Haseeb ArshadHaseeb Arshad
← All projects
Zero-trust accessProduction

Identity-Aware Edge and Remote Access

A layered access plane combining automatic TLS, single sign-on, two-factor authentication, client certificates, and outbound-initiated VPN paths.

CaddyAutheliaWireGuardOAuth 2.0mTLSACME

2

edge replicas

2FA

operator access

mTLS

sensitive clients

The challenge

What the system needed to solve

Expose useful services remotely without turning private administration tools into unauthenticated internet endpoints.

The build

Engineering decisions

01

Deployed a redundant Caddy edge with automatic certificate management and readiness checks that validate real TLS handshakes.

02

Placed browser-facing private tools behind Authelia with two-factor authentication and explicit bypass rules only for machine-to-machine paths that cannot use redirects.

03

Used mutual TLS for a sensitive mobile client and WireGuard for private administration and SMTP-edge transport.

04

Kept selected administration surfaces LAN/VPN-only and documented the reasoning for each public route.

Architecture

How the pieces connect

  1. 1Public or VPN client
  2. 2Caddy TLS edge
  3. 3Authelia or client-certificate policy
  4. 4Network policy
  5. 5Private application service

Results

What changed

  • Public convenience and private administration coexist without sharing one permissive trust boundary.
  • Certificate renewal, authentication, and service health are independently monitored.
  • Access decisions are declared in code and reviewed alongside the application they protect.