Allow multiple ports to cut through the containers

[dragosbulugean]

For software that manages SSL certificates for customers (called SSL for SaaS in the industry, https://developers.cloudflare.com/ssl/ssl-for-saas/), many times it's required to allow 80 and 443 both to cut through to the containers so they can manage the lifecycle of SSL certificates.

For example Caddy (https://caddyserver.com/) works great for this use case, but it does require 80 and 443 (without termination) to function properly with LetsEncrypt. We know it's possible because we use ECS+Fargate+Caddy with NLB in front for this exact use case in production. We'd like to move this setup to Copilot.

It would be useful if NLB could be configured in Copilot to allow multiple ports somewhat like this:

nlb:
  ports: ['80/tcp', '443/tcp']

Is this feasible? Thanks :)

[dannyrandall]

Hey @dragosbulugean, thanks for opening this issue - the feature request makes sense to me.

To connect these two issues: we have a similar request here.

[ernst-du-plessis]

Another use-case that I feel should be considered is when you need multiple ports exposed, and allow the NLB listeners to terminate the TLS certs.

Example is running a RabbitMQ message broker as a Load Balanced Service:

name: rbmq-message-broker
type: Load Balanced Web Service
http: false
nlb:
  alias: 'mqtt.example.com'
  port: 8883/tls
  target_port: 1883
nlb:
  alias: 'amqp.example.com'
  port: 5671/tls
  target_port: 5672
image:
  build: rbmq-message-broker/Dockerfile
  # Port(s) exposed through your container to route traffic to it.
  ports:
    - 1883
    - 5672

[iamhopaul123]

Hello @ernst-du-plessis. It seems like the service could potentially be split up into two smaller ones. Is it because if doing so they would look very similar and you'd like to manage fewer very similar services?

[ernst-du-plessis]

Hi @iamhopaul123 - yes I would prefer to only manage a single service, supporting multiple protocols (NLB listeners).

But as you mentioned, this can easily be split into multiple services, which is in fact what we are currently doing.

In doing so we have the benefit of managing the cpu/memory requirements per supported protocol. But this isn’t something we currently need, and can still go a long way by simply having a single (small) service supporting multiple protocols.

All-in-all, this is a nice-to-have use case to consider.

[craigjbass]

This is particularly problematic for running a custom reverse proxy that terminates SSL, as we can't expose port 80 to facilitate the HTTP -> HTTPS redirect. In this situation, we can't split into multiple services.

[paragbhingre]

Hello everyone,

The proposal to support multiple ports is out, and we would love to get your feedback 🙏

#4170