Hybrid Nginx & Apache Reverse Proxy Architecture

================================================================================
             HYBRID DUAL-TIER REVERSE PROXY ARCHITECTURE TOPOLOGY
================================================================================

                    [ Public Web Clients & Browsers ]
                                   |
                                   v  (HTTPS :443 / HTTP/3 QUIC)
                  +--------------------------------+
                  |    NGINX FRONTEND REVERSE PROXY|
                  |  - SSL/TLS Termination         |
                  |  - Gzip / Brotli Compression   |
                  |  - Fast Edge Microcaching      |
                  |  - Rate Limiting & WAF Shield  |
                  +--------------------------------+
                                   |
            +----------------------+----------------------+
            | (Static Request)                            | (Dynamic Request)
            v                                             v  (HTTP Loopback :8080)
  +--------------------+                         +--------------------------------+
  | Direct NVMe Disk   |                         |     APACHE BACKEND DAEMON      |
  | (sendfile zero-copy|                         |  - Reads .htaccess Directives  |
  |  bypasses Apache)  |                         |  - mod_remoteip Header Restore |
  +--------------------+                         |  - mpm_event Worker Threads    |
                                                 +--------------------------------+
                                                                  |
                                                                  v (FastCGI)
                                                         +----------------+
                                                         |  PHP-FPM Pool  |
                                                         +----------------+

# /etc/apache2/ports.conf
# Bind Apache exclusively to the local loopback interface on port 8080
Listen 127.0.0.1:8080

<IfModule ssl_module>
    # Internal SSL is unnecessary since Nginx handles SSL termination at the edge
    # Keep commented unless end-to-end backend TLS is explicitly required
    # Listen 127.0.0.1:8443
</IfModule>

# /etc/apache2/sites-available/app.conf
<VirtualHost 127.0.0.1:8080>
    ServerName example.com
    ServerAlias www.example.com
    ServerAdmin webmaster@example.com

    DocumentRoot /var/www/html/app/public

    <Directory /var/www/html/app/public>
        Options -Indexes +FollowSymLinks
        # Enable full .htaccess support for application routing and redirects
        AllowOverride All
        Require all granted
    </Directory>

    # Dynamic PHP Handling via FastCGI
    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost"
    </FilesMatch>

    # Logging Configuration
    ErrorLog ${APACHE_LOG_DIR}/app_error.log
    CustomLog ${APACHE_LOG_DIR}/app_access.log combined
</VirtualHost>

# Enable the remote IP module
sudo a2enmod remoteip

# /etc/apache2/conf-available/remoteip.conf
<IfModule mod_remoteip_c>
    # Define the header injected by Nginx containing the real client IP
    RemoteIPHeader X-Forwarded-For

    # Trust Nginx running on local loopback addresses
    RemoteIPInternalProxy 127.0.0.1 ::1

    # If Cloudflare or external proxy layers sit in front of Nginx, trust their CIDRs:
    # RemoteIPTrustedProxy 173.245.48.0/20
    # RemoteIPTrustedProxy 103.21.244.0/22
    # RemoteIPTrustedProxy 104.16.0.0/13
</IfModule>

sudo a2enconf remoteip

# Replace existing LogFormat lines with %a:
LogFormat "%a %l %u %t \"%r\" %>s %O \"%{Referer}i\" \"%{User-Agent}i\"" combined
LogFormat "%a %l %u %t \"%r\" %>s %O" common

sudo systemctl restart apache2
sudo ss -tulpn | grep 8080
# Output should show: tcp LISTEN 0 511 127.0.0.1:8080

# Define the upstream Apache backend cluster
upstream apache_backend {
    server 127.0.0.1:8080 max_fails=3 fail_timeout=10s;
    keepalive 64; # Maintain persistent connection pool to Apache
}

# 1. HTTP Port 80 -> Automatic HTTPS Redirect
server {
    listen 80;
    listen [::]:80;
    server_name example.com www.example.com;

    # Let's Encrypt ACME challenge location
    location ^~ /.well-known/acme-challenge/ {
        root /var/www/html/app/public;
        default_type "text/plain";
        allow all;
    }

    location / {
        return 301 https://$host$request_uri;
    }
}

# 2. HTTPS Port 443 -> Primary Edge Reverse Proxy
server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name example.com www.example.com;

