Nginx TCP stream optimization - performance

Question

I am using Nginx to connect my PHP web server with my MySQL server (via the stream module), so Nginx is running on the web server and on the MySQL server and both are connected via TCP over SSL.
I have noticed the initial connection from my application to the MySQL server takes 4-6ms for every request, and I am wondering if I can do something more to reuse connections or speed things up in general - both servers are in the same network locally.
This is the configuration on my web server:
stream {
upstream mysql {
server 192.168.10.5:3999;
}
server {
listen 127.0.0.1:998 so_keepalive=30s:10s:6;
proxy_pass mysql;
proxy_connect_timeout 1s;
proxy_ssl on;
proxy_ssl_certificate mysql.client.crt;
proxy_ssl_certificate_key mysql.client.key;
proxy_ssl_protocols TLSv1.2;
proxy_ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
proxy_ssl_trusted_certificate root.crt;
proxy_ssl_verify on;
proxy_ssl_verify_depth 2;
proxy_ssl_session_reuse on;
}
}
This is the configuration on my MySQL server:
stream {
upstream mysql_local {
server 127.0.0.1:3306;
}
server {
listen 3999 ssl so_keepalive=60s:30s:20;
proxy_pass mysql_local;
proxy_connect_timeout 1s;
# SSL configuration - use server certificate & key
ssl_certificate mysql.server.crt;
ssl_certificate_key mysql.server.key;
ssl_protocols TLSv1.2;
ssl_ciphers 'ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305:ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-SHA384:ECDHE-RSA-AES256-SHA384:ECDHE-ECDSA-AES128-SHA256:ECDHE-RSA-AES128-SHA256';
ssl_prefer_server_ciphers on;
ssl_client_certificate root.crt;
ssl_verify_client on;
ssl_session_cache shared:MYSQL:100m;
ssl_session_tickets off;
ssl_session_timeout 600m;
ssl_handshake_timeout 5s;
}
}
I tried setting up TCP keepalive on both sides, but not sure if something more is needed or how to check if connections are even reused. There is little online documentation on this kind of setup, especially optimizing it.
I suspect there is more that I can do because within the application I am also connecting to Elasticsearch (also running on the MySQL server) via HTTP+SSL using Nginx as a HTTP proxy and there the connection time is much lower even though it is HTTP, also uses the same certificates and also goes through Nginx as a go-between, yet it only takes max. 1ms to connect. I am using HTTP keepalive connections there.

Answer 1

Someone from Nginx confirmed that TCP connection pooling / some kind of keepalive method is currently not supported and also not planned for the future.
Instead, I added ProxySQL in front of Nginx, which has connection pooling built-in. It also has other benefits, like statistics on which queries are run the most, which take the longest time, etc., so it is actually a really good tool to find out where you can optimize an application and which queries might need additional care. You can even cache certain queries transparently, although I am not really interested in that. Beware though: the documentation of ProxySQL is a bit spotty, and the configuration system seems more confusing than beneficial to me, but once you have set it up it runs really well.