glm-5.1
9a2352e61c
Resolve open questions: - OQ-01: Restrict cipher suites to match nginx scope (4 ECDHE-AES-GCM suites for TLS 1.2 + all TLS 1.3 suites) — ADR-012 - OQ-03: Health check on separate local port (default 9900, localhost only) — ADR-013 - OQ-04: Add Unix domain socket admin API for config reload alongside SIGHUP, with structured success/failure responses — ADR-014 - OQ-06: Per-site upstream timeouts with defaults (5s connect, 60s request), overridable in SiteConfig — ADR-015 Document previously undocumented decisions flagged by architecture review: - ADR-016: Explicit bind address requirement (reject 0.0.0.0) - ADR-017: Upstream connection defaults (HTTP/1.1, no redirects, pooling) - ADR-018: 100 MB body size limit (matches nginx, Gitea compatibility) OQ-07 (per-site TLS overrides) remains open for future consideration. Spec updates: - config.md: add health_check_port, admin_socket_path, per-site timeout fields, update TOML example and validation rules - proxy.md: reference ADR-015/017/018 for timeouts, connection defaults, and body limit decisions - tls.md: replace OQ-01 cipher suite section with ADR-012 decision - operations.md: add local health check port section, admin socket reload - overview.md: update Phase 1 scope with new features, add ADR references - open-questions.md: resolve OQ-01/03/04/06, keep OQ-07 open
92 lines
3.3 KiB
Markdown
92 lines
3.3 KiB
Markdown
---
|
|
status: draft
|
|
last_updated: 2026-06-11
|
|
---
|
|
|
|
# Open Questions
|
|
|
|
## TLS
|
|
|
|
### ~~OQ-01: Should cipher suites be restricted beyond rustls defaults?~~
|
|
|
|
- **Origin**: [tls.md](tls.md)
|
|
- **Status**: resolved
|
|
- **Priority**: medium
|
|
- **Resolution**: Restrict cipher suites to match the nginx scope: four
|
|
ECDHE-AES-GCM suites for TLS 1.2 plus all TLS 1.3 suites. This provides
|
|
behavioral parity during migration. See ADR-012.
|
|
- **Cross-references**: ADR-005, ADR-012
|
|
|
|
### ~~OQ-02: What log format should fail2ban consume?~~
|
|
|
|
- **Origin**: [operations.md](operations.md), [proxy.md](proxy.md)
|
|
- **Status**: resolved
|
|
- **Priority**: high
|
|
- **Resolution**: Custom structured log format with `key=value` pairs and
|
|
`RATE_LIMIT` prefix. A corresponding custom fail2ban filter will be provided.
|
|
See ADR-007.
|
|
- **Cross-references**: ADR-007
|
|
|
|
### OQ-07: Should per-site TLS overrides be supported for mixed ACME/manual domains?
|
|
|
|
- **Origin**: [tls.md](tls.md), [config.md](config.md)
|
|
- **Status**: open
|
|
- **Priority**: low
|
|
- **Context**: Phase 1 uses a single TLS configuration (ACME or manual) for all
|
|
domains. All domains share the same ACME config and certificate. If a future
|
|
domain needs a manual certificate (e.g., a corporate CA cert) while other
|
|
domains use ACME, a per-site TLS override would be needed. This would require
|
|
a custom `ResolvesServerCert` that combines ACME-provisioned certs with
|
|
manually loaded certs. For now, all proxied domains use the same ACME config,
|
|
so this is not needed.
|
|
- **Cross-references**: ADR-011
|
|
|
|
## Logging and Monitoring
|
|
|
|
### ~~OQ-03: Should the health check endpoint be on a separate port?~~
|
|
|
|
- **Origin**: [operations.md](operations.md)
|
|
- **Status**: resolved
|
|
- **Priority**: low
|
|
- **Resolution**: Add a configurable local health check port (default: 9900)
|
|
bound to `127.0.0.1` only. Health checks work even when TLS is misconfigured.
|
|
The main HTTPS `/health` endpoint remains available as a fallback. See
|
|
ADR-013.
|
|
- **Cross-references**: ADR-013
|
|
|
|
## Configuration
|
|
|
|
### ~~OQ-04: Should config reload support a Unix domain socket API in addition to SIGHUP?~~
|
|
|
|
- **Origin**: [config.md](config.md)
|
|
- **Status**: resolved
|
|
- **Priority**: low
|
|
- **Resolution**: Yes. Add a Unix domain socket admin API alongside SIGHUP.
|
|
The socket accepts a `reload` command and returns structured success/failure
|
|
responses. SIGHUP is retained as a fallback. See ADR-014.
|
|
- **Cross-references**: ADR-014
|
|
|
|
## Deployment
|
|
|
|
### ~~OQ-05: Should the proxy bind to multiple addresses or just one?~~
|
|
|
|
- **Origin**: [overview.md](overview.md)
|
|
- **Status**: resolved
|
|
- **Priority**: low
|
|
- **Resolution**: A single `bind_addr` is sufficient. The proxy binds to one
|
|
explicit IP address (not `0.0.0.0`). Multi-address binding is not needed for
|
|
this single-server deployment. If needed in the future, `bind_addr` could be
|
|
extended to an array. See config.md for the `bind_addr` field.
|
|
- **Cross-references**: ADR-016
|
|
|
|
## Proxy
|
|
|
|
### ~~OQ-06: Should upstream timeouts be configurable per-site?~~
|
|
|
|
- **Origin**: [proxy.md](proxy.md)
|
|
- **Status**: resolved
|
|
- **Priority**: low
|
|
- **Resolution**: Yes. Per-site upstream timeouts with sensible defaults (5s
|
|
connect, 60s request). Optional fields in SiteConfig that override global
|
|
defaults when specified. See ADR-015.
|
|
- **Cross-references**: ADR-015, ADR-017 |