System:Components - Revision history

Josh: Updated documentation from markdown files

2026-05-16T14:04:32Z

Updated documentation from markdown files

← Older revision		Revision as of 14:04, 16 May 2026
Line 1:		Line 1:
	This document describes the key components of the ~~reverse proxy system~~.		This document describes the key components of the jb-vpn.uk infrastructure.

	== ~~Nginx Reverse Proxy~~ ==		== Caddy (edge reverse proxy) ==

	'''Purpose''': ~~Acts as the entry~~ point for ~~all web~~ traffic, ~~handling SSL termination~~ and ~~request forwarding~~.		'''Purpose''': Entry point for public HTTPS traffic on the VPS. Terminates TLS, routes by hostname, and proxies to local Docker services or to the NAS over OpenVPN.

	'''Configuration ~~Locations''':~~		'''Configuration''': <code>/etc/caddy/Caddyfile</code>
	* '''Available Configs''': <code>/etc/~~nginx/sites-available~~/</code>

	* '''~~Enabled Configs~~''': ~~<code>/etc/nginx/sites-enabled/</code> (symlinks to sites-available)~~		'''Key features''':
			* Automatic Let's Encrypt certificates and renewal

	~~'''Key Features''':~~		* HTTP → HTTPS redirects
	* ~~SSL/TLS termination~~

	* ~~HTTP to HTTPS redirects~~		* Host-based routing (<code>wiki.jb-vpn.uk</code>, <code>dsm.jb-vpn.uk</code>, etc.)

	* Proxy ~~header forwarding~~		* Proxy headers (<code>Host</code>, <code>X-Real-IP</code>, <code>X-Forwarded-For</code>, <code>X-Forwarded-Proto</code>)

	* WebSocket ~~support~~		* WebSocket upgrade headers where needed

	* Request routing based on hostname		'''Management''':

	=~~== Proxy Headers ===~~		<pre class="lang-bash">
			caddy validate --config /etc/caddy/Caddyfile
			systemctl reload caddy
			systemctl status caddy
			journalctl -u caddy -n 50
			</pre>

	~~Nginx forwards important headers to maintain client information:~~		== VPS-hosted services (Docker) ==

	* '''Host''': ~~Preserves the original host header~~		{\| class="wikitable"
			\|-
			\| Service \|\| Hostname \|\| Local upstream
			\|-
			\| WebApp (prod) \|\| <code>app.jb-vpn.uk</code> \|\| <code>127.0.0.1:8008</code>
			\|-
			\| WebApp (beta) \|\| <code>app-beta.josh.me.uk</code> \|\| <code>127.0.0.1:8009</code>
			\|-
			\| phpMyAdmin \|\| <code>app-db.josh.me.uk</code> \|\| <code>127.0.0.1:8080</code>
			\|-
			\| Main wiki \|\| <code>wiki.jb-vpn.uk</code> \|\| <code>127.0.0.1:8010</code>
			\|-
			\| Werbs wiki \|\| <code>werbs-wiki.jb-vpn.uk</code> \|\| <code>127.0.0.1:8011</code>
			\|-
			\| Static site \|\| <code>vps.jb-vpn.uk</code> \|\| <code>/var/www/html</code>
			\|}

	* '''X-Real-IP''': ~~Client's real IP address~~		MediaWiki stack path: <code>/var/www/wiki.jb/</code>

	* '''X-Forwarded-For''': Forwarded for chain (for multi-proxy scenarios)		== OpenVPN tunnel ==

	* '''~~X-Forwarded-Proto~~''': ~~Original protocol (http/https)~~		'''Purpose''': Encrypted access from the VPS to the NAS for DSM, Plex, and SSH port forwarding.

	* '''~~Upgrade & Connection~~''': ~~For WebSocket support~~		'''Network''':
			* VPN server (VPS): <code>10.8.0.1</code> on <code>tun0</code>

	~~== SSL~~/~~TLS Certificates ==~~		* NAS client: <code>10.8.0.2</code>

	~~'''Provider'''~~: ~~Let's Encrypt (free SSL certificates)~~		* Subnet: <code>10.8.0.0/24</code>

	~~'''Management'''~~: ~~Certbot (automatic renewal every 90 days~~)		Caddy reaches NAS services at <code>10.8.0.2</code> (e.g. DSM <code>:5001</code>, Plex <code>:32400</code>) only when the VPN tunnel is up.

