Getting started / Add-Ons /
Secureproxy
--- title: SecureProxy (SSL Termination) weight: 16 ---

Overview

SecureProxy provides automatic SSL/TLS termination as a separate ECS service using Traefik. Unlike CertWrapper which runs as a sidecar container, SecureProxy runs independently with its own dedicated Fargate resources, enabling zero-downtime deployments since application deployments don’t restart or redeploy the proxy service.

Purpose and Benefits

  • Zero-Downtime Deployments: Application deployments don’t affect SSL termination & proxying
  • Dedicated Resources: Runs on separate ECS Fargate service with its own CPU/memory
  • Automatic HTTPS: Secure your application with automatically provisioned SSL certificates
  • Let’s Encrypt Integration: Free SSL certificates with automatic renewal using Traefik
  • Independent Scaling: Proxy service scales independently of application

vs. CertWrapper Comparison

| Feature | SecureProxy | CertWrapper | |———|————-|————-| | Architecture | Separate ECS Fargate service | Sidecar container | | Sharing | Shared across multiple apps | One per app | | Resources | Dedicated Fargate resources | Shares app CPU/RAM | | Cost | Additional service costs | No additional compute cost | | Deployment | Independent of app deploys | Restarts with app deploys | | Use Case | Zero-downtime deployments | Cost-effective SSL | | Proxy Technology | Traefik | Traefik |

CLI Usage

Create SecureProxy 

tapit create secureproxy acme_email=my@email.com

Required Parameters

  • acme_email: Email address for Let’s Encrypt certificate registration and notifications

Create CertWrapper (alternative)

If you prefer a per-app sidecar approach instead:

tapit create certwrapper acme_email=my@email.com

Required Parameters

  • acme_email: Email address for Let’s Encrypt certificate registration and notifications

List and Show SecureProxy 

# List all addons (including SecureProxy)
tapit list addons

# Show specific SecureProxy details
tapit show addon name=secureproxy

Delete SecureProxy 

tapit delete addon name=secureproxy

Application Configuration

Your application must be configured to listen on the port specified by the $PORT environment variable. SecureProxy (and CertWrapper) will handle TLS termination and forward HTTP requests to your application on this port.

For example, if your application is a Node.js Express app:

const port = process.env.PORT || 3000;
app.listen(port, () => {
  console.log(`Server listening on port ${port}`);
});

Traffic Flow 

Internet → SecureProxy (HTTPS:443) → Your Application (HTTP:$PORT)
  1. Client Request: Browser makes HTTPS request to your domain
  2. SSL Termination: SecureProxy decrypts the request
  3. Forwarding: Request is forwarded to your application on $PORT over internal network
  4. Response: Application response is encrypted and sent back to client

Domain Configuration

DNS Setup

Point your domain’s CNAME record to the app’s Tapitalee hostname (*.dns.tapitalee.net)

Multiple Domains

SecureProxy supports multiple domains and subdomains. Certificates are automatically requested for all domains pointing to the proxy.