Key Components

This document describes the key components of the reverse proxy system.

Nginx Reverse Proxy

Purpose: Acts as the entry point for all web traffic, handling SSL termination and request forwarding.

Configuration Locations: Available Configs: /etc/nginx/sites-available/ Enabled Configs: /etc/nginx/sites-enabled/ (symlinks to sites-available)

Key Features: SSL/TLS termination HTTP to HTTPS redirects Proxy header forwarding WebSocket support Request routing based on hostname

Proxy Headers

Nginx forwards important headers to maintain client information:

Host: Preserves the original host header X-Real-IP: Client's real IP address X-Forwarded-For: Forwarded for chain (for multi-proxy scenarios) X-Forwarded-Proto: Original protocol (http/https) Upgrade & Connection: For WebSocket support

SSL/TLS Certificates

Provider: Let's Encrypt (free SSL certificates)

Management: Certbot (automatic renewal every 90 days)

Certificate Storage: /etc/letsencrypt/live/[domain]/ Features: Automatic renewal via cron/systemd timer Wildcard or single-domain certificates HTTPS enforcement (HTTP redirects to HTTPS)

OpenVPN Tunnel

Purpose: Creates a secure, encrypted tunnel between the VPS and Synology NAS.

Network Details: VPN Server: VPS (10.8.0.1) VPN Client: Synology NAS (10.8.0.2) Network Range: 10.8.0.0/24

Security: Encrypted traffic between VPS and NAS NAS not directly exposed to internet Internal services accessible only via VPN

Firewall and Routing

iptables Rules: NAT Rules: Port forwarding for direct TCP connections MASQUERADE: Enables VPN clients to access internet through VPS FORWARD Rules: Controls traffic between VPN and internal networks

System:Components