	~~'''Certificate Storage''': <code>/etc/letsencrypt/live/[domain]/</code> '''Features''':~~		== WebApp internal Nginx ==
	* Automatic renewal via cron/systemd timer

	* Wildcard or single-domain certificates		The WebApp Docker stack uses its own '''Nginx''' container for PHP/Laravel routing on <code>127.0.0.1:8008</code> / <code>8009</code>. That is separate from the public edge proxy (Caddy).

	* HTTPS enforcement (HTTP redirects to HTTPS)		== Firewall and routing ==

	~~== OpenVPN Tunnel ==~~		'''iptables''' on the VPS:
			* NAT / port forwards (e.g. SSH <code>22222</code> → <code>10.8.0.2:22</code>)

	~~'''Purpose''': Creates a secure, encrypted tunnel between the VPS and Synology NAS.~~		* MASQUERADE for VPN clients

	~~'''Network Details''':~~		* FORWARD rules between <code>tun0</code> and internal targets
	* ~~VPN Server: VPS (10.8.0.1)~~

	* VPN Client: Synology NAS (10.8.0.2)		== Related documentation ==

	* Network ~~Range: 10.8.0.0/24~~		* [Network Architecture Network Architecture] — topology and ports

	~~'''~~Security~~''':~~		* [Security Security] — security layers
	* Encrypted traffic between VPS and NAS

	* ~~NAS not directly exposed to internet~~		* [[Services:Current Services]] — per-hostname inventory

	* Internal services accessible only via VPN

	~~== Firewall and Routing ==~~

	~~'''iptables Rules''':~~
	* '''NAT Rules''': Port forwarding for direct TCP connections

	* '''MASQUERADE''': Enables VPN clients to access internet through VPS

	* '''FORWARD Rules''': Controls traffic between VPN and internal networks

	~~== Related Documentation ==~~

	* [Network Architecture](network-architecture.md) - Network topology

	* [Security Architecture](security.md) - Security features

	* [OpenVPN Server](index.md) - VPN configuration

	[[Category:Documentation]]		[[Category:Documentation]]
	[[Category:Documentation/System]]		[[Category:Documentation/System]]

Josh: Minor update - configuration guide: Key Components (6 sections)

2026-01-01T13:44:31Z

Minor update - configuration guide: Key Components (6 sections)

← Older revision		Revision as of 13:44, 1 January 2026
Line 1:		Line 1:
	~~= Key Components =~~

	This document describes the key components of the reverse proxy system.		This document describes the key components of the reverse proxy system.

Josh: Minor update - configuration guide: Key Components (6 sections)

2026-01-01T13:28:01Z

Minor update - configuration guide: Key Components (6 sections)

← Older revision		Revision as of 13:28, 1 January 2026
Line 8:		Line 8:

	'''Configuration Locations''':		'''Configuration Locations''':
	'' '''Available Configs''': <code>/etc/nginx/sites-available/</code>		* '''Available Configs''': <code>/etc/nginx/sites-available/</code>
	'' '''Enabled Configs''': <code>/etc/nginx/sites-enabled/</code> (symlinks to sites-available)
			* '''Enabled Configs''': <code>/etc/nginx/sites-enabled/</code> (symlinks to sites-available)

	'''Key Features''':		'''Key Features''':
	'' SSL/TLS termination		* SSL/TLS termination
	'' HTTP to HTTPS redirects
	'' Proxy header forwarding		* HTTP to HTTPS redirects
	'' WebSocket support
	'' Request routing based on hostname		* Proxy header forwarding

			* WebSocket support

			* Request routing based on hostname

	=== Proxy Headers ===		=== Proxy Headers ===
Line 22:		Line 27:
	Nginx forwards important headers to maintain client information:		Nginx forwards important headers to maintain client information:

	'' '''Host''': Preserves the original host header		* '''Host''': Preserves the original host header
	'' '''X-Real-IP''': Client's real IP address
	'' '''X-Forwarded-For''': Forwarded for chain (for multi-proxy scenarios)		* '''X-Real-IP''': Client's real IP address
	'' '''X-Forwarded-Proto''': Original protocol (http/https)
	'' '''Upgrade & Connection''': For WebSocket support		* '''X-Forwarded-For''': Forwarded for chain (for multi-proxy scenarios)

			* '''X-Forwarded-Proto''': Original protocol (http/https)

			* '''Upgrade & Connection''': For WebSocket support

	== SSL/TLS Certificates ==		== SSL/TLS Certificates ==
Line 35:		Line 44:

	'''Certificate Storage''': <code>/etc/letsencrypt/live/[domain]/</code> '''Features''':		'''Certificate Storage''': <code>/etc/letsencrypt/live/[domain]/</code> '''Features''':
	'' Automatic renewal via cron/systemd timer		* Automatic renewal via cron/systemd timer
	'' Wildcard or single-domain certificates
	'' HTTPS enforcement (HTTP redirects to HTTPS)		* Wildcard or single-domain certificates

