Prep for move off CloudFlare #794

jonah · 2019-03-30T18:24:02Z

jonah commented

2019-03-30 18:24:02 +00:00

We are going to move off of CloudFlare to an Nginx server we control that will reverse proxy to the GitHub Pages host. Essentially we will be acting in the exact same way CloudFlare currently does for us, but under our control.

We need to start by serving this site on privacytoolsio.github.io/privacytools.io instead of www.privacytools.io so we can actually implement this server side (which is what this commit accomplishes). Once we move to the new DNS infrastructure we will point the main domain to our Nginx server and get Let's Encrypt installed. Hopefully this will be accomplished with minimal downtime.

Obviously, don't merge this until the backend is ready.

Resolves: #374

We are going to move off of CloudFlare to an Nginx server we control that will reverse proxy to the GitHub Pages host. Essentially we will be acting in the exact same way CloudFlare currently does for us, but under our control. We need to start by serving this site on `privacytoolsio.github.io/privacytools.io` instead of `www.privacytools.io` so we can actually implement this server side (which is what this commit accomplishes). Once we move to the new DNS infrastructure we will point the main domain to our Nginx server and get Let's Encrypt installed. Hopefully this will be accomplished with minimal downtime. Obviously, don't merge this until the backend is ready. --- Resolves: #374

ghost commented

2019-03-30 18:31:30 +00:00

(Migrated from github.com)

Why not just let GH take care of everything?

jonah commented

2019-03-30 18:51:39 +00:00

@Shifterovich that’s something I thought about, but this is my thinking...

If we just let GH handle it, GitHub will have access to all their access logs of course and will be able to see Visitor IPs. If we proxy it, GH will only be able to see our IP, which is better from our user’s privacy perspective. And
If we proxy it, we can enable all the custom headers we want, which will help with #792, #151, etc. We can also do better browser caching for attachments.

Thoughts?

Edit: also GitHub will take a while to get an SSL certificate probably, if it doesn’t have one already for this domain (I can’t check, not a repo admin). That’d be a lot of downtime if we had to wait for their servers to catch up.

Also ideally we'll eventually stop relying on GitHub at all, and this would make that transition easier. But that's long-term.

GitHub will still be handling everything behind the scenes to be clear, it'll just be User --> Our Server --> GitHub Pages

@Shifterovich that’s something I thought about, but this is my thinking... 1. If we just let GH handle it, GitHub will have access to all their access logs of course and will be able to see Visitor IPs. If we proxy it, GH will only be able to see our IP, which is better from our user’s privacy perspective. And 2. If we proxy it, we can enable all the custom headers we want, which will help with #792, #151, etc. We can also do better browser caching for attachments. Thoughts? Edit: also GitHub will take a while to get an SSL certificate probably, if it doesn’t have one already for this domain (I can’t check, not a repo admin). That’d be a lot of downtime if we had to wait for their servers to catch up. Also ideally we'll eventually stop relying on GitHub at all, and this would make that transition easier. But that's long-term. GitHub will still be handling everything behind the scenes to be clear, it'll just be User --> Our Server --> GitHub Pages

ghost commented

2019-03-30 19:37:03 +00:00

(Migrated from github.com)

If that's something @BurungHantu1605 can set up and maintain, sure, I see the benefits.

Using just GH is the easiest solution. For me personally, the convenience outweighs the few drawbacks (like custom headers and GH having log access).

If that's something @BurungHantu1605 can set up and maintain, sure, I see the benefits. Using just GH is the easiest solution. For me personally, the convenience outweighs the few drawbacks (like custom headers and GH having log access).

jonah commented

2019-03-30 19:49:47 +00:00

@BurungHantu1605 and I are setting up servers for stuff like Searx and Mastodon and DNS so this is just included in all of that work.

@BurungHantu1605 and I are setting up servers for stuff like [Searx](https://search.privacytools.io/) and [Mastodon](https://social.privacytools.io/) and DNS so this is just included in all of that work.

jonah commented

2019-03-31 00:38:39 +00:00

This won't be necessary for the new plan :)

This repo is archived. You cannot comment on pull requests.

1 Participants

Due Date

No due date set.

Dependencies

No dependencies set.

Reference: privacyguides/privacytools.io#794