- Dedicated Linux VM from an Ubuntu Server template
- Nginx as the reverse proxy
- Let's Encrypt certificates managed by Certbot
- Active local firewall
- Fail2ban active and validated for SSH administration
- HTTP → HTTPS redirection and certificate renewal tested
- Streaming responses and WebSocket connections validated
- VM200 restart validated with no configuration loss
| Service | Public status |
|---|---|
| OpenWebUI · VM210 | 🟢 published & HTTPS validated |
| n8n · VM300 | 🟢 published & HTTPS validated |
| Nextcloud · VM205 | 🟢 published & HTTPS validated |
| other internal services | ⚪ not published / deferred |
1. Navigateur Internet
↓ demande gpt.stephanemuraro.fr
2. DNS public
↓ renvoie l'adresse Internet de la connexion
3. Routeur
↓ transfère uniquement le trafic Web vers VM200
4. VM200 / Nginx
↓ choisit le virtual host correspondant au nom
5. VM210 / OpenWebUI
↓ produit la réponse applicative
6. VM200 / Nginx
↓ renvoie la réponse dans la session HTTPS
7. NavigateurDNS only associates the public name with the Internet address — it does not know which VM hosts the application. The router does not choose the service either: it hands Web connections off to VM200. It is Nginx that performs the application-level routing: the name requested during the TLS negotiation and in the HTTP request selects a configuration block (virtual host) that designates the target internal machine and service.
gpt.stephanemuraro.fr ─┐
n8n.stephanemuraro.fr ─┼─> même adresse publique ─> VM200
nextcloud.stephanemuraro.fr ─┘ ├─> VM IA
├─> VM automatisation
└─> VM fichiers| Component | Responsibility | Limit |
|---|---|---|
| Public DNS | associate a name with the Internet address | does not choose the internal VM |
| Router | forward Web traffic to VM200 | does not understand the applications |
| VM200 firewall | reject unplanned inbound connections | does not replace authentication |
| Nginx | terminate HTTPS, select the virtual host, relay | does not store business data |
| Certbot | obtain/renew Let's Encrypt certificates | does not publish an application by itself |
| Fail2ban | block certain repetitive attacks from the logs | replaces neither a firewall nor strong passwords |
| Backend | serve the application, control its users | must not be exposed directly |
Public encryption terminates on VM200. The certificate and its private key stay centralized on the reverse proxy, which avoids managing a different public certificate on each backend.
Client Internet ═════ HTTPS chiffré ═════> VM200 VM200 ───── flux LAN contrôlé ──> backend
Nginx forwards the requested name, the external protocol and the information needed for traceability to the backend. For interactive applications, it supports WebSockets, streaming responses and timeouts suited to long-running processing.
- the router only sends VM200 the necessary Web traffic
- the local firewall rejects other inbound connections
- administration stays limited to the internal network
- Nginx only relays configured names and services
- TLS encrypts and authenticates the public connection
- Fail2ban reduces certain observable repetitive attempts
- each backend keeps its own authentication and filtering
- databases and technical APIs stay absent from the WAN
Fail2ban is validated for SSH; this does not automatically protect application login forms — each protection requires an exploitable log and a tested filter.
- validate the service on the local network
- identify its HTTPS, WebSocket, request size and timeout needs
- define its public name and authentication model
- configure the application for its public origin
- create a separate virtual host on VM200
- validate the Nginx syntax before reloading
- obtain and test the certificate
- test from a genuinely external network
- check the logs and the absence of direct exposure
- document the rollback
- disable only the virtual host of one service;
- temporarily remove the Web forwarding to VM200;
- stop VM200 to neutralize all publications without changing the internal applications.
The formal test of the global rollback by removing the WAN forwarding remains the last open check of the first phase.
- Design of a shared reverse proxy
- DNS, NAT, SNI, virtual hosts and proxy headers
- Automation of the certificate lifecycle
- Support for WebSockets and streaming
- Segmentation between the Internet boundary and backends
- Defense in depth and rollback strategy
- Publishing a service hosted on another machine
Infrastructure
n8n
Nextcloud