4 ms·
They're using the autocert package which is the bare minimum. It's brittle, doesn't allow for horizontal scaling of your proxy instances because you're subject
by francislavoie 2y ago
They're using the autocert package which is the bare minimum. It's brittle, doesn't allow for horizontal scaling of your proxy instances because you're subject to Let's Encrypt rate limits and simultaneous cert limits. (Disclaimer: I help maintain Caddy) Caddy/Certmagic solves this by writing the data to a shared storage so only a single cert will be issued and reused/coordinated across all instances through the storage. It also doesn't have issuer fallback, doesn't do rate limit avoidance, doesn't respect ARI, etc.
Holding requests until an upstream is available is also something Caddy does well, just configure the reverse_proxy with try_duration and try_interval, it will keep trying to choose a healthy upstream (determined via active health checks done in a separate goroutine) for that request until it times out.
Their proxy headers handling doesn't consider trusted IPs so if enabled, someone could spoof their IP by setting X-Forwarded-For. At least it's off by default, but they don't warn about this.
This looks pretty undercooked. I get that it's simple and that's the point, but I would never use this for anything in its current state. There's just so many better options out there.
- markusw 2y agoI just want to say I use Caddy for this exact thing and it works beautifully! :D Thank you all for your work!
- shafyy 2y agoInteresting, thanks for the detailed explanation! I'm not very experienced with devops, so this is very helpful!
- mwcampbell 2y agoI doubt that 37signals themselves are using Kamal's new automatic SSL support, at least in their main apps, since they're running their apps behind Cloudflare. I'd love to see a deployment tool that's like Kamal, in that it's simpler than Kubernetes, but fronted by something mature like Caddy, that can be exposed directly to the Internet rather than running behind a CDN like Cloudflare.
- shafyy 2y agoMy understanding is that even if you run behind Cloudfare, you need to secure your connection to Cloudfare with a certificate?
- pqdbr 2y agoThat's an option that Cloudflare gives you in the panel. I wouldn't run my Web apps without something like Cloudflare in front; it's great for DDoS, WAF, Rate Limiting, so on. Assuming that, I just use the Cloudflare-signed certificate and configure that in my Nginx. It's really easy to do and it expires in 20 years or something.
- robertritz 2y agoI'm using apps deployed with Kamal behind cloudflare and I set up some Traefik things to enable Let's Encrypt certs so the connection from my server to Cloudflare is SSL secured.