System:Components

Key Components

This document describes the key components of the reverse proxy system.

Nginx Reverse Proxy

Purpose: Acts as the entry point for all web traffic, handling SSL termination and request forwarding.

Configuration Locations:

• Available Configs: /etc/nginx/sites-available/

• Enabled Configs: /etc/nginx/sites-enabled/ (symlinks to sites-available)

Key Features:

• SSL/TLS termination

• HTTP to HTTPS redirects

• Proxy header forwarding

• WebSocket support

• Request routing based on hostname

Proxy Headers

Nginx forwards important headers to maintain client information:

• Host: Preserves the original host header

• X-Real-IP: Client's real IP address

• X-Forwarded-For: Forwarded for chain (for multi-proxy scenarios)

• X-Forwarded-Proto: Original protocol (http/https)

• Upgrade & Connection: For WebSocket support

SSL/TLS Certificates

Provider: Let's Encrypt (free SSL certificates)

Management: Certbot (automatic renewal every 90 days)

Certificate Storage: /etc/letsencrypt/live/[domain]/ Features:

• Automatic renewal via cron/systemd timer

• Wildcard or single-domain certificates

• HTTPS enforcement (HTTP redirects to HTTPS)

OpenVPN Tunnel

Purpose: Creates a secure, encrypted tunnel between the VPS and Synology NAS.

Network Details:

• VPN Server: VPS (10.8.0.1)

• VPN Client: Synology NAS (10.8.0.2)

• Network Range: 10.8.0.0/24

Security:

• Encrypted traffic between VPS and NAS

• NAS not directly exposed to internet

• Internal services accessible only via VPN

Firewall and Routing

iptables Rules:

• NAT Rules: Port forwarding for direct TCP connections

• MASQUERADE: Enables VPN clients to access internet through VPS

• FORWARD Rules: Controls traffic between VPN and internal networks

Related Documentation

• [Network Architecture](network-architecture.md) - Network topology

• [Security Architecture](security.md) - Security features

• [OpenVPN Server](index.md) - VPN configuration