# Nginx Proxy NSG Rules Analysis

## Current NSG Rules

| Priority | Name | Port | Protocol | Status |
|----------|------|------|----------|--------|
| 1000 | AllowSSH | 22 | TCP | ✅ Configured |
| 1001 | AllowP2PTCP | 30303 | TCP | ✅ Configured |
| 1002 | AllowP2PUDP | 30303 | UDP | ✅ Configured |
| 1003 | AllowRPCHTTP | 8545 | TCP | ✅ Configured |
| 1004 | AllowRPCWS | 8546 | TCP | ✅ Configured |
| 1005 | AllowMetrics | 9545 | TCP | ✅ Configured |

## Missing Rules

| Priority | Name | Port | Protocol | Status |
|----------|------|------|----------|--------|
| ❌ | AllowHTTP | 80 | TCP | **MISSING** |
| ❌ | AllowHTTPS | 443 | TCP | **MISSING** |

## Why Ports 80 and 443 Are Needed

### Port 80 (HTTP)
- **Purpose**: Nginx listens on port 80 for HTTP traffic
- **Usage**: 
  - Cloudflare Tunnel connects to Nginx via `localhost:80`
  - Direct HTTP access (for testing/admin)
  - Health checks
- **Required**: ✅ **YES** - Nginx must listen on port 80

### Port 443 (HTTPS)
- **Purpose**: Direct HTTPS access (if not using Cloudflare Tunnel exclusively)
- **Usage**:
  - Direct HTTPS connections (bypassing Cloudflare)
  - SSL/TLS termination at Nginx (if configured)
  - Testing and administration
- **Required**: ⚠️ **OPTIONAL** - Only if direct HTTPS access needed

## Architecture Context

### Current Setup
1. **Cloudflare Tunnel**: Handles SSL termination and public access
2. **Nginx**: Listens on port 80 (HTTP)
3. **Connection Flow**: 
   - Public → Cloudflare Tunnel → localhost:80 → Nginx → Backend Besu nodes

### Port Requirements
- **Port 80**: Required for Nginx to receive traffic from Cloudflare Tunnel
- **Port 443**: Optional, but recommended for:
  - Direct HTTPS access
  - SSL certificate management (Let's Encrypt)
  - Backup access method

## Updated NSG Configuration

### New Rule Priority Order
1. **1000**: AllowSSH (22/TCP) - Existing
2. **1001**: AllowHTTP (80/TCP) - **ADDED**
3. **1002**: AllowHTTPS (443/TCP) - **ADDED**
4. **1003**: AllowP2PTCP (30303/TCP) - Renumbered
5. **1004**: AllowP2PUDP (30303/UDP) - Renumbered
6. **1005**: AllowRPCHTTP (8545/TCP) - Renumbered
7. **1006**: AllowRPCWS (8546/TCP) - Renumbered
8. **1007**: AllowMetrics (9545/TCP) - Renumbered

## Recommendation

✅ **Add both ports 80 and 443 to NSG rules**

**Reasons:**
1. Port 80 is essential for Nginx to function
2. Port 443 provides flexibility for direct HTTPS access
3. Cloudflare Tunnel connects via localhost, but public access may need these ports
4. Better security posture with explicit port rules

## Implementation

The NSG rules have been updated in `terraform/modules/nginx-proxy/main.tf` to include:
- Port 80 (HTTP) - Priority 1001
- Port 443 (HTTPS) - Priority 1002
- All other rules renumbered accordingly

## Next Steps

1. ✅ NSG rules updated in Terraform configuration
2. ⏳ Apply Terraform changes: `terraform apply`
3. ⏳ Verify NSG rules are applied correctly
4. ⏳ Test port accessibility

---

**Status**: ✅ **NSG Rules Updated**

Ports 80 and 443 have been added to the Nginx proxy NSG configuration.

