Infrastructure Overview

What Was Set Up

1. Node.js Web App (server.js)

A minimal HTTP server built with Node's built-in http module — no frameworks, no dependencies.

• Listens on 127.0.0.1:3000 (localhost only — not directly exposed)
• Serves a single HTML page showing hostname, OS, Node version, and server time
• Bound to localhost intentionally; all public traffic goes through nginx or Tailscale Funnel

2. nginx Reverse Proxy

Extracted from nginx-1.30.0.zip into the project folder.

• Listens on 0.0.0.0:80 — accessible to all network interfaces
• Proxies all requests to http://127.0.0.1:3000 (the Node app)
• Forwards real client IP via X-Real-IP and X-Forwarded-For headers
• Config location: nginx-1.30.0/conf/nginx.conf

Key change from the default nginx config:

# Before (static file serving)
location / {
    root   html;
    index  index.html index.htm;
}

# After (reverse proxy to Node)
location / {
    proxy_pass         http://127.0.0.1:3000;
    proxy_http_version 1.1;
    proxy_set_header   Host $host;
    proxy_set_header   X-Real-IP $remote_addr;
    proxy_set_header   X-Forwarded-For $proxy_add_x_forwarded_for;
}

3. Windows Firewall Rule

Added an inbound rule to allow external traffic on port 80 (required admin privileges):

Rule name: nginx HTTP 80
Direction: Inbound
Action: Allow
Protocol: TCP
Port: 80

Without this rule, Windows blocks traffic to nginx even if nginx is listening.

4. Tailscale Funnel

Exposes the Node app to the public internet via Tailscale's infrastructure — no port forwarding or static IP required.

tailscale funnel --bg http://127.0.0.1:3000

This gives a permanent public HTTPS URL: https://nbg3pc.taileeca1e.ts.net

Tailscale handles:

• TLS certificate (auto-renewed)
• HTTPS termination
• Routing from the internet to this machine

The funnel config persists across reboots — you do not need to re-run this command after a restart.

Traffic Flow

Public internet request

Browser → https://nbg3pc.taileeca1e.ts.net
        → Tailscale's edge servers (TLS terminated)
        → Tailscale daemon on this machine
        → http://127.0.0.1:3000
        → Node.js app
        → HTML response

Tailscale network request (other devices on the tailnet)

Device → http://100.126.33.100
       → nginx :80
       → http://127.0.0.1:3000
       → Node.js app
       → HTML response

Why This Architecture

Decision	Reason
Node.js over Python/Flask	Node is better suited for long-running HTTP servers; Flask's dev server is not production-grade
nginx in front of Node	Standard practice — nginx handles connection management, keeps Node focused on app logic
Node bound to localhost only	Prevents direct port-3000 access; all traffic must go through nginx or Tailscale Funnel
Tailscale Funnel over port forwarding	No router config needed, automatic HTTPS, works behind CGNAT