Porter Valley Technology CompanyDiscuss your project
All six parts of Forge

Keystone · DNS and certificates

Finding the right address, and proving it

Keystone answers two questions for every connection on Forge - where is this service, and is it really who it says it is? Zones are written in Git, name servers are replicated, and certificates are issued and renewed automatically.

Powered by Knot DNS, Unbound, step-ca, cert-manager and Let's Encrypt

Why it matters

DNS and certificates are invisible until they fail, and then nothing works. An expired certificate or a mistyped record takes a site down as surely as a broken server.

Keystone keeps both in files, applies them by pipeline, and renews certificates before they expire, so they stay boring.

DNS zones kept in Git
12
copies of each internal zone
3
resolvers, on separate machines
2
certificate renewal
Auto

How it works

  1. Zones in Git

    Each DNS zone is a file in Git. A change is reviewed like code and applied by the pipeline to a hidden primary name server.

  2. Copied, and watched

    Secondary name servers - one on a separate machine and two inside the cluster - keep copies of each zone. An alert fires if a copy falls behind.

  3. Our own certificate authority

    Internal services get certificates from our own authority - a step-ca root signing an intermediate in Vault - issued and renewed automatically by cert-manager.

  4. Let's Encrypt for the public

    Public websites get free, automatically renewed certificates from Let's Encrypt, at our edge or on the CDN.

Live today

  • Internal DNS from Git, with replicated name servers and drift alerts.
  • Internal certificates from our own authority, issued and renewed automatically.
  • Let's Encrypt certificates for public websites.

In progress

  • Verified, encrypted connections between every one of our own services, not only at the edge.
  • DNSSEC, so resolvers can check our answers have not been tampered with.

What you get

HTTPS on your domain

Valid certificates for your site, renewed before they expire, without a reminder in anyone's diary.

Names that resolve

Your services can reach each other by name, inside the platform.

A record of every change

Every DNS change is a commit you can read, with who made it and when.

Built on

  • Knot DNS

    A fast, open-source authoritative name server from CZ.NIC. It serves our internal zones.

  • Unbound

    A validating, recursive resolver from NLnet Labs. It answers our machines' DNS questions.

  • step-ca

    An open-source certificate authority. It holds the root of our internal trust.

  • cert-manager

    Issues and renews certificates inside Kubernetes, from our authority and from Let's Encrypt.

  • Let's Encrypt

    The free, non-profit certificate authority behind most of the web's HTTPS.

Hallmark

A standard name for every service, so nothing on the platform is a mystery. Every name is checked automatically before it exists.

Portcullis

The front door. It routes visitors to the right place, with a CDN caching public pages so they load fast. The cluster dials out to it, so it opens no web ports to the internet.

Citadel

Disks and S3-compatible object storage. On our main tier, every piece of data is copied to three separate machines, so one failure loses nothing.