This page describes the flow matrix of the Frontend a.k.a as the CDN.
General description
Our CDN (or "frontend"), named rapid-cdn, is a software release acting as a reverse proxy to serve any kind of http content. It handles the HTTPS certificates and the cache. The CDN SR is composed of:
- one main SlapOS instance (MASTER)
- one kedifa instance (KEDFIA)
- one error page manager instance (EPM)
- any number of frontend instance (FRONTEND-N) (running each on a different machine) containing
- the frontend haproxy listening on a public IPv4
- the Apache Traffic Server cache
- the backend haproxy
A CDN is needed to run any kind of SlapOS services as by default, the SlapOS services won't handle the HTTPS certificate and will always delegate to the CDN this part. This allows SlapOS services to stay simple.
A CDN can run on only one machine or be spawned over several machines all over the world. Each machine of the CDN must have a reachable IPv4, and you should have a wildcard DNS name pointing to all the machines of the CDN (the DNS can use geolocalisation or any other trick to return only a subpart of the available IPv4).
Incoming traffic
We will show in the table below the incoming connection on the different CDN services:
| SlapOS Service |
From |
Destination IP |
Destination Port |
Traffic Type |
Purpose |
| MASTER |
all frontend |
MASTER-IPv6 |
8401 |
https |
monitoring |
| all frontend |
MASTER-IPv6 |
8990-8991 |
https |
caucase backend client |
| all frontend |
MASTER-IPv6 |
one of 14455-14464 |
https |
master introspection |
| KEDIFA |
all frontend |
KEDIFA-IPv6 |
8402 |
https |
monitoring |
| all frontend |
KEDIFA-IPv6 |
8890-8891 |
https |
caucase server |
| all frontend |
KEDIFA-IPv6 |
7879 |
https |
kedifa |
| all frontend |
KEDIFA-IPv6 |
17000 |
https |
web server of the CSR |
| EPM |
all fronted |
EPM-IPv6 |
8403 |
https |
monitoring |
| all frontend |
EPM-IPv6 |
24000 |
https |
epm manager
|
| FRONTEND-N |
anywhere |
FRONTEND-N-IPv6 |
4443 --> 443 |
https
tcp and udp |
frontend haproxy for HTTPS traffic |
| anywhere |
FRONTEND-N-IPv6 |
8080 --> 80 |
http
tcp only |
frontend haproxy for HTTP traffic |
| all frontend |
FRONTEND-N-IPv6 |
8410 and up |
https |
web server of the monitoring |
| MASTER |
FRONTEND-N-IPv6 |
17001 |
https |
node CSR exposure |
| all frontend |
FRONTEND-N-IPv6 |
22443 |
https |
shared instance introspection |
| all frontend |
FRONTEND-N-IPv6 |
21444 |
https |
backend haproxu statistic |
| local |
FRONTEND-N-IPv6 |
23432 |
http |
internal cache port |
| anywhere |
FRONTEND-N-IPv4 |
8080 --> 80 |
http
tcp and udp |
frontend haproxy for HTTP traffic |
| anywhere |
FRONTEND-N-IPv4 |
4443 --> 443 |
https
tcp and udp |
frontend haproxy for HTTPS traffic |
| local |
FRONTEND-N-IPv6 |
21080 |
http |
backend haproxy http port |
| local |
FRONTEND-N-IPv6 |
21443 |
https |
backend haproxy https |
Note1: if you have only one frontend running on the same machine as DEFAULT and KEDIFA instances, you can disregard all IPv6 incoming traffic. You should see only IPv4 incoming traffic.
Note2: the "-->" means that the port is also exposed as another port through port redirection.
Outgoing traffic
The list below describes outgoing traffic for all machines involved in the CDN
- SlapOS client:
- https traffic to frontend (to reach the NMS)
- https and http traffic to frontend (to reach the shacache for sotfware release upgrades)
- OS upgrades : https traffic to package repositories
- IPv6 traffic to backends handled by the CDN
- NTP
- DNS