Confluence Proxy
A confluence proxy sits in front of your wiki server to manage incoming network traffic. You set up this web server to handle TLS encryption and forward requests to the internal app. Most engineering teams use standard web servers like Nginx or Apache for this task. They place the wiki on a private network and expose only the front server. When teams set broad network rules or share admin keys, anyone on the network can read private pages. How a native confluence proxy architecture works In a
Database Proxy (ProxySQL, PgBouncer): the complete guide
Architecture patterns, implementation strategies, and security best practices. Delivered to your inbox.
A confluence proxy sits in front of your wiki server to manage incoming network traffic. You set up this web server to handle TLS encryption and forward requests to the internal app. Most engineering teams use standard web servers like Nginx or Apache for this task. They place the wiki on a private network and expose only the front server. When teams set broad network rules or share admin keys, anyone on the network can read private pages.
How a native confluence proxy architecture works
In a standard setup, users send browser requests to a public domain name. That domain points to your front web server rather than the wiki host itself. The front server ends the public TLS session and checks the request headers. Next, it forwards the plain traffic to the internal wiki port over a private network.
You must also update the base URL setting inside the wiki software. The wiki needs to know its public address so it can build valid page links. You also configure the internal server connector so it trusts headers from the front server. Without this trust setting, the wiki will build broken links or fail to load styles.
Many teams also run this setup to serve several tools under one domain. One path routes traffic to the wiki while another path sends traffic to an issue tracker. The front web server reads the URL path and picks the right back-end host. It also caches static files like images to take load off the main wiki server.
What native routing solves and where gaps remain
A standard reverse web server solves basic network exposure and certificate management problems. It keeps your app server off the public internet and centralizes TLS renewals. It also lets network admins filter bad traffic by source IP address before requests hit the wiki.
Still, a basic web server only checks network headers and routes packets. It decides who can reach the login page, not what authenticated users or scripts do next. Once a user or automated script logs in, the web server passes every request straight through.
Database Proxy (ProxySQL, PgBouncer): architecture patterns and best practices
Continue reading? Get the full guide.
Free. No spam. Unsubscribe anytime.
Teams often create shared service accounts for scripts that pull wiki pages or post build notes. Those service tokens usually hold broad space permissions across the whole wiki. If a script runs a bad request, it can overwrite pages or pull sensitive text. Standard web logs only show the URL path, not the full data inside the page body. When pages hold customer emails, phone numbers, or card numbers, broad tokens put that data at risk.
Managing automated script permissions
Modern engineering workflows connect many internal tools, chat bots, and build scripts to your wiki API. Each integration needs an API token or account to read and write content. Over time, teams lose track of which server holds which static token.
Rotating those tokens by hand takes hours and often breaks automated jobs. Admins need a clear view of every API call and a way to mask sensitive fields like national IDs in results.
Add runtime guardrails and masking beside your databases and APIs
Login rules, role grants, and CI checks govern who connects to your stack. Yet any allowed script, engineer, or AI agent still runs commands with the full scope of its role. For workloads on Postgres, MySQL, SQL Server, MongoDB, ClickHouse, Kubernetes, SSH, or internal HTTP services, hoop.dev sits beside the service as an open-source proxy, a sidecar for your database or API.
Before a query runs, hoop.dev guardrails check the statement against your rules. An AI Analyzer you configure can score intent or hold risky calls for human review. Next, hoop.dev data masking rewrites sensitive fields in responses, and each verdict is logged per listener. Explore the MIT-licensed project on GitHub.
Frequently asked questions
Why does my wiki show broken links behind a reverse web server?
This happens when the public base URL does not match the front server address. Update the base URL in the wiki settings and check that the internal connector trusts forwarded host headers.
Can a standard web server restrict which wiki spaces an API token reads?
No, a standard web server only routes network traffic by path and IP address. Space access depends on the internal wiki permissions tied to that user account or API token.
How should teams protect sensitive data stored inside wiki pages?
Teams should limit space roles, audit page read events, and mask fields like emails or card numbers in API results. Avoid giving broad admin roles to automated scripts or shared accounts.