docs: add rationale for the two-proxy (inner/outer Caddy) split #1
Loading…
Reference in a new issue
No description provided.
Delete branch "%!s()"
Deleting a branch is permanent. Although the deleted branch may continue to exist for a short time before it actually gets removed, it CANNOT be undone in most cases. Continue?
network.md (TLS section) ends with "(TBD: rationale for the two-proxy split)." I left it unexplained rather than infer it. Please add a sentence or two on why the inner Caddy (citrine, step-ca relationship) and outer Caddy (bort, public entry) are separate, and I'll fold it in.
so I don't want to have any unencrypted traffic that is sniffable on any VLAN; all http traffic should (ideally) have SSL enabled. As such, each host/lxc/vm typically instantiates its own caddy proxy which gets internal certs from step-ca, then the outer proxy (which only serves a subset of those sites) gets LE certs for a handful. The outer proxy terminates public TLS and re-encrypts with the private step-ca key for internal TLS.
This is true on basically every internal host, not just hydra or citrine. If it's not true, it should be flagged, but I think it's all covered. Some sites don't have step-ca-produced certs yet (i.e opnsense and a couple other sites), but they use self-signed certs for now until I get all of them on the same setup.
Done. TLS section rewritten: no-plaintext-on-any-VLAN goal, per-host Caddy with step-ca certs, outer Caddy terminating public TLS and re-encrypting with the step-ca key, self-signed cert exception noted. Diagram updated.