Homec4science

When an install is instanced, include the instance identifier in the URI for…

Authored by epriestley <git@epriestley.com> on Feb 3 2015, 23:55.

Description

When an install is instanced, include the instance identifier in the URI for file data

Summary:
This allows us to CDN the cluster.

General problem is that we can't easily give each instance its own CDN URI (giraffe.phcdn.net) in Cloudfront, because it requires that you enumerate all aliases (and there's a limit of 100) and depends on SNI (a newish feature of SSL which allows one server to serve multiple certificates, but which doesn't have full support everywhere yet).

It's possible that we could eventually work around this, or use Cloudflare instead (which has a different model that seems like a slightly easier fit for CDN-domain-per-instance), but I don't want to sink a ton of work into this and want to keep things on AWS insofar as we reasonably can.

The easiest way to fix this is just to put the instance identity into URIs, then read it out when handling CDN requests. This has no effect on installs without cluster instance configuration, which is all of them except ours.

It's also slightly desirable to share this stuff, since we get to share the cache for static resources, which are always identical across instances.

So requests go from the Cloudfront gateway ("xyz.cloudfront.com") to the LB with a hard-coded instance name ("cdn.phacility.com"), which gets them routed to a balanced web machine. The web machine picks the correct instance name out of the URI, acts as that instance, and does the correct thing.

The messiest part of this is that we need "cdn.phacility.com" to be a real instance so it can serve static resources, but that's not a big deal. We have a few other hard-codes which have to be real resources for now, like we must have a merchant named "Phacility".

Test Plan:

  • Viewed files with security.alternate-file-domain off (i.e., no file tokens).
  • Viewed pages and files with security.alternate-file-domain on. Saw correct resource behavior, @isntance generation of URIs, and correct token redirect behavior for files.

Reviewers: btrahan

Reviewed By: btrahan

Subscribers: epriestley

Differential Revision: https://secure.phabricator.com/D11668

Details

Committed
epriestley <git@epriestley.com>Feb 3 2015, 23:55
Pushed
aubortJan 31 2017, 17:16
Parents
rPHda1531f219d0: Policy - make ManiphestTaskQuery verify project visibility first thing
Branches
Unknown
Tags
Unknown

Event Timeline

epriestley <git@epriestley.com> committed rPHe6fb1dc1e9dc: When an install is instanced, include the instance identifier in the URI for… (authored by epriestley <git@epriestley.com>).Feb 3 2015, 23:55