search

alexnathanson / solar-protocol

A repository in development for a solar powered network of servers that host a distributed web platform. Project by Tega Brain, Alex Nathanson and Benedetta Piantella. Supported by Eyebeam, Mozilla, and CS&S
http://solarprotocol.net
220 stars 19 forks source link

Enable serving pages over HTTPS #27

Closed mrchrisadams closed 2 weeks ago

mrchrisadams commented 1 year ago

From the Hackathon, one discussion that came up was making it easier to switch on HTTPS serving for each worker node, using Certbot and LetsEncrypt, and that the current set up had some problems.

https://github.com/alexnathanson/solar-protocol/blob/master/certbot-https-setup.md

We had to navigate a bunch of these problems ourselves setting up servers at the Green Web Foundation, and I'm happy to have a look at this, as it can be a bit of pain.

Would you mind describing one example of the problems you've seen?

therealmaxmoon commented 1 year ago

Why do you need HTTPS? I hope not only because Google is telling you to do so...

As far as I know, only static websites without any sensible data are transferred with the solar-protocol. There is no need for encryption imho. Encryption is an energy-intensive task and everything what wastes energy in a sustainable system, should be avoided.

shuryoka commented 1 year ago

Two things came to my mind:

First: HTTP/2 Isn't HTTPs more or less required for HTTP/2? HTTP/2 seems to be the better choice to set up a sustainable system (see https://greenspector.com/en/http2-latency-and-energy/ by @simplygreenit). So as long as the website isn't text only and it loads external assets like CSS, javascript and images, HTTP/2 + HTTPs seems to be a good idea. While the specs do not actually require HTTPs, the major browser providers seem to (https://www.digicert.com/blog/https-only-features-in-browsers).

Second: SEO For a good ranking in Google's search results, HTTPs is also a part of the must haves. So yes, Google tells us so. :-)

descartes commented 1 year ago

As far as I know, only static websites without any sensible data are transferred with the solar-protocol.

And I was getting so excited - what if I want to put some "sensible" data or more important, a client side single page app on to this network - one that has a login and interacts?

There's so much detail to figure out that's not obvious, but even serving the front pages talking to a conventionally powered backend database would be a start.

Over https. Because that's how we keep passwords and data secure. Just say'ing