Live data from Hacker News

Show HN: An API to provision custom hostnames with SSL

news.ycombinator.com

11–20 of 38 posts

Re: Show HN: An API to provision custom hostnames with SSL

#11
post #9

Can you help me understand how this is different than Cloudflare's offering [1]? 1- https://www.cloudflare.com/lp/sector/saas/

It's superficially similar. The most obvious difference is that you need a CloudFlare Enterprise plan to do that stuff, and we have a free tier + easy metered pricing.

You can probably do a complete Fly implementation in the time it takes to setup a call with one of their sales folks.

Re: Show HN: An API to provision custom hostnames with SSL

#12
post #6

Timely. I launched a SaaS a few months ago and have found early customers have expected custom domain names with SSL. It seems that not offering this is a deal breaker these days. I didn't even consider that third parties such as yourself might offer a solution. Edit: I tried to sign up. I have to already choose lots of detailed config options? No option for AWS elastic beanstalk or EC? Asking for my AWS secret key w…

Send me an email and I'll help (kurt@fly.io, or support@fly.io)! We've been working on improving the onboarding flow for new apps, but it's definitely complicated. Elastic Beanstalk and EC2 will work fine, and we can help you get setup. You can either run through ELB (if you already have that setup) or use our agent and let us handle all the load balancing: https://fly.io/docs/agents/

It should be obvious when and what we need AWS keys for. We only need those for private S3 buckets and to invoke Lambda functions. We don't want full access keys, just scoped IAM stuff!

Re: Show HN: An API to provision custom hostnames with SSL

#13
post #12
post #6

Timely. I launched a SaaS a few months ago and have found early customers have expected custom domain names with SSL. It seems that not offering this is a deal breaker these days. I didn't even consider that third parties such as yourself might offer a solution. Edit: I tried to sign up. I have to already choose lots of detailed config options? No option for AWS elastic beanstalk or EC? Asking for my AWS secret key w…

Send me an email and I'll help (kurt@fly.io, or support@fly.io)! We've been working on improving the onboarding flow for new apps, but it's definitely complicated. Elastic Beanstalk and EC2 will work fine, and we can help you get setup. You can either run through ELB (if you already have that setup) or use our agent and let us handle all the load balancing: https://fly.io/docs/agents/ It should be obvious when and wh…

One thing I really appreciate from companies is when they give me a policy with just the permissions they absolutely need to function (or a reference to a cross-account policy). That way I can review it and I'm not dicking around with trying to figure out the right permissions, and I know what all you may have access to. Getting s3 objects may be a deal breaker for example, unless the action is properly scoped to a bucket.

Re: Show HN: An API to provision custom hostnames with SSL

#14
post #10
post #8

I am trying to understand what you offer, compared to AWS. Does it kind of substitute the combination of API Gateway + CloudFront + Certificate Manager ? I have some Lambda funcs running and just today starting looking into this AWS combination to access Lambda from the outside world. So I wonder if Fly would do the same. If its the same then it certainly is simpler to set up. And might be cheaper as well, but the pr…

Fly is a good alternative to API Gateway + Cloudfront + Certificate Manager. We can invoke lambda functions directly. And yes, AWS pricing is a monstrous headache. I'm really not sure if we're cheaper at scale, but we're easy to predict at the very least (and the first 2 million requests are free).

Ok thanks. Might be good to mention comparable AWS services (and maybe others) in your faq. Its only because of this being on HN that I gave it more then a few seconds of consideration ;-) If I ran into it by accident I might have missed the essence.

Re: Show HN: An API to provision custom hostnames with SSL

#15
post #12

Earlier quoted context omitted.

Send me an email and I'll help (kurt@fly.io, or support@fly.io)! We've been working on improving the onboarding flow for new apps, but it's definitely complicated. Elastic Beanstalk and EC2 will work fine, and we can help you get setup. You can either run through ELB (if you already have that setup) or use our agent and let us handle all the load balancing: https://fly.io/docs/agents/ It should be obvious when and wh…

One thing I really appreciate from companies is when they give me a policy with just the permissions they absolutely need to function (or a reference to a cross-account policy). That way I can review it and I'm not dicking around with trying to figure out the right permissions, and I know what all you may have access to. Getting s3 objects may be a deal breaker for example, unless the action is properly scoped to a b…

Yeah agreed. We should make that explicit, or even give people a CloudFormation template to set up a restricted policy.

And to be clear, we don't need s3 access unless you want to serve files from a private s3 bucket. Most sites don't use that at all.

Re: Show HN: An API to provision custom hostnames with SSL

#16
post #12
post #6

Timely. I launched a SaaS a few months ago and have found early customers have expected custom domain names with SSL. It seems that not offering this is a deal breaker these days. I didn't even consider that third parties such as yourself might offer a solution. Edit: I tried to sign up. I have to already choose lots of detailed config options? No option for AWS elastic beanstalk or EC? Asking for my AWS secret key w…

Send me an email and I'll help (kurt@fly.io, or support@fly.io)! We've been working on improving the onboarding flow for new apps, but it's definitely complicated. Elastic Beanstalk and EC2 will work fine, and we can help you get setup. You can either run through ELB (if you already have that setup) or use our agent and let us handle all the load balancing: https://fly.io/docs/agents/ It should be obvious when and wh…

You don't need AWS keys at all. This enrollment flow flies in the face of best practices.

Intead, you should be providing your users with instructions to create an IAM role for cross-account utilization. Ideally in addition to the instructions, you'd provide a minimal CloudFormation template defining such a role, with your minimum required permissions.

Asking a customer to create a user and ship you a secret is asking for trouble.

Re: Show HN: An API to provision custom hostnames with SSL

#18

I may have missed this in the docs, but how are you verifying that someone owns the hostname they are trying to create a cert for? Do you need to cname the hostname to a fly domain first?

I see, read too quickly. So after the POST we/user needs to create a DNS entry and then you guys will poll for that and kick off cert generation, right?

Re: Show HN: An API to provision custom hostnames with SSL

#19

I may have missed this in the docs, but how are you verifying that someone owns the hostname they are trying to create a cert for? Do you need to cname the hostname to a fly domain first?

I see, read too quickly. So after the POST we/user needs to create a DNS entry and then you guys will poll for that and kick off cert generation, right?

That's right! It happens immediately. Thanks for checking us out.

Re: Show HN: An API to provision custom hostnames with SSL

#20
post #16
post #12

Earlier quoted context omitted.

Send me an email and I'll help (kurt@fly.io, or support@fly.io)! We've been working on improving the onboarding flow for new apps, but it's definitely complicated. Elastic Beanstalk and EC2 will work fine, and we can help you get setup. You can either run through ELB (if you already have that setup) or use our agent and let us handle all the load balancing: https://fly.io/docs/agents/ It should be obvious when and wh…

You don't need AWS keys at all. This enrollment flow flies in the face of best practices. Intead, you should be providing your users with instructions to create an IAM role for cross-account utilization. Ideally in addition to the instructions, you'd provide a minimal CloudFormation template defining such a role, with your minimum required permissions. Asking a customer to create a user and ship you a secret is askin…

And when you use a role like this, you really should use an external ID to avoid confused deputy attacks.

http://docs.aws.amazon.com/IAM/latest/UserGuide/id_roles_cre...

Post reply on HN