• 3 Posts
  • 3 Comments
Joined 3 years ago
cake
Cake day: January 3rd, 2022

help-circle

  • I recommend it every time this question pops up and I’m surprised more people aren’t privy to it:

    Rent a VPS as your public gateway. Connect the VPS to your server with a simple wireguard tunnel.

    The only thing on the VPS should be a reverse proxy with SSL/TLS pass through.

    Send the traffic at the VPS reverse proxy to a reverse proxy on the main server. Configure this proxy to use letsencrypt certs.

    The benefit and importance of the SSL pass through reverse proxy, is that it allows all data in transit to remain encrypted until it reaches your physical server. Traditionally, most would suggest the one and only reverse proxy exist on the VPS but all traffic would then be decrypted on the VPS. This could obviously compromise your traffic if the VPS provider snoops or your VPS is compromised.

    Cloudflare tunnels decrypt on their hardware as well, which is why I always recommend avoiding their services.