5 ms·

Why did you switch away from nginx?

by enimodas 9y ago

scrollaway 9y ago
Not having to deal with certificate renewal is a big deal.
- fb03 9y ago
  I am running nginx reverse-proxying to a python API right now. Dealing with certificate renewal is a matter of running a daily cronjob issuing 'certbot renew'. If it works it replaces the fullchain.pem certificate, and that's it, easy peasy. Am I missing something?
  - scrollaway 9y ago
    And by running Caddy instead, I have one less piece to monitor and worry about. The way Let's Encrypt works, it makes a lot of sense to have the functionality be part of the web server.
    - JshWright 9y ago
      > The way Let's Encrypt works, it makes a lot of sense to have the functionality be part of the web server. That's an odd thing to say in this particular conversation thread... Why would you want to tightly couple your webserver to the availability of another service provider?
      - scrollaway 9y ago
        It's not tightly coupled any more than it would be with certbot. The issue I filed is an issue because it's unexpected behaviour (despite early closure, it has actually now been fixed).
    - stephenr 9y ago
      > by running Caddy instead, I have one less piece to monitor and worry about No, with Caddy you have several vaguely related pieces glued together with superglue. > The way Let's Encrypt works, it makes a lot of sense to have the functionality be part of the web server. I think this thread is pretty much proof that that approach will bite you in the ass.
      - scrollaway 9y ago
        > I think this thread is pretty much proof that that approach will bite you in the ass. What bit me here is the fact that I'm running alpha software instead of a battle-tested web server; I'm doing so willingly, with full awareness of the risks that that entails. Drawing the conclusion you did from the variables at play is shortsighted. If anything bites people in the ass, it's prejudice and shortsightedness. I wouldn't want you handling my ops/infrastructure.
        stephenr 9y ago
        > What bit me here is the fact that I'm running alpha software This wasn't caused by a bug. This was a deliberate decision to fail to start if the certificates on-disk were <= 30 days away from expiring and the CA can't be contacted. > Drawing the conclusion you did from the variables at play is shortsighted Using caddy is the web-server-stack equivalent of "putting all your eggs in one basket". If one thing about it isn't working the way you want, you have to either a) replace it completely or b) work out how to disable the bit that's not working how you want, and replace that part of it. > Drawing the conclusion you did from the variables at play is shortsighted - People use a piece of software that serves as both ACME TLS certificate client and web server - Said software by design won't start if the CA can't be contacted 30-days out from expiry The conclusion I drew is that such integration leave the operator with less control than if they followed a separation-of-concerns approach, and left web serving to a web server, and TLS certificate renewal to an ACME client. The former doesn't need to care about how old the certificates are, just use what it's given.
        scrollaway 9y ago
  - tyingq 9y ago
    The simple config syntax and sane defaults is nice in Caddy. For example, 3 lines of config nets a https server with http/2 support and an A rating with Qualsys for ssl setup.
    - stephenr 9y ago
      > sane defaults Failure to start if a CA is down is a "sane default" ?
      - tyingq 9y ago
        Yes, that's exactly what I meant. You can tell because I didn't present any examples. And because one issue invalidates everything else. And I didn't express my opinion on this issue up thread.
- majewsky 9y ago
  Is it? I spent one day getting certbot up and running, and ever since then it's been pretty much a done deal.
  - manigandham 9y ago
    That's 1 day that I didn't have to spend, even better when dealing with many instances.
    - majewsky 9y ago
      Okay, I agree, with two caveats: 1. The cost does not scale with the amount of instances since it is the one-time cost to create the configuration package. 2. If you decide to go for Caddy instead, you'll have to spend the same time, if not more, learning Caddy.
eridius 9y ago
I switched from nginx to caddy for my (extremely low-traffic) server because I was tired of having to copy & paste a bunch of SSL setup any time I was configuring a new domain.

Why did you switch away from nginx?

scrollaway 9y ago

Not having to deal with certificate renewal is a big deal.

fb03 9y ago
I am running nginx reverse-proxying to a python API right now. Dealing with certificate renewal is a matter of running a daily cronjob issuing 'certbot renew'. If it works it replaces the fullchain.pem certificate, and that's it, easy peasy. Am I missing something?
- scrollaway 9y ago
  And by running Caddy instead, I have one less piece to monitor and worry about. The way Let's Encrypt works, it makes a lot of sense to have the functionality be part of the web server.
  - JshWright 9y ago
    > The way Let's Encrypt works, it makes a lot of sense to have the functionality be part of the web server. That's an odd thing to say in this particular conversation thread... Why would you want to tightly couple your webserver to the availability of another service provider?
    - scrollaway 9y ago
      It's not tightly coupled any more than it would be with certbot. The issue I filed is an issue because it's unexpected behaviour (despite early closure, it has actually now been fixed).
  - stephenr 9y ago
    > by running Caddy instead, I have one less piece to monitor and worry about No, with Caddy you have several vaguely related pieces glued together with superglue. > The way Let's Encrypt works, it makes a lot of sense to have the functionality be part of the web server. I think this thread is pretty much proof that that approach will bite you in the ass.
    - scrollaway 9y ago
      > I think this thread is pretty much proof that that approach will bite you in the ass. What bit me here is the fact that I'm running alpha software instead of a battle-tested web server; I'm doing so willingly, with full awareness of the risks that that entails. Drawing the conclusion you did from the variables at play is shortsighted. If anything bites people in the ass, it's prejudice and shortsightedness. I wouldn't want you handling my ops/infrastructure.
      - stephenr 9y ago
        > What bit me here is the fact that I'm running alpha software This wasn't caused by a bug. This was a deliberate decision to fail to start if the certificates on-disk were <= 30 days away from expiring and the CA can't be contacted. > Drawing the conclusion you did from the variables at play is shortsighted Using caddy is the web-server-stack equivalent of "putting all your eggs in one basket". If one thing about it isn't working the way you want, you have to either a) replace it completely or b) work out how to disable the bit that's not working how you want, and replace that part of it. > Drawing the conclusion you did from the variables at play is shortsighted - People use a piece of software that serves as both ACME TLS certificate client and web server - Said software by design won't start if the CA can't be contacted 30-days out from expiry The conclusion I drew is that such integration leave the operator with less control than if they followed a separation-of-concerns approach, and left web serving to a web server, and TLS certificate renewal to an ACME client. The former doesn't need to care about how old the certificates are, just use what it's given.
        scrollaway 9y ago
- tyingq 9y ago
  The simple config syntax and sane defaults is nice in Caddy. For example, 3 lines of config nets a https server with http/2 support and an A rating with Qualsys for ssl setup.
  - stephenr 9y ago
    > sane defaults Failure to start if a CA is down is a "sane default" ?
    - tyingq 9y ago
      Yes, that's exactly what I meant. You can tell because I didn't present any examples. And because one issue invalidates everything else. And I didn't express my opinion on this issue up thread.
majewsky 9y ago
Is it? I spent one day getting certbot up and running, and ever since then it's been pretty much a done deal.
- manigandham 9y ago
  That's 1 day that I didn't have to spend, even better when dealing with many instances.
  - majewsky 9y ago
    Okay, I agree, with two caveats: 1. The cost does not scale with the amount of instances since it is the one-time cost to create the configuration package. 2. If you decide to go for Caddy instead, you'll have to spend the same time, if not more, learning Caddy.

eridius 9y ago

I switched from nginx to caddy for my (extremely low-traffic) server because I was tired of having to copy & paste a bunch of SSL setup any time I was configuring a new domain.