    # Document Root (Identical to Apache's DocumentRoot)
    root /var/www/html/app/public;
    index index.php index.html;

    # SSL/TLS Configuration
    ssl_certificate /etc/letsencrypt/live/example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/example.com/privkey.pem;
    ssl_trusted_certificate /etc/letsencrypt/live/example.com/chain.pem;

    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384';
    ssl_prefer_server_ciphers off;
    ssl_session_timeout 1d;
    ssl_session_cache shared:SSL:50m;
    ssl_session_tickets off;
    ssl_stapling on;
    ssl_stapling_verify on;

    # Security Headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;
    add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

    # Block sensitive hidden files (.git, .env, .htaccess, .htpasswd)
    location ~ /\.(?!well-known).* {
        deny all;
        access_log off;
        log_not_found off;
    }

    # =========================================================================
    # STATIC ASSET OFFLOADING (Bypasses Apache Completely!)
    # =========================================================================
    location ~* \.(jpg|jpeg|png|gif|webp|avif|ico|svg|css|js|woff|woff2|ttf|eot|mp4|webm|pdf)$ {
        expires 365d;
        add_header Cache-Control "public, no-transform, immutable";
        add_header X-Served-By "Nginx-Static-Engine" always;
        access_log off;
        log_not_found off;
        tcp_nodelay off;
        open_file_cache max=10000 inactive=30s;
        open_file_cache_valid 60s;
        open_file_cache_min_uses 2;
        open_file_cache_errors on;
        
        # If file exists on disk, serve immediately; otherwise fallback to Apache
        try_files $uri @apache;
    }

    # =========================================================================
    # DEFAULT ROUTING: Forward All Dynamic Requests to Apache Backend
    # =========================================================================
    location / {
        try_files $uri $uri/ @apache;
    }

    # Named location for proxying to Apache backend
    location @apache {
        proxy_pass http://apache_backend;

        # Standard Proxy Headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Port $server_port;

        # Enable HTTP/1.1 for persistent connection pooling
        proxy_http_version 1.1;
        proxy_set_header Connection "";

        # Buffer Configuration
        proxy_buffering on;
        proxy_buffer_size 128k;
        proxy_buffers 8 256k;
        proxy_busy_buffers_size 256k;
        proxy_temp_file_write_size 256k;

        # Timeouts
        proxy_connect_timeout 10s;
        proxy_send_timeout 60s;
        proxy_read_timeout 60s;

        # Add diagnostic header to verify hybrid proxy execution
        add_header X-Served-By "Nginx-Reverse-Proxy-to-Apache" always;
    }
}

# In-memory proxy cache definition stored in shared RAM (/dev/shm)
proxy_cache_path /dev/shm/nginx_apache_cache
    levels=1:2
    keys_zone=HYBRID_CACHE:50m
    max_size=500m
    inactive=30m
    use_temp_path=off;

    # Cache bypass conditions
    set $bypass_cache 0;

    # Bypass cache for POST requests
    if ($request_method = POST) {
        set $bypass_cache 1;
    }

    # Bypass cache if query strings are present (search, filters)
    if ($query_string != "") {
        set $bypass_cache 1;
    }

    # Bypass cache for authenticated sessions or admin paths
    if ($request_uri ~* "/(wp-admin|wp-login.php|admin|cart|checkout|my-account)") {
        set $bypass_cache 1;
    }

    if ($http_cookie ~* "comment_author|wordpress_logged_in_|session_|PHPSESSID") {
        set $bypass_cache 1;
    }

    location @apache {
        proxy_pass http://apache_backend;

        # Proxy Cache Parameters
        proxy_cache HYBRID_CACHE;
        proxy_cache_key "$scheme$request_method$host$request_uri";
        proxy_cache_valid 200 301 302 5m;
        proxy_cache_valid 404 1m;
        proxy_cache_bypass $bypass_cache;
        proxy_no_cache $bypass_cache;

        proxy_cache_use_stale error timeout updating invalid_header http_500 http_502 http_503 http_504;
        proxy_cache_lock on;
        proxy_cache_lock_timeout 5s;

