01
Web Servers and Proxies
The layer a request passes through before it reaches the application: separating the static-serving, proxy, and load-distribution roles, upstream definition in a reverse proxy and the information header forwarding loses when it is done wrong, TLS termination and protocol selection, automatic certificate renewal and the window a failed renewal opens, the hit-and-freshness balance between the edge cache and the origin cache, and the cost of managing traffic with sidecar proxies.
- 01 Web Server Roles The surface the default installation of the static-serving, reverse-proxy, and load-distribution roles leaves open: a role-by-role count of eighteen items, merging the three roles into a single process raising fourteen unique items to seventeen and carrying the externally reachable item count from ten to seventeen, four hardening steps closing thirteen items against the four legitimate workflows they stop, and the four items left over that cannot be closed.
- 02 Reverse Proxy Configuration Counting the four pieces of information lost by passing a real request through a two-hop proxy chain: client address, protocol, server name, and the request's original path; the wrong decision each loss produces in the application (three members recorded under a single identity, an absolute link pointing at an internal address, a link that returns 404 once the prefix is stripped), the second hop erasing the first hop's forwarding, and the claimed-identity surface opened by trusting the forwarded header.
- 03 TLS Termination Comparing three options for where termination happens: the plaintext-leg count, certificate-location count, renewal-touch-point count, and the work the edge loses when terminating at the edge, at the proxy, and at the app; modeling protocol version and cipher suite as an item set, the twenty-eight items the default leaves open, and the device and read counts a restriction drops.
- 04 Certificate Automation Writing the renewal flow as a state machine and sweeping lifetime against threshold: the twelve unneeded renewals an early threshold produces, the thirty-eight-hour exposure window a late threshold leaves, five validation-failure attempts and the moment the alert must fire, and manual renewal getting forgotten on nine items over a three-year period, leaving seventeen hundred hours of exposure window.
- 05 Cache Server How the hit rate splits between the edge and the origin in a two-layer cache: splitting the edge into three nodes raising the requests reaching the app from fifty to one hundred forty-three and the origin cache bringing that back down to ten, invalidation's propagation window dropping from three hundred sixty seconds to eleven seconds, the freshness setting's effect on that window, and the shared-key surface opened when a personal response lands in the shared cache.
- 06 Service Mesh Comparing the same traffic rules applied in application code and in a sidecar proxy: the number of services touched and the annual work items when a rule changes, measuring a real sidecar hop, the hop and latency added to every request, sidecar memory and core consumption, the new surface items they introduce, and the break-even point in a three-service system where the cost outweighs the gain.