Document reverse proxy header buffers for the sync websocket

[LeoAnt02]

Problem

The Zero client sends its entire client schema (plus auth token) URL-encoded in the Sec-WebSocket-Protocol header, and zero-cache echoes it back in the 101 Switching Protocols response. Behind nginx or Kubernetes ingress-nginx with default settings, proxy_buffer_size is 4 KB — once an app's schema grows past that, the proxy rejects every sync connection with 502 Bad Gateway before anything reaches zero-cache.

This is painful to diagnose in the wild:

• Nothing appears in zero-cache logs — the 101 response dies at the proxy.
• The client only sees a generic websocket failure.
• It typically appears out of nowhere when a schema change crosses the threshold, on a deploy that has nothing to do with infrastructure.

I hit this in production: sync had worked for months, then adding a feature's tables pushed the encoded handshake from ~1.9 KB to ~4.7 KB and every environment behind nginx went dark simultaneously. Bisecting a padded Sec-WebSocket-Protocol header against the proxy showed the failure cliff exactly between 3.8 KB (101) and 4.2 KB (502), while the identical handshake succeeded against zero-cache directly. Raising proxy_buffer_size fixed it instantly.

Change

Adds a Reverse Proxies section to the deployment page documenting the mechanism, the symptom, and the fix (nginx and ingress-nginx examples), plus a note that request-side header limits can also be reached with large schemas + long JWTs.

[vercel]

@LeoAnt02 is attempting to deploy a commit to the Rocicorp Team on Vercel.

A member of the Team first needs to authorize it.