Request Security Layers

Request Security Layers A lifecycle diagram generated by Archify. 01 / Request path 02 / Interruptions + recovery 03 / Rejected L0 · Internet · any IP · any port · Request path L0 · Internet any IP · any port L1 · ufw · 80/443 tcp · 51820 udp · Request path · kernel firewall L1 · ufw 80/443 tcp · 51820 udp kernel firewall L2 · Traefik · TLS terminated · SNI routed · Request path · 80 → 443 redirect L2 · Traefik TLS terminated · SNI routed 80 → 443 redirect L3 · Middleware · public / vpn-only / internal · Request path · allowlist L3 · Middleware public / vpn-only / internal allowlist L4 · Container · service handles request · Request path L4 · Container service handles request Dropped · silently, at the kernel · Rejected Dropped silently, at the kernel 403 Forbidden · source not in allowlist · Rejected 403 Forbidden source not in allowlist port match everything else cert validated allowed source not allowed Legend start active state decision terminal success failure / exit

Public tier

  • • No source restriction beyond the allowlist rule itself

VPN-only tier

  • • Source must be in the WireGuard or LAN range, else 403

Internal tier

  • • Source must be loopback (127.0.0.1), else 403 — never externally reachable