Fedora magazine DNS switch

[Michael Scherer]

Hi,

as noted on https://pagure.io/fedora-infrastructure/issue/8109, I did
finish the DNS switch so fedora magazine should now be avaliable
without the proxy.

This was done because the previous setup did trigger alerts resulting
in the reverse proxy being blocked, resulting in random failure from
people until someone (a admin) fixed it. Since that's just going to be
a whack-a-mole game (as we will always trigger alert from proxies, due
to the setup), we removed the proxy from the equation.

In practice, it do change a few details:
- the certificate. Now, this is a letsencrypt one, not a digicert one. 
- the blog is ip v4 only

If anything is broken, do not hesitate to ping me or report the problem
using the usual way.

For now, I keep the setup so it can be reversed easily (just a rapid
DNS change) if any problem is discovered. I will clean the config later
once enough time as passed.

[Paul Frields]

Thanks for continuing to work on this, Michael. I'm not sure I
understand the proxy trouble, but that's OK. The Magazine seems to be
working well for daily use so far. If something changes we'll let you
know!

Paul

On Tue, Aug 27, 2019 at 8:34 AM Michael Scherer  wrote:
> Hi,
>
> as noted on https://pagure.io/fedora-infrastructure/issue/8109, I did
> finish the DNS switch so fedora magazine should now be avaliable
> without the proxy.
>
> This was done because the previous setup did trigger alerts resulting
> in the reverse proxy being blocked, resulting in random failure from
> people until someone (a admin) fixed it. Since that's just going to be
> a whack-a-mole game (as we will always trigger alert from proxies, due
> to the setup), we removed the proxy from the equation.
>
> In practice, it do change a few details:
> the certificate. Now, this is a letsencrypt one, not a digicert one.
> the blog is ip v4 only
>
> If anything is broken, do not hesitate to ping me or report the problem
> using the usual way.
>
> For now, I keep the setup so it can be reversed easily (just a rapid
> DNS change) if any problem is discovered. I will clean the config later
> once enough time as passed.
>
> --
> Michael Scherer / He/Il/Er/Él
> Sysadmin, Community Infrastructure
>
> Fedora Magazine mailing list -- [e-mail]
> To unsubscribe send an email to [e-mail]
> Fedora Code of Conduct: https://docs.fedoraproject.org/en-US/project/code-of-conduct/
> List Guidelines: https://fedoraproject.org/wiki/Mailing_list_guidelines
> List Archives: https://lists.fedoraproject.org/archives/list/[e-mail].o...

[Stuart D. Gathman]

On Tue, 27 Aug 2019, Paul Frields wrote:
> Thanks for continuing to work on this, Michael. I'm not sure I
> understand the proxy trouble, but that's OK. The Magazine seems to be
> working well for daily use so far. If something changes we'll let you
> know!
> > In practice, it do change a few details:
> > the certificate. Now, this is a letsencrypt one, not a digicert one.
> > the blog is ip v4 only

I don't see any problem with letsencrypt.  But why not include the IPv6
of the server in DNS?  Why would a proxy be required to support IPv6?
Does Wordpress somehow not support IPv6 or something, and the proxy was
used to work around that?

[Michael Scherer]

Le mardi 27 août 2019 à 10:06 -0400, Stuart D. Gathman a écrit :
> On Tue, 27 Aug 2019, Paul Frields wrote:
> > Thanks for continuing to work on this, Michael. I'm not sure I
> > understand the proxy trouble, but that's OK. The Magazine seems to
> > be
> > working well for daily use so far. If something changes we'll let
> > you
> > know!
> > > In practice, it do change a few details:
> > > the certificate. Now, this is a letsencrypt one, not a digicert
> > >
> > > one.
> > > the blog is ip v4 only
>
> I don't see any problem with letsencrypt.

yeah, just warning people to not panic if they see the cert got
changed;
> But why not include the IPv6
> of the server in DNS?

Our provider (wpengine) only support ipv4 AFAIK.
> Why would a proxy be required to support IPv6?
> Does Wordpress somehow not support IPv6 or something, and the proxy
> was used to work around that?

No, the proxy was used for the old installation (like last month) in
Fedora cloud. It was setup this way so the certificate (a digicert one,
so 3 years but not automated) could be managed by the infra team for
all websites at once. The IP v6 was just a side effect of being hosted
on Fedora infra managed systems.

We moved out of the cloud to a hoted wordpress provider, so we had to
get a new certificate, hence the switch to lets encrypt. And a new IP,
hence the warning

I warned people, in case some folks have some fancy browser plugin that
verify certificates, this kind of stuff (principle of least surprise).