SecureProxy (SSL Termination)

Overview

SecureProxy provides automatic SSL/TLS termination as a separate ECS service using Traefik. Unlike CertWrapper which runs as a sidecar container, SecureProxy runs independently with its own dedicated Fargate resources, enabling zero-downtime deployments since application deployments don’t restart or redeploy the proxy service.

Purpose and Benefits

• Zero-Downtime Deployments: Application deployments don’t affect SSL termination & proxying
• Dedicated Resources: Runs on separate ECS Fargate service with its own CPU/memory
• Automatic HTTPS: Secure your application with automatically provisioned SSL certificates
• Let’s Encrypt Integration: Free SSL certificates with automatic renewal using Traefik
• Independent Scaling: Proxy service scales independently of application

vs. CertWrapper Comparison

Feature	SecureProxy	CertWrapper
Architecture	Separate ECS Fargate service	Sidecar container
Sharing	Shared across multiple apps	One per app
Resources	Dedicated Fargate resources	Shares app CPU/RAM
Cost	Additional service costs	No additional compute cost
Deployment	Independent of app deploys	Restarts with app deploys
Use Case	Zero-downtime deployments	Cost-effective SSL
Proxy Technology	Traefik	Traefik

CLI Usage

Create SecureProxy

Create a SecureProxy add-on with Traefik for SSL termination and routing

tapit create secureproxy acme_email=my@email.com [https_redirect=true|false] [--ignore-existing]

Parameters

• acme_email: Email address for Let’s Encrypt ACME notifications (required)
• https_redirect: Redirect (302) all HTTP requests to HTTPS, for every app using this proxy (true/false, default false)
• --ignore-existing: Skip creation if a resource with the same name already exists (useful for idempotent scripts)

Create CertWrapper (alternative)

If you prefer a per-app sidecar approach instead:

Create a CertWrapper add-on for automatic SSL certificate management

tapit create certwrapper [acme_email=my@email.com] [https_redirect=true|false] [--ignore-existing]

Parameters

• acme_email: Email address for Let’s Encrypt ACME notifications
• https_redirect: Redirect (302) all HTTP requests to HTTPS (true/false, default false)
• --ignore-existing: Skip creation if a resource with the same name already exists (useful for idempotent scripts)

List and Show SecureProxy

List all add-ons attached to the app with their state and configuration

tapit list addons [-w|--wait]

Parameters

• -w|--wait: Wait until all add-ons reach a stable state (fully ready or fully deleted); exits non-zero if any add-on is in a failed state

Show detailed information about a specific add-on

tapit show addon name=addon_name

Parameters

• name: Name of the add-on to show (required)

Delete SecureProxy

Delete an add-on and all its associated AWS resources

tapit delete addon name=addon_name

Parameters

• name: Name of the add-on to delete (required)

Application Configuration

Your application must be configured to listen on the port specified by the $PORT environment variable. SecureProxy (and CertWrapper) will handle TLS termination and forward HTTP requests to your application on this port.

For example, if your application is a Node.js Express app:

const port = process.env.PORT || 3000;
app.listen(port, () => {
  console.log(`Server listening on port ${port}`);
});

Traffic Flow

Internet → SecureProxy (HTTPS:443) → Your Application (HTTP:$PORT)

1. Client Request: Browser makes HTTPS request to your domain
2. SSL Termination: SecureProxy decrypts the request
3. Forwarding: Request is forwarded to your application on $PORT over internal network
4. Response: Application response is encrypted and sent back to client

HTTP to HTTPS Redirect

Both SecureProxy and CertWrapper can optionally redirect all plain HTTP requests to HTTPS with a temporary (302) redirect. Enable it with https_redirect=true when creating the add-on, or via the checkbox in the web UI.

Note that the redirect applies to every request arriving on port 80, including requests to hostnames with no certificates of their own, and for a shared SecureProxy it applies to all apps using the proxy.

Domain Configuration

DNS Setup

Point your domain’s CNAME record to the app’s Tapitalee hostname (*.dns.tapitalee.net)

Multiple Domains

SecureProxy supports multiple domains and subdomains. Certificates are automatically requested for all domains pointing to the proxy.