One door for the web.
The edge is where the internet meets the estate. One proxy receives every web request, holds the certificate, and passes each request to the service its name belongs to. Web services listen only inside, so there is one door to watch instead of many.
What it holds
| Nginx Proxy Manager | the one proxy every web request passes through |
|---|---|
| Wildcard certificate | HTTPS for every name under the domain |
| Wildcard DNS record | new names resolve without a DNS change |
| Loopback-bound services | reachable only through the proxy |
What it promises
One proxy in front
Every web request reaches the estate through Nginx Proxy Manager. It holds the certificates and sends each name to the service behind it.
Services listen only inside
Each web service binds to the host’s own loopback address, so from outside it can only be reached through the proxy.
One certificate for every name
A wildcard certificate covers every subdomain. A new service gets HTTPS on its own name without a new certificate.
Admin consoles behind the same door
Portainer and the backup console are reached through the proxy over HTTPS, like everything else. A console can also be left with no public name at all.
What people ask
Is anything else open to the internet?
For the web, no: every page and API goes through the proxy. Video calls are the exception, by design. Call media and the call relay have their own openings, because calls need them.
What does it take to put a new service online?
One proxy entry that maps a name to the service. The wildcard certificate and the wildcard DNS record already cover the name, so nothing else changes.
Can an admin console stay off the internet entirely?
Yes. The service keeps running and its console is reached only from inside the estate. Backups, for one, run on their schedule whether or not the backup console has a public name.