^ Custom domains issue a certificate for the entire (sub-)domain (that's one of their downsides actu

^ Custom domains issue a certificate for the entire (sub-)domain (that's one of their downsides actually, they don't use the existing wildcard cert they issue their own cert)

IIsaac McFadyen ^ Custom domains issue a certificate for the entire (sub-)domain (that's one of ...

dave•1/16/24, 8:01 PM

isn't that a positive?

Unsmart•1/16/24, 8:01 PM

depends if you consider that a downside I guess LUL

Isaac McFadyenOP•1/16/24, 8:01 PM

So if you ever have a Worker that you don't want to be easily discovered via cert transparency logs, don't use Custom Domains

Isaac McFadyenOP•1/16/24, 8:01 PM

I mean... I don't really think it's a positive? There's not much benefit to re-issuing a cert.

Isaac McFadyenOP•1/16/24, 8:01 PM

If you have one for *.example.com*.example.com why issue one for foo.example.comfoo.example.com?

Original message was deleted

dave•1/16/24, 8:01 PM

sanity check, are these messages talking about the same feature? https://discord.com/channels/595317990191398933/779390076219686943/1196903837257170974 and https://discord.com/channels/595317990191398933/779390076219686943/1196837523729682586

CChaika Worker are behind proxy so that'll just work. You can disable IPv6 via API even ...

kev-ac•1/16/24, 8:02 PM

Disabling IPV6 is still an option while its disabled in the UI? Nice to know

Original message was deleted

dave•1/16/24, 8:02 PM

oh, so the certificate handling is different, but the TLS/cert perf is the same?

CChaika Worker are behind proxy so that'll just work. You can disable IPv6 via API even ...

kev-ac•1/16/24, 8:02 PM

Yes its the limitation that the upstream service needs an IPV4 because it still does not support IPV6

kev-ac•1/16/24, 8:03 PM

And it needs to be a valid IPv4 because otherwise there will be connection issues between the client and the service

Kkev-ac Disabling IPV6 is still an option while its disabled in the UI? Nice to know 😅

Chaika•1/16/24, 8:04 PM

via the api yea

Chaika•1/16/24, 8:04 PM

You can always delete it

Chaika•1/16/24, 8:04 PM

it's just an adv. cert under Edge Certs

Chaika•1/16/24, 8:04 PM

if you're fast enough or script it, you can delete it before it issues

IIsaac McFadyen If you have one for `*.example.com` why issue one for `foo.example.com`?

dave•1/16/24, 8:04 PM

so when I do curl -v, I see only the SSL cert for the domain and not the wildcard ;P

Original message was deleted

Chaika•1/16/24, 8:05 PM

yea Worker Custom Domains are just really hacky. You don't need ACM to delete them, or use it. They do count against your ACM Quota though, and show up there

Unsmart•1/16/24, 8:05 PM

Speaking of ACM I think the workers custom domains does use your limit of ACM if you have it or it least did in the past LUL

kian•1/16/24, 8:05 PM

the main feature of custom domains (imo) is not having same-zone fetch issues, but that has been broken since day 1

kian•1/16/24, 8:05 PM

Unsmart•1/16/24, 8:06 PM

I just like how it shows in the dns thats why I use it

Unsmart•1/16/24, 8:06 PM

service bindings are better for fetching anyways so that feature is useless imo

Kkian the main feature of custom domains (imo) is not having same-zone fetch issues, b...

Chaika•1/16/24, 8:07 PM

for me custom domains are just easier and I can just snipe the adv. cert

Chaika•1/16/24, 8:07 PM

no reason to use routes over custom domains if you intend to use the entire subdomain, routes are messier, configuration slightly hidden, and can be misconfigured

Unsmart•1/16/24, 8:09 PM

docs also say this so I just follow it

UUnsmart Speaking of ACM I think the workers custom domains does use your limit of ACM if...

dave•1/16/24, 8:10 PM

we have Total TLS on and our cert count is 0 out of 100.

dave•1/16/24, 8:11 PM

and we have 81 certs

Isaac McFadyenOP•1/16/24, 8:11 PM

Now that we have descriptions on DNS records I just add a description to the Worker record and use routes lul

CChaika via the api yea

kev-ac•1/16/24, 8:11 PM

It did indeed work. Thanks for the hint!

kev-ac•1/16/24, 8:11 PM

Not the best solution but the only possible right now. But having it disabled for the whole zone... suboptimal

Ddave we have Total TLS on and our cert count is 0 out of 100.

