Scriptable GeoDNS: leaving AWS for Bunny
14 points by vbernat
14 points by vbernat
I love more attention sent to Bunny recently. I'm happy for everyone moving away from the big "default" providers.
On the other hand:
But Route 53 is expensive
I run seven small NixOS virtual machines to host this blog around the world: Paris, Nuremberg, Ashburn, Singapore, San Jose, São Paulo, and Sydney.
That feels like both an overkill (why not let Bunny cache it then if it's a static blog?) and high enough traffic ($10 in DNS queries!) that it will cost real money?
I'm really curious why it's done this way to begin with?
Yes, it's overkill. But that's how I keep myself busy! Somebody else would host it on a Raspberry Pi running on solar power, that would be fine too.
About not hosting the HTML itself on the CDN too, it's because I want to control the integrity of the content: CSS and JavaScript files are protected by an integrity hash (SRI) and can therefore be hosted externally. If I could, I would also include images in this, but this is not supported by browsers/HTML spec (and not something that looks planned).
The $10 was for haproxy.debian.net, which hosts an APT repository and is being hit by automated tools. My blog is far from costing that much in DNS traffic. Most of the costs were fixed (a few zones, the KMS key, so maybe 2$ for CloudFront+Route53 traffic). Paying $5 for a VM seems an OK deal for me. Paying 0.75$ for an healthcheck, not so much.
That's fair. I was just confused by the post motivation and constraints. Like, if it's for saving money, then there are other approaches, if it's for latency , then there are other things to fix, etc. But "because I can" is a cool direction ;)
how do you host the vms?
Various VPS providers: Sapinet, Vultr, and Hetzner.
If the question was more "but you don't really self host if you rely on a VM running on a third party infrastructure", yes, that's true. This is a compromise.
Nice!
It's a shame the ACME DNS part ends up a bit complex, though as you say in a footnote, it's simpler if you find/use a DNS host that offers API tokens that are scoped to a particular domain.
I often want a different auth scheme than a service provider offers, and so end up writing/using proxies to do my preferred auth on ingress, and then inject the actual token on the egress. Exactly where to host that is another question (where are you willing to host a server that has write on all your domains...), but perhaps Bunny Edge Scripting could do this (since you already trust Bunny).
For ACME DNS in particular, https://letsencrypt.org/2026/02/18/dns-persist-01 will allow DNS-based cert validation, without needing to do DNS updates, making all this a lot easier.
Exactly where to host that is another question (where are you willing to host a server that has write on all your domains...)
I was previously using nginx and the certificates were managed through NixOS security.acme.certs. After adding more hosts, I noticed Let's Encrypt had quite a low limit when you ask the same certificates many times (5 per week). I started working around this issue by making SAN different for each host by adding a host-specific cert. But there are many limits, including the number of new certs per domain.
When I switched to Caddy, I have considered its ability to share certificates through an S3 bucket, but this would add another dependency on a service I need either to self-host or rely on an external party. Instead, I get the certificates on my laptop (with DNS-01) and I push them to each server when updating them (I am using Colmena and a wrapper script). I added a test with Hurl to ensure I don't forget to refresh the certificates.
From my understanding, DNS-PERSIST-01 is not yet available? I didn't investigate much. Edit: looks like it's still not ready.
This is cool! I use Bunny but didn't realize they offered a DNS product. It's especially neat that they allow custom server-side logic on the DNS requests.
I use dnsimple, and I've been pretty happy with them, but bot traffic is recently driving up my costs because bots are doing millions of DNS queries from different residential proxies.
Currently, dnsimple's overage fees only cost me about $3/month, but if it gets worse, I might explore delegating DNS to Bunny.