261–266 of 266 posts
Earlier quoted context omitted.
But what features does Traefik have that nginx doesn't?
I believe the biggest are automatic Lets Encrypt certificates and the ability to discover services and route to them based on things like Kubernetes labels.
We've been using Traefik in prod for 2 years. While I used NGINX in the past, I decided to migrate to Traefik mainly because of the automatic let's encrypt integration. I am sorry for that decision. Traefik's documentation does not make sense to me or my team. It is finicky and misbehaves without proper logging. As an example - when I want to recreate the certificates - it fails sporadically leaving prod down for an…
This is one area where I've found nixos to be really helpful. I can set this up with just adding some lines to the configuration.nix (which uses lego(1) and letsencrypt in the backend): security.acme = { acceptTerms = true; defaults.email = "admin-email@provider.net"; certs."mydomain.example.com" = { domain = "*.mydomain.example.com"; dnsProvider = "cloudflare"; environmentFile = "/path/to/cloudflare/password"; }; };…
Earlier quoted context omitted.
One of the problems that the yaml interpreter class of languages, or whatever you'd call them, suffer from is the fact that yaml itself is a language and tends to be more or less undocumented in the interpreter docs. It's sort of assumed that you are going to do extremely simple tasks on very flat data structures. That doesn't tend to be the reality that most of us live in. And to really get the most out of these lan…
I honestly wonder why not just write your web server in node or something. It would be traceable and testable and probably performant enough. There's just so much arcana inside platforms like traefik or nginx where they do all this miraculous stuff if you just add the right flags, but also when it doesn't work it's a total black box and there's no way to discover what it thinks it's doing.
Let's imagine we go this way, implemented own self made webserver in nodejs, started using it and the next day it will be required to add simple things like basic auth for specific location or ACL based on Maxmind geo data or even setting straightforward round-robin balancing among several php-fpm upstream, even without weights - what would be the flow here? Involving dev team and trying to put those tasks into their backlog?
Why it's better than just adjust Nginx config in 5-10 minutes?
Earlier quoted context omitted.
I don't see why you're opposing HTTPS everywhere and SNI, HTTP already had the Host header so it is not a new information leak. It's pretty much mandatory if you intend to serve multiple domains with different certificates from the same host/proxy, which seems like a very very common use case, and there is no alternative to this right now.
I don't see how you think NSI doesn't nullify https everywhere. "we need MitM for performance". listen to yourself. if some optimization breaks security, you do not optimize.
It doesn't. SNI doesn't leak the URL being accessed, or anything that isn't encoded in the hostame.
Earlier quoted context omitted.
can you elaborate?
SNI = nsa backdoor into https everywhere. basically it moves private info in the plain text header "for edge performance"
No. Not even remotely true. If you can write a coherent argument that substantiates this claim then I will address it.
Side question - what people use to hide (and make accessible) the internal services such as grafana, prometheus, rabbit mq (the web interface) and such? Should they be public behind such a proxy? (seems odd) Or should they be totally internal and then setup a Wireguard VPN to reach them?
Cloudflare tunnels are super convenient and provide lots of auth mechanisms. If you set up a tunnel using cloudflared and proxy the IP through cloudflare, there's nothing even exposed directly to the internet. You can even have different auth requirements for urls (like /admin) or punch holes for stuff like webhooks. I have set up quite a few as kubernetes pods that direct to private hostnames in different namespaces…
They effectively are decrypting your entire traffic then, including login credentials. It’s a little scary…