Standalone broker (independent of App Engine)

Currently the broker code is implemented only for App Engine; i.e. it doesn't have a main function and relies on being invoked using the App Engine APIs.

Instead, the broker should run as a standalone HTTPS server somewhere, and App Engine should only be a dumb request/response forwarder (we can steal the forwarder code from meek). That will make it possible to easily add domain fronts other than Google (#22782 (moved)), and any secret data we handle on the broker won't have to be revealed to Google.

added component::circumvention/snowflake owner::cmm32 priority::high resolution::fixed severity::normal status::closed type::project labels

Replying to dcf:

Currently the broker code is implemented only for App Engine; i.e. it doesn't have a main function and relies on being invoked using the App Engine APIs.

Instead, the broker should run as a standalone HTTPS server somewhere, and App Engine should only be a dumb request/response forwarder (we can steal the forwarder code from meek). That will make it possible to easily add domain fronts other than Google (#22782 (moved)), and any secret data we handle on the broker won't have to be revealed to Google.

Trac:
Username: cmm32
Owner: N/A to cmm32
Status: new to assigned

Trac:
Priority: Medium to High

Hooman has been working on this and I pushed their changes to a standalone-broker branch: https://gitweb.torproject.org/user/dcf/snowflake.git/log/?h=standalone-broker&id=3f4f5d2292416dc7aeb6d091c174e20d779fe947

I added automatic Let's Encrypt code here: https://gitweb.torproject.org/user/dcf/snowflake.git/log/?h=standalone-broker&id=afe771690364e14586f24d98b65f0a2172cac1cc

Trac:
Keywords: N/A deleted, arlolra serene cmm32 added

Trac:
Cc: N/A to arlolra, serene, cmm32
Keywords: arlolra serene cmm32 deleted, N/A added

I merged the standalone-broker branch in 36debdfdd2.

There's a standalone broker running at https://snowflake-broker.bamsoftware.com/.

I think now we just need https://snowflake-reg.appspot.com/ to upload the code from appengine so that clients start communicating with the standalone broker.

Replying to dcf:

I think now we just need https://snowflake-reg.appspot.com/ to upload the code from appengine so that clients start communicating with the standalone broker.

I think we're not going to regain access to https://snowflake-reg.appspot.com/. I think the way forward is to do #23947 (moved); i.e., move the proxy-hosting page away from keroserene.net, and then we configure the proxy on the new host to use the new broker.

Sounds good to me.

Replying to dcf:

Replying to dcf:

I think now we just need https://snowflake-reg.appspot.com/ to upload the code from appengine so that clients start communicating with the standalone broker.

I think we're not going to regain access to https://snowflake-reg.appspot.com/. I think the way forward is to do #23947 (moved); i.e., move the proxy-hosting page away from keroserene.net, and then we configure the proxy on the new host to use the new broker.

Done in comment:15:ticket:23947.

The standalone broker is now the primary broker. Let's leave proxy-go instances running for the old App Engine broker for a time.

Trac:
Resolution: N/A to fixed
Status: assigned to closed

I just noticed that, due to a mistake of mine, the fallback proxy-go instances that were meant to be assigned to the standalone broker were instead assigned to the old App Engine broker. So all 6 were on the old broker, instead of 3 and 3 like desired.

I fixed it at 2018-04-18 00:06:42. I suspect it had been misconfigured since 2018-04-02 04:57:42, when I reinstated periodic restarts of the fallback proxies (comment:1:ticket:25688).

closed

mentioned in issue #23947 (moved)

mentioned in issue #26010 (moved)

moved to tpo/anti-censorship/pluggable-transports/snowflake#22874 (closed)

mentioned in issue tpo/applications/tor-browser#26010 (closed)