Out of the orange cloud

Before the move, golemtrust.am resolved through a US company. The zone lived in Cloudflare, every record was proxied through it, the orange cloud, and Cloudflare Load Balancing steered visitors between the two Hetzner regions. The .am name is the city’s own, on the city’s registry, so unlike Purple Lantern’s old .dev there is no US registry under the name. The foreign layer here is not the registry. It is the company sitting in front of every request, terminating the TLS, seeing the traffic, and holding a switch. The scraps for this layer say: a sovereign provider whose name resolves at a US company’s pleasure has already handed out the one key that unlocks all the others.

Whose cloud

Cloudflare, Inc., of San Francisco, held three jobs at once. It ran authoritative DNS for the zone. It proxied every record, which meant it terminated TLS for auth, vault, db and packages.golemtrust.am and saw the requests to them. And its load balancer did the geo-failover between Finland and Germany. All three sat behind one Cloudflare account, Carrot’s to own and Ludmilla’s to share, so three jobs in one US company were also three jobs behind one login. The convenience is the point: a single compliance decision in San Francisco could take the name, the certificates in front of it and the failover in one afternoon.

Turning off the orange

The proxy went first, because it was doing the most and was needed least. Golem Trust already runs its own ingress and terminates its own TLS at the edge. Cloudflare in front of that added an American TLS-termination point and a place for a US company to see and to block, in exchange for nothing it could not do itself. The records went from orange to grey, DNS only, and then off Cloudflare altogether.

A European name-server

The zone moved to a European authoritative DNS. Bunny DNS, run by BunnyWay d.o.o. of Slovenia, holds it now, and its geo-steering does the job Cloudflare Load Balancing had done, so the failover between the two regions moved with the zone rather than being left behind at a US company. deSEC, a free DNS service with DNSSEC, went into the notes as the plainer alternative for a zone that needs signing and nothing clever. DNSSEC is on, signed at the new operator, with the DS record beside the name at the city’s registry. The .am registration itself did not move: it was already the city’s own, which is where the graph stops.

The failover, self-owned

The geo-failover no longer depends on a US load balancer deciding which region answers. It runs on health checks at the European provider, or, where Golem Trust would rather own it outright, on its own resolvers steering between the two regions. What that does not fix is underneath it: both regions are still Hetzner, so the DNS is independent while the substrate is not, and the substrate page is where that half is fought.

Rerouted

   before                                     after

   golemtrust.am (city registry)              golemtrust.am (city registry)
        │                                          │
   Cloudflare: DNS + proxy + load balancer    European DNS: authoritative, DNSSEC,
   (US, one switch)                           geo-steering (Bunny, Slovenia)
        │                                          │
   Hetzner, two regions                       Hetzner, two regions (see substrate)

The name still on the city’s registry, the zone at a European operator with DNSSEC on, the proxy gone so no US company terminates the TLS or sees the traffic, the geo-failover moved off the US load balancer, and the one join left honest: the regions it steers between are still one operator’s.

What could go wrong?

  • Cloudflare, before the move, suspends the account, and the DNS, the certificates in front of it and the failover go together, which is the afternoon the move exists to prevent.

  • The European DNS operator has an outage, and the zone is served from a second set of nameservers, because a name on one provider is the old mistake in a new colour.

  • The geo-steering hides the substrate join, and a Hetzner-region failure the DNS cannot see takes both regions while the healthy-looking nameserver keeps sending traffic at them.

  • The DS record at the city’s registry is left pointing at the old signing key on the move, and every validating resolver treats golemtrust.am as forged until it is fixed.

Miss Tick can find any village in the mountains without once asking the way, holding that a road a traveller can follow only by its signs belongs, in the end, to whoever paints the signs.