Infrastructure » website

Hi Dan,

Here is the motivation for the wildcard cert: https://github.com/ceph/ceph.io/blob/main/ansible/roles/deploy/templates/site.j2#L76-L78

Here's where we serve up the main site is if whatever.ceph.io doesn't exist: https://github.com/ceph/ceph.io/blob/main/ansible/roles/deploy/templates/site.j2#L92-L95

I'm not sure how this could be abused as we only whitelist members of the Ceph github org and a couple folks from SoftIron to trigger website builds: https://github.com/ceph/ceph-build/blob/master/ceph-website-prs/config/definitions/ceph-website-prs.yml#L24-L30

Given that background information, how do you feel about the setup?

David Galloway wrote:

Hi Dan,

Here's where we serve up the main site is if whatever.ceph.io doesn't exist: https://github.com/ceph/ceph.io/blob/main/ansible/roles/deploy/templates/site.j2#L92-L95

Thanks for the background, makes sense.

Would it be possible / better to issue a temporary redirect to https://ceph.io in this case, rather than serve the main site content?