3 ms·
Why not something like: ssh dogmatic-potato-342@jump.fly.io And tunnel connection over wireguard on jump server
by bluesign 6y ago
Why not something like:
ssh dogmatic-potato-342@jump.fly.io
And tunnel connection over wireguard on jump server
- tptacek 6y agoBecause then there would be some service exposed to the Internet (not over WireGuard; if you have WireGuard, you don't need a jump box) whose job it would be to hop 6PN networks. The only thing we have in our infra now that controls access to 6PN is eBPF code; we keep the system simple so we can reason about it.
- bluesign 6y agoFair point, but isn’t this also losing “who connected to this server in my organization and when” information.
- tptacek 6y agoWe pipe logs from our instances to users (all logs, including your app's); you can see them in `flyctl`. (Certificate issuance is also logged in our API, and these certs are very short-lived).