The challenge
What the system needed to solve
Expose useful services remotely without turning private administration tools into unauthenticated internet endpoints.
The build
Engineering decisions
Deployed a redundant Caddy edge with automatic certificate management and readiness checks that validate real TLS handshakes.
Placed browser-facing private tools behind Authelia with two-factor authentication and explicit bypass rules only for machine-to-machine paths that cannot use redirects.
Used mutual TLS for a sensitive mobile client and WireGuard for private administration and SMTP-edge transport.
Kept selected administration surfaces LAN/VPN-only and documented the reasoning for each public route.
Architecture
How the pieces connect
- 1Public or VPN client
- 2Caddy TLS edge
- 3Authelia or client-certificate policy
- 4Network policy
- 5Private application service
Results
What changed
- Public convenience and private administration coexist without sharing one permissive trust boundary.
- Certificate renewal, authentication, and service health are independently monitored.
- Access decisions are declared in code and reviewed alongside the application they protect.
