I don't think LetsEncrypt will work for this: https://letsencrypt.org/docs/rate-limits/

tl;dr they will rate limit us to 50 certs per week that end with coder.app

@spikecurtis I think we could contact them and work out some agreement. There are probably other providers to consider as well.

the tricky bit is that the person operating Coder needs a cert that is good for their dev URLs, unless we're MITM all their traffic and customers are ok with that (very unlikely!).

And, in order for that work smoothly, we'd presumably have to be brokering those certs. So, we need some CA that's willing to accept via us either:

• a bunch of certificate requests, one for each dev URL across everyone using Coder in this way
• a wildcard certificate request *.<deployment_id>.coder.app per Coder deployment using this feature

We will also need to centrally manage the deployment IDs to prevent customers from hijacking each other's traffic.

@spikecurtis since Coder controls the backend, coderd can selectively send back our wildcard certificate via SNI. We could toss the private key into the database.

This wouldn't work if there's HTTP middleware between the coderd and the user. But, this is just a feature to get started easily, so advanced setups can bring their own domain.

Doing a wildcard cert per deployment seems simplest to me.

If the ratelimit becomes the only thing standing between us and the feature, I will reach out to these ACME providers and try to work something out.

We will also need to centrally manage the deployment IDs to prevent customers from hijacking each other's traffic.

The deployment ID can be derivative of the certificate key, eliminating hijack risk.

The deployment ID can be derivative of the certificate key, eliminating hijack risk.

Could you describe in a little more detail how this might work?

If the deployment ID is a pure function of the private key, deployment_id = f(key), then this means you can't rotate keys without breaking everyone's bookmarks, which isn't great.

Yeah was just thinking about MVP. There could a key distinct from the TLS cert to authenticate a deployment with our DNS service.

There could a key distinct from the TLS cert to authenticate a deployment with our DNS service.

Yeah, that's more along the lines of what I'm thinking. The deployments authenticate with whatever service we're building to support this, and we keep track of the mapping. We'd want to support rotating that credential as well, but it'd be like passwords, you input your old password in order to set a new one.

Or, "register for a free account on coder.com to use this feature."

re. rate limiting: ZeroSSL does not rate limit but takes ~10-30 seconds longer to provision a URL.

@spikecurtis creating an account would add back a step, which is kinda against the spirit of this feature.

Closed for #3378 ... And also I think this is a waste of time right now.