Network exposure
Terminate TLS deliberately
Use a maintained reverse proxy or platform endpoint for HTTPS and keep upstream connections, redirects, certificates, and headers explicit.
8 minute lesson
HTTPS protects traffic to the TLS endpoint. Know exactly where decryption happens and what path follows it.
Automate certificate renewal, redirect HTTP deliberately, and pass trusted proxy headers through a controlled boundary. Bind the application to loopback when only the reverse proxy should reach it. Test certificate expiry and renewal alerts.
Nginx may terminate TLS while forwarding plain HTTP to an app on loopback. That is reasonable on one host, but the same hop across a private network needs its own protection decision.
Proxy identity headers need the same boundary. Remove caller-supplied copies at the edge, then add trusted values so the application never confuses internet input with proxy evidence.
Record the protocol, certificate owner, and trust boundary for every browser-to-database hop. Force HTTP, an expired test certificate, and a direct app-port request, then prove each fails or redirects as designed.
Lesson completed