Web server structure scheme

Hi, Going on your description, I can see your configuration like below. Correct it if it is actually different, pls.

                            user (somewhere in the internet)
                              |
                           SSL|
                              |   
                 -----------------------------
                              |  Cloudflare
                           SSL|
                              |  
                 -----------------------------
                           SSL|  Company's infrastructure
                              |
                     .-----------------.
                     | Firewall/router |
                     '-----------------'
                           SSL|
                              |   Bare metal server
.-----------------------------|----------------------------------.
|                          SSL|                                  | 
|                      .-------------.                           |
|                      |    VM-01    |                           |
|                      |    nginx    |                           |
|                      '-------------'                           |
|                             | Private network (LAN)            |
|         .------------------------------------------.           |
|         |                   |                      |           |
| .--------------.   .-----------------.   .-------------------. |
| |      VM      |   |       VM        |   |        VM         | |
| |    web app   |   |  internal app   |   |   financial app   | |
| '--------------'   '-----------------'   '-------------------' |
|                                                                |
'----------------------------------------------------------------'

Some quick thoughts on your configuration:

• It seems to be absolute minimum to have SSL/TSL connection both between user and Cloudflare and between Cloudflare and VM-01. Cloudflare calls it Full SSL. If a user addresses app VMs through the subdomains, SSL certificate needs to include them or separate certificates need to be issued/installed for these subdomains.
• I would put the financial app VM behind VPN gateway (server) to secure an access to it more. I am pretty sure that the data served by this VM is sensitive enough to enhance security. The same may be related to the internal and web app VMs but again, it depends on how sensitive data is served by them. You can assess the data sensitivity going on (1) the regulations are in force in the countries where your company is present, (2) the regulations that are in force in the industries that your company is involved in (e.g. military), (3) internal regulations in your company, (4) a common sense. A consultation with your company’s law department may be needed on that subject.

Considering VPN, you could check Cloudflare’s service called Access. They announced it in March this year: https://blog.cloudflare.com/dogfooding-from-home/.

I hope it is helpful a bit.

Thanks for the reply! It is of great help to me.

The nginx VM will only act as a reverse proxy, what resources should I allocate? Does the reverse proxy consume a lot and of launching the requests towards internal servers and returning them? 4GB RAM? 100GB disk? We are talking about no more than 5k visits a day.

And another question of the scheme, my local private network really starts on the nginx server, right?

Thank you!