DNS, TLS and domains

Domain pattern

A deployment may use domains such as:

• example.org — public site
• app.example.org — authenticated OneTALA workspace
• flow.example.org — TALA Flow
• uat.example.org — restricted UAT entry
• deploy.example.org — deployment console, restricted to administrators

TLS

Issue valid certificates at the reverse proxy or managed load balancer. If Cloudflare is used in front of the origin, use Full (strict) TLS. Do not use Flexible mode.

Session scope

When several trusted subdomains share authentication, configure the session domain intentionally and use secure cookies. Do not widen cookie scope to unrelated domains.

Private services

Database, Redis, queue backends, internal Go service ports, and management metrics should not be public simply because DNS exists for the application.