stunnel: disable compression.

1 files changed, 2 insertions, 0 deletions

diff --git a/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2 b/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2
index 51c5dca..bbe4114 100644
--- a/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2
+++ b/roles/munin-master/templates/etc/stunnel/munin-master.conf.j2
@@ -18,40 +18,42 @@ debug = 4
 
 ; Certificate/key is needed in server mode and optional in client mode
 cert = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.pem
 key  = /etc/stunnel/certs/munin-{{ inventory_hostname_short }}.key
 client = yes
 socket = a:SO_BINDTODEVICE=lo
 
 ; Some performance tunings
 socket = l:TCP_NODELAY=1
 socket = r:TCP_NODELAY=1
 
 ; Prevent MITM attacks
 verify = 4
 
 ; Disable support for insecure protocols
 options = NO_SSLv2
 options = NO_SSLv3
 options = NO_TLSv1
 options = NO_TLSv1.1
 
+options = NO_COMPRESSION
+
 ; These options provide additional security at some performance degradation
 options = SINGLE_ECDH_USE
 options = SINGLE_DH_USE
 
 ; Select permitted SSL ciphers
 ciphers = EECDH+AESGCM:!MEDIUM:!LOW:!EXP:!aNULL:!eNULL
 
 ; **************************************************************************
 ; * Service definitions (remove all services for inetd mode)               *
 ; **************************************************************************
 
 {% set n = 0 %}
 {% for node in groups.all | sort %}
 {% set n = n + 1 %}
 {% if node != inventory_hostname %}
 [{{ hostvars[node].inventory_hostname_short }}]
 accept  = 127.0.{{ n }}.1:4994
 connect = {{ node }}:4949
 delay   = yes
 CAfile  = /etc/stunnel/certs/munin-{{ hostvars[node].inventory_hostname_short }}.pem