CDN (Powered by Fastly)#

The PSF has a CDN donated by Fastly which is available to any service hosted on our infrastructure. This CDN is running a geo distributed varnish cluster which respects various headers for handling caching. HTTPS is available from fastly for any *.python.org domain including the EV Certificate.

The setup of our infrastructure means that the only configuration which needs to change to move a service between fronted by the CDN or not is what address the service CNAME points to. Everything else is identically configured.

Setup a Service with Fastly#

Services served through Fastly are still hosted through the loadbalancers and should be configured as normal there. Note that if you’re using nginx you can include the fastly_params file inside the server block to set up some common settings for fastly backends (include fastly_params;). In order to configure these services in Fastly you should do:

Create a new Service at Fastly.
Configure the backends in Fastly to match all of the loadbalancers (currently lb0.nyc1.psf.io and lb1.nyc1.psf.io) on port 20004. These should also have TLS setup with the hostname lb.psf.io, and the PSF_CA certificate (see below). The SSL Client Certificate and Key should be blank.
Configure a Header under the “Content” tab to set a Fastly-Token header set to the static value from pillar/prod/secrets/fastly.sls.

PSF_CA#

The nyc1 hosted value of the PSF CA is: