One front door for many sites: a reverse proxy with a certificate per name

reverse-proxy-tls — One front door for many sites: a reverse proxy with a certificate per name

One public address and one front server for 20 site and app names: TLS ends at the front server, and requests for apps on the second server go over the LAN.

My own lab in the Fraser Valley: one internet connection and one public address, two servers, and 20 site and app names that each need a certificate.

• nginx on the front server holds the Let’s Encrypt certificates and forwards requests for apps on the second server over the LAN.
• The visitor’s real address is passed through, so the logs and the intrusion filter see the visitor, not the proxy.
• The app server’s web port accepts connections only from the front server.
• Rate limits on the front door, with CrowdSec and fail2ban reading its logs.
• Every change runs the nginx config test first, and nginx is reloaded, never restarted, so visitors are not cut off.

• Config test before every reload; a failed test means no reload.
• From another machine on the LAN, the app server’s web port refuses the connection; only the front server gets through.
• Each name checked with a TLS handshake after its certificate was issued.

• nginx
• Let’s Encrypt
• ufw
• CrowdSec
• fail2ban