Open rgaudin opened 7 months ago
As discussed, the "main" problem with serving subdomains during maintenance is that:
The SSL certificates issue is linked to the fact that we use the HTTP challenge, hence needing a list of subdomains to retrieve a certificate for.
While it is possible to configure Caddy to retrieve these certificates at runtime (i.e. once a request is received on a given subdomain), it is risky because it means that anyone could generate hundreds of certificates (by randomly trying many subdomains) and we would be banned from our certificate issuer.
I see two way forward:
Point 2 while more complex is my preference, since this could be a great opportunity to try using https://desec.io/ and its fine-grained permissions model. We could delegate only a subdomain to desec.io for now (demo.hotspot.kiwix.org is sufficient) and see how it works on a non-critical part of our infrastructure.
That's why it's a ticket and not a + *:
commit 😉.
I also think we should use this as an opportunity for using a DNS Challenge but I'm more skeptical regarding changing DNS Hosting. dnssec.io looks fantastic but it's a free service with no warranty. I don't see us using it for the rest so it looks like an effort that cannot scale. We should discuss it with @kelson42
We've seen that users tend to directly access subdomains of the demo which fails in an unexpected way during maintenance as we are not serving those subdomains.