The discussion is about hiding the origin IP address in a Discourse setup using a DDoS protection service. meglio wants to know if there is a global setting to hide the origin IP address everywhere, including in emails and Let’s Encrypt SSL certificate issuance.
meglio mentions that their DDoS protection service, ddos-guard.net, requires the origin IP address to be hidden. Stephen notes that Let’s Encrypt may not work if the server isn’t directly accessible.
pfaffman advises against using Let’s Encrypt and suggests that the DDoS protection service should provide an email server that removes the IP address from email headers. However, meglio disagrees and proposes a possible solution by manually getting a certificate and configuring the DDoS protection service to transparently proxy HTTPS traffic.
itsbhanusharma suggests using DNS validation to get an SSL certificate for Nginx, which involves using a reverse proxy outside the Docker container.
We are using a ddos protection service from the very beginning, and their staff says it is important that out software never ever expose the origin IP in any way.
Besides turning off emails entirely, are there any settings that we put in app.yml that will help with this globally?
For instance, one of the things that make me confused is, at a time when Discourse will issue an SSL certificate with Let’s Encrypt, will Discourse expose the origin IP, or will it make Let’s Encrypt validate by URL, not by IP?
Let’s Encrypt may not enroll correctly at all if the server isn’t directly accessible. If Cloudflare’s orange cloud is turned on for example this can screw up the challenge.
You can’t use let’s encrypt. They will need to supply certs on their reverse proxy.
They should provide an email server that will remove your ip from the email headers, but really, leaking your ip isn’t a problem if you firewall access to your server and allow access only from their server.
They have an option where they don’t decrypt secure traffic, i.e. it they “transparently” proxy it without decrypting. So I was thinking, what if I manually get a certificate and install it as guided in this topic, and the configure ddos-guard to just transparently proxy all https traffic.
FWIW, you can get an ssl cert for nginx using dns validation. The Process is a bit involved and requires you to use nginx reverse proxy outside docker container.