0045. A node behind another reverse proxy serves its apps through it (co-ingress)
Status: accepted, 2026-10-30. Refines 0015, which knew two ingress modes.
Context
ADR 0015 gives a node two ways to take its apps' traffic: edge (it owns 80 and 443) or relay (the control
plane's Caddy takes it and forwards it). A server that already runs software behind its own reverse proxy can't
give up 80 and 443, so it is a relay, and every request to its apps crosses the control plane — Caddy, domains'
front, appsd's router, a second TLS hop to the node — on the 1 vCPU server that also carries the AI gateway, and
stops whenever appsd restarts. Production apps on such servers are reached by their own names, which domains
already points at a node when the node serves them itself.
Decision
- A third mode,
co: the node keeps its reverse proxy, which hands the agent the names of the node's apps —
ending TLS and passing HTTP with a token of the node's (terminate), or passing TLS through by name with the
PROXY protocol (passthrough). The agent serves them as an edge node does: guards, cache, analytics,
telemetry.
- xvii proposes the other proxy's configuration (Caddy, nginx, Traefik, HAProxy) and never changes it: that proxy
belongs to whoever runs it.
- apps checks from outside: the path through the proxy before any name moves to the node, then each name through
public DNS. domains points a name at the node only while both hold; a name that fails goes back to the relay by
itself.
- The relay keeps running on every node:
<app>.apps.<d> stays relayed, and so does any name the other proxy
doesn't route.
- The agent takes the token, forwarded client addresses and PROXY headers only from the proxy's addresses.
Consequences
- App traffic of servers behind another proxy skips the control plane; the relay becomes their fallback, not
their path.
- A proxy that isn't xvii's joins the serving path: its mistakes show as failing names, which fall back, and the
certificates it keeps (
terminate) are outside xvii's backups.
- The node's owner sees its token, as they see everything given to their node (ADR 0008).
- Edge nodes gain the same name checks.
- Design:
superpowers/specs/2026-10-30-autopilot-and-thin-control-plane-design.md in this repository.