2 ms·
Okay, thanks, this makes more sense in my head now. I thought you managed the domains yourself and that’s clearly not the case. I can think of a few ideas…mayb
by dangus 2y ago
Okay, thanks, this makes more sense in my head now. I thought you managed the domains yourself and that’s clearly not the case.
I can think of a few ideas…maybe they not perfect but here they are.
A couple of them involve setting expectations for your customers and I think that may or may not be reasonable.
1. Tell your customers that apex domain redirection isn’t going to be supported moving forward. This might not be an option for you, but if you can stomach it I think if customers were told to use a subdomain maybe your customers’ customers wouldn’t accidentally add www and necessitate the redirect. For example, “app.example.com” is less likely to pick up stray stray www entries. Your customer can then be responsible directing their customers to the correct place.
2. Similar to #1, you could say that you only support apex domains for DNS providers that support ALIAS/ANAME records at the apex. So if customers complain about #1 you could tell them to suck eggs and change their DNS provider. They can’t say they don’t have a workable option.
3. Run proxy server(s) with a static IP your customers will point their records to, which terminates SSL and runs certbot before forwarding traffic on to your ALB. I think in that case you’d just want to automate the configuration changes for when you modify the customer domain configuration, as well as having job/timer for renewal.
- oriettaxx 2y agothank @dagus. My boss was for option #1, eventually for #2 (especially since we are wasting a huge amount of valuable time to tech customers how to set, change, correct DNS, which is not paid), but then it came out that part of the requirements for our customers (it's public administrations) is to correctly handle the apex domain, so we cannot skip it. So we are left with 3. As to how: we know haproxy a bit, and we see it could work but we have to automate it, as you said. We love Traefik, and the way it creates automatically a letsencrypt TLS certificates at the first https call (so, "on the fly") , but as far as we understood we need to manually add new domain to its configuration: once again we need to "automate" it. We were wondering if some service out there is already providing it, since I think is really a general issue many should face.
- oriettaxx 2y agoah... I've asked perplexity, and they suggest https://apexwise.io/#pricing https://apexwise.io/#pricing and what I've tried to explain is perfectly described here https://apexwise.io/#why https://apexwise.io/#why It could be a solution, but I see we have to add domains (with API), while our need is just to "fire and forget": we want to tell our customers: * set your apex domain as RECORD A with these two IPs: .... then if they do it well, if they don't we just do not want to care: if one day they remove those IPs, or add a new one on their own (something that happens way too often) it's their problem: we do not want to have to handle it (fix certificate renew, tell them they have to react and correct....)
- oriettaxx 2y agoMore here, but still with the same limitations as apexwise.io * https://redirect.pizza/use-cases/apex-to-www https://redirect.pizza/use-cases/apex-to-www The general issue can be called: "apex to www" (I'll update the title of this post) https://stackoverflow.com/questions/16533341/https-redirect-from-root-domain-i-e-apex-or-naked-to-www-subdomain-withou https://stackoverflow.com/questions/16533341/https-redirect-... Omg... I've found it, and it's even free https://www.apextowww.com/#get-started https://www.apextowww.com/#get-started completely automatic!! I'll contact them: I guess we can't just move 500+ domains there without asking permission :)
- oriettaxx 2y agoand maybe it is just Caddy itself? https://news.ycombinator.com/reply?id=43073019&goto=item%3Fid%3D43070025%2343073019 https://news.ycombinator.com/reply?id=43073019&goto=item%3Fi...