5 ms·

Azure Storage Static Website and Azure Front Door

34 points by omiossec 6y ago

Arnavion 6y ago
Front Door seems to be overkill for storage account-hosted static websites. Instead of setting up storage accounts for multiple regions manually and then setting up Front Door in front of them, it would be easier to create one storage account and put Azure CDN in front of that instead. That is what I do for my website.
- deleted 6y ago
  [deleted]
- arethuza 6y ago
  Out of interest, how much does that approach cost, I did have a quick look at the Azure CDN pricing page but that didn't really help ;-)
  - Arnavion 6y ago
    I don't have a breakdown per resource, but the whole resource group (Storage account + CDN + a KeyVault to store the TLS cert + a Function app to get the TLS cert from LetsEncrypt + a DNS for ACME + a second Function app to update the HTTPS cert used by the CDN to whatever's in the KeyVault) cost about $1.50 for the month of March. Of course nobody visits my website, so it'd probably cost a bit more if there was some actual egress traffic.
    - arethuza 6y ago
      Thanks - you have any good links to resources describing how to replicate that setup?
      - Arnavion 6y ago
        https://www.arnavion.dev/blog/2019-08-04-lets-encrypt-via-azure-function/ https://www.arnavion.dev/blog/2019-08-04-lets-encrypt-via-az... https://github.com/Arnavion/acme-azure-function https://github.com/Arnavion/acme-azure-function Specifically https://github.com/Arnavion/acme-azure-function/blob/master/UpdateCdnCertificateFunction/deployment-template.json https://github.com/Arnavion/acme-azure-function/blob/master/... is the template for the website-side of things, as opposed to the ACME-side of things if you don't care for that.
        Havoc 6y ago
        Thanks!
Lucasoato 6y ago
Does it support https?
- garblegarble 6y ago
  Yes: https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https https://docs.microsoft.com/en-us/azure/frontdoor/front-door-...
- arkj 6y ago
  If you need a custom domain on https you’ll need to add azure CDN in front of the static site.
  - JoyrexJ9 6y ago
    You can enable HTTPS on a static site, using either CDN or with Azure Front Door. The process is nearly identical
ksec 6y ago
Can someone explain to me like I am a 5 years old. The Site is lots of gibberish to me. What is the different between this and hosting my site with CDN ( Pushed or Pulled ) in front of it?
- pram 6y ago
  It's basically Cloudfront + S3
yodon 6y ago
Given that a simple CDN is the normal way to solve the problem the linked page is talking about, it's hard to understand why they didn't include a price comparison against placing a simple CDN in front of a Storage hosted static website to help the reader understand how Frontdoor does or doesn't improve on the costs and/or functionality of that approach. At a bit under $1/day the Front Door approach feels more expensive than the CDN solution but I'm not an Azure expert so it would be great to know for sure. Also, I tried to give feedback on the linked page using the integrated give us feedback popup that was presented to me on my iPhone. The result was an error code which isn't confidence inducing.
- breakingcups 6y ago
  That's funny, I had no cfeedback to give until I closed that pop-up and it promptly scrolled me all the way back to the top even though I was still only halfway through reading the article.
deno 6y ago
DOS attack means Denial of Service. If you are attacked and your bandwidth costs grow exponentially then how have you protected yourself from a “denial of service” attack? Azure Frontdoor should not advertise itself as “protecting your app from attacks.” It does no such thing.
withinboredom 6y ago
I set this up the other day for fun. This basically a CDN plus http proxy (for doing rewrites, combining multiple services into one, etc). What they neglect to be upfront about is that you pay the bandwidth cost of the health checks. I watched my bill go from €4 a month to €40 in one day. Not cool. I tuned the health checks and even turned some of them off and it’s back to mostly normal, but I’m glad I paid attention. I really like the power of Front Door, but it’s sneaky.

34 points by omiossec 6y ago

Front Door seems to be overkill for storage account-hosted static websites. Instead of setting up storage accounts for multiple regions manually and then setting up Front Door in front of them, it would be easier to create one storage account and put Azure CDN in front of that instead. That is what I do for my website.

deleted 6y ago
[deleted]
arethuza 6y ago
Out of interest, how much does that approach cost, I did have a quick look at the Azure CDN pricing page but that didn't really help ;-)
- Arnavion 6y ago
  I don't have a breakdown per resource, but the whole resource group (Storage account + CDN + a KeyVault to store the TLS cert + a Function app to get the TLS cert from LetsEncrypt + a DNS for ACME + a second Function app to update the HTTPS cert used by the CDN to whatever's in the KeyVault) cost about $1.50 for the month of March. Of course nobody visits my website, so it'd probably cost a bit more if there was some actual egress traffic.
  - arethuza 6y ago
    Thanks - you have any good links to resources describing how to replicate that setup?
    - Arnavion 6y ago
      https://www.arnavion.dev/blog/2019-08-04-lets-encrypt-via-azure-function/ https://www.arnavion.dev/blog/2019-08-04-lets-encrypt-via-az... https://github.com/Arnavion/acme-azure-function https://github.com/Arnavion/acme-azure-function Specifically https://github.com/Arnavion/acme-azure-function/blob/master/UpdateCdnCertificateFunction/deployment-template.json https://github.com/Arnavion/acme-azure-function/blob/master/... is the template for the website-side of things, as opposed to the ACME-side of things if you don't care for that.
      - Havoc 6y ago
        Thanks!

Lucasoato 6y ago

Does it support https?

garblegarble 6y ago
Yes: https://docs.microsoft.com/en-us/azure/frontdoor/front-door-custom-domain-https https://docs.microsoft.com/en-us/azure/frontdoor/front-door-...
arkj 6y ago
If you need a custom domain on https you’ll need to add azure CDN in front of the static site.
- JoyrexJ9 6y ago
  You can enable HTTPS on a static site, using either CDN or with Azure Front Door. The process is nearly identical

ksec 6y ago

Can someone explain to me like I am a 5 years old. The Site is lots of gibberish to me. What is the different between this and hosting my site with CDN ( Pushed or Pulled ) in front of it?

pram 6y ago
It's basically Cloudfront + S3

yodon 6y ago

Given that a simple CDN is the normal way to solve the problem the linked page is talking about, it's hard to understand why they didn't include a price comparison against placing a simple CDN in front of a Storage hosted static website to help the reader understand how Frontdoor does or doesn't improve on the costs and/or functionality of that approach. At a bit under $1/day the Front Door approach feels more expensive than the CDN solution but I'm not an Azure expert so it would be great to know for sure. Also, I tried to give feedback on the linked page using the integrated give us feedback popup that was presented to me on my iPhone. The result was an error code which isn't confidence inducing.

breakingcups 6y ago
That's funny, I had no cfeedback to give until I closed that pop-up and it promptly scrolled me all the way back to the top even though I was still only halfway through reading the article.

deno 6y ago

DOS attack means Denial of Service. If you are attacked and your bandwidth costs grow exponentially then how have you protected yourself from a “denial of service” attack? Azure Frontdoor should not advertise itself as “protecting your app from attacks.” It does no such thing.

withinboredom 6y ago

I set this up the other day for fun. This basically a CDN plus http proxy (for doing rewrites, combining multiple services into one, etc). What they neglect to be upfront about is that you pay the bandwidth cost of the health checks. I watched my bill go from €4 a month to €40 in one day. Not cool. I tuned the health checks and even turned some of them off and it’s back to mostly normal, but I’m glad I paid attention. I really like the power of Front Door, but it’s sneaky.