# Deploy an edge reverse proxy with the edge-reverse-proxy template

Source: https://docs.quake.ai/resources/deployments/deploy-edge-reverse-proxy-template
Markdown: https://docs.quake.ai/resources/deployments/deploy-edge-reverse-proxy-template.md

---

# Deploy an edge reverse proxy with the edge-reverse-proxy template

Stand up a [Caddy](https://caddyserver.com) reverse proxy with automatic TLS on one Quake AI instance using the [validated OpenTofu template](/docs/platform/validation#how-infrastructure-templates-are-checked) `edge-reverse-proxy`. You apply the template, launch a private backend on the same subnet, verify traffic flows through the proxy, lock the backend security group to the proxy, point a domain at the floating IP, and confirm HTTPS end to end.

The proxy holds the only public floating IP. The backend stays on the private subnet with no address on the internet. You operate both instances yourself; this is a regional reverse proxy you run, not a managed global edge network.

<Figure size="md" caption="What you'll build: Caddy on a proxy instance with a floating IP terminates TLS and forwards to a private backend on the same subnet">

```d2
direction: right

client: Browser {shape: person}
fip: Floating IP\n80 / 443
proxy: Proxy VM\nCaddy {
  caddy: Caddy
}
backend: Backend VM\nno floating IP {
  app: App :8080
}

client -> fip: HTTPS
fip -> proxy.caddy
proxy.caddy -> backend.app: private subnet only
```

</Figure>

<PricingCompanion
  components={[
    { kind: "template", slug: "edge-reverse-proxy", required: true },
    { kind: "primitive", required: true, label: "Private backend instance", vm: { flavor: "s1a.small", count: 1 } },
  ]}
/>

## Prerequisites

You need:

- OpenTofu 1.6.0 or later (or Terraform 1.6.0 or later) installed locally.
- Your OpenStack credentials sourced into the shell (`source openrc.sh`). See [the OpenStack CLI guide](/docs/tools/openstack-cli).
- An SSH keypair that already exists in your project. Record its name for the `key_name` variable.
- A copy of the `edge-reverse-proxy` template directory from [the template reference page](/resources/iac-templates/edge-reverse-proxy).
- A domain you can point at the proxy floating IP when you reach the HTTPS step.

## Step 1: Apply the proxy template

Copy the template's example variables file and set `key_name`. Leave `domain` empty for now so Caddy serves plain HTTP on port 80 while you stand up the backend. Keep the default `upstream_host` and `upstream_port` unless you plan a different private address:

```bash
cp terraform.tfvars.example terraform.tfvars
```

```hcl
key_name       = "YOUR_KEY_NAME"
upstream_host  = "10.42.0.10"
upstream_port  = 8080
```

Initialize, preview, and apply:

```bash
tofu init
tofu plan
tofu apply
```

OpenTofu provisions a private network, router, security group, data volume, proxy instance, and floating IP. cloud-init installs Docker, mounts the data volume at `/data`, writes a Caddyfile that reverse-proxies to `upstream_host:upstream_port`, and starts Caddy.

Record the outputs:

```bash
tofu output floating_ip
tofu output private_ip
tofu output proxy_url
```

Wait two to three minutes for cloud-init to finish before you test the proxy.

## Step 2: Launch a private backend on the proxy network

The template creates network `edge-reverse-proxy-net` and subnet `edge-reverse-proxy-subnet` (names follow the default `app_name`). Launch a small backend instance on that subnet at the fixed address `10.42.0.10` with no floating IP.

1. Create a security group for the backend:

```bash
openstack security group create app-backend-sg \
  --description "Private app backend; ingress from proxy only after step 4"
```

Allow SSH from your workstation while you configure the backend (tighten or remove this rule after setup):

```bash
openstack security group rule create \
  --protocol tcp --dst-port 22 --remote-ip YOUR_IP/32 app-backend-sg
```

2. Create a port with the fixed private IP:

```bash
SUBNET_ID=$(openstack subnet list -f value -c ID -c Name | awk '/edge-reverse-proxy-subnet/ {print $1}')

openstack port create \
  --network edge-reverse-proxy-net \
  --fixed-ip subnet=$SUBNET_ID,ip-address=10.42.0.10 \
  --security-group app-backend-sg \
  app-backend-port
```

3. Write a short cloud-init file that serves a test page on port 8080:

```bash
cat > backend-cloud-init.yaml <<'EOF'
#cloud-config
package_update: true
packages:
  - nginx
runcmd:
  - |
    echo 'backend ok' > /var/www/html/index.html
    printf '%s\n' 'server {' '  listen 8080;' '  root /var/www/html;' '}' > /etc/nginx/sites-available/default
    systemctl restart nginx
EOF
```

4. Launch the backend instance on the port:

```bash
openstack server create \
  --flavor s1a.small \
  --image Ubuntu-24.04 \
  --key-name YOUR_KEY_NAME \
  --port app-backend-port \
  --user-data backend-cloud-init.yaml \
  app-backend
```

Wait until the instance reports `ACTIVE`, then confirm the backend answers on the private subnet from the proxy host:

```bash
ssh ubuntu@YOUR_FLOATING_IP 'curl -s http://10.42.0.10:8080/'
```

The response body should include `backend ok`.

