System:Security - Revision history

Josh: Updated documentation from markdown files

2026-05-16T14:04:32Z

Updated documentation from markdown files

← Older revision		Revision as of 14:04, 16 May 2026
Line 5:		Line 5:
	The system uses multiple layers of security:		The system uses multiple layers of security:

	=== '''Public Layer''': ~~Nginx~~ with SSL/TLS encryption ===		=== '''Public Layer''': Caddy with SSL/TLS encryption (Let's Encrypt) ===
	== '''VPN Layer''': Encrypted tunnel between VPS and NAS ==		== '''VPN Layer''': Encrypted tunnel between VPS and NAS ==
	== '''Internal Layer''': Services only accessible via VPN ==		== '''Internal Layer''': Services only accessible via VPN ==

Josh: Content added - configuration guide: Security Architecture (11 sections)

2026-01-01T13:44:30Z

Content added - configuration guide: Security Architecture (11 sections)

← Older revision		Revision as of 13:44, 1 January 2026
Line 1:		Line 1:
	~~= Security Architecture =~~

	This document describes the security architecture of the reverse proxy system.		This document describes the security architecture of the reverse proxy system.

Line 7:		Line 5:
	The system uses multiple layers of security:		The system uses multiple layers of security:

	= '''Public Layer''': Nginx with SSL/TLS encryption =		=== '''Public Layer''': Nginx with SSL/TLS encryption ===
	= '''VPN Layer''': Encrypted tunnel between VPS and NAS =		== '''VPN Layer''': Encrypted tunnel between VPS and NAS ==
	= '''Internal Layer''': Services only accessible via VPN =		== '''Internal Layer''': Services only accessible via VPN ==
	= '''Certificate Security''': Automatic renewal prevents expired certificates =		== '''Certificate Security''': Automatic renewal prevents expired certificates ==

	== Security Benefits ==		== Security Benefits ==

Josh: Minor update - configuration guide: Security Architecture (7 sections)

2026-01-01T13:27:59Z

Minor update - configuration guide: Security Architecture (7 sections)

← Older revision		Revision as of 13:27, 1 January 2026
Line 14:		Line 14:
	== Security Benefits ==		== Security Benefits ==

	'' '''No Direct Exposure''': Synology NAS is not directly accessible from the internet		* '''No Direct Exposure''': Synology NAS is not directly accessible from the internet
	'' '''Encrypted Traffic''': All public traffic uses HTTPS
	'' '''Isolated Network''': Internal services communicate over VPN		* '''Encrypted Traffic''': All public traffic uses HTTPS
	'' '''Certificate Management''': Automatic SSL certificate renewal
			* '''Isolated Network''': Internal services communicate over VPN

			* '''Certificate Management''': Automatic SSL certificate renewal

	== Security Components ==		== Security Components ==
Line 23:		Line 26:
	=== SSL/TLS Encryption ===		=== SSL/TLS Encryption ===

	'' All public-facing traffic uses HTTPS		* All public-facing traffic uses HTTPS
	'' Let's Encrypt certificates automatically renew
	'' HTTP traffic is redirected to HTTPS		* Let's Encrypt certificates automatically renew

			* HTTP traffic is redirected to HTTPS

	=== VPN Encryption ===		=== VPN Encryption ===

	'' OpenVPN provides encrypted tunnel between VPS and NAS		* OpenVPN provides encrypted tunnel between VPS and NAS
	'' All internal traffic is encrypted through VPN
	'' Certificate-based authentication for VPN clients		* All internal traffic is encrypted through VPN

			* Certificate-based authentication for VPN clients

	=== Network Isolation ===		=== Network Isolation ===

	'' Internal services only accessible via VPN		* Internal services only accessible via VPN
	'' No direct internet exposure of Synology NAS
	'' Firewall rules control traffic flow		* No direct internet exposure of Synology NAS

			* Firewall rules control traffic flow

	== Related Documentation ==		== Related Documentation ==

	'' [Network Architecture](network-architecture.md) - Network topology		* [Network Architecture](network-architecture.md) - Network topology
	'' [Key Components](components.md) - Component details
	'' [OpenVPN Server](index.md) - VPN security configuration		* [Key Components](components.md) - Component details

			* [OpenVPN Server](index.md) - VPN security configuration

	[[Category:Documentation]]		[[Category:Documentation]]
	[[Category:Documentation/System]]		[[Category:Documentation/System]]

Josh: Added configuration guide: Security Architecture

2026-01-01T13:15:46Z

Added configuration guide: Security Architecture

New page

= Security Architecture =

This document describes the security architecture of the reverse proxy system.

== Defense in Depth ==

The system uses multiple layers of security:

= '''Public Layer''': Nginx with SSL/TLS encryption =
= '''VPN Layer''': Encrypted tunnel between VPS and NAS =
= '''Internal Layer''': Services only accessible via VPN =
= '''Certificate Security''': Automatic renewal prevents expired certificates =

== Security Benefits ==

'' '''No Direct Exposure''': Synology NAS is not directly accessible from the internet
'' '''Encrypted Traffic''': All public traffic uses HTTPS
'' '''Isolated Network''': Internal services communicate over VPN
'' '''Certificate Management''': Automatic SSL certificate renewal

== Security Components ==

=== SSL/TLS Encryption ===

'' All public-facing traffic uses HTTPS
'' Let's Encrypt certificates automatically renew
'' HTTP traffic is redirected to HTTPS

=== VPN Encryption ===

'' OpenVPN provides encrypted tunnel between VPS and NAS
'' All internal traffic is encrypted through VPN
'' Certificate-based authentication for VPN clients

=== Network Isolation ===

'' Internal services only accessible via VPN
'' No direct internet exposure of Synology NAS
'' Firewall rules control traffic flow

== Related Documentation ==

'' [Network Architecture](network-architecture.md) - Network topology
'' [Key Components](components.md) - Component details
'' [OpenVPN Server](index.md) - VPN security configuration

[[Category:Documentation]]
[[Category:Documentation/System]]