        # Diagnostic header to inspect cache status (HIT, MISS, BYPASS, EXPIRED)
        add_header X-Proxy-Cache $upstream_cache_status always;
        add_header X-Served-By "Nginx-Reverse-Proxy-to-Apache" always;

        # Pass standard headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }

upstream apache_backend {
    server 127.0.0.1:8080 max_fails=3 fail_timeout=10s;
    
    # Maintain up to 128 idle keepalive connections in pool
    keepalive 128;
    
    # Limit maximum requests per persistent connection
    keepalive_requests 10000;
    
    # Keepalive timeout
    keepalive_timeout 60s;
}

KeepAlive On
MaxKeepAliveRequests 10000
KeepAliveTimeout 65

sudo ss -tulpn | grep -E '(80|443|8080)'
# Expected Output:
# tcp LISTEN 0 511 0.0.0.0:80    (nginx)
# tcp LISTEN 0 511 0.0.0.0:443   (nginx)
# tcp LISTEN 0 511 127.0.0.1:8080 (apache2)

# Test a static file:
curl -I https://example.com/images/logo.png
# Expected Header: X-Served-By: Nginx-Static-Engine

# Test a dynamic page:
curl -I https://example.com/
# Expected Header: X-Served-By: Nginx-Reverse-Proxy-to-Apache
# Expected Header: X-Proxy-Cache: HIT (or MISS on first load)

tail -f /var/log/apache2/app_access.log
# Verify that the first column shows your public WAN IP address, NOT 127.0.0.1.

================================================================================
         ENTERPRISE HIGH-AVAILABILITY HYBRID CLUSTER TOPOLOGY
================================================================================

                         [ Global Edge CDN / Cloudflare ]
                                        |
                                        v (HTTPS 443)
              +---------------------------------------------------+
              |    PRIMARY NGINX EDGE REVERSE PROXY CLUSTER       |
              |  - Active-Passive VRRP / Keepalived High Avail   |
              |  - SSL / TLS 1.3 Termination                      |
              |  - Shared Memory Sticky Session Routing           |
              +---------------------------------------------------+
                                        |
                 +----------------------+----------------------+
                 | (Load Balanced Internal Traffic - 10GbE LAN)|
                 v                                             v
  +-------------------------------+             +-------------------------------+
  |  APACHE NODE 1 (10.0.1.11)    |             |  APACHE NODE 2 (10.0.1.12)    |
  |  - Port 8080 (mpm_event)      |             |  - Port 8080 (mpm_event)      |
  |  - mod_remoteip Trusted Proxy |             |  - mod_remoteip Trusted Proxy |
  |  - Local PHP-FPM 8.3 Pool     |             |  - Local PHP-FPM 8.3 Pool     |
  +-------------------------------+             +-------------------------------+
                 |                                             |
                 +----------------------+----------------------+
                                        |
                                        v (Internal Database Cluster)
                        +-------------------------------+
                        |  Galera Cluster / PostgreSQL  |
                        +-------------------------------+

# /etc/nginx/conf.d/upstreams.conf
upstream backend_cluster {
    least_conn; # Distribute to least-busy backend worker

    # Backend Node 1 (Primary)
    server 10.0.1.11:8080 max_fails=3 fail_timeout=10s weight=5;

    # Backend Node 2 (Primary)
    server 10.0.1.12:8080 max_fails=3 fail_timeout=10s weight=5;

    # Backend Node 3 (Hot Standby / Backup)
    server 10.0.1.13:8080 backup;

    # Maintain persistent connection pool to reduce TCP handshake latency
    keepalive 256;
    keepalive_requests 10000;
    keepalive_timeout 60s;
}

# Advanced SSL/TLS Directives for Nginx Edge
ssl_protocols TLSv1.2 TLSv1.3;

# Prioritize modern AEAD ciphers (ChaCha20-Poly1305 and AES-GCM)
ssl_ciphers 'ECDHE-ECDSA-AES128-GCM-SHA256:ECDHE-RSA-AES128-GCM-SHA256:ECDHE-ECDSA-AES256-GCM-SHA384:ECDHE-RSA-AES256-GCM-SHA384:ECDHE-ECDSA-CHACHA20-POLY1305:ECDHE-RSA-CHACHA20-POLY1305';
ssl_prefer_server_ciphers off;

