[google-appengine] Re: Using App Engine Flexible behind a CDN (Fastly)

[Alex G]

@George, is Google Cloud CDN compatible with App Engine (Flexible)? I 
thought it was just possible to use it with GCE.


On Tuesday, May 15, 2018 at 1:57:16 PM UTC+2, Alex G wrote:
>
> We are currently using Fastly as our CDN that reads from the origin App 
> Engine Flexible (GAE) app. When trying to enable a TLS connection between 
> Fastly and GAE, we have noticed that ghs.googlehosted.com does not 
> support TLS. We have also tried using myapp.appspot.com as the origin, 
> but a 404 is returned. It seems related to the *Host* HTTP header, which 
> is not supported in this case.
>
> Is there any alternative to ghs.googlehosted.com that we could use that 
> supports TLS?
>

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/445a7b76-59d2-4b4b-8cbe-209f46cd3541%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Re: Using App Engine Flexible behind a CDN (Fastly)

[Alex G]

Just another update here. I've realized that I was missing an SNI in the 
Fastly request to the origin.

You can test this with the following command (ensure your *curl* is up to 
date):
curl --resolve ghs.googlehosted.com:443:mydomainA.com 
https://mydomainB.com/ -v -I

Basically, if there is a valid certificate for mydomainA.com on App Engine 
(which should be automatic 
<https://cloudplatform.googleblog.com/2017/09/introducing-managed-SSL-for-Google-App-Engine.html>),
 
then you can do a request to https://mydomainB.com/.


On Tuesday, May 15, 2018 at 1:57:16 PM UTC+2, Alex G wrote:
>
> We are currently using Fastly as our CDN that reads from the origin App 
> Engine Flexible (GAE) app. When trying to enable a TLS connection between 
> Fastly and GAE, we have noticed that ghs.googlehosted.com does not 
> support TLS. We have also tried using myapp.appspot.com as the origin, 
> but a 404 is returned. It seems related to the *Host* HTTP header, which 
> is not supported in this case.
>
> Is there any alternative to ghs.googlehosted.com that we could use that 
> supports TLS?
>

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/a174863d-099a-49b1-a32e-779c95f059e6%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Re: Using App Engine Flexible behind a CDN (Fastly)

[Alex G]

So far, this is what we have found out when choosing the origin host of our 
CDN (Fastly):

   - myapp.appspot.com: Supports TLS but requires the Host HTTP header to 
   be exactly "myapp.appspot.com". Therefore, the Host header needs to be 
   overridden.
   - ghs.googlehosted.com: Does not support TLS, but accepts any Host HTTP 
   header, so you can use any of your App Engine custom domains.

@Ben, thanks for the answer! We will follow this approach, too, but we will 
need to send an extra header (for example, X-Host) in order to convey the 
actual site requested. Otherwise, the GAE app has no way of knowing what is 
the requested site since the Host header needs to be hardcoded to "
myapp.appspot.com". Our GAE app hosts several sites with slightly different 
content.

@George, not sure if I understand what you are saying. I believe your 
instructions are geared towards Compute Engine, where you need to configure 
the load balancer. AFAIK, GAE abstracts this from us, so we have no way of 
dealing with the load balancer.


On Tuesday, May 15, 2018 at 1:57:16 PM UTC+2, Alex G wrote:
>
> We are currently using Fastly as our CDN that reads from the origin App 
> Engine Flexible (GAE) app. When trying to enable a TLS connection between 
> Fastly and GAE, we have noticed that ghs.googlehosted.com does not 
> support TLS. We have also tried using myapp.appspot.com as the origin, 
> but a 404 is returned. It seems related to the *Host* HTTP header, which 
> is not supported in this case.
>
> Is there any alternative to ghs.googlehosted.com that we could use that 
> supports TLS?
>

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/c6e3c216-203e-42e9-96eb-986e5aa88df3%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Re: Using App Engine Flexible behind a CDN (Fastly)

[Alex G]

Thanks for your reply, George.

Isn't the GAE load balancer hidden to the user?  


On Tuesday, May 15, 2018 at 1:57:16 PM UTC+2, Alex G wrote:
>
> We are currently using Fastly as our CDN that reads from the origin App 
> Engine Flexible (GAE) app. When trying to enable a TLS connection between 
> Fastly and GAE, we have noticed that ghs.googlehosted.com does not 
> support TLS. We have also tried using myapp.appspot.com as the origin, 
> but a 404 is returned. It seems related to the *Host* HTTP header, which 
> is not supported in this case.
>
> Is there any alternative to ghs.googlehosted.com that we could use that 
> supports TLS?
>

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/4cfe6bfd-6b62-4b39-8173-2d4910342335%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Using App Engine Flexible behind a CDN (Fastly)

[Alex G]

We are currently using Fastly as our CDN that reads from the origin App 
Engine Flexible (GAE) app. When trying to enable a TLS connection between 
Fastly and GAE, we have noticed that ghs.googlehosted.com does not support 
TLS. We have also tried using myapp.appspot.com as the origin, but a 404 is 
returned. It seems related to the *Host* HTTP header, which is not 
supported in this case.

Is there any alternative to ghs.googlehosted.com that we could use that 
supports TLS?

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/20df376f-c9c5-4080-90a8-70312596099b%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Re: What is the best way to manage env vars in App Engine (flexible environment)?

[Alex G]

We ended up doing something similar to what Ani suggests.

