reinitialized.net/infrastructure
2
0
Fork 0
Code Issues 37 Pull requests Projects Releases Packages Wiki Activity Actions

[HIGH] Nginx proxy_ssl_verify disabled for internal upstream connections #19

New issue
Open
opened 2026-05-05 15:44:28 -05:00 by pjennings · 0 comments
pjennings commented 2026-05-05 15:44:28 -05:00
Owner
Copy link

Labels: area:security, area:network, priority:high, type:bug

Description

In hosts/rp1.nix, three reverse proxy locations disable TLS certificate verification:

  • unifi.in.reinitialized.net -> proxy_ssl_verify off
  • pgadmin.in.reinitialized.net -> proxy_ssl_verify off
  • redisadmin.in.reinitialized.net -> proxy_ssl_verify off

Impact

Man-in-the-middle attacks between rp1 and upstream services on the mesh network.

Recommended Fix

  1. Generate an internal CA for the mesh network
  2. Issue proper TLS certs for internal services
  3. Configure nginx to verify upstream certificates
**Labels:** area:security, area:network, priority:high, type:bug ## Description In hosts/rp1.nix, three reverse proxy locations disable TLS certificate verification: - unifi.in.reinitialized.net -> proxy_ssl_verify off - pgadmin.in.reinitialized.net -> proxy_ssl_verify off - redisadmin.in.reinitialized.net -> proxy_ssl_verify off ## Impact Man-in-the-middle attacks between rp1 and upstream services on the mesh network. ## Recommended Fix 1. Generate an internal CA for the mesh network 2. Issue proper TLS certs for internal services 3. Configure nginx to verify upstream certificates
Sign in to join this conversation.
No Branch/Tag specified
Branches Tags
indev
No results found.
Labels
Clear labels   
area:documentation

Documentation, inventory, runbooks

  
area:infrastructure

Infrastructure services and hardware

  
area:network

Network, firewall, and connectivity

  
area:security

Security vulnerabilities and findings

  
priority:critical

Fix immediately — active risk

  
priority:high

Fix within 1-2 weeks

  
priority:low

Backlog — hardening and best practices

  
priority:medium

Fix within 1 month

  
status:blocked

Blocked on dependency or decision

  
type:bug

Misconfiguration or broken behavior

  
type:deployment

New service or system deployment

  
type:enhancement

Improvement or hardening

  
type:investigation

Needs research or identification

No labels
area:documentation
area:infrastructure
area:network
area:security
priority:critical
priority:high
priority:low
priority:medium
status:blocked
type:bug
type:deployment
type:enhancement
type:investigation
Milestone
Clear milestone
No items
Projects
Clear projects
No items
No project
Assignees
Clear assignees
No assignees
1 participant
Notifications
Due date
The due date is invalid or out of range. Please use the format "yyyy-mm-dd".

No due date set.

Dependencies

No dependencies set.

Reference
reinitialized.net/infrastructure#19
No description provided.