Aplicatiile (Java, Python, Node.js, PHP) nu trebuie sa se ocupe de SSL, WAF, rate limiting sau load balancing. Acestea sunt responsabilitati de infrastructura, centralizate intr-un strat reverse proxy.
Componente arhitecturale
- HAProxy — load balancer L4/L7 cu keepalived HA. Sticky sessions, health checks active, weighted round-robin
- Nginx — reverse proxy aplicativ pentru WebSocket, caching, compress (brotli/gzip), serve static
- Varnish — HTTP cache agresiv pentru aplicatii read-heavy
- Traefik — pentru containere Docker/K8s ingress cu auto-discovery
- ModSecurity — WAF cu OWASP Core Rule Set, blocaj injection attempts
- Let's Encrypt + Certbot — SSL auto-renewal centralizat
Functionalitati implementate standard
- SSL termination cu cipher hardening (TLS 1.3, HSTS, OCSP stapling)
- GeoIP filtering — blocaj tari fara trafic legitim
- IP whitelist/blacklist (CrowdSec sync, blocklist-uri custom)
- Rate limiting per IP si per endpoint (anti-scraping, anti-DDoS L7)
- Caching agresiv pentru endpoint-uri publice
- Compresie pre-cached pentru economisire bandwidth
Ce livram
Cluster reverse proxy HA, SSL auto-renewable, WAF cu false-positive reduction, dashboards monitoring, runbook pentru add/remove backend.