Chaika•1/16/24, 8:11 PM

total tls certs don't count

Kkev-ac Not the best solution but the only possible right now. But having it disabled fo...

Chaika•1/16/24, 8:12 PM

convince your upstream to move on from 2006 and support ipv6

dave•1/16/24, 8:13 PM

ahhh

CChaika convince your upstream to move on from 2006 and support ipv6 🙂

kev-ac•1/16/24, 8:13 PM

They haven't updated their software in the last 4 years but we sadly have to integrate it into our app

kev-ac•1/16/24, 8:14 PM

I wish they would do it, but I doubt it

IIsaac McFadyen Now that we have descriptions on DNS records I just add a description to the Wor...

dave•1/16/24, 8:19 PM

isn't that ent-only? or am I thinking about tags?

Ddave isn't that ent-only? or am I thinking about tags?

Chaika•1/16/24, 8:19 PM

Neither are Ent-only

Chaika•1/16/24, 8:20 PM

Comments are on free, Tags are Pro or higher

dave•1/16/24, 8:20 PM

ooo nice! thanks

JJ Mocko - Adapture•1/16/24, 8:24 PM

Hi CF developers. I have an existing worker, and I cannot figure out how to have a 'staging' version and a 'production' version of the same worker. I have tried running

npx wrangler deploy --env production

npx wrangler deploy --env production

and

npx wrangler deploy --env staging

npx wrangler deploy --env staging

but all it does it create a new worker with -production or -staging at the end.

JJ Mocko - Adapture•1/16/24, 8:25 PM

Can someone point me in the right direction?

JJJ Mocko - Adapture Hi CF developers. I have an existing worker, and I cannot figure out how to have...

Chaika•1/16/24, 8:25 PM

but all it does it create a new worker with -production or -staging at the end.

That is how environments work right now with Wrangler

JJ Mocko - Adapture•1/16/24, 8:26 PM

I have other workers that in the dashboard are named the same, and they have a dropdown on the worker page where I can select environment

Chaika•1/16/24, 8:26 PM

There is bits and pieces in the dashboard about the old Service Environments system if you're being confused by that, that shows production and such. James has a write up explaining that all here: https://community.cloudflare.com/t/environments-vs-deployments/451036/2?u=chaika

Chaika•1/16/24, 8:27 PM

The TLDR being the Wrangler way with entirely different Workers is the best way right now and the intended way. You can have specific settings in your wrangler.toml for specific environments as well https://developers.cloudflare.com/workers/wrangler/environments/

Environments · Cloudflare Workers docs

Deploy the same Worker application with different configuration for each environment.

JJ Mocko - Adapture•1/16/24, 8:31 PM

So that functionality has been removed? (having the same worker have multiple environments).

JJJ Mocko - Adapture So that functionality has been removed? (having the same worker have multiple en...

Chaika•1/16/24, 8:32 PM

Essentially, iirc it never fully worked anyway

Chaika•1/16/24, 8:32 PM

there's just bits of pieces of it left over

Unsmart•1/16/24, 8:33 PM

I dont even think it existed for more than a month tbh

JJ Mocko - Adapture•1/16/24, 8:33 PM

I have clients that have that functionality currently in their dashboard working.. but ok, thanks for the information!

JJ Mocko - Adapture•1/16/24, 8:33 PM

I appreciate you taking the time

^ Custom domains issue a certificate for the entire (sub-)domain (that's one of their downsides actu

Similar Threads

Similar Threads

Similar Threads