aere-quantum/control-plane/dovezi/retete-2026-10-18/CITESTE-MA.md

Retetele de remediere go si nginx, masurate cap la cap, 2026-10-18 04:28Z-04:31Z

Pana azi remediere.mjs spunea despre profilul nginx "the server directive from the nginx documentation, not measured by us on a real nginx" si despre go "from the Go 1.24 release notes; not measured by us (the Go on the test machine is 1.22)". Masurat azi, cu EXACT fragmentele pe care le scrie reteta pentru hndl-exposed + tls12-accepted + hsts-missing (setarile: grupurile X25519MLKEM768:X25519, versiunea minima 1.3, HSTS un an), fiecare server pornit pe 127.0.0.1 si sondat cu Node 24 (tls-sonda.mjs: o strangere de mana reala cu grupurile oferite si, optional, cu versiunea maxima) si cu curl -k pentru antet:

	Go (go/main.go, laptop)	nginx (masoara-nginx-rpc2.sh, container pe rpc2)
serverul	Go 1.26.5 windows/amd64, &tls.Config{MinVersion: tls.VersionTLS13, CurvePreferences: []tls.CurveID{tls.X25519MLKEM768, tls.X25519}}, w.Header().Set("Strict-Transport-Security", "max-age=31536000")	nginx 1.31.7 din nginx:alpine, "built with OpenSSL 3.5.8 (running with OpenSSL 3.5.9)"; ssl_ecdh_curve X25519MLKEM768:X25519; ssl_protocols TLSv1.3; add_header Strict-Transport-Security "max-age=31536000" always;; nginx -t ok
client care ofera numai X25519MLKEM768	reusit (TLSv1.3, TLS_AES_128_GCM_SHA256)	reusit (TLSv1.3, grup raportat X25519MLKEM768)
client care ofera numai X25519 (rezerva din reteta)	reusit, grup X25519	reusit, grup X25519
client X25519MLKEM768:X25519	reusit	reusit, grupul ales X25519MLKEM768
client TLS 1.2	refuzat ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION	refuzat ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION
HSTS	Strict-Transport-Security: max-age=31536000	Strict-Transport-Security: max-age=31536000
scanerul AERE pe server (scaneaza-local.mjs, scaneazaAdresa pe 127.0.0.1)	pqKeyExchange X25519MLKEM768, prefersPqWhenOffered true, tls12Accepted false, hsts true; scor 70 numai din certificatul de proba (autosemnat, 2 zile: cert-expiring, chain-untrusted)	NEMASURAT cu scanerul (modulul nu e instalat pe rpc2 in forma importabila); sondele si curl-ul acopera aceleasi fapte
curatenie	serverul oprit, binarul sters	container si imagine sterse; RPC-ul local 11 -> 13 ms

Ce NU s-a masurat la 04:31Z: Apache si HAProxy (masurate apoi la 05:18Z-05:25Z, mai jos), un nginx de productie cu configuratia lui intreaga (aici un singur server {} de proba), Go sub Windows numai (Linux NEMASURAT; Go-ul din WSL e 1.22, sub 1.24), clienti reali (browsere) spre aceste servere. Jurnalele: masoara-go.log, masoara-nginx.log.

Apache si HAProxy, masurate 2026-10-18 05:18Z-05:25Z (masoara-apache-haproxy-rpc2.sh, masoara-haproxy2-rpc2.sh)

Aceleasi conditii: containere pe rpc2 (httpd:alpine, haproxy:alpine, OpenSSL-ul lui Alpine), publicate NUMAI pe 127.0.0.1, EXACT fragmentele retetei, aceeasi sonda, curatenie la sfarsit (containere si imagini sterse, RPC-ul local 13 -> 10 ms).

	Apache (httpd:alpine)	HAProxy (haproxy:alpine)
serverul	Apache/2.4.69 (Unix) OpenSSL/3.5.9 (randul de pornire AH00489 din jurnal, chiar preconditia retetei); httpd -t: Syntax OK; SSLOpenSSLConfCmd Groups X25519MLKEM768:X25519, SSLProtocol -all +TLSv1.3, Header always set Strict-Transport-Security "max-age=31536000" intr-un <VirtualHost *:8447>	HAProxy 3.4.7 (2026-10-14), "Built with / Running on SSL library version : OpenSSL 3.5.9"; haproxy -c -f cod 0; ssl-default-bind-curves X25519MLKEM768:X25519 si ssl-default-bind-options ssl-min-ver TLSv1.3 in global, http-response set-header Strict-Transport-Security "max-age=31536000" in frontend
hibrid singur / clasic singur / hibrid + clasic	reusit / reusit / reusit (TLSv1.3)	reusit / reusit / reusit (TLSv1.3)
client TLS 1.2	refuzat ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION	refuzat ERR_SSL_TLSV1_ALERT_PROTOCOL_VERSION
HSTS	Strict-Transport-Security: max-age=31536000	strict-transport-security: max-age=31536000 prin HAProxy, pe un raspuns venit de la un backend httpd FARA antet (control: curl direct pe backend, fara HSTS)

Doua lucruri gasite pe drum, despre PROBA si despre RETETA, nu despre servere: (1) prima masurare HAProxy folosea http-request return si nu vedea HSTS, fiindca regulile http-response nu se aplica unui raspuns generat intern de HAProxy (numai http-after-response); a doua masurare trece raspunsul unui backend real prin frontend, si antetul apare; (2) comanda de preconditie a retetei haproxy -vv | grep -i "running on openssl" NU prinde nimic pe HAProxy 3.4: randul e "Running on SSL library version : OpenSSL 3.5.9"; reteta spune acum grep -i "SSL library version". Ramane NEMASURAT: un Apache/HAProxy de productie cu configuratia lui intreaga, clienti reali (browsere).