Technical Deep Dive: HEP over TLS via Nginx Proxy

This document details the configuration of the Nginx stream module as a reverse proxy to provide native HEP (Homer Encapsulation Protocol) TLS encryption support for the CXMind Ingestion Engine (IE).

1. Architecture Topology

By deploying Nginx at the edge, Nginx handles TLS termination (decryption) and subsequently forwards the plaintext HEP traffic to the IE service via an internal network or local loopback using standard TCP.

2. Nginx Configuration

Since HEP functions at Layer 4 (Transport Layer) rather than Layer 7 (Application Layer), the Nginx stream module must be utilized for L4 proxying and SSL/TLS offloading. Add the following to your Nginx config (typically located at /etc/nginx/nginx.conf):

stream {
    # CXMind Ingestion Engine Upstream (Cleartext TCP)
    upstream cxmind_ie {
        server 127.0.0.1:9060; # Or your internal IE IP
    }

    # TLS Listener for incoming HEP traffic
    server {
        listen 9061 ssl;
        proxy_pass cxmind_ie;
        
        # TLS Configuration
        ssl_certificate     /etc/nginx/ssl/cxmind.crt;
        ssl_certificate_key /etc/nginx/ssl/cxmind.key;
        
        # SSL Optimization (Recommended)
        ssl_session_cache shared:SSL:10m;
        ssl_session_timeout 10m;
        ssl_protocols TLSv1.2 TLSv1.3;
        ssl_ciphers HIGH:!aNULL:!MD5;
    }
}

3. Ingestion Engine Configuration

In this setup, the IE processes plaintext HEP TCP traffic as usual and remains completely agnostic of the TLS layer. We recommend binding the IE to the loopback address for maximum security.

4. Core Advantages