Deploy using template railway.com/deploy/open...

ssh tinyblog.page

Try manage using Railway railway.com/deploy/manage

I tested this setup with BunnyDNS across 4 regions (US, Singapore, Europe, Sydney) and it has worked really well so far!

Now when I deploy a service, I replicate to every region. The agent, proxy, and control plane handle the rest.

So any server can handle any challenge. Once ready, the generated certificate syncs to every server.

This needed perfect coordination between control plane, Traefik proxy, and server agents for certificate sync.

Instead of each proxy creating its own certificate, I delegate to the control plane. When a custom domain is added, the control plane triggers certificate generation. Any challenge request hitting the domain (could be any server in the fleet) gets rewritten by the proxy to the control plane.

When a proxy server tries to generate SSL certificates, the HTTP-01 ACME challenge needs to hit the correct server. With GeoDNS routing users everywhere, this couldn't be done reliably.

The solution: Central ACME.

My goal: any node can become a proxy, terminate TLS for any service, and route to available servers. Always hitting the nearest server.

Since I couldn't afford Anycast / BGP, I went with GeoDNS. DNS always resolves to nearest server, but there was a big problem: ACME challenges.

In our server fleet, any node can become an edge, all edges can terminate TLS, we’ve central ACME and certificate sync across edges and thanks to all this, users will get their requests served faster from the nearest edge!

I must thank @AmpCode for helping me crack the final bits.

Is GeoDNS a viable option? 🤔

Anyone starting their software engineering career should read this: addyosmani.com/blog/21-les...