This document discusses web hosting on IPv6-only virtual machines. It describes moving from a shared IP address model to dedicating an IP address per website. Jails (lightweight virtual machines) are used, with each jail hosting a website on its own IP address. Challenges addressed include acquiring SSL certificates via Let's Encrypt, sending email, plugin installations, and compatibility with some webdav clients. Further challenges are expected from customers and services only available over IPv4.

1. Webhosting on IPv6-only Virtual Machines
Wolfgang Zenker
Dubai, October 25, 2017

2. Webhosting for small to medium sized websites
Model Separation Security File access Shell Webserver Database php
old
nameVirtual
Host
suexec ftp (chroot) no shared shared shared

3. Webhosting for small to medium sized websites
Model Separation Security File access Shell Webserver Database php
old
nameVirtual
Host
suexec ftp (chroot) no shared shared shared
new jail jail ftp, scp root own own own

4. FreeBSD jails
• Jails are lightweight virtual machines
• Extension of chroot model: partition not only file system but also process table, network- and IPC-stack
etc.
We use jails combined with ZFS datasets
• System environment on r/o mount from host
• Application environment on r/o mount from blueprint
• Configuration defaults copied from blueprint to r/w dataset
• r/w dataset for application data and software

5. Host
Internet
virtual Bridge
v4/v6 v4/v6v4/v6v4/v6v4/v6
…
Jail JailJailJailJail
Jail hosting – version 1

6. SSL
“dehydrated” script running in each jail to aquire SSL certificates
from “Let's Encrypt”

7. IP Address requirement
old model: one address shared by all websites on one physical machine
new model: one address per website

8. IP Address requirement
old model: one address shared by all websites on one physical machine
new model: one address per website
AS16188 address space
IPv4: 1 x /20, 1 x (final) /22
-> 5120 addresses
IPv6: 1 x /32
-> 79228162514264337593543950336 addresses

9. Host
Internet
virtual Bridge
v6 v6v6v6v6
…
Jail JailJailJailJail
Jail hosting – version 2
reverse proxy
v4/v6

10. First implementation for “nextcloud” hosting
• Application pre-installed
• Customer interacts per https only

11. SSL
• “dehydrated” script running on host only
• host has r/w access of jail dataset to provision certificate and key
• v4 SSL termination on host, proxy to v6 http on jail
At time of implementation, “Let's encrypt” would send challenges
on IPv4 if signing request was by IPv4.

12. Problem
• Applications sends mail to users
• Some users don't have IPv6 on mailserver
Solution
• Use host system as outgoing mail relay

13. Problem
• “nextcloud” plugin repository is IPv4 only
Solution (kind of)
• disable plugin installation by customer

14. Problem
• Let’s encrypt now sends challenge on IPv6
Solution
• reverse proxy on jail for challenges, going to host IPv6
Tried
• run “dehydrated” in jail
-> failed: “dehydrated” does not work on IPv6-only

15. Problem
• Some webdav clients fail because of SSL termination on host
Solution (probably)
• proxy to https on jail instead of http

16. Outlook
For "generic" webhosting we expect more challenges:
• customers with IPv4-only need ssh access
• code repositories (e.g. GitHub, RubyGems, ...) are IPv4-only
• ...

17. Questions?

18. Thank you
Further questions: hosting@punkt.de
@punktdehosting
https://www.facebook.com/punkt.deGmbH/