A while back, everything ran through a single reverse proxy. Handy — one place to handle all incoming traffic, whether it came from outside or from my own network. Until I realized: that’s actually pretty risky.
The problem with “everything in one place”
A reverse proxy that handles both public and internal traffic effectively knows the entire map of your network. If that one proxy ever turns out to be vulnerable — a bug, a misconfiguration, whatever — the door is, in theory, open to everything behind it. Including the things that were never meant for the outside world.
That didn’t sit right with me. So I split it.
Two proxies, two worlds
Now I have:
- A public proxy, which only knows which handful of services should actually be reachable from the internet
- An internal proxy, which handles everything else — purely for use within my own network
The public proxy literally knows nothing about the rest of my setup. Even if something ever goes wrong there, the rest of the network isn’t sitting right next to it.
That public proxy, by the way, doesn’t even sit on the same network segment as the rest. It lives in its own isolated slice of the network — a kind of DMZ — that by default has access to nothing, not even neighboring services within that same segment. That’s more or less the core idea behind Zero Trust: never trust automatically, even if something is “inside.” Every connection has to prove itself, every time.
The move was less simple than expected
Moving everything over sounded easier than it was. Some settings — think login-system integrations — turned out not to live in a config file at all, but buried deep in the tool’s own internal database. So I couldn’t just “copy it over.” I had to re-enter it by hand, service by service.
Annoying in the moment, but a good lesson: not every setting is as portable as you’d think. Next time I migrate something, I’ll figure that out beforehand instead of discovering it mid-move.
What I learned
- Separate public and internal traffic, even if it feels like overkill at first
- Don’t assume “copying the config” always brings everything with it
- A smaller attack surface is worth every bit of extra effort
Next time: how I manage my own DNS, from simple ad blocker to my own resolver.
