=31536000` prin HAProxy, pe un raspuns venit de la un backend httpd FARA antet (control: curl direct pe backend, fara HSTS) |

Doua lucruri gasite pe drum, despre PROBA si despre RETETA, nu despre servere: (1) prima masurare HAProxy folosea `http-request return` si nu
vedea HSTS, fiindca regulile `http-response` nu se aplica unui raspuns generat intern de HAProxy (numai `http-after-response`); a doua
masurare trece raspunsul unui backend real prin frontend, si antetul apare; (2) comanda de preconditie a retetei `haproxy -vv | grep -i
"running on openssl"` NU prinde nimic pe HAProxy 3.4: randul e "Running on SSL library version : OpenSSL 3.5.9"; reteta spune acum
`grep -i "SSL library version"`. Ramane NEMASURAT: un Apache/HAProxy de productie cu configuratia lui intreaga, clienti reali (browsere).