We currently route traffic between services based on URL (host and path) with dispatch.yaml. It's great, but only supports GAE services, not our frontend on Cloud Run (#1717). Due to this, we've been gradually adding workarounds (eg 7c24ea4), rolling some of our own functionality (eg 56e82b8 / snarfed/webutil@c73700b), and disabling others (eg #2517).
I'm considering switching to a proper load balancer, probably a global external LB. It'd cost $30-80/mo, but it would let us drop most of those workarounds and homegrown hacks and bring back the admin UI.
The straw that broke the camel's back here was thinking through #1785/#2494, notably redirecting OAuth service proxy requests from CR (atproto.brid.gy) to GAE, which wouldn't work, since clients would strip the Authorization header, and OAuth clients would have to re-sign DPoP proofs when redirected, which not many (if any) do.
We currently route traffic between services based on URL (host and path) with
dispatch.yaml. It's great, but only supports GAE services, not our frontend on Cloud Run (#1717). Due to this, we've been gradually adding workarounds (eg 7c24ea4), rolling some of our own functionality (eg 56e82b8 / snarfed/webutil@c73700b), and disabling others (eg #2517).I'm considering switching to a proper load balancer, probably a global external LB. It'd cost $30-80/mo, but it would let us drop most of those workarounds and homegrown hacks and bring back the admin UI.
The straw that broke the camel's back here was thinking through #1785/#2494, notably redirecting OAuth service proxy requests from CR (atproto.brid.gy) to GAE, which wouldn't work, since clients would strip the
Authorizationheader, and OAuth clients would have to re-sign DPoP proofs when redirected, which not many (if any) do.