4 ms·

Wow! Super interested in this (as it is similar to what I had in mind) Could you share further detail please? The jumpserver is haproxy or something similar? I

• sdevonoes 5y ago
  - The jumpserver is just an Ubuntu machine with the ssh daemon running. It's open to the internet. I try to follow the "best security practices" to harden this machine (but I still have a lot to learn): don't allow root access, only allow access via ssh keys, etc. I don't have ssh access to any of the machines inside the VPC, I use the jumpserver for this: I ssh into the jumpserver and then ssh into any other server (of course, I do this automatically. Search "ssh jumphost") - nginx is installed only in one server. This server is also public to the internet: it's the main entrance to my web application (so whenever you type mydomainname.com, it's nginx the one that handles the request and redirects it to my web application) The other servers (the webserver with my application code) and the database server are only accessible from within the VPC (internal network) and are not open to the internet (there are some iptables rules set up) - At the moment I have everything in DigitalOcean. I use Terraform to create the servers (droplets) and then provision them via Ansible. So far so good. > I thought previously that you had to put nginx + server application in every node. I only have one application server because my load is low. In order to scale, sure you can have N application servers and M nginx servers. I don't know why would I put nginx and the application code in 1 server (I think K8s does this?)
  • juanse 5y ago
    Thank you very much for the answer. I've got now a concept to try and develop.