| System | Description | Technology |
|---|---|---|
| Cloudflare / Reverse Proxy | Forwards to (optional layer) | HTTP or HTTPS |
| Let's Encrypt (ACME CA) | Validates domain control via HTTP-01 challenge callback | HTTP |
| System | Description | Technology |
|---|---|---|
| DNS Upstream | Forwards non-zone DNS queries verbatim (optional, resolver enabled only) | UDP/TCP 53 |
| Let's Encrypt (ACME CA) | Requests, validates (HTTP-01), and renews a certificate (optional, ACME mode only) | HTTPS |
| nftables | Generates and atomically reloads ACL ruleset | nft CLI |
| OIDC Provider | Verifies ID tokens via OIDC / JWKS | HTTPS |
| Resource Host | Proxies browser RDP over TLS (RDCleanPath) | TCP/TLS |
| WireGuard | Configures peers | wg CLI |