rproxy Exposure Matrix

Last updated: 2026-05-27

This document tracks the public reverse proxy surface for rproxy.cfts.co.

Use it before changing the Caddyfile so each hostname has an explicit exposure decision, upstream, auth layer, header profile, logging posture, and follow-up work.

Current Edge Posture

rproxy.cfts.co firewall posture observed on 2026-05-17 after HTTP/3 was disabled:

Default incoming: deny
Default outgoing: allow

4422/tcp   allowed from 172.16.198.0/24
80/tcp     allowed from anywhere
443/tcp    allowed from anywhere
161/udp    allowed from 172.16.198.50

Listening services observed:

Caddy: 80/tcp, 443/tcp
SSH:   4422/tcp
SNMP:  161/udp
Caddy admin API: 127.0.0.1:2019 only

Fail2Ban posture verified on 2026-05-15, with Caddy jail source configs added on 2026-05-17:

fail2ban.service: active (running), enabled
active jail: sshd
sshd jail port: 4422
backend: systemd
current bans: 0
planned Caddy jails: caddy-unknown-host, caddy-scanner-paths

This is acceptable for the reverse proxy role. The main remaining risk is which applications are exposed through Caddy on public 80/443.

Reusable Caddy Profiles

The Caddyfile imports reusable snippets from:

/etc/caddy/includes/00-common.caddy

Source workspace copy:

F:\Avery_Vault_LLM\07-Projects\CFTS\Platforms\rproxy.cfts.co\caddy\includes\00-common.caddy

Current snippets:

Do not apply public_site_base blindly to app dashboards, ticket systems, consoles, or legacy apps without browser testing.

Default Error Pages

Every active HTTPS site block imports default_error_pages. Caddy-generated 403, 404, and 5xx errors render shared HTML from /etc/caddy/errors, and LAN-only deny paths call error 403 so they use that shared page.

Normal upstream responses from reverse_proxy are still passed through unchanged. A backend-owned 404 or 500 will not be replaced by the shared Caddy page unless a deliberate per-site handle_response rule is added.

POC result on 2026-05-26: an external browser request to https://download.cfts.co/ rendered the shared 403 Access restricted page. Keep the feature as a tidy Caddy-side fallback set; do not treat it as an application error-page override.

Testing notes:

• Test LAN-only denials from outside 172.16.198.0/24; testing from rproxy.cfts.co or the LAN can correctly return upstream 200.
• isp-status.cfts.co WAN fallbacks can return 401 because Basic Auth owns that path.
• Public app 404 responses, such as docs app misses, remain upstream-owned unless a site-specific handle_response rule is added.

Explicit HTTP Routing / Unknown Host Catch-All

The Caddyfile sets auto_https disable_redirects, then defines a single http:// block for plaintext HTTP. Known hostnames in @known_hosts redirect to HTTPS; unknown hostnames are logged to /var/log/caddy/unknown-host-access.log and closed with abort.

As of 2026-05-27, @known_hosts includes the current active hostnames, including edge-01.cfts.co, edge-02.cfts.co, inventory.cfts.co, and rp-logs.cfts.co. It also retains older vps.cfts.co / hvps.cfts.co names for compatibility/history.

No broad https:// catch-all is configured. Unknown HTTPS names should fail during TLS/SNI handling unless Caddy has a matching certificate.

Global Server Guardrails

The Caddyfile configures :80 and :443 server-level timeouts and protocol limits:

HTTP/3 is intentionally disabled, and public 443/udp exposure has been removed from UFW.

Log-Based Banning And Patch Automation

Source configs for easy-win automation live under:

security/fail2ban/filter.d/caddy-unknown-host.conf
security/fail2ban/filter.d/caddy-scanner-paths.conf
security/fail2ban/jail.d/caddy-rproxy.local
security/apt/apt.conf.d/20auto-upgrades
security/apt/apt.conf.d/52unattended-upgrades-cfts-security

Planned Fail2Ban web jails:

The unattended-upgrades config enables Ubuntu security upgrades without automatic reboots.

Planned PRTG Integration

PRTG integration is the next monitoring milestone. Keep it low-noise and focused on edge health, security automation, and certificate/service drift.

Suggested first sensors:

Avoid noisy per-request alerting at first. Alert on service down, cert expiry, disk pressure, missing Fail2Ban jails, unexpected listeners, or repeated validation failures.

Exposure Matrix

Hardening Backlog

In suggested order:

1. Confirm each origin VM firewall allows its application port only from 172.16.198.60 where practical. This is normal CFTS operating procedure; check periodically.
2. Review upstream authentication on edge-01.cfts.co, edge-02.cfts.co, public monitor.cfts.co/PRTG, redmine.cfts.co, tracks.cfts.co, and ticket portals.
3. Deploy and observe the Caddy Fail2Ban web jails; tune thresholds only after reviewing real matches.
4. Implement PRTG integration for edge health, certificates, Fail2Ban jail state, listener drift, disk/log growth, and unattended-upgrades status.
5. Consider adding or strengthening Caddy basic_auth, IP allowlists, or mixed LAN/public policies in front of other high-risk admin surfaces if upstream authentication is not strong enough.
6. Keep strict CSP limited to simple/public sites until each app is browser-tested.
7. Record validation results after each Caddy change:

sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy
systemctl status caddy --no-pager

Deployment Notes

Because SFTP does not write directly to /etc/caddy, stage files under:

/home/sysops/temp

Then copy with sudo:

sudo mkdir -p /etc/caddy/includes /etc/caddy/errors
sudo cp /home/sysops/temp/Caddyfile /etc/caddy/Caddyfile
sudo cp /home/sysops/temp/includes/00-common.caddy /etc/caddy/includes/00-common.caddy
sudo cp /home/sysops/temp/errors/*.html /etc/caddy/errors/
sudo chown root:root /etc/caddy/Caddyfile /etc/caddy/includes/00-common.caddy /etc/caddy/errors/*.html
sudo chmod 644 /etc/caddy/Caddyfile /etc/caddy/includes/00-common.caddy /etc/caddy/errors/*.html

Dedicated log files must be writable by the caddy service user before reload. Example for docs:

sudo install -d -o caddy -g caddy -m 0750 /var/log/caddy
sudo touch /var/log/caddy/docs-access.log
sudo chown caddy:caddy /var/log/caddy/docs-access.log
sudo chmod 0640 /var/log/caddy/docs-access.log

If a reload reports opening log writer with permission denied, create the named file and set caddy:caddy ownership before reloading again. This was required for /var/log/caddy/inventory.log during the 2026-05-26 inventory deployment.

The LAN-only log GUI is served at https://rp-logs.cfts.co/ from /var/www/caddy-log-report/index.html. The report is generated by observability/goaccess/render-caddy-goaccess-report.sh through the caddy-goaccess-report.timer systemd timer.