diff --git a/docs/deployment-architectures.md b/docs/deployment-architectures.md index 1693eff..681ec02 100644 --- a/docs/deployment-architectures.md +++ b/docs/deployment-architectures.md @@ -8,9 +8,7 @@ Use this if you have a **public IPv4 address** (either static or dynamically updated via DDNS) and access to your home router. -``` -Internet ──► Public IP (Router) ──(Port Forward)──► Home Host (Envoy:80/443) ──► backend -``` +![Direct Exposure Flow](screenshots/Direct%20Exposure%20Flow%20(Home%20Router%20Port%20Forwarding).svg) ### 1. How to configure it: 1. **Static IP / DDNS:** Ensure your router has a public WAN IP. If it's dynamic, configure a Dynamic DNS (DDNS) service (e.g., No-IP, DuckDNS) so your domain always points to your home IP. @@ -28,9 +26,7 @@ Use this if you are behind **CGNAT** (cannot port forward), do not have a public IPv4, or want to **hide your home public IP** for privacy/DDoS protection. -``` -Internet ──► VPS (Public IP) ──(WireGuard Tunnel + PROXY Protocol)──► Home Host (Envoy) ──► backend -``` +![VPS Relay Flow](screenshots/VPS%20Relay%20Flow%20(PROXY%20Protocol%20&%20AI%20Auto-Blocking).svg) ### The Client IP Preservation Problem (Crucial for AI Threat Analysis) If you use a VPS to proxy traffic to your home Envoy (e.g., using standard Nginx reverse proxy or simple port forwarding), Envoy will see **all incoming traffic as originating from the VPS's internal tunnel IP** (e.g., `10.0.0.1`), rather than the real client's IP. @@ -72,9 +68,7 @@ Use this if you want to expose your gateway **without port forwarding** and benefit from Cloudflare's DDoS protection, CDN, and WAF. -``` -Internet ──► Cloudflare Edge ──(cloudflared Tunnel)──► cloudflared Container ──(HTTP Headers)──► Home Envoy ──► backend -``` +![Cloudflare Tunnel Flow](screenshots/Cloudflare%20Tunnel%20Flow%20(HTTP%20Headers%20&%20AI%20Auto-Blocking).svg) ### The Client IP Preservation Problem (Headers vs. PROXY) Unlike Nginx stream relays which forward TCP packets directly, Cloudflare Edge acts as an HTTP reverse proxy and terminates the SSL connection. By default, Cloudflare does **not** use the PROXY Protocol (unless you are on an Enterprise plan). diff --git "a/docs/screenshots/Cloudflare Tunnel Flow \050HTTP Headers & AI Auto-Blocking\051.svg" "b/docs/screenshots/Cloudflare Tunnel Flow \050HTTP Headers & AI Auto-Blocking\051.svg" new file mode 100644 index 0000000..dba323d --- /dev/null +++ "b/docs/screenshots/Cloudflare Tunnel Flow \050HTTP Headers & AI Auto-Blocking\051.svg" @@ -0,0 +1,132 @@ + + + + + + + + + + + + + + + + Cloudflare Tunnel Flow (HTTP Headers & AI Auto-Blocking) + + + + + + + + + + + Attacker (1.2.3.4) + + + Cloudflare Edge + + + cloudflared (Daemon) + + + Envoy (Home) + + + Aegis (Home) + + + + Bootstrapping Phase + + + + Connect gRPC xDS + + + + Push config (Extract IP from CF-Connecting-IP) + + + + Traffic Flow (Exploit Attack & Dynamic Auto-Blocking) + + + + Send Exploit (IP 1.2.3.4) + + + + Inject CF-Connecting-IP: 1.2.3.4 + + + + Forward via outbound tunnel + + + + Forward to Envoy (Container 10080) + + + + Envoy extracts real IP: 1.2.3.4 + + + + Stream ALS (Client IP = 1.2.3.4) + + + + AI Engine Blocks 1.2.3.4 + + + + Push updated xDS blocklist + + + + Envoy blocks 1.2.3.4 dynamically + + + + Subsequent Request from Attacker (Blocked) + + + + Send Request 2 + + + + Forward + + + + Forward + + + + Drop Connection immediately (Client blocked) + + + + Legitimate traffic passing through Cloudflare continues to work unaffected! + + + + Attacker (1.2.3.4) + + + Cloudflare Edge + + + cloudflared (Daemon) + + + Envoy (Home) + + + Aegis (Home) + \ No newline at end of file diff --git "a/docs/screenshots/Direct Exposure Flow \050Home Router Port Forwarding\051.svg" "b/docs/screenshots/Direct Exposure Flow \050Home Router Port Forwarding\051.svg" new file mode 100644 index 0000000..7b0f644 --- /dev/null +++ "b/docs/screenshots/Direct Exposure Flow \050Home Router Port Forwarding\051.svg" @@ -0,0 +1,86 @@ + + + + + + + + + + + + + Direct Exposure Flow (Home Router Port Forwarding) + + + + + + + + + + Client + + + Router + + + Envoy + + + Aegis + + + + Bootstrapping Phase + + + + Connect via gRPC xDS (port 18000) + + + + Push http_listener (10080) + + + + http_listener live inside container + + + + Traffic Flow (HTTP to HTTPS Redirect) + + + + Request http://yourdomain.com (port 80) + + + + Forward to Host 80 -> Container 10080 + + + + Stream Access Log (gRPC ALS) + + + + Log request & update dashboard + + + + Redirect to HTTPS (https://yourdomain.com:443) + + + + Client + + + Router + + + Envoy + + + Aegis + \ No newline at end of file diff --git "a/docs/screenshots/VPS Relay Flow \050PROXY Protocol & AI Auto-Blocking\051.svg" "b/docs/screenshots/VPS Relay Flow \050PROXY Protocol & AI Auto-Blocking\051.svg" new file mode 100644 index 0000000..83d574e --- /dev/null +++ "b/docs/screenshots/VPS Relay Flow \050PROXY Protocol & AI Auto-Blocking\051.svg" @@ -0,0 +1,132 @@ + + + + + + + + + + + + + + + + VPS Relay Flow (PROXY Protocol & AI Auto-Blocking) + + + + + + + + + + + Attacker (1.2.3.4) + + + VPS (Nginx) + + + WG Tunnel + + + Envoy (Home) + + + Aegis (Home) + + + + Bootstrapping Phase + + + + Connect gRPC xDS + + + + Push https_listener + PROXY filter + + + + Traffic Flow (Exploit Attack & Dynamic Auto-Blocking) + + + + Send Exploit to Port 443 + + + + Prepend PROXY header (IP 1.2.3.4) + + + + Forward TCP stream + + + + Deliver to Home (10443) + + + + PROXY filter restores Client IP: 1.2.3.4 + + + + Stream ALS (Client IP = 1.2.3.4) + + + + AI Engine Blocks 1.2.3.4 + + + + Push updated xDS blocklist + + + + Envoy blocks 1.2.3.4 dynamically + + + + Subsequent Request from Attacker (Blocked) + + + + Send Request 2 + + + + Forward + + + + Deliver + + + + Drop Connection immediately (Client blocked) + + + + Legitimate traffic passing through VPS continues to work unaffected! + + + + Attacker (1.2.3.4) + + + VPS (Nginx) + + + WG Tunnel + + + Envoy (Home) + + + Aegis (Home) + \ No newline at end of file