System:Security
This document describes the security architecture of the reverse proxy system.
Defense in Depth
[edit]The system uses multiple layers of security:
Public Layer: Caddy with SSL/TLS encryption (Let's Encrypt)
[edit]VPN Layer: Encrypted tunnel between VPS and NAS
[edit]Internal Layer: Services only accessible via VPN
[edit]Certificate Security: Automatic renewal prevents expired certificates
[edit]Security Benefits
[edit]- No Direct Exposure: Synology NAS is not directly accessible from the internet
- Encrypted Traffic: All public traffic uses HTTPS
- Isolated Network: Internal services communicate over VPN
- Certificate Management: Automatic SSL certificate renewal
Security Components
[edit]SSL/TLS Encryption
[edit]- All public-facing traffic uses HTTPS
- Let's Encrypt certificates automatically renew
- HTTP traffic is redirected to HTTPS
VPN Encryption
[edit]- OpenVPN provides encrypted tunnel between VPS and NAS
- All internal traffic is encrypted through VPN
- Certificate-based authentication for VPN clients
Network Isolation
[edit]- Internal services only accessible via VPN
- No direct internet exposure of Synology NAS
- Firewall rules control traffic flow
Related Documentation
[edit]- [Network Architecture](network-architecture.md) - Network topology
- [Key Components](components.md) - Component details
- [OpenVPN Server](index.md) - VPN security configuration