Day 27 Security Upgrade and Tentative Step for solving dynamic DNS

What I did: Ensured site sapphirepack.org only ran using latest 256 bit encryption and restricted to using TLS1.3.

Time spent: 65.150

Comments:

The biggest thing is ensuring a high level of security for the static content of the site. For the dynamic content, I'm not willing to do cloud since I believe that we should be able to self control the most important hubs of Gaya.

This will be processing some of the most important data, acting as relays and such. There are several benefits and drawbacks to this approach. The biggest drawback that I can see is cost and economy of scales. Breaking into our servers will likely be waaay easier than breaking into Amazon's servers or Googles.

However by going with a public cloud provider I loose the protection of the server, I can't protect the server and anyone can tap and spy on the information. Gaya requires trust between the operators and Sapphire Pack.

Furthermore there are other issues that we haven't even considered like routing, latency and such. However if the company gets that big we can reevaluate the core infrastructure. The infrastructure that I'm designing is designed to be easily moved and redeployed.

I also began test running the idea of having a subdomain point to a computer hosted within our network so that it'll be more cost effective to run since renting a bare metal server on a cloud provider is very expensive. Even going Digital Oceans route can get quite expensive, Heroku I looked at but there were other issues and you're nickled and dimed. Quite frankly we need to cut our hosting costs as much as possible. We don't currently have the budget to be spending 60-80$ a month on a server, much less the certificates and other requirements to ensure that it all properly nests under sapphirepack.org

With this concept I'll likely need to explore Let's Encrypt to protect the subdomain on a local computer but it should be cheaper and easier then provisioning a server remotely. I'll run it for the first while with very aggressive protection under limited remote device interaction to avoid certain classes of exploits (hopefully).