You signed in with another tab or window. Reload to refresh your session.You signed out in another tab or window. Reload to refresh your session.You switched accounts on another tab or window. Reload to refresh your session.Dismiss alert
Copy file name to clipboardExpand all lines: docs/cloud/index.mdx
+7-7Lines changed: 7 additions & 7 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -46,15 +46,15 @@ All of Sourcegraph's features are available on Sourcegraph Cloud instances out-o
46
46
47
47
### Regular upgrades and maintenance
48
48
49
-
- Automatic [upgrades](/admin/updates/) when a new Souregraph version is released and maintenance when security patches are needed.
49
+
- Automatic [upgrades](/admin/updates/) when a new Sourcegraph version is released and maintenance when security patches are needed.
50
50
- Regular reassessment of resource utilization based on your organization's unique usage to determine if costs can be reduced without impact to service. Additionally, you will automatically benefit from any committed use cloud provider discounts we receive.
51
51
52
52
### Custom domains
53
53
54
54
Sourcegraph Cloud provides all customer instances a `customer.sourcegraphcloud.com` domain. This domain is fully managed by Sourcegraph, including DNS and HTTPS.
55
55
However, to provide better branding and a more seamless experience for your users, you may bring your own company domain, for example `sourcegraph.company.io`.
56
56
57
-
In order to use your own domain, you need to perform an one-time setup by adding DNS records at your authoritative DNS. These DNS records are neccessary to ensure that your users can access your Sourcegraph instance via the custom domain, and also to ensure we can provide managed TLS certificates for your instance. See a [list of DNS records to be created by your organization](#dns-records-to-be-created-by-your-organization) below as an example. Additionally, your custom domain's [CAA records](https://blog.cloudflare.com/caa-of-the-wild/) should permit our upstream certificate authorities to issue certificates for your domain, follow the [instructions](#verify-caa-records) below to verify your CAA records.
57
+
In order to use your own domain, you need to perform an one-time setup by adding DNS records at your authoritative DNS. These DNS records are necessary to ensure that your users can access your Sourcegraph instance via the custom domain, and also to ensure we can provide managed TLS certificates for your instance. See a [list of DNS records to be created by your organization](#dns-records-to-be-created-by-your-organization) below as an example. Additionally, your custom domain's [CAA records](https://blog.cloudflare.com/caa-of-the-wild/) should permit our upstream certificate authorities to issue certificates for your domain, follow the [instructions](#verify-caa-records) below to verify your CAA records.
58
58
59
59
Please reach out to your Sourcegraph account team to request a custom domain to be configured for your Sourcegraph Cloud instance.
60
60
@@ -96,9 +96,9 @@ More details about the locations and data storage can be found in [our handbook]
96
96
97
97
### Private Connectivity
98
98
99
-
Sourcegraph Cloud can connect to resources that are publically accessible or protected by IP-based firewall rules out-of-the-box. Sourcegraph can provide static IP addresses for customers to add to their firewall allowlist. Please let your account team know.
99
+
Sourcegraph Cloud can connect to resources that are publicly accessible or protected by IP-based firewall rules out-of-the-box. Sourcegraph can provide static IP addresses for customers to add to their firewall allowlist. Please let your account team know.
100
100
101
-
Private Connectivity enables customers to privately connect Private Resources to the Sourcegraph Cloud instance. Private Resources refer to services that are not publicly accessible, such as self-hosted GitHub Enterprise servers, self-hosted GitLab instances, self-hosted Nexus instance, or Jira Data Center deployed in a private network that are only accessible through VPN. Learn more about Private Connectvity support below:
101
+
Private Connectivity enables customers to privately connect Private Resources to the Sourcegraph Cloud instance. Private Resources refer to services that are not publicly accessible, such as self-hosted GitHub Enterprise servers, self-hosted GitLab instances, self-hosted Nexus instance, or Jira Data Center deployed in a private network that are only accessible through VPN. Learn more about Private Connectivity support below:
102
102
103
103
-[Private Resources on AWS via AWS Private Link](/cloud/private_connectivity_aws)
104
104
-[Private Resources on GCP via GCP Private Service Connect](/cloud/private_connectivity_gcp)
@@ -170,9 +170,9 @@ To learn more about how the Sourcegraph team operates managed SMTP internally, r
170
170
> NOTE: We may be able to [support special requests](#accommodating-special-requirements), please reach out to your account team.
171
171
172
172
- The Sourcegraph instance can only be accessible via a public IP. Running it in a private network and pairing it with your private network via site-to-site VPN or VPC Peering is not yet supported.
173
-
- Code hosts or user authentication providers running in a private network are not yet supported. They have to be publically available or they must allow incoming traffic from Sourcegraph-owned static IP addresses. We do not have proper support for other connectivity methods, e.g. site-to-site VPN, VPC peering, tunneling.
