Let's Encrypt is down

Re:Let's Encrypt is down by mholt on Friday May 19, 2017 @09:57AM (#14375655)

Caddy restarts gracefully with zero downtime. If you're killing the process and starting one anew, you're doing it wrong. Use signal USR1 to gracefully apply new configuration changes. Failed reloads fall back to the current working configuration without any changes or downtime. https://caddyserver.com/docs/cli#usr1

[ Parent | on HN ]

Re:Let's Encrypt is down by atonse on Friday May 19, 2017 @10:26AM (#14375923)

This misses the overall point.

If I am hosting 5 sites on caddy, and add a 6th one, I restart the server. If the 6th site doesn't work (for example, if DNS didn't resolve for lets encrypt), the other 5 sites which were working before the restart, all fail to start as caddy completely crashes.

This is basic resiliency you'd expect from your web server. Why should the other 5 sites fail to start if their configs are completely valid?

[ Parent | on HN ]

Re:Let's Encrypt is down by majewsky on Friday May 19, 2017 @10:29AM (#14375962)

> If I am hosting 5 sites on caddy, and add a 6th one, I restart the server.

No, you don't. You reload the server, not restart it. Restarting a web server should only be required if you get an upgrade for it (or for OpenSSL etc.)

[ Parent | on HN ]

Re:Let's Encrypt is down by sleepychu on Friday May 19, 2017 @10:42AM (#14376078)

OK, there's a 0-day patch for OpenSSL, without it my users are vulnerable to RCE. Why can't I restart if LE's ACME is down?

[ Parent | on HN ]

Re:Let's Encrypt is down by e_d_e_v on Friday May 19, 2017 @10:38AM (#14376043)

This goes wholly against most cattle-not-pets devops philosophy though, right?

[ Parent | on HN ]

Re:Let's Encrypt is down by eropple on Friday May 19, 2017 @10:48AM (#14376144)

How so? In Chef:

   notifies :reload, "service[caddy]", :delayed

[ Parent | on HN ]

Re:Let's Encrypt is down by e_d_e_v on Friday May 19, 2017 @11:14AM (#14376461)

The idea here is that the server can't be scaled up or down. I suggest googling "cattle vs pets". If you know how to make a single process scale horizontally across additional hosts or scale up in alternative datacenters with a chef service notification, I'd pay you money to tell me how.

[ Parent | on HN ]

Re:Let's Encrypt is down by eropple on Friday May 19, 2017 @01:39PM (#14377835)

So, um: devops and cloud architecture is my job. I think I know what "cattle vs pets" is referring to. Nothing in this thread has anything to do with one versus many processes or one versus many nodes, nor does it have anything to do with manual configuration of anything. Rewrite the configuration based in orchestration data or, in extremity, upload a new version of a cookbook that handles that new site; the hypothetical sixth site is added and the service kicked over without human interaction. Scaling is an orthogonal concern.

[ Parent | on HN ]

Re:Let's Encrypt is down by ptman on Friday May 19, 2017 @10:19AM (#14375867)

What if there's a reason to restart the server or spawn a new one?

[ Parent | on HN ]

Re:Let's Encrypt is down by imhoguy on Friday May 19, 2017 @12:41PM (#14377309)

Scaling, upgrading, disk issues, just migrating to new place... and foremost https://en.m.wikipedia.org/wiki/Fallacies_of_distributed_com... Also nowadays with Docker around I rarely see server/app bundles supporting graceful reload.

[ Parent | on HN ]