## Step 3: Verify traffic through the proxy

From your workstation, request the proxy floating IP over HTTP:

```bash
curl -s http://YOUR_FLOATING_IP/
```

The response should show `backend ok`. The request path is client to proxy floating IP to Caddy to private backend.

If Caddy returns `502`, cloud-init may still be running on the proxy or backend. Wait and retry. If the error persists, SSH to the proxy and run `docker compose -f /opt/edge-proxy/docker-compose.yml ps` to confirm Caddy is up.

## Step 4: Lock the backend security group to the proxy

Restrict the backend so it accepts application traffic only from the proxy security group `edge-reverse-proxy-sg`. Remove any rule that opens the application port to `0.0.0.0/0` if you added one during testing.

```bash
openstack security group rule create \
  --protocol tcp \
  --dst-port 8080 \
  --remote-group edge-reverse-proxy-sg \
  app-backend-sg
```

List the backend rules and confirm port 8080 allows only the proxy group:

```bash
openstack security group rule list app-backend-sg -f table
```

The backend still has no floating IP, so it is not reachable directly from the internet. Only the proxy can forward traffic to it on the private subnet.

## Step 5: Point a domain and enable HTTPS

1. Create a DNS **A record** for your domain (for example `app.example.com`) pointing at `YOUR_FLOATING_IP`. Follow [How to point a domain at a Quake AI resource](/docs/network/how-to/point-domain-to-quake-ai). Wait until it resolves:

```bash
dig +short app.example.com
```

2. Set `domain` in `terraform.tfvars`:

```hcl
domain = "app.example.com"
```

3. Apply again. OpenTofu updates cloud-init so Caddy serves the domain with automatic Let's Encrypt HTTPS:

```bash
tofu apply
```

OpenTofu may replace the proxy instance when `domain` changes because cloud-init content changed. Wait for cloud-init to finish on the new instance.

For background on certificates, see [How to issue and auto-renew a TLS certificate with Let's Encrypt](/docs/network/how-to/lets-encrypt-certificate).

## Step 6: Verify HTTPS end to end

Request the site over HTTPS:

```bash
curl -s https://app.example.com/
```

The response should still show `backend ok`. Inspect the certificate:

```bash
curl -vI https://app.example.com/ 2>&1 | grep -E 'subject:|issuer:'
```

Traffic now flows client to HTTPS on the domain to Caddy on the proxy to the private backend.

## What you built

- **Applied the `edge-reverse-proxy` template** to provision a private network, proxy security group, data volume, Caddy host, and floating IP
- **Launched a private backend** on the same subnet at `10.42.0.10` with no public address
- **Verified HTTP and HTTPS** through the proxy floating IP and your domain
- **Locked the backend security group** so application traffic accepts only the proxy as its source
- **Obtained automatic TLS** by pointing DNS at the floating IP and setting `domain` in `terraform.tfvars`

## Scope of this deployment

This proxy runs in one region on VMs you operate. It is a regional reverse proxy, not a global edge network: Quake AI has no anycast, no global PoPs, and no first-party CDN. For geographic distribution and volumetric DDoS absorption at the network edge, [front the origin with a third-party CDN](/docs/network/how-to/front-with-cdn). For L7 attack filtering in front of the same shape, see [front with a WAF](/docs/network/how-to/front-with-waf).

The walkthrough adds a second small instance for the backend; that VM is not part of the OpenTofu template. Size the proxy with the template defaults; scale the backend independently for your application.

## Next steps

- [Edge reverse proxy template](/resources/iac-templates/edge-reverse-proxy): parameters, ports, and resource map
- [Front with a WAF](/docs/network/how-to/front-with-waf): add L7 filtering in front of the same private-backend shape
- [Front with a CDN](/docs/network/how-to/front-with-cdn): cache static assets and absorb edge traffic geographically
- [Security hardening checklist](/docs/security/hardening-checklist): audit security groups and floating IP usage

## Clean up

When you no longer need the deployment, destroy the OpenTofu stack and delete the backend resources you created in step 2:

```bash
tofu destroy
openstack server delete app-backend
openstack port delete app-backend-port
openstack security group delete app-backend-sg
```

Remove the DNS A record you created in step 5.