AutoCore Reverse Proxy, DNS, and TLS
Documents the verified reverse-proxy, hostname, forwarding, and TLS boundary.
The reference Nginx configuration expects a Cloudflare Full/strict edge, trusted forwarding ranges, separate public/API/Admin hostnames, and TLS 1.2/1.3. Public docs use example hostnames only.
Release candidate source
This article reflects the audited AutoCore source revision 7a504f6e430c16d4fcb03ebdea3cc3fb7816df60 and immutable release-candidate tag v1.0.0-rc.1 at 9edfb109f44cc80385784c694b96392cfc04e70f. Configuration and external provider behavior remain deployment-dependent.
Source boundary
| Control | Source-verified behavior |
|---|---|
| Proxy | Forwarded client identity is trusted only from configured Cloudflare ranges; those ranges require operational refresh. |
| Exposure | The proxy hides server tokens, limits request size, sets timeouts, and does not publish internal datastore ports. |
| TLS | The example policy enables TLS 1.2/1.3, HSTS, and HTTP-to-HTTPS redirection with a health exception. |
| DNS | Public, API, and Admin records are separate deployment inputs; the application does not create DNS records. |
| Rate limits | No Nginx rate-limit claim is made; edge and application responsibilities must be verified separately. |
Operational controls
Use the smallest verified control for the task. Keep provider, host, legal, and operator responsibilities separate from application behavior. When a control is not implemented or not verified, leave it disabled or mark it as a limitation.
Verification
Verify the route, relevant API or configuration state, negative path, audit/evidence result, and public effect before closing the task. Record unknown or configuration-dependent behavior as a limitation.