200 karma · joined October 9, 2015
The site is hosted via Federalist (https://federalist.18f.gov/) a SaaS which runs on top of sibling Platform as a Service cloud.gov (https://cloud.gov), which is based on Cloud Foundry. (Think of cloud.gov as "government-compliant and -operated Heroku" and you're not too far off.)
One of the benefits of using cloud.gov is that it automatically brokers and renews certs from Let's Encrypt... Math is math, and there's no sense spending taxpayer money where we don't have to! Here's the page about it, including a link to the broker source at the bottom: https://cloud.gov/docs/services/cdn-route/
Both are operated by 18F (https://18f.gsa.gov)... We're all feds! If anyone is interested in joining us check out https://18f.gsa.gov/join/
We also leverage the fact that AWS GovCloud already has FedRAMP status as an IaaS to accelerate our delivery of cloud.gov (which sits on top of it), so we're piggy-backing on the money and effort already spent and eliminating the millions we would otherwise spend by having the government run the IaaS layer.
In other words...
> The focus really needs to be on building a process to better integrate private cloud services and gov't applications.
...that's what we're doing!
This is a major reason for cloud.gov going after the FedRAMP JAB P-ATO recognition. "JAB" is the Joint Authorization Board comprised of the CIOs of the Department of Defense, Department of Homeland Security, and the General Services Administration. Having a triple-sign-off from three CIOs under a consistently applied set of standards is the highest social proof you can get in government that will convince other agency CIOs that it is OK to use your stuff at their agency. Normally it's vendors that go through this program... We're among the few to do it for a government-developed-and-operated service, and the first to do it for something as generally useful as a PaaS.
The other aspect is making sure everything we do to deploy and document the platform's compliance is open source and subject to scrutiny, so they can check for themselves... and ideally contribute in areas they think it could be better, of course!
EDIT: Which is here, by the way! https://www.youtube.com/watch?v=n6u4WjYaX2Q
Accessibility and L10N are app-level concerns, not something that cloud.gov is going to be able to help with. However, 18F works on other efforts aimed at helping people do those things better, eg https://18f.gsa.gov/2015/09/28/web-design-standards/
As for security and other devops concerns, which is what cloud.gov is about: This is why we're in a scaling/pilot phase now. A successful PaaS should reduce the depth of expertise needed to do those things right. That said, there are things like awareness of 12factor.net app design principles which are very unevenly distributed in government once you get outside of 18F. We will be concentrating on generating materials and documentation to make learning about those things in the context of cloud.gov as self-service as possible, and expand the pilot outward to those who need help even approaching the concept of a PaaS once we have more of those materials.