mirror of
https://github.com/google/nomulus
synced 2026-09-30 03:36:25 +00:00
Ben McIlwainandGitHub
dcfe939c38
Summarize all documentation updates across the repository to align with modern GKE, Cloud SQL Proxy v2, standard EPP fee v1.0, and Postgres database environments. Key Updates: - Prerequisites: Bump Java requirement to Java 25. - Architecture & Scaling: Document GKE workloads, Cloud Tasks queues, and scheduled tasks. Replace App Engine references with GKE deployment restart commands (kubectl rollout restart). - Configuration: Update Cloud SQL Proxy instructions to v2, fix keyring verification commands, and document IAP configuration. - Escrow (RDE/BRDA): Fix manual generation and download procedures to match the Dataflow job ID folder structure, and correct deposit encryption/verification command parameters. - Monitoring: Correct metric names and expand the documented metrics list with caching, locking, and reserved list metrics. - Fixes: Standardize lists formatting across markdown files, fix broken webdriver links, and resolve various typos. - Cleanup: Remove leftover cloud scheduler configurations for the deleted wipeOutContactHistoryPii task, and update ICANN reporting documentation to reflect open-sourced DNS query coordinator. TAG=agy CONV=88271e71-e272-40e0-85f8-a075a423b7c2
36 lines
1.5 KiB
Markdown
36 lines
1.5 KiB
Markdown
# TLD security restrictions
|
|
|
|
Nomulus has several security features that allow registries to impose additional
|
|
restrictions on which domains are allowed on a TLD and what nameservers they can
|
|
have. The restrictions can be applied to an entire TLD or on a per-domain basis.
|
|
These restrictions are intended for use on closed TLDs that need to allow
|
|
external registrars, and prevent undesired domain registrations or updates from
|
|
occurring, e.g. if a registrar makes an error or is compromised. For closed TLDs
|
|
that do not need external registrars, a simpler solution is to not grant any
|
|
registrars access to the TLD.
|
|
|
|
This document outlines the various restrictions available, their use cases, and
|
|
how to apply them.
|
|
|
|
## TLD-wide nameserver/registrant restrictions
|
|
|
|
Nomulus allows registry administrators to set nameserver restrictions on a TLD.
|
|
This is typically desired for brand TLDs on which all domains are either
|
|
self-hosted or restricted to a small set of webhosts.
|
|
|
|
To [configure allowed nameservers on a TLD](modifying-tlds.md), use the
|
|
`allowedFullyQualifiedHostNames` field in the TLD YAML file:
|
|
|
|
```
|
|
addGracePeriodLength: "PT432000S"
|
|
allowedFullyQualifiedHostNames:
|
|
- "ns1.test.goog"
|
|
- "ns2.test.goog"
|
|
- "ns3.test.goog"
|
|
```
|
|
|
|
When nameserver restrictions are set on a TLD, any domain mutation flow under
|
|
that TLD will verify that the supplied nameservers are not empty and that they
|
|
are a strict subset of the allowed nameservers on the TLD. If no
|
|
restrictions are set, domains can be created or updated without nameservers.
|