FDE ACADEMY · MODULE 03 · LESSON 03
Networking: who can reach this
A reverse proxy, TLS, one exposed port and a model server that is not on the internet. The unglamorous layer that decides whether a stack is a deployment or an incident.
- Effort
- Two hours, plus however long the TLS material takes to obtain.
- Skills
- networking · security-hardening · linux
Free and self-paced. No certification is offered.
Before you startYou have a stack running from module 02 lesson 05.
01Exactly one way in
A deployment should present a single entry point: a reverse proxy terminating TLS on a name your customer recognises, forwarding to the application. Everything else — the model server, the database, the automation service — listens on an internal network and is not published.
The failure this prevents is common and quiet. Container port publishing binds to every interface by default on many setups, so a model server started for a quick test can be reachable from outside the host. It has no authentication because it was “just local”, and it will answer anyone who finds it.
- Publish the proxy’s port and nothing else. Everything internal talks over the container network by name.
- Terminate TLS at the proxy, using material the customer’s own devices already trust.
- Set request size and timeout limits at the proxy — uploads and long generations both need them raised deliberately.
02Public, private, or neither
Ask where the users are. On the office network only, and you may not need to be reachable from the internet at all. Working from home, and the honest options are the customer’s existing remote access or a properly fronted public endpoint — not a port forward with a long password.
This is a decision to take with whoever runs the customer’s network, in writing, early. It is also the point where you discover the real constraints: an internal issuing authority for TLS, an outbound proxy that intercepts traffic, a firewall change that takes three weeks.
03Egress, not just ingress
Ingress is who can reach you. Egress is what your deployment can reach, and it is the half that gets skipped. A stack that can open arbitrary outbound connections can send documents anywhere, whatever the diagram says.
Decide what the deployment needs to reach — a model registry during setup, an update channel, one CRM endpoint — and restrict the rest. Then your architecture diagram is enforced by the network rather than described by a document.
04Do this
PRACTICAL TASK
Put one door in front of the stack and prove the rest is shut
Front the deployment with a reverse proxy over TLS, then verify from another machine that no internal service is reachable.
What you need
- Your running stack
- A second machine on the same network to test from
- A hostname and TLS material, even from a private issuer
Steps
- 01
Follow the recipe’s hardening step and put the reverse proxy in front before anyone logs in.
- 02
Remove every published port except the proxy’s. Restart the stack and confirm the application still works through the proxy.
- 03
From the second machine, attempt to reach the model server, the database and the automation service directly. Record what happens for each.
- 04
Raise the proxy’s request size and timeout limits deliberately, then upload your largest real document and run your longest real query.
- 05
Write down the outbound connections the deployment genuinely needs, and check them against the architecture you read in lesson 02.
You are done when
- One published port; connection attempts to the internal services from another machine fail, and you have the output.
- A large upload and a long generation both succeed through the proxy.
- You have a written list of required outbound destinations, and it matches the architecture diagram.
05Where these facts live
This lesson does not restate anything that is already recorded with its evidence elsewhere on the site. These are the pages it leans on.
- Private company knowledge base
Its hardening step is deliberately placed before the first login rather than after rollout.
- Local LLM serving
Includes putting a key on the endpoint — the second lock behind the network one.
- Private internal document search
Who can reach what, written as a design: the identity provider decides which matter each fee earner sees.
Ticks are stored in your browser only. They are not sent anywhere, they are not attached to an account, and clearing your browser data removes them.