4 ms·
Could you connect a bigger server at your house or wherever using Wireguard to a small VPS, and then don't terminate the TLS at the VPS, use haproxy in TCP mode
by Vecr 4y ago
Could you connect a bigger server at your house or wherever using Wireguard to a small VPS, and then don't terminate the TLS at the VPS, use haproxy in TCP mode or similar to copy the still TLS-encrypted TCP connections down the Wireguard pipe back to your house. In that case no one can DOS/DDOS your house (because they don't know your IP), and you can throttle the connections down the Wireguard pipe as well, see CAKE[0], with "Outbound, General Case" but with wg0 instead of eth0 done on the VPS.
https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/ https://www.bufferbloat.net/projects/codel/wiki/CakeRecipes/
- tristor 4y ago> Could you Yes. I could. This is one of several possible solutions available to me as an alternative. All alternative solutions to this problem either: 1. Are more expensive to implement, for various values of "more expensive". 2. Are more complicated to implement, for various values of "more complicated". 3. Are less resilient to the problem space, for various values of "less resilient". In some cases, they are all three. The proposal you made happens to be all three. If I were to do things all over again from scratch /today/, I might do things differently, simply because I'm more well off and have a more stable physical location than when I set up the last iteration of my personal site (which is still running), but none of the possibilities I can think of are strictly "better" than what I have already done, leveraging Cloudflare.