API Gateway, Reverse Proxy & Service Perimeter Expert (2026 Edition)

English | Bahasa Indonesia

---

<a name="english"></a>

English

Orchestration & Integration

• Upstream Specs & Routing: api-design-expert, openapi-swagger-codegen-expert, spec-driven-development-expert
• Backend Upstreams: js-backend-expert, python-programming-expert, go-programming-expert, rust-programming-expert
• Streaming & Realtime: sse-websocket-streaming-expert, voice-ai-realtime-agent
• Security & Perimeter: rate-limit-abuse-prevention, zero-trust-secret-vault, autonomous-red-teamer
• DevOps & Orchestration: ci-cd-devops-architect, docker-container-expert, zero-to-prod-orchestrator

Description

Production architectural guide for API Gateways, Edge Proxies, and perimeter traffic management in modern microservices and serverless topologies. Covers zero-downtime routing, SSL/TLS termination, automatic certificate issuance (Let's Encrypt), rate limiting at L7, Server-Sent Events (SSE) and WebSocket connection proxying, canary traffic splitting, and configuration templates for Caddy, Traefik, and NGINX.

Trigger Conditions

• Architecting a unified API entry point (Backend-for-Frontend / BFF) in front of multiple microservices.
• Configuring reverse proxies for SSE, WebSockets, or streaming AI model outputs without proxy buffer truncation.
• Implementing edge-level DDoS mitigation, IP allowlisting, or API key validation.
• Configuring automatic SSL/TLS termination with modern HTTP/2 and HTTP/3 (QUIC) support.

Level 1: Production Caddyfile (Automatic TLS + WebSocket/SSE Proxying)

# /etc/caddy/Caddyfile
api.vibesplug.internal {
    # Modern TLS 1.3 enforcement
    tls admin@vibesplug.internal

    # Global compression
    encode zstd gzip

    # Security Headers
    header {
        Strict-Transport-Security "max-age=31536000; includeSubDomains; preload"
        X-Content-Type-Options "nosniff"
        X-Frame-Options "DENY"
        Referrer-Policy "strict-origin-when-cross-origin"
    }

    # Route 1: Auth Service (Rate limited)
    handle /v1/auth/* {
        reverse_proxy localhost:4001 {
            header_up X-Real-IP {remote_host}
            header_up X-Forwarded-Proto {scheme}
        }
    }

    # Route 2: Streaming Real-time SSE / WebSockets (Buffer disabled)
    handle /v1/ai/stream* {
        reverse_proxy localhost:4002 {
            flush_interval -1
            header_up Connection "upgrade"
            header_up Upgrade {http.request.header.Upgrade}
        }
    }

    # Route 3: Default Core Microservice Pool (Round-Robin Load Balanced)
    handle /v1/* {
        reverse_proxy localhost:5001 localhost:5002 {
            lb_policy round_robin
            lb_try_duration 2s
            fail_duration 10s
            max_fails 3
        }
    }
}

Level 2: High-Performance NGINX Reverse Proxy for AI Streaming & SSE

# /etc/nginx/conf.d/api_gateway.conf
upstream backend_nodes {
    server 127.0.0.1:3001 max_fails=3 fail_timeout=10s;
    server 127.0.0.1:3002 max_fails=3 fail_timeout=10s;
    keepalive 64;
}

server {
    listen 443 ssl http2;
    server_name api.vibesplug.internal;

    ssl_certificate /etc/ssl/certs/bundle.crt;
    ssl_certificate_key /etc/ssl/private/privkey.key;
    ssl_protocols TLSv1.2 TLSv1.3;

    # Crucial for SSE & LLM Streaming: disable proxy buffering and set long timeouts
    location /v1/stream {
        proxy_pass http://backend_nodes;
        proxy_http_version 1.1;
        proxy_set_header Connection "";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_buffering off;
        proxy_cache off;
        chunked_transfer_encoding on;
        proxy_read_timeout 600s;
        proxy_send_timeout 600s;
    }
}

Key Perimeter Architectural Rules

1. Always Set proxy_buffering off for Streaming: If proxy buffering is enabled, LLM tokens and Server-Sent Events will be delayed and batched until the buffer fills (~4KB-16KB), destroying the perceived TTFT.
2. Forwarded Header Sanitation: Strip spoofed incoming X-Forwarded-For headers from untrusted clients to prevent security bypasses in IP-based rate limiters.
3. Health Check Probes: Always configure active health checks so the proxy immediately drops unhealthy microservice pods without returning 502 Bad Gateway to users.

---

<a name="bahasa-indonesia"></a>

Bahasa Indonesia

Integrasi Orkestrasi

• Spesifikasi Hulu & Routing: api-design-expert, openapi-swagger-codegen-expert, spec-driven-development-expert
• Upstream Backend: js-backend-expert, python-programming-expert, go-programming-expert, rust-programming-expert
• Streaming & Realtime: sse-websocket-streaming-expert, voice-ai-realtime-agent
• Keamanan & Perimeter: rate-limit-abuse-prevention, zero-trust-secret-vault, autonomous-red-teamer
• DevOps & Orkestrasi: ci-cd-devops-architect, docker-container-expert, zero-to-prod-orchestrator

Deskripsi

Panduan arsitektur produksi untuk API Gateway, Edge Proxy, dan manajemen trafik perimeter dalam topologi microservices dan serverless modern. Mencakup routing tanpa downtime, terminasi SSL/TLS otomatis (Let's Encrypt), rate limiting pada layer L7, proxy koneksi Server-Sent Events (SSE) dan WebSocket tanpa buffering, pemisahan trafik canary, serta template konfigurasi untuk Caddy, Traefik, dan NGINX.

Kondisi Pemicu

• Merancang pintu gerbang masuk tunggal (BFF) di depan kumpulan microservices backend.
• Mengonfigurasi reverse proxy untuk streaming token AI atau SSE agar respons tidak terpotong.
• Menerapkan pertahanan DDoS tingkat edge, pembatasan IP (allowlisting), atau verifikasi API key.
• Menyiapkan terminasi SSL/TLS dengan protokol HTTP/2 dan HTTP/3 (QUIC).

Contoh Konfigurasi Docker Compose dengan Traefik (Auto-Discovery)

# docker-compose.yml
services:
  traefik:
    image: traefik:v3.1
    command:
      - "--providers.docker=true"
      - "--entrypoints.websecure.address=:443"
      - "--certificatesresolvers.myresolver.acme.tlschallenge=true"
    ports:
      - "443:443"
    volumes:
      - "/var/run/docker.sock:/var/run/docker.sock:ro"

  api-service:
    image: my-company/api:latest
    labels:
      - "traefik.enable=true"
      - "traefik.http.routers.api.rule=Host(`api.vibesplug.internal`)"
      - "traefik.http.routers.api.entrypoints=websecure"
      - "traefik.http.routers.api.tls.certresolver=myresolver"

3 Praktik Wajib Proxy Streaming

1. Matikan Buffering Proxy: Untuk endpoint streaming AI atau Server-Sent Events, wajib matikan buffering (proxy_buffering off di NGINX, flush_interval -1 di Caddy) agar token muncul seketika di layar pengguna.
2. Atur Timeout Panjang: Berikan batas waktu pembacaan (proxy_read_timeout 600s) agar koneksi streaming tidak terputus di tengah jalan saat respons AI panjang.
3. Penyaringan Header Asli: Teruskan X-Real-IP dan X-Forwarded-Proto agar backend dapat mendeteksi lokasi dan skema enkripsi klien secara akurat.