Secure Gateways¶

Connect your external environments — such as an appliance deployment — to your Reemo infrastructure through a dedicated, isolated entry point secured with mutual TLS (mTLS), without exposing your Reemo infrastructure’s internal PKI.

How It Works¶

A Secure Gateway acts as a reverse proxy, typically powered by NGINX, that controls and encrypts all inbound and outbound traffic between your infrastructure and an external environment.

Each gateway keeps two trust domains separate:

Internal PKI: the PKI already used by your Reemo infrastructure to authenticate and secure its own internal communications.
External PKI: secures the connection with the external environment — either a certificate authority you provide, or one generated automatically by the system.

When you create a Secure Gateway, the system automatically issues a server certificate for the NGINX proxy that handles both:

internal connections, using your internal PKI;
external connections, using the external certificate.

Create a Secure Gateway¶

Open verified_user Admin Area > shield Network & Security > vpn_lock Secure Gateways, then click + New Secure Gateway.
Fill in the form fields.
Click Create.

Note

Creating a Secure Gateway here is a declarative action: it registers the gateway so your instance can reference and use it, but it does not deploy the gateway itself. The underlying infrastructure is deployed separately, typically via Ansible.

Form Fields¶

Identifier: unique name the system uses to know which Secure Gateway to use when deploying containers with Secure Signal, or which the NGINX proxy uses to fetch the server certificate.
Type: resource this gateway serves. The available choices depend on which modules are enabled on your instance — by default, only Signal is available.
PKI: whether Reemo generates the external certificate authority automatically, or whether you provide your own.
- Auto generate PKI: Reemo generates the certificate authority for you. Set the Validity (in days) of the PKI (default: 3650 days).
- Specify your own PKI: provide your own certificate authority by pasting its KEY (private key, PEM format — PKCS#1 or PKCS#8) and CERT (certificate authority, PEM format).
Validity (in days) of generated certificates: lifetime of the server certificates this gateway issues for the NGINX proxy (default: 3650 days). Not shown for every Type — for example, Vault has no such field; it instead has a required Token and container certificate lifetime field under Configuration, in minutes (default: 5).
Configuration: additional fields that vary depending on the selected Type — typically a portal URL, IP addresses, and/or port.