However, we are now considering this new feature (beta):
https://cloud.google.com/deployment-manager/runtime-configurator/reference/rest/v1beta1/projects.configs.variables


On Saturday, September 9, 2017 at 4:20:44 PM UTC+2, Alex G wrote:
>
> Moving our apps from Heroku to App Engine has been great, but there are a 
> few things that we miss. In particular, having a way to define config 
> variables <https://devcenter.heroku.com/articles/config-vars> in Cloud 
> Console would be great. We have tried a couple of approaches but none are 
> optimal:
>
>- Place config within env_variables 
>
> <https://cloud.google.com/appengine/docs/flexible/nodejs/configuring-your-app-with-app-yaml#Node.js_app_yaml_Defining_environment_variables>
>  
>in the app.yaml file. Not ideal to store secrets since anyone deploying 
> the 
>app has access to the app.yaml and those secrets.
>- Place config in Cloud Storage. Hard to edit, prone to errors (e.g. 
>breaking the JSON file that might contain them) and it doesn't trigger an 
>app restart with the updated config (I believe Heroku restarts the app 
>every time you change a config variable).
>
> Are there any ideas on implementing a similar feature in App Engine?
> Is there a better way of currently handling those config vars?
>
> Thanks
>

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/5c5584e1-bb3f-4fda-b8f9-b32e921f4aac%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Re: Is there a way to get geolocation when the user is behind a proxy?

[Alex G]

Thanks, Yannick. I hope App Engine implements this since I'm interested in 
the geolocation that Google provides.
However, by looking at the creation date of the request (more than 5 years 
ago), it is probably not going to happen.


On Thursday, September 28, 2017 at 9:42:47 PM UTC+2, Yannick (Cloud 
Platform Support) wrote:
>
> Hello Alex,
>
> Proxies will usually use the X-Forwarded-For header to denote which IP the 
> request originated from. You may do your own geolocation based on that 
> value.
>
> As for getting X-AppEngine-Country to use the value of X-Forwarded-For, 
> there is an open request <https://issuetracker.google.com/35892919> for 
> that feature on the Issue Tracker.
>
> On Thursday, September 28, 2017 at 10:10:32 AM UTC-4, Alex G wrote:
>>
>> I'm using Varnish (Fastly) between the user and App Engine (flexible). 
>> When I read the X-AppEngine-Country header it seems it is getting the IP 
>> from the proxy.
>> This happens even when I set app.enable('trust proxy') 
>> <https://expressjs.com/en/guide/behind-proxies.html> in Express.
>>
>> Is there a way to overcome this?
>>
>

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/94d545d0-8ecb-483a-a859-c5651e932940%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Is there a way to get geolocation when the user is behind a proxy?

[Alex G]

I'm using Varnish (Fastly) between the user and App Engine (flexible). When 
I read the X-AppEngine-Country header it seems it is getting the IP from 
the proxy.
This happens even when I set app.enable('trust proxy') 
 in Express.

Is there a way to overcome this?

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/5c862b63-c958-46cd-9de4-352f21277de6%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] What is the best way to manage env vars in App Engine (flexible environment)?

[Alex G]

Moving our apps from Heroku to App Engine has been great, but there are a 
few things that we miss. In particular, having a way to define config 
variables  in Cloud 
Console would be great. We have tried a couple of approaches but none are 
optimal:

   - Place config within env_variables 
   

 
   in the app.yaml file. Not ideal to store secrets since anyone deploying the 
   app has access to the app.yaml and those secrets.
   - Place config in Cloud Storage. Hard to edit, prone to errors (e.g. 
   breaking the JSON file that might contain them) and it doesn't trigger an 
   app restart with the updated config (I believe Heroku restarts the app 
   every time you change a config variable).

Are there any ideas on implementing a similar feature in App Engine?
Is there a better way of currently handling those config vars?

Thanks

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/5cb07ca9-0403-410c-bb1d-10f0b526e320%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] Re: App Engine (flexible) instances starting every 30 seconds

[Alex G]

Sorry for posting it in the wrong place. I've now submitted an issue 
.


On Thursday, August 31, 2017 at 11:01:18 PM UTC+2, Jordan (Cloud Platform 
Support) wrote:
>
> Google Groups is meant for general product discussions and not for 
> technical support or for reporting issues. It is recommended to report this 
> in a Public Issue Tracker  
> with your actual 
> project ID and we will be able to investigate the cause of these VM 
> creations for your project. 
>

-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/00db309a-b170-4079-84cd-001f7d611a2a%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.

[google-appengine] App Engine (flexible) instances starting every 30 seconds

[Alex G]

Hi, 

I'm running a Node app on App Engine flexible environment. The app is very 
flaky and many requests are now failing. I've looked into the logs and it 
seems the 2 instances that the app has are being started every ~30 seconds.

I've enabled the Updated Health Checks 
,
 
so I'm wondering if this could be the issue. However, either the 
/readiness_check and the /liveness_check seem to be getting a 200 response. 
As you can see, the "app_updater" logs something every 30 seconds (see 
pictures below).

Anyone has any ideas of what could be going wrong?
Thanks in advance











-- 
You received this message because you are subscribed to the Google Groups 
"Google App Engine" group.
To unsubscribe from this group and stop receiving emails from it, send an email 
to google-appengine+unsubscr...@googlegroups.com.
To post to this group, send email to google-appengine@googlegroups.com.
Visit this group at https://groups.google.com/group/google-appengine.
To view this discussion on the web visit 
https://groups.google.com/d/msgid/google-appengine/d3ec0015-fe21-4c70-b4f2-f415b1e07914%40googlegroups.com.
For more options, visit https://groups.google.com/d/optout.