Turns out half the internet has a single-point-of-failure called “Cloudflare”

Re:Turns out half the internet has a single-point-of-failure... by henriquez on Monday July 20, 2020 @11:48AM (#23898989)

Right, with Stackpath they do TLS but not necessarily on the primary domain. You don't have to point your nameservers if you don't want to. So you can set them up on a subdomain and use their fake SSL to serve purely static files (if the file doesn't exist on CDN at the time it's requested then their system will pull it directly from your server via a private subdomain, serve it to the client and store it for next time)

So in this way it's possible to setup CDN with shared SSL for purely static files but not the app server itself; you don't have to give the keys to the whole kingdom so to speak and it's cheaper than Cloudflare at the basic level.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by Kalium on Monday July 20, 2020 @12:00PM (#23899121)

Let me see if I follow. Auto-provisioned TLS (misleadingly termed "fake SSL") on the front-end for delivering static contents and caching. A private subdomain with a pinned cert not managed by the CDN to deliver static contents to the CDN. And a third subdomain for the application itself that's not going through the CDN.

I was under the impression that the same result could be achieved with Cloudflare, or indeed nearly any CDN. Was I mistaken? Though you may not actually need a secret, private subdomain for static files with all CDNs.

Again, please let me know if I've made a mistake somewhere. I'd love to learn something this morning.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by henriquez on Monday July 20, 2020 @12:23PM (#23899333)

You're right about that. So it might look like this

static.domain.com (CDN subdomain with auto provisioned TLS)

static-uncached.domain.com (private pass-through subdomain when CDN is missing a file)

www.domain.com (app server hosted wherever)

You're right that you could do something similar with other CDNs including Cloudflare (you can just set the www subdomain to "bypass Cloudflare" to accomplish a similar result), but I'm not aware of any way to use Cloudflare on a domain without forwarding your nameservers to them, effectively giving them complete control over the domain. At least with Stackpath I can host DNS wherever and simply point the subdomains I want at them.

Also, by the time you do the work to split static files into separate subdomains you might as well go with a dedicated CDN. One of the selling points of Cloudflare is for sites serving everything on one subdomain that they can forward to Cloudflare and get caching without any work.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by edaemon on Monday July 20, 2020 @12:41PM (#23899513)

They have a CNAME setup where authoritative DNS stays outside of Cloudflare: https://support.cloudflare.com/hc/en-us/articles/36002061511...

It requires at least the Business level plan, though.

[ Parent | on HN ]

Re:Turns out half the internet has a single-point-of-failure... by henriquez on Monday July 20, 2020 @12:48PM (#23899574)

Ah my bad. That’s probably why I never knew about it. The $200/month entry price is steep there.

[ Parent | on HN ]