# 50MB shared SSL session cache holds ~200,000 negotiated session states in RAM
ssl_session_cache shared:SSL_EDGE:50m;
ssl_session_timeout 1d;
ssl_session_tickets off; # Prevents forward-secrecy compromise if ticket key leaks

# Online Certificate Status Protocol (OCSP) Stapling
# Pre-fetches revocation status from CA and staples response to TLS handshake, saving client DNS/HTTP queries
ssl_stapling on;
ssl_stapling_verify on;
resolver 1.1.1.1 8.8.8.8 valid=300s;
resolver_timeout 5s;

# Diffie-Hellman Parameter for Ephemeral Key Exchange (4096-bit)
ssl_dhparam /etc/nginx/ssl/dhparam4096.pem;

sudo openssl dhparam -out /etc/nginx/ssl/dhparam4096.pem 4096

# Global Rate Limit Zones (inside http {} block)
# Zone 1: General site browsing (30 requests/sec per IP)
limit_req_zone $binary_remote_addr zone=general_limit:20m rate=30r/s;

# Zone 2: Sensitive authentication endpoints (5 requests/minute per IP)
limit_req_zone $binary_remote_addr zone=auth_limit:10m rate=5r/m;

# Zone 3: Maximum simultaneous TCP connections per IP
limit_conn_zone $binary_remote_addr zone=addr_conn_limit:20m;

# Custom HTTP 429 Too Many Requests status code
limit_req_status 429;
limit_conn_status 429;

server {
    listen 443 ssl http2;
    server_name example.com;

    # Apply global connection limit (Max 50 simultaneous connections per IP)
    limit_conn addr_conn_limit 50;

    # Apply general rate limit with burst allowance
    location / {
        limit_req zone=general_limit burst=50 nodelay;
        try_files $uri $uri/ @apache;
    }

    # Strict protection for WordPress login, checkout, and admin endpoints
    location ~* /(wp-login\.php|xmlrpc\.php|user/login|api/v1/auth) {
        limit_req zone=auth_limit burst=3 nodelay;
        proxy_pass http://apache_backend;
        
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

================================================================================
           IPC TRANSPORT MECHANISM COMPARISON (TCP vs UNIX SOCKET)
================================================================================

LOOPBACK TCP TRANSPORT (High Isolation, TCP Stack Overhead):
[ Nginx ] ---> [ TCP Socket Buffer ] ---> [ Linux IP Stack / Netfilter ] ---> [ TCP Loopback Driver ] ---> [ Apache ]
(Incurs TCP checksum calculations, packet framing, and port allocation)

UNIX DOMAIN SOCKET TRANSPORT (Direct Kernel Memory Transfer):
[ Nginx ] ---> [ Kernel IPC Stream Buffer (VFS Pipe) ] ---> [ Apache ]
(Zero network stack traversal, zero TCP checksumming, filesystem permission security)

<VirtualHost unix:/run/apache2/apache-app.sock|http://localhost>
    ServerName example.com
    DocumentRoot /var/www/html/app/public

    <Directory /var/www/html/app/public>
        Options -Indexes +FollowSymLinks
        AllowOverride All
        Require all granted
    </Directory>

    <FilesMatch \.php$>
        SetHandler "proxy:unix:/run/php/php8.3-fpm.sock|fcgi://localhost"
    </FilesMatch>

    ErrorLog ${APACHE_LOG_DIR}/app_error.log
    CustomLog ${APACHE_LOG_DIR}/app_access.log combined
</VirtualHost>

upstream apache_unix_backend {
    server unix:/run/apache2/apache-app.sock max_fails=3 fail_timeout=10s;
    keepalive 64;
}

server {
    listen 443 ssl http2;
    server_name example.com;
    root /var/www/html/app/public;

    # Static Asset Offloading
    location ~* \.(jpg|jpeg|png|gif|webp|avif|css|js|woff|woff2)$ {
        expires 365d;
        add_header Cache-Control "public, immutable";
        try_files $uri @apache;
    }

    location / {
        try_files $uri $uri/ @apache;
    }

    location @apache {
        proxy_pass http://apache_unix_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
    }
}

