I thought this would be vital... VPC, Firewall and High Availability

aad

Dear Everyone

I am aware that the Firewall GUI is currently in development, and High Availability features are planned for the future. However, I would like to emphasize the importance of VPC (Virtual Private Cloud) communication integration.

Specifically, I propose that communication between the Main Control Centre and the Backup Server should be both private and internal. This ensures confidentiality and minimizes exposure to external threats. Additionally, some VPS (Virtual Private Server) providers offer free bandwidth on their VPC Networks, which could be advantageous for our infrastructure.

Furthermore, I recommend that S3 backups be configurable independently from the enhanced backup process. Having a separate backup schedule for S3 backups would enhance flexibility and allow us to tailor backup strategy more effectively.

Thank you for considering these suggestions. I believe they will contribute to a more robust and secure system.

Best regards,
aad

JohnB

aad free bandwidth on their VPC Networks, which could be advantageous for our infrastructure.

This is a good point and being added.

aad This ensures confidentiality and minimizes exposure to external threats.

All communication between nodes uses manual TLS. Adam explained here: https://community.enhance.com/d/1430-vpn-for-control-plane-traffic

Not sure what you mean by "confidentiality" as this will only apply if the backup server gets compromised. Other servers in the estate is public facing. This includes the control panel which has access to backup server files...even if that access is over VPC.

cosmoshosting

An important long term feature, do consider that many of us host servers with roles across multiple providers (ie backup, secondary nameserver, reselling enhance licences on customer-provided VPS) and such may require a 'hybrid architecture' between local & wan interfaces

Adam

cosmoshosting An important long term feature, do consider that many of us host servers with roles across multiple providers (ie backup, secondary nameserver, reselling enhance licences on customer-provided VPS) and such may require a 'hybrid architecture' between local & wan interfaces

One of the biggest strengths of Enhance is the ability to create clusters spanning multiple data centres, networks, countries and we won't be changing this.

We appreciate some customers would prefer to use a private network for internal communications. The way we are likely to implement this is to offer the ability to set a preferred interface for internal comms. If the source server has the subnet in its local routing table it will connect on that IP, otherwise it will fall back to the public interface. This should give you the hybrid capability that you need.