Secure Custom Domain Setup for Client Status Pages Using CNAME, Certbot and Go Instead of ACME On-Demand
A monitoring service needed to offer public status pages on customer domains for white-label use by web studios. Clients add a CNAME record pointing their subdomain to the service endpoint, after which the platform must serve the page over HTTPS with a valid certificate.
The team rejected ACME on-demand solutions such as Caddy or OpenResty auto-SSL for three reasons. Private keys would reside inside the application process or require an additional stateful component. Any attacker could point arbitrary domains at the IP and trigger Let's Encrypt issuance, exhausting the 300-order rate limit per account. Issuing certificates during the TLS handshake also imposes latency on the first visitor and risks connection drops if the CA is unreachable.
Instead, domains are stored in the database when users enter them in settings. A four-stage pipeline handles the rest: input normalization and validation in Go, periodic DNS verification by a background goroutine, certificate issuance and nginx configuration by a privileged helper script, and request routing inside the application.
Validation rejects empty strings only when removing a domain, blocks the service's own domains to prevent takeover of internal pages, and requires Punycode for internationalized names so users see exactly what they must configure at their registrar. After saving, the domain enters pending status.
The DNS verifier runs every five minutes. It first checks for a matching CNAME and falls back to comparing A records for apex domains where CNAME is prohibited by RFC. Temporary DNS failures do not downgrade an already verified or active domain; only a warning is recorded. This hysteresis avoids random outages for customers whose pages are already live.
A systemd-timer script running as root queries the application over loopback, runs certbot with the webroot challenge, writes per-domain nginx server blocks from a template, and notifies the application when a domain becomes active. Certificates for removed domains are left untouched and simply expire naturally. The script always validates input with a regex and runs nginx -t before reloading.
Inside the Go application a HostRouter middleware maps verified custom hosts to the corresponding status page while returning 404 for all other paths, preventing exposure of dashboards or APIs. Internal endpoints used by the helper are protected by checking for the absence of X-Forwarded-For and X-Real-IP headers in addition to loopback address validation.
The scheme works well for hundreds of domains on a single server. It avoids rate-limit exhaustion because issuance occurs only after confirmed DNS ownership, keeps certificate handling outside the application, and ensures that failure of any single component does not affect already-active customer pages.
Related articles
Rostelecom Refactors InfoSec Careers: Matching Employee Skills to Evolving Business Priorities
Rostelecom's information security block developed a systematic approach to reassess employee expertise and redirect talent to new roles when business structures change rapidly. In one case, an architect hired for a specific team was reassigned after the unit was disbanded, initially moving to a similar position that did not fully align with his broader competencies. HR-business partner Olga Lapshina examined the specialist's full background, including prior work in audits, methodology development, regulatory documentation, university teaching, and scientific research, plus strong mentoring abilities with younger staff. These skills matched the needs of the methodology department, leading to a transfer supported by an individual development plan and a mentor via the internal Tochka Rosta platform. Within two months the employee contributed improvements that accelerated preliminary InfoSec audits by 30 percent and risk assessments by 20 percent while expanding threat scenario coverage by 10 percent. The initiative demonstrates Rostelecom's emphasis on horizontal career movement and retention of experienced professionals through structured career tracks.
How to Avoid Becoming the Hero of 'My Program Deleted 800 GB': Safe Recursive Deletion in Bash and Python
A recent Habr article examines dangerous patterns in recursive file deletion scripts that have caused massive data loss incidents, including an 800 GB wipe triggered by Telegram Desktop on Windows. The piece analyzes classic mistakes such as empty variables in rm commands and extra spaces that turned single paths into multiple destructive arguments, referencing the 2015 Steam Linux bug and the 2011 Bumblebee installer error. It provides hardened Bash templates using set -euo pipefail, ${VAR:?} checks, realpath validation, and --one-file-system flags to prevent deletion of forbidden directories or symlinked targets. The Python section introduces a safe_rmtree wrapper that enforces root boundaries, rejects symlinks, uses resolve(strict=True), and checks shutil.rmtree.avoids_symlink_attacks before proceeding. Additional recommendations include dry-run modes, marker files, temporary directory usage, and logging to make deletion operations auditable and reversible where possible.
Hackers tamper with refrigeration units in European supermarkets, setting temperatures to +50 °C
Attackers gained unauthorized access to refrigeration and freezer control systems in supermarkets across several European countries, including Sweden, Belgium, Luxembourg, and Estonia. In multiple locations they altered temperature settings to +50 °C, risking widespread spoilage of perishable goods. The incidents primarily affected older, unpatched Danfoss controllers that had been connected to networks for remote maintenance. Estonian manufacturer Kitman Coldtech reported that one attack on a legacy Danfoss system was detected and stopped within approximately ten minutes, preventing any damage. Similar intrusions were confirmed by Swedish chains ICA and Coop, following earlier incidents in French supermarkets in October that resulted in product losses. Experts note that legacy industrial controllers remain attractive targets because they are often left exposed once placed online for convenience.
AmneziaWG Container for MikroTik Routers Delivers Top Performance Six Months After Launch
A developer released an AmneziaWG container for MikroTik devices in February 2026 and has since added major improvements in speed, protocol support, and stability. The lightweight container leverages the router's native WireGuard implementation for cryptography while handling AmneziaWG obfuscation in software. Performance now reaches 250-350 Mbit/s on models such as Hap Ax3 and RB5009B after switching to C code and increasing buffer sizes with RouterOS 7.24. New features include server mode for connecting multiple MikroTik devices, random port hopping, IPv6 support, dynamic DNS, and offline configuration. The project survived an early GitHub ban caused by test scripts and has grown to over 370 stars while remaining fully offline and privacy-focused.