Post #3449341
2026-06-28 13:30 UTC
I wrote a little something about WebPKI and client side certificates at IPng:
https://ipng.ch/s/articles/2026/06/27/case-study-ipngs-client-certificates/
In this article I describe an AuthZ sidecar to nginx that handles ~150K req/s on one machine. They protect (hopefully) my internal websites from Bad People and Big Tech scrapers.
Replies (2)
-
@IPngNetworks@ublog.tech 2026-06-28 13:31
Here's a short video of me tinkering with the ACL system in real time. It's pretty easy to use.
-
@antonis@mastodon.social 2026-07-01 06:33
@IPngNetworks@ublog.tech Amazing work! I have a very similar setup that’s been serving me well for several years now with a few different architectural decisions but equally cool. I like how you created an ACL CLI utility, I used git and PRs. I loved the pf ruleset syntax too! I went for the “Cloud Native” YAML :) For issuance I’m using an ACME CA: https://blog.daknob.net/acme-end-user-client-certificates/ so I can have short-lived certs, but that’s probably overkill. I’m also tying them to hardware such as YubiKeys or FaceID / TouchID.