Week 8 Mini Project: Secure TCP Gateway

Combine all Phase 2 work into a single, production-grade secure TCP gateway.

Architecture

Internet Traffic
    │
    ▼
┌──────────────────────────────────────────────────┐
│              Secure TCP Gateway :443              │
│                                                  │
│  1. mTLS Termination (client cert required)      │
│  2. SNI Routing → select backend cluster         │
│  3. Per-IP Rate Limiting (100 conns/IP)          │
│  4. Circuit Breaker per backend                  │
│  5. Least-Connections → pool connection          │
│  6. Bidirectional proxy with metrics tap         │
│                                                  │
│  Admin API :9090                                 │
│    /stats   /debug/vars   /debug/pprof           │
│    SIGHUP → hot-reload cert                      │
│    SIGTERM → graceful drain                      │
└──────────────────────────────────────────────────┘
    │              │              │
    ▼              ▼              ▼
Backend A      Backend B      Backend C

Feature Integration Map

Feature	Implemented in	Integrated via
mTLS termination	Day 41	`tls.RequireAndVerifyClientCert`
SNI routing	Day 55	`tls.Config.GetConfigForClient`
Cert hot-reload	Day 54	`SIGHUP` → `CertReloader.reload()`
Connection pool	Day 36	`Pool.Get()` / `Pool.Put()`
Health checker	Day 46	`HealthChecker.Run()` in goroutine
Circuit breaker	Day 51	`CircuitBreaker.Allow()` / `RecordFailure()`
Rate limiter	Day 49	`IPLimiter.Allow()` / `Release()`
Observability	Day 50	`expvar`, `/stats` handler
Graceful shutdown	Day 27	`signal.NotifyContext` + drain

Engineer Takeaway

This is roughly what Cloudflare Spectrum does for TCP proxying. The entire implementation is ~500 lines of Go stdlib code. You've moved from "I read the architecture doc" to "I built it." L4 networking is now something you can debug and extend, not just configure.