ქსელი5 წუთის საკითხავი
What a reverse proxy actually does for you
Why your app listens on a random port and the world still reaches it on 443, in the order the packets arrive.
ეს სტატია ჯერ ინგლისურადაა. ვთარგმნით.
Your application listens on a port allocated to it. Visitors type a name and expect port 443. The thing in between is a reverse proxy, and understanding it explains most of what looks like magic in the Domain tab.
In order
- A visitor resolves your domain and connects on 443.
- The proxy terminates TLS - it holds the certificate, your app does not.
- It reads the requested hostname and decides which server that means.
- It forwards the request internally to your port, adding headers that say who originally asked.
- Your app answers, and the proxy passes it back down the encrypted connection.
What this buys
- Your app never handles certificates, which is one fewer thing to renew and get wrong.
- Several domains can reach several servers over one address and one port.
- Your origin port does not need to be exposed to the internet at all.
The header that catches people
Because the proxy makes the connection to your app, your app sees the proxy's address as the client. The real one is in X-Forwarded-For. If you are rate limiting, logging or geolocating by IP, read that header - otherwise every visitor looks like the same person, which is a bug that only shows up in production.