hn.today

Scriptable GeoDNS: Leaving AWS for Bunny

vincent.bernat.ch67 points23 comments
Screenshot of Scriptable GeoDNS: Leaving AWS for Bunny

The setup replaces Amazon CloudFront and Route 53 in a globally distributed blog infrastructure. Route 53’s zone, query, health-check, and DNSSEC-signing fees made it costly, while Bunny DNS offers near-free hosting for many domains and programmable answers. Bunny CDN was straightforward to adopt, supports IPv6, and can cache image formats separately; logging is disabled to limit personal-data collection. Its main drawback is that it does not yet support HTTP/3. The blog runs on seven virtual machines across Europe, North America, South America, Asia, and Australia. A JavaScript DNS function uses the requester’s location and server health to select nearby hosts, returning two addresses so a browser can try another if needed.

Returning two addresses can send users to a much more distant server because resolvers may reorder them. HTTPS DNS records could express preferred and backup servers, but browser support and Bunny’s handling of related address lookups prevent that approach from working reliably. The adopted compromise returns two servers when their distances are reasonably close; otherwise it returns only the nearest, with a two-minute TTL to limit the impact of an outage. The migration also separates DNS-based certificate challenges from Bunny: Hickory, a Rust DNS server, handles dynamic ACME updates and DNSSEC signing. Since Bunny cannot publish the required delegation-signing record, the parent zone remains with deSEC, a free nonprofit DNS provider.

Read on vincent.bernat.ch23 comments on Hacker News

Summary generated by AI from the linked article. hn.today is not affiliated with Hacker News or Y Combinator.

More in Web

The daily digest

Today's best Hacker News stories, summarized and screenshotted, one email a day.