Week 12 Mini Project: Unified Security Proxy (L4 + L7)

Complete Integration

// main.go — all components wired together
func main() {
    // Config
    cfg, _ := config.Load("gateway.json")

    // PKI
    reloader, _ := cert.NewReloader("server.crt", "server.key")

    // Security components
    tokenSvc, _ := auth.NewTokenService()
    threatIntel := threatintel.New(10 * time.Minute)
    waf, _ := waf.NewScoringWAF(waf.DefaultRules(), "waf-config.json", audit.NewLogger())
    ipLimiter := ratelimit.NewRateLimiter(50, 10)
    cors := cors.New(buildCORSConfig(cfg.Get()))
    abuse := abuse.New()

    // Update components when config changes
    cfg.OnChange(func(c *config.GatewayConfig) {
        waf.Reload(&waf.Config{Mode: c.WAF.Mode, Threshold: c.WAF.Threshold})
    })

    // Build middleware chain
    appHandler := buildRoutes(tokenSvc)
    gatewayHandler := pipeline.Chain(appHandler,
        middleware.PanicRecoverer(logger),
        middleware.RequestID,
        cors.Middleware,
        ipLimiter.Middleware(ipKeyFn),
        abuse.CheckHoneypot,
        auth.ECDSATokenAuth(tokenSvc),
        threatIntel.Middleware,
        waf.Handler,
        middleware.SecurityHeaders,
        pii.Middleware,
        middleware.RequestLogger(logger),
    )

    // TLS server with mTLS + SNI + cert hot-reload
    tlsConfig := &tls.Config{
        GetCertificate: reloader.GetCertificate,
        MinVersion:     tls.VersionTLS12,
    }
    srv := &http.Server{
        Addr:              ":443",
        Handler:           gatewayHandler,
        TLSConfig:         tlsConfig,
        ReadHeaderTimeout: 5 * time.Second,
        ReadTimeout:       30 * time.Second,
        WriteTimeout:      60 * time.Second,
        IdleTimeout:       120 * time.Second,
    }

    // Observability
    go http.ListenAndServe(":9090", observabilityMux())

    // Signal handling
    ctx, stop := signal.NotifyContext(context.Background(), syscall.SIGTERM, syscall.SIGINT)
    defer stop()
    go cfg.WatchSignal(ctx.Done())

    logger.Info("unified security proxy starting", "addr", ":443", "metrics", ":9090")
    go srv.ListenAndServeTLS("", "")

    <-ctx.Done()
    logger.Info("shutting down...")
    shutCtx, cancel := context.WithTimeout(context.Background(), 30*time.Second)
    defer cancel()
    srv.Shutdown(shutCtx)
    logger.Info("shutdown complete")
}

Engineer Takeaway

You've built the architecture of Cloudflare's edge — L4 TCP termination, mTLS, SNI routing, circuit breakers, HTTP/2, WAF (OWASP Top 10), API authentication, rate limiting, and full observability — in ~3000 lines of Go standard library code.

More importantly, you now have the technical depth to:

• Design and review network and security code, knowing what each layer actually does
• Choose between building and configuring managed products (AWS WAF, Cloudflare, Akamai), because you know what they do inside
• Debug incidents across the whole stack: you've written every component
• Fix false positives precisely ("WAF rule SQLI-001 triggers on Irish names; here's the exact normalization path")
• Set realistic SLOs: you have benchmark numbers for each middleware layer

90 days of one hour each turned "black box" infrastructure into code you understand line by line.