================================================================================
             DOCKER COMPOSE HYBRID PRODUCTION ARCHITECTURE
================================================================================

              [ Ingress Network: Port 80, 443 (Public) ]
                                  |
                                  v
              +---------------------------------------+
              |       SERVICE: nginx_edge             |
              |  - Image: nginx:alpine-slim           |
              |  - Binds Host Ports 80 & 443          |
              |  - Mounts Static Web Root Read-Only   |
              |  - Terminates TLS & Manages Cache     |
              +---------------------------------------+
                                  |
               (Internal Docker Bridge: app_internal_net)
                                  |
                                  v
              +---------------------------------------+
              |       SERVICE: apache_backend         |
              |  - Image: httpd:2.4-alpine            |
              |  - Exposes Internal Port 8080         |
              |  - Processes .htaccess & mod_rewrite  |
              |  - FastCGI Proxy to PHP-FPM           |
              +---------------------------------------+
                                  |
                                  v
              +---------------------------------------+
              |       SERVICE: php_fpm                |
              |  - Image: php:8.3-fpm-alpine          |
              |  - Executes Application Logic         |
              +---------------------------------------+

version: '3.8'

services:
  nginx_edge:
    image: nginx:alpine
    container_name: web_edge_nginx
    restart: always
    ports:
      - "80:80"
      - "443:443"
    volumes:
      - ./nginx/nginx.conf:/etc/nginx/nginx.conf:ro
      - ./nginx/conf.d:/etc/nginx/conf.d:ro
      - ./ssl:/etc/letsencrypt:ro
      - ./webroot:/var/www/html:ro
      - cache_data:/dev/shm/nginx_cache
    depends_on:
      - apache_backend
    networks:
      - public_net
      - internal_net

  apache_backend:
    image: httpd:2.4-alpine
    container_name: web_backend_apache
    restart: always
    expose:
      - "8080"
    volumes:
      - ./apache/httpd.conf:/usr/local/apache2/conf/httpd.conf:ro
      - ./webroot:/var/www/html:rw
    depends_on:
      - php_fpm
    networks:
      - internal_net

  php_fpm:
    image: php:8.3-fpm-alpine
    container_name: web_runtime_php
    restart: always
    volumes:
      - ./webroot:/var/www/html:rw
      - ./php/custom.ini:/usr/local/etc/php/conf.d/custom.ini:ro
    networks:
      - internal_net

networks:
  public_net:
    driver: bridge
  internal_net:
    driver: bridge
    internal: true # Isolates backend services from direct public internet routing

volumes:
  cache_data:

# Enable HTTP/3 (QUIC) in Nginx 1.25+
server {
    # Standard TCP SSL listener
    listen 443 ssl;
    listen [::]:443 ssl;

    # QUIC UDP listener for HTTP/3
    listen 443 quic reuseport;
    listen [::]:443 quic reuseport;

    server_name example.com;

    # Advertise HTTP/3 availability to connecting browsers via Alt-Svc header
    add_header Alt-Svc 'h3=":443"; ma=86400';
    
    # Enable GSO (Generic Segmentation Offload) for high-speed UDP packet transmission
    quic_gso on;
    quic_retry on;

    # Dynamic backend proxying to Apache remains HTTP/1.1 over fast local loopback
    location / {
        try_files $uri $uri/ @apache;
    }

    location @apache {
        proxy_pass http://apache_backend;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

================================================================================
          MULTI-TENANT HYBRID VIRTUAL HOST ROUTING ENGINE
================================================================================

                                [ Ingress HTTPS :443 ]
                                          |
                                          v (SNI Evaluation)
            +-----------------------------+-----------------------------+
            |                             |                             |
            v (Host: store.com)           v (Host: api.io)              v (Host: blog.net)
  +---------------------+       +---------------------+       +---------------------+
  | Nginx VHost: store  |       | Nginx VHost: api    |       | Nginx VHost: blog   |
  | - SSL: store.pem    |       | - SSL: api.pem      |       | - SSL: blog.pem     |
  | - Static Direct IO  |       | - Rate Limiter      |       | - FastCGI Cache     |
  +---------------------+       +---------------------+       +---------------------+
            |                             |                             |
            +-----------------------------+-----------------------------+
                                          |
                                          v (Loopback :8080 with Host Header)
                        +-------------------------------+
                        |    Apache Backend Cluster     |
                        | - NamedVirtualHost *:8080     |
                        | - .htaccess per domain        |
                        +-------------------------------+