173
+
- Code hosts or user authentication providers running in a private network are not yet supported. They have to be publicly available or they must allow incoming traffic from Sourcegraph-owned static IP addresses. We do not have proper support for other connectivity methods, e.g. site-to-site VPN, VPC peering, tunneling.
174
174
- Instances currently run only on Google Cloud Platform in the [chosen regions](#multiple-region-availability). Other regions and cloud providers (such as AWS or Azure) are not yet supported.
175
-
- Some [configuration options](/admin/config/) are managed by Sourcegrpah and cannot be override by customers, e.g. feature flags, experimental features.
175
+
- Some [configuration options](/admin/config/) are managed by Sourcegraph and cannot be overridden by customers, e.g. feature flags, experimental features.
176
176
177
177
## Security
178
178
@@ -186,7 +186,7 @@ Only essential Sourcegraph personnel will have access to the instance, server, c
186
186
187
187
### Sourcegraph management access
188
188
189
-
[Sourcegraph management access](https://handbook.sourcegraph.com/departments/cloud/technical-docs/oidc_site_admin/) is the ability for Sourcergaph employees to grant time-bound and audit-trailed UI access to Cloud instances in the events of instance maintenance, issue troubleshooting, and customer assistance. Customer consent is guaranteed prior to human accesses.
189
+
[Sourcegraph management access](https://handbook.sourcegraph.com/departments/cloud/technical-docs/oidc_site_admin/) is the ability for Sourcegraph employees to grant time-bound and audit-trailed UI access to Cloud instances in the events of instance maintenance, issue troubleshooting, and customer assistance. Customer consent is guaranteed prior to human accesses.
190
190
191
191
All Sourcegraph Cloud instances have Sourcegraph management access enabled by default, and customers may request to disable by contacting your Sourcegraph contact.
Copy file name to clipboardExpand all lines: docs/cloud/private_connectivity_aws.mdx
+14-14Lines changed: 14 additions & 14 deletions
Display the source diff
Display the rich diff
Original file line number
Diff line number
Diff line change
@@ -1,8 +1,8 @@
1
1
# Code hosts on AWS without public access
2
2
3
-
<Callouttype="info">Please contact Sourcegraph directly via [prefered contact method](https://about.sourcegraph.com/contact) for more information.</Callout>
3
+
<Callouttype="info">Please contact Sourcegraph directly via [preferred contact method](https://about.sourcegraph.com/contact) for more information.</Callout>
4
4
5
-
As part of the [Enterprise tier](https://sourcegraph.com/pricing), Sourcegraph Cloud supports connecting customer private resouces on AWS using [AWS Private Link](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) and managed [site-to-site VPN](https://cloud.google.com/network-connectivity/docs/vpn/tutorials/create-ha-vpn-connections-google-cloud-aws) solution between GCP (where Sourcegraph Cloud instances are hosted) and AWS, so that access to the private resource is secure and without the need to expose it to the public internet.
5
+
As part of the [Enterprise tier](https://sourcegraph.com/pricing), Sourcegraph Cloud supports connecting customer private resources on AWS using [AWS Private Link](https://docs.aws.amazon.com/vpc/latest/privatelink/what-is-privatelink.html) and managed [site-to-site VPN](https://cloud.google.com/network-connectivity/docs/vpn/tutorials/create-ha-vpn-connections-google-cloud-aws) solution between GCP (where Sourcegraph Cloud instances are hosted) and AWS, so that access to the private resource is secure and without the need to expose it to the public internet.
6
6
7
7
## How it works
8
8
@@ -21,32 +21,32 @@ Sourcegraph Cloud is a managed service hosted on GCP. Sourcegraph creates a secu
21
21
22
22
### Initiate the process
23
23
24
-
Customer should reach out to their account manager to initiate the process. The account manager will work with the customer to collect the required information and initiate the process, including but not limited to:
24
+
Customers should reach out to their account manager to initiate the process. The account manager will work with the customer to collect the required information and initiate the process, including but not limited to:
25
25
26
26
- The DNS name of the private code host, e.g. `github.internal.company.net` or private artifact registry, e.g. `artifactory.internal.company.net`.
27
27
- The region of the private resource on AWS, e.g. `us-east-1`.
28
-
- The type of the TLS certificate used by the private resource, one of self-signed by internal private CA, or issued by a public CA.
29
-
- The VPC endpoint serivce name in the format of `com.amazonaws.vpce.<REGION>.<VPC_ENDPOINT_SERVICE_ID>`. Learn more from [create the VPC Endpoint Service](#create-the-vpc-endpoint-service).
28
+
- The type of TLS certificate used by the private resource: either self-signed by an internal private CA or issued by a public CA.
29
+
- The VPC endpoint service name in the format of `com.amazonaws.vpce.<REGION>.<VPC_ENDPOINT_SERVICE_ID>`. Learn more from [create the VPC Endpoint Service](#create-the-vpc-endpoint-service).
