Skip to content

Commit 2e4b9d9

Browse files
KrinkleKrinkle
committed
doc: Add fastly.md, initial version of TLS-hostnames list
1 parent 96d9cbd commit 2e4b9d9

3 files changed

Lines changed: 85 additions & 4 deletions

File tree

‎doc/cdn.md‎

Lines changed: 4 additions & 3 deletions
Original file line numberDiff line numberDiff line change
@@ -54,9 +54,10 @@ For uptime monitoring, refer to [monitoring.md](./monitoring.md).
5454
The "code" service has the following notable configuration settings (last updated Oct 2023). See also [issue #30](https://github.com/jquery/infrastructure-puppet/issues/30).
5555

5656
* Origins:
57-
* Always TLS to origin.
58-
* Verify cert.
59-
* Enable SNI hostname.
57+
* TLS to origin: Always.
58+
* Verify cert: Yes.
59+
* SNI hostname: Enabled.
60+
* Shielding: Enabled (choose same region as origin, ref [hosting.md](./hosting.md)).
6061
* Headers
6162
* [Ignore query strings: req.url = req.url.path](https://docs.fastly.com/en/guides/making-query-strings-agnostic)
6263
* [Case-insensitive req.url](https://developer.fastly.com/reference/vcl/functions/strings/std-tolower/)

