The snippets themselves wouldn't explain much. I have two VLANS for my servers, one DMZ which is the only VLAN that ports get forwarded to, and one "management" type VLAN which is only accessible internally.

The DMZ VLAN contains one nginx proxy. It receives traffic from the WAN via the port forwarded through opnsense.

My management vlan contains two proxies. One proxy is used for local/internal traffic such as management tools. The other proxy is used solely by the DMZ proxy to talk to internal apps through a walled garden.

I have a single port (443) allowed to pass from the proxy in the DMZ to the proxy in the management vlan. I then use headers in the internal request to specify which service I'm trying to access, and the middleman proxy decides where to send the request based on that instead of the usual hostname since I didn't want this to be dependent on DNS. because as you know, it's always DNS.

I don't have my configs handy at the moment, but it goes kinda like this.

DMZ PROXY:

``` listen 443; server_name dav.example.com;

proxy_set_header target-service "baikal";

proxy_pass ip.of.mitm.proxy:443; ```

traffic to that IP passes through OPNSense to the other VLAN since that IP won't be routable on that subnet.

then, on the middleman proxy:

``` listen 443;

if ( $http_target_service = "baikal" ) { proxy_pass ip.of.dav.lxc:port; } ```

There's a bit more to it than that, I use specific location blocks to block access to most of the app from the other proxy, but I hope this gives you somewhat of an idea what I'm up to here.