30
30
31
31
### Create the VPC Endpoint Service
32
32
33
33
When a customer has private resources inside the AWS VPC and needs to expose it for Sourcegraph managed AWS VPC, customers can follow [AWS Documentation](https://docs.aws.amazon.com/vpc/latest/privatelink/create-endpoint-service.html). An example can be found from our [handbook](https://handbook.sourcegraph.com/departments/cloud/technical-docs/private-code-hosts/#aws-private-link-playbook-for-customer).
34
34
35
-
Sourcegraph will provide the Sourcegraph-managed AWS account ARN that needs to be allowlist in your VPC endpoint service, e.g., `arn:aws:iam::$accountId:root`. It must be allowlisted by customer before the connection can be established. Notes: The AWS account is created exclusively for individual Cloud customers and not shared with others.
35
+
Sourcegraph will provide the Sourcegraph-managed AWS account ARN that needs to be allowlisted in your VPC endpoint service, e.g., `arn:aws:iam::$accountId:root`. It must be allowlisted by customer before the connection can be established. Note: The AWS account is created exclusively for individual Cloud customers and not shared with others.
36
36
37
37
The customer needs to share the following details with Sourcegraph:
38
38
39
-
- VPC endpoint serivce name in the format of `com.amazonaws.vpce.<REGION>.<VPC_ENDPOINT_SERVICE_ID>`.
39
+
- VPC endpoint service name in the format of `com.amazonaws.vpce.<REGION>.<VPC_ENDPOINT_SERVICE_ID>`.
40
40
41
-
Upon receiving the details, Sourcegraph will create a connection to the customer's private resource. The customer may need to manually accept the connection request depending on theirs[acceptance settings](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#accept-reject-connection-requests). Sourcegraph will follow up with the customer to confirm the connection is established.
41
+
Upon receiving the details, Sourcegraph will create a connection to the customer's private resource. The customer may need to manually accept the connection request depending on their[acceptance settings](https://docs.aws.amazon.com/vpc/latest/privatelink/configure-endpoint-service.html#accept-reject-connection-requests). Sourcegraph will follow up with the customer to confirm the connection is established.
42
42
43
43
### Create the private resource connection
44
44
45
45
Once the connection to private code host is established, the customer can create the [code host connection](/admin/code_hosts/) on their Sourcegraph Cloud instance.
46
46
47
47
### Verify artifact registries are working
48
48
49
-
Once the connection to private artifact registry is established, customer might then verify that auto-indexing is working with private artifact registry by [configuring auto-indexing](/code-search/code-navigation/auto_indexing#configure-auto-indexing)
49
+
Once the connection to private artifact registry is established, customer might then verify that auto-indexing is working with the private artifact registry by [configuring auto-indexing](/code-search/code-navigation/auto_indexing#configure-auto-indexing)
50
50
51
51
## FAQ
52
52
@@ -67,20 +67,20 @@ Advantages of the site-to-site GCP to AWS VPN include:
67
67
68
68
### How can I restrict access to my private resource?
69
69
70
-
The customer has full control over the exposed service and they can may terminate the connection at any point.
70
+
The customer has full control over the exposed service and they may terminate the connection at any point.
71
71
72
72
### What are the next steps when artifact registry connectivity is working?
73
73
74
-
Only if private artifact registry is protected by authentication, the customer will need to:
74
+
Only if the private artifact registry is protected by authentication, the customer will need to:
75
75
- create executor secrets containing credentials for Sourcegraph to access the private artifact registry - [how to configure executor secrets](/admin/executors/executor_secrets#executor-secrets)
76
-
- update auto-indexing inference configuration to create additional files from executor secrets for given programing language - [how to configure auto-indexing](/code-search/code-navigation/inference_configuration)
76
+
- update auto-indexing inference configuration to create additional files from executor secrets for given programming language - [how to configure auto-indexing](/code-search/code-navigation/inference_configuration)
77
77
78
78
### Can I use self-signed TLS certificate for my private resources?
79
79
80
80
Yes. Please work with your account team to add the certificate chain of your internal CA to [site configuration](/admin/config/site_config#experimentalFeatures) at `experimentalFeatures.tls.external.certificates`.
81
81
82
-
### What is the disater recovery plan?
82
+
### What is the disaster recovery plan?
83
83
84
84
For customers with a disaster recovery plan that can failover the private resource deployment to another region, we recommend the customer to provision VPC endpoint services in the failover region and share the details with Sourcegraph during the onboarding process. In the event of an incident, the customer can reach out to support and request Sourcegraph to failover the connection to the failover region.
85
85
86
-
For disater recovery plan of Sourcegraph Cloud, please reach out to your account team for more information.
86
+
For disaster recovery plan of Sourcegraph Cloud, please reach out to your account team for more information.
0 commit comments