Ben McIlwainandGitHub
dcfe939c38
Summarize all documentation updates across the repository to align with modern GKE, Cloud SQL Proxy v2, standard EPP fee v1.0, and Postgres database environments. Key Updates: - Prerequisites: Bump Java requirement to Java 25. - Architecture & Scaling: Document GKE workloads, Cloud Tasks queues, and scheduled tasks. Replace App Engine references with GKE deployment restart commands (kubectl rollout restart). - Configuration: Update Cloud SQL Proxy instructions to v2, fix keyring verification commands, and document IAP configuration. - Escrow (RDE/BRDA): Fix manual generation and download procedures to match the Dataflow job ID folder structure, and correct deposit encryption/verification command parameters. - Monitoring: Correct metric names and expand the documented metrics list with caching, locking, and reserved list metrics. - Fixes: Standardize lists formatting across markdown files, fix broken webdriver links, and resolve various typos. - Cleanup: Remove leftover cloud scheduler configurations for the deleted wipeOutContactHistoryPii task, and update ICANN reporting documentation to reflect open-sourced DNS query coordinator. TAG=agy CONV=88271e71-e272-40e0-85f8-a075a423b7c2
1.5 KiB
TLD security restrictions
Nomulus has several security features that allow registries to impose additional restrictions on which domains are allowed on a TLD and what nameservers they can have. The restrictions can be applied to an entire TLD or on a per-domain basis. These restrictions are intended for use on closed TLDs that need to allow external registrars, and prevent undesired domain registrations or updates from occurring, e.g. if a registrar makes an error or is compromised. For closed TLDs that do not need external registrars, a simpler solution is to not grant any registrars access to the TLD.
This document outlines the various restrictions available, their use cases, and how to apply them.
TLD-wide nameserver/registrant restrictions
Nomulus allows registry administrators to set nameserver restrictions on a TLD. This is typically desired for brand TLDs on which all domains are either self-hosted or restricted to a small set of webhosts.
To configure allowed nameservers on a TLD, use the
allowedFullyQualifiedHostNames field in the TLD YAML file:
addGracePeriodLength: "PT432000S"
allowedFullyQualifiedHostNames:
- "ns1.test.goog"
- "ns2.test.goog"
- "ns3.test.goog"
When nameserver restrictions are set on a TLD, any domain mutation flow under that TLD will verify that the supplied nameservers are not empty and that they are a strict subset of the allowed nameservers on the TLD. If no restrictions are set, domains can be created or updated without nameservers.