‎doc/fastly.md‎

Lines changed: 81 additions & 0 deletions
Original file line numberDiff line numberDiff line change
@@ -0,0 +1,81 @@
1+
# Fastly
2+
3+
## See also
4+
5+
* [cdn.md](./cdn.md), our Fastly configuration in broad strokes.
6+
* [cdn-cert.md](./cdn-cert.md), the annual renew process including how to upload it to Fastly.
7+
* [runbook-fastly-debug.md](./runbook-fastly-debug.md), how to temporarily enable real-time logging.
8+
9+
## Fastly service domains
10+
11+
There appears to be no single place that documents all these together, so we've compiled this ourselves from public docs and emperical testing.
12+
13+
The format appears to be:
14+
15+
```
16+
[dualstack].[letter].[kind].[region].fastly.net
17+
```
18+
19+
References: [Working with CNAME](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-cname-records-and-your-dns-provider/), [2022 Archive](https://docs-archive.fastly.com/snapshots/static/2022-05-31-guides-aio.pdf), [2021 Archive](https://docs-archive.fastly.com/snapshots/static/2021-02-28-guides-aio.pdf), [Legacy Shared TLS](https://web.archive.org/web/20210730031032/https://docs.fastly.com/products/legacy-shared-tls-and-tls-wildcard-certificates-services), [Fastly blog: IPv6](https://www.fastly.com/blog/ipv6-fastly), [Fastly blog: HTTP/2](https://www.fastly.com/blog/http2-now-general-availability)).
20+
21+
* `[region]`:
22+
* `global`: Fastly's entire global network.
23+
* `us-eu`: North American and EU POPs only.
24+
* `<nothing>`: There appears to be a legacy map for some or all of the below variants that uses a presumed smaller subset or alternate set of POPs, under a different IP-range, and is IPv4-only and HTTP/1-only.
25+
* `[kind]`:
26+
* "sni": TLS 1.2+, HTTP/2+.
27+
* "ssl": TLS 1.2 only, HTTP/1 only.
28+
* "nonssl": Plaintext HTTP only.
29+
* ~~"shared"~~: "Shared SAN certicate" which included HTTP/2. Undocumented after 2022.
30+
* `[letter]`: Specific TLS configurations for sni/ssl/shared kinds, detailed below.
31+
This component is absent for "nonssl".
32+
It appears that certifications are identified by letter+kind, such that letters in `sni` are distinct from those under `ssl` and `shared`. This means if you deploy a certificate to `k.sni`, you can freely choose between regions and dualstack, but you can't see it via "ssl" or "shared".
33+
* `[dualstack]`: Optional prefix to enable IPv6.
34+
35+
### TLS-hostnames
36+
37+
Below uses `global` as the default region, but it is assumed (but not verified by us) that `us-eu` exists for all of these.
38+
39+
When "HTTP/2" is listed, this includes "HTTP/1" support.
40+
41+
When "HTTP/3" is listed, this includes "HTTP/1" and "HTTP/2" support.
42+
43+
For TLS versions, only the listed versions are supported.
44+
45+
| Identifier (letter+kind) | Example hostname | Description | Comment | References
46+
|--|--|--|--|--
47+
| `j.sni` | `j.sni.global.fastly.net` | TLS 1.3 or TLS 1.2, HTTP/2 | | [Enabling dualstack](https://www.fastly.com/documentation/guides/full-site-delivery/domains-and-origins/enabling-dualstack-connections/)
48+
| `k.sni` | `k.sni.global.fastly.net` | TLS 1.3 + 0RTT or TLS 1.2 + CBC, HTTP/3 | Like `t.sni` but with cipher suites in CBC mode for Windows 7 compat | [jquery/infrastructure-puppet#30](https://github.com/jquery/infrastructure-puppet/issues/30)
49+
| `m.sni` | `m.sni.global.fastly.net` | TLS 1.3 or TLS 1.2, HTTP/3 | HTTP/3 experiment? | [2022 Archive](https://docs-archive.fastly.com/snapshots/static/2022-05-31-guides-aio.pdf)
50+
| `n.sni` | `n.sni.global.fastly.net` | TLS 1.3 + 0RTT, HTTP/3 | HTTP/3 experiment? | [2022 Archive](https://docs-archive.fastly.com/snapshots/static/2022-05-31-guides-aio.pdf)
51+
| `s.sni` | `s.sni.global.fastly.net` | TLS 1.3 or TLS 1.2, HTTP/3 | | ..
52+
| `t.sni` | `t.sni.global.fastly.net` | TLS 1.3 + 0RTT, HTTP/3 | | [Your own certificates](https://www.fastly.com/documentation/guides/getting-started/domains/securing-domains/setting-up-tls-with-your-own-certificates/)
53+
54+
The `ssl` kind letters seem to be interchangable with `shared`, so only one is shown:
55+
56+
| Identifier (letter+kind) | Example hostname | Description | References
57+
|--|--|--|--
58+
| `g.ssl` | `g.ssl.global.fastly.net` | Unknown (Shared SAN) | [Fastly blog: HTTP/2](https://www.fastly.com/blog/http2-now-general-availability)
59+
| `k.ssl` | `k.ssl.global.fastly.net` | Unknown (Shared SAN) | [Fastly blog: HTTP/2](https://www.fastly.com/blog/http2-now-general-availability)
60+
| `m.ssl` | `m.ssl.global.fastly.net` | TLS 1.2 only, HTTP/1 only (Shared SAN) | [2022 Archive](https://docs-archive.fastly.com/snapshots/static/2022-05-31-guides-aio.pdf), [TLS quick start](https://www.fastly.com/documentation/guides/getting-started/domains/securing-domains/tls-quick-start/)
61+
62+
Unless otherwise indicated, these are IPv4-only. There is a `dualstack.*` variant of all these which adds IPv6 support ([Fastly blog: IPv6](https://www.fastly.com/blog/ipv6-fastly)), [TLS quick start](https://www.fastly.com/documentation/guides/getting-started/domains/securing-domains/tls-quick-start/), [Enabling dualstack](https://www.fastly.com/documentation/guides/full-site-delivery/domains-and-origins/enabling-dualstack-connections/), [Working with CNAME](https://www.fastly.com/documentation/guides/getting-started/domains/working-with-domains/working-with-cname-records-and-your-dns-provider/)).
63+
64+
For example:
65+
66+
* `dualstack.g.shared.global.fastly.net`
67+
* `dualstack.g.shared.us-eu.fastly.net`
68+
* `dualstack.g.ssl.global.fastly.net`
69+
* `dualstack.g.ssl.us-eu.fastly.net`
70+
* `dualstack.k.sni.global.fastly.net`
71+
* `dualstack.m.sni.global.fastly.net`
72+
* `dualstack.n.sni.global.fastly.net`
73+
* `dualstack.t.sni.global.fastly.net`
74+
* ...
75+
76+
### Non-TLS hostnames
77+
78+
* `nonssl.global.fastly.net`
79+
* `nonssl.us-eu.fastly.net`
80+
* `dualstack.nonssl.global.fastly.net`
81+
* `dualstack.nonssl.us-eu.fastly.net`

‎doc/runbook-fastly-debug.md‎

Lines changed: 0 additions & 1 deletion
Original file line numberDiff line numberDiff line change
@@ -8,7 +8,6 @@ page in Fastly, this includes for example requests by cache response
88
type (hit, miss, pass, synthetic, error), status code, object size,
99
and HTTP version.
1010

11-
1211
There isn't a built-in way to review, e.g. a sampled web request log,
1312
but you can debug actual requests by setting up a logging endpoint
1413
under one of the "services" in your account. This endpiont then

0 commit comments

Comments
 (0)