3 ms·

Thought for a second that it included automatic TLS certificates but that is still done manually with Certbot, which also isn’t that difficult.

deleted 3y ago
[deleted]
danappelxx 3y ago
Not that difficult, but it’s still a separate dependency (with python requirements). If the goal here is a Caddy competitor, then IMO it’s missing the mark in terms of “one stop shop”. What’s the killer feature?
- wolletd 3y ago
  On the python requirements: I've always been satisfied with Bash implementations of ACME. I use dehydrated from the very beginning (when it was still called letsencrypt.sh) and lately started using acme.sh.
kijin 3y ago
This thing will probably run in a bunch of VMs/containers behind a load balancer, so it's actually better that it doesn't try to obtain any certificates by default. Even a small number of apps trying to get their own certificates at the same time can exhaust the Let's Encrypt quota for your domain, with serious consequences to your other online properties.
- smarkov 3y ago
  > Even a small number of apps trying to get their own certificates at the same time can exhaust the Let's Encrypt quota for your domain I got curious about this and decided to look it up, they actually have more restrictions than I expected[1]. Looks like to play it on the safe side you might be better off having a single server issuing certificates and distributing them where needed as well as using wildcards as much as possible. Interestingly, it looks like Google is doing just that since their certificate covers a very wide range of domains[2]. [1] https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ [2] https://www.sslchecker.com/sslchecker?su=b39e88e1c4d3efcdb79ce7182d9317d1 https://www.sslchecker.com/sslchecker?su=b39e88e1c4d3efcdb79...

3 ms·

Thought for a second that it included automatic TLS certificates but that is still done manually with Certbot, which also isn’t that difficult.

by l5870uoo9y 3y ago

deleted 3y ago
[deleted]
danappelxx 3y ago
Not that difficult, but it’s still a separate dependency (with python requirements). If the goal here is a Caddy competitor, then IMO it’s missing the mark in terms of “one stop shop”. What’s the killer feature?
- wolletd 3y ago
  On the python requirements: I've always been satisfied with Bash implementations of ACME. I use dehydrated from the very beginning (when it was still called letsencrypt.sh) and lately started using acme.sh.
kijin 3y ago
This thing will probably run in a bunch of VMs/containers behind a load balancer, so it's actually better that it doesn't try to obtain any certificates by default. Even a small number of apps trying to get their own certificates at the same time can exhaust the Let's Encrypt quota for your domain, with serious consequences to your other online properties.
- smarkov 3y ago
  > Even a small number of apps trying to get their own certificates at the same time can exhaust the Let's Encrypt quota for your domain I got curious about this and decided to look it up, they actually have more restrictions than I expected[1]. Looks like to play it on the safe side you might be better off having a single server issuing certificates and distributing them where needed as well as using wildcards as much as possible. Interestingly, it looks like Google is doing just that since their certificate covers a very wide range of domains[2]. [1] https://letsencrypt.org/docs/rate-limits/ https://letsencrypt.org/docs/rate-limits/ [2] https://www.sslchecker.com/sslchecker?su=b39e88e1c4d3efcdb79ce7182d9317d1 https://www.sslchecker.com/sslchecker?su=b39e88e1c4d3efcdb79...