# /etc/nginx/snippets/apache-proxy-params.conf
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_set_header X-Forwarded-Port $server_port;

proxy_http_version 1.1;
proxy_set_header Connection "";

proxy_connect_timeout 10s;
proxy_send_timeout 60s;
proxy_read_timeout 60s;

proxy_buffering on;
proxy_buffer_size 128k;
proxy_buffers 8 256k;
proxy_busy_buffers_size 256k;

# /etc/nginx/snippets/static-caching.conf
expires 365d;
add_header Cache-Control "public, no-transform, immutable";
add_header X-Served-By "Nginx-Edge-Static" always;
access_log off;
log_not_found off;
tcp_nodelay off;
open_file_cache max=10000 inactive=30s;
open_file_cache_valid 60s;
open_file_cache_min_uses 2;
open_file_cache_errors on;

# WebSocket Connection Upgrade Map
map $http_upgrade $connection_upgrade {
    default upgrade;
    ''      close;
}

# Proxy WebSocket / Live Events to Backend
location /ws/ {
    proxy_pass http://apache_backend;
    
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $connection_upgrade;
    
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    
    # Extend timeout for persistent real-time streaming connections
    proxy_read_timeout 3600s;
    proxy_send_timeout 3600s;
}

# /etc/nginx/conf.d/metrics.conf
server {
    listen 127.0.0.1:9090;
    server_name localhost;

    location /stub_status {
        stub_status on;
        access_log off;
        allow 127.0.0.1;
        deny all;
    }
}

# /etc/apache2/conf-available/status.conf
<Location /server-status>
    SetHandler server-status
    Require local
</Location>

================================================================================
           MULTI-TIER DEFENSE-IN-DEPTH SECURITY ARCHITECTURE
================================================================================

[ Edge Request ] ---> [ NGINX TIER 1: Edge Scrubbing & Rate Limiting ]
                            - Drops malformed HTTP requests
                            - Enforces strict TLS 1.3 ciphers
                            - Token-bucket rate limiting (limit_req)
                            - Injects Content-Security-Policy & HSTS
                                   |
                                   v
                      [ APACHE TIER 2: Deep Application WAF ]
                            - ModSecurity v2 / OWASP Core Rule Set (CRS)
                            - SQLi, XSS, RCE payload inspection
                            - Application-level access control & .htaccess
                                   |
                                   v
                      [ TIER 3: Isolated PHP-FPM Execution ]
                            - Sandboxed UNIX user pools
                            - open_basedir filesystem isolation
                            - Disabled dangerous PHP functions

# /etc/nginx/conf.d/security-headers.conf
# Prevent MIME-type sniffing
add_header X-Content-Type-Options "nosniff" always;

# Prevent clickjacking attacks by restricting iframe embedding
add_header X-Frame-Options "SAMEORIGIN" always;

# Enable legacy XSS filter protection in older browsers
add_header X-XSS-Protection "1; mode=block" always;

# Enforce strict HTTPS via HTTP Strict Transport Security (HSTS) with 2-year duration
add_header Strict-Transport-Security "max-age=63072000; includeSubDomains; preload" always;

# Restrict referrer leakage on cross-origin requests
add_header Referrer-Policy "strict-origin-when-cross-origin" always;

# Restrict browser feature access (Camera, Microphone, Geolocation, Payment)
add_header Permissions-Policy "camera=(), microphone=(), geolocation=(), payment=()" always;

# Modern Content Security Policy (CSP)
add_header Content-Security-Policy "default-src 'self'; script-src 'self' 'unsafe-inline' 'unsafe-eval' https://cdn.jsdelivr.net; style-src 'self' 'unsafe-inline' https://fonts.googleapis.com; font-src 'self' https://fonts.gstatic.com data:; img-src 'self' data: https:; connect-src 'self' wss: https:;" always;

