Skip to content
New issue

Have a question about this project? Sign up for a free GitHub account to open an issue and contact its maintainers and the community.

By clicking “Sign up for GitHub”, you agree to our terms of service and privacy statement. We’ll occasionally send you account related emails.

Already on GitHub? Sign in to your account

Route clients at DNS level #262

Open
c-w opened this issue Dec 8, 2019 · 0 comments
Open

Route clients at DNS level #262

c-w opened this issue Dec 8, 2019 · 0 comments

Comments

@c-w
Copy link
Member

c-w commented Dec 8, 2019

Currently all Lokole clients are configured to send their API requests to mailserver.lokole.ca (see install.py).

We should change this such that each client sends its API requests to a separate endpoint, e.g. {client_name}.lokole.ca. This provides us a number of benefits such as being able to block a misbehaving client at the DNS level and enabling different clients to be served by different server stacks which is useful for scaling, experimentation, etc.

There are several steps required to implement this change:

  1. Modify cert-manager (see cluster-issuer.yaml) to issue wildcard certificates. This will enable us to request a TLS certificate which is valid for all of our dynamically created hostnames in the format of *.lokole.ca.
  2. In the client registration code (see actions.py), create a new DNS A record in Cloudflare for the client, such as {client_name}.lokole.ca and return this value in the registration response. The code required for this will be very similar to what we're already doing to create the client-specific MX record (see dns.py), but instead of creating a MX record for {client_name}.lokole.ca we'll create an A record that maps {client_name}.lokole.ca to the server's IP address.
  3. To make the server aware of its IP address, we'll need to store the ingress IP available at the end of the server setup (see setup.sh) in a kubernetes secret and inject this to the server as an environment variable.
  4. The Lokole webapp code already looks up the hostname of the API server it should connect to via an environment variable (see config.py). We'll need to modify the Lokole client setup script (which sets the server endpoint environment variable) from its current static value (see install.py) to a dynamic value. We can achieve this by modifying the Lokole client setup script where we call the client registration endpoint to store the new API endpoint URL returned by the server (see install.py).
Sign up for free to join this conversation on GitHub. Already have an account? Sign in to comment
Projects
None yet
Development

No branches or pull requests

1 participant