			* HTTPS enforcement (HTTP redirects to HTTPS)

	== OpenVPN Tunnel ==		== OpenVPN Tunnel ==
Line 44:		Line 55:

	'''Network Details''':		'''Network Details''':
	'' VPN Server: VPS (10.8.0.1)		* VPN Server: VPS (10.8.0.1)
	'' VPN Client: Synology NAS (10.8.0.2)
	'' Network Range: 10.8.0.0/24		* VPN Client: Synology NAS (10.8.0.2)

			* Network Range: 10.8.0.0/24

	'''Security''':		'''Security''':
	'' Encrypted traffic between VPS and NAS		* Encrypted traffic between VPS and NAS
	'' NAS not directly exposed to internet
	'' Internal services accessible only via VPN		* NAS not directly exposed to internet

			* Internal services accessible only via VPN

	== Firewall and Routing ==		== Firewall and Routing ==

	'''iptables Rules''':		'''iptables Rules''':
	'' '''NAT Rules''': Port forwarding for direct TCP connections		* '''NAT Rules''': Port forwarding for direct TCP connections
	'' '''MASQUERADE''': Enables VPN clients to access internet through VPS
	'' '''FORWARD Rules''': Controls traffic between VPN and internal networks		* '''MASQUERADE''': Enables VPN clients to access internet through VPS

			* '''FORWARD Rules''': Controls traffic between VPN and internal networks

	== Related Documentation ==		== Related Documentation ==

	'' [Network Architecture](network-architecture.md) - Network topology		* [Network Architecture](network-architecture.md) - Network topology
	'' [Security Architecture](security.md) - Security features
			* [Security Architecture](security.md) - Security features

	* [OpenVPN Server](index.md) - VPN configuration		* [OpenVPN Server](index.md) - VPN configuration

	[[Category:Documentation]]		[[Category:Documentation]]
	[[Category:Documentation/System]]		[[Category:Documentation/System]]

Josh: Added configuration guide: Key Components

2026-01-01T13:15:47Z

Added configuration guide: Key Components

New page

= Key Components =

This document describes the key components of the reverse proxy system.

== Nginx Reverse Proxy ==

'''Purpose''': Acts as the entry point for all web traffic, handling SSL termination and request forwarding.

'''Configuration Locations''':
'' '''Available Configs''': <code>/etc/nginx/sites-available/</code>
'' '''Enabled Configs''': <code>/etc/nginx/sites-enabled/</code> (symlinks to sites-available)

'''Key Features''':
'' SSL/TLS termination
'' HTTP to HTTPS redirects
'' Proxy header forwarding
'' WebSocket support
'' Request routing based on hostname

=== Proxy Headers ===

Nginx forwards important headers to maintain client information:

'' '''Host''': Preserves the original host header
'' '''X-Real-IP''': Client's real IP address
'' '''X-Forwarded-For''': Forwarded for chain (for multi-proxy scenarios)
'' '''X-Forwarded-Proto''': Original protocol (http/https)
'' '''Upgrade & Connection''': For WebSocket support

== SSL/TLS Certificates ==

'''Provider''': Let's Encrypt (free SSL certificates)

'''Management''': Certbot (automatic renewal every 90 days)

'''Certificate Storage''': <code>/etc/letsencrypt/live/[domain]/</code> '''Features''':
'' Automatic renewal via cron/systemd timer
'' Wildcard or single-domain certificates
'' HTTPS enforcement (HTTP redirects to HTTPS)

== OpenVPN Tunnel ==

'''Purpose''': Creates a secure, encrypted tunnel between the VPS and Synology NAS.

'''Network Details''':
'' VPN Server: VPS (10.8.0.1)
'' VPN Client: Synology NAS (10.8.0.2)
'' Network Range: 10.8.0.0/24

'''Security''':
'' Encrypted traffic between VPS and NAS
'' NAS not directly exposed to internet
'' Internal services accessible only via VPN

== Firewall and Routing ==

'''iptables Rules''':
'' '''NAT Rules''': Port forwarding for direct TCP connections
'' '''MASQUERADE''': Enables VPN clients to access internet through VPS
'' '''FORWARD Rules''': Controls traffic between VPN and internal networks

== Related Documentation ==

'' [Network Architecture](network-architecture.md) - Network topology
'' [Security Architecture](security.md) - Security features
* [OpenVPN Server](index.md) - VPN configuration

[[Category:Documentation]]
[[Category:Documentation/System]]