# Configure selective cache purging endpoint
location ~ /purge(/.*) {
    # Restrict cache purge calls exclusively to local backend or authorized management IP
    allow 127.0.0.1;
    allow 10.0.0.0/8;
    deny all;

    proxy_cache_purge HYBRID_CACHE "$scheme$request_method$host$1";
}

<?php
// Function to purge Nginx cache for a specific URL
function purge_nginx_edge_cache($url_path) {
    $purge_url = 'http://127.0.0.1:80/purge' . $url_path;
    $ch = curl_init($purge_url);
    curl_setopt($ch, CURLOPT_CUSTOMREQUEST, 'PURGE');
    curl_setopt($ch, CURLOPT_RETURNTRANSFER, true);
    curl_setopt($ch, CURLOPT_TIMEOUT, 2);
    $response = curl_exec($ch);
    $http_code = curl_getinfo($ch, CURLINFO_HTTP_CODE);
    curl_close($ch);
    
    return ($http_code === 200);
}
?>

================================================================================
           ZERO-DOWNTIME HYBRID CUTOVER STATE MACHINE
================================================================================

[ Phase 1: Standalone Apache ]
- Apache on :80 and :443 (Public)
                   |
                   v (Install Nginx & Configure Loopback Virtual Hosts)
[ Phase 2: Dual Staging Mode ]
- Apache shifted to 127.0.0.1:8080 (mod_remoteip active)
- Nginx listening on Public Ports 80 & 443 with proxy_pass to :8080
- Live Traffic Cutover in < 0.1s via systemctl socket handover
                   |
                   v (Validation & Cache Activation)
[ Phase 3: Optimized Hybrid Production ]
- Static assets offloaded to Nginx sendfile
- Dynamic RAM microcache enabled
- Full .htaccess compliance verified

# 1. Install Nginx without starting it immediately
sudo apt update
sudo apt install -y nginx

# 2. Configure Nginx virtual host with proxy_pass to 127.0.0.1:8080
sudo cp /etc/nginx/sites-available/app.conf /etc/nginx/sites-enabled/

# 3. Test Nginx configuration syntax
sudo nginx -t

# 4. Modify Apache ports.conf to Listen 127.0.0.1:8080
sudo sed -i 's/Listen 80/Listen 127.0.0.1:8080/g' /etc/apache2/ports.conf
sudo a2enmod remoteip
sudo systemctl reload apache2

# 5. Start Nginx on public ports 80 and 443
sudo systemctl start nginx
sudo systemctl enable nginx

# 6. Verify real client IP logging and static asset offloading
curl -I https://example.com/assets/css/main.css
curl -I https://example.com/api/status

# .github/workflows/verify-webservers.yml
name: Validate Web Server Configurations

on:
  push:
    branches: [ main ]
  pull_request:
    branches: [ main ]

jobs:
  validate_syntax:
    runs-on: ubuntu-latest
    steps:
      - name: Checkout Code
        uses: actions/checkout@v4

      - name: Validate Nginx Syntax
        run: |
          docker run --rm -v ${{ github.workspace }}/nginx:/etc/nginx:ro nginx:alpine nginx -t

      - name: Validate Apache Syntax
        run: |
          docker run --rm -v ${{ github.workspace }}/apache:/usr/local/apache2/conf:ro httpd:2.4-alpine httpd -t

BENCHMARK CONCURRENCY SCALING CURVE (1,000 to 50,000 Concurrent Connections):

Throughput (Req/sec)
50,000 |                                    ___________ [Stack B: Standalone Nginx]
45,000 |                               ____/
40,000 |                         _____/ ______________ [Stack C: Hybrid Nginx-Apache]
35,000 |                   _____/ _____/
30,000 |             _____/ _____/
25,000 |       _____/ _____/
20,000 | _____/ _____/
15,000 |  ___/
10,000 | / \
 5,000 |/   \__________________________________________ [Stack A: Standalone Apache]
       +-------------------------------------------------------------------->
       1,000        5,000       10,000      25,000      50,000 (Concurrency)