aboutsummaryrefslogtreecommitdiff
path: root/deploy_nixos
diff options
context:
space:
mode:
authorBaptiste Jonglez <git@bitsofnetworks.org>2024-06-08 17:14:44 +0200
committerBaptiste Jonglez <git@bitsofnetworks.org>2024-06-08 17:14:48 +0200
commit7e88a88e04db20b0c5552742dae78ae50d3f4318 (patch)
tree7d2d9af8e58a8a2195e66fb1973a93ca1d9154f6 /deploy_nixos
parent9fc22d72d44e3c987bb9fa589fde8af1626cb98f (diff)
downloadnixcfg-7e88a88e04db20b0c5552742dae78ae50d3f4318.tar.gz
nixcfg-7e88a88e04db20b0c5552742dae78ae50d3f4318.zip
prod: garage: Enable on-demand-tls check for *.garage S3 endpoint
We were hitting Let's Encrypt rate limits because we were generating thousands of non-sense certificates like "foo.bar.baz.garage.deuxfleurs.fr" See https://crt.sh Subdomains of garage.deuxfleurs.fr only make sense when accessing buckets through S3 with vhost-style, so let's enable the on-demand-tls check to make sure that the bucket exists in Garage. In the long term, we might want to have a wildcard certificate for this usage, or simply stop supporting vhost-style S3 access.
Diffstat (limited to 'deploy_nixos')
0 files changed, 0 insertions, 0 deletions