Introduction

This guide will explain how to set up a reverse proxy with Amazon Web Services (AWS), allowing you to source and self-host your own domains, for the purpose of generating opt-out links within your SUPPRESS account.

Self-hosting your own Opt-Out Domains is doable, but can be resource intensive in both fixed costs and maintenance requirements. OPTIZMO's Managed Domain services within SUPPRESS are inexpensive and provide:

• SSL signing of your Opt-Out pages
• High availability (99.999% uptime SLAs)
• Automatic scaling to meet traffic demands
• 24/7 monitoring, giving you peace of mind that you remain compliant
• DDoS protection should your opt-out domain be picked up by bad actors
• One Click provisioning
• ISP Abuse Report protection

Prerequisites

In order to begin provisioning your own self-hosted domains for use within SUPPRESS, you'll need:

• An AWS account with admin credentials
• A SUPPRESS account with a managed domain to proxy your Opt-Out requests to - Note this domain, as it will be required later on in the guide
• The new domain you've purchased that you want to use for collecting Opt-Out traffic

Procedure

1. Log in to AWS and navigate to EC2 -> Load Balancers -> Create Load Balancer
   
2. Select Network Load Balancer -> Create
   1. Choose a suitable name
   2. For Scheme select Internet Facing
   3. Add TCP and TLS listeners (port 80 and 443 respectively)
   4. For VPC select at least 1 AZ, 3 are selected here. The more AZ's the greater the redundancy
   5. Click Next: Configure Security Settings
      
3. Click Request a new certificate from ACM -> Request a certificate ->  Request a public certificate
   1. Enter your BYO self-hosted domain
   2. Enter the www subdomain
   3. There are different ways to prove to AWS that you own the domain. In this example, we selected DNS validation
   4. Click Request
      
      
      
4. Click on the certificate to see the CNAME name and CNAME value fields you need to enter into your self-hosted domain's DNS provider.
5. Enter these like so (this example is showing Constellix as the DNS provider)
   
6. After a while, you should see that the certificate is issued by AWS.
   
7. Back in the configure Load Balancer menu
   1. Select the Certificate you have created for the load balancer
   2. Click Next: Configure Routing. Note the Network Load Balancer can take more than one certificate should you have many self-hosted domains.
      
8. In Configure Routing
   1. Choose New Target Group
   2. Choose a suitable name
   3. Choose TCP Port 80
   4. Click Next: Register Targets
      
9. Next, create the instance(s) you wish to add to your target group. You should consider multiple instances spread across multiple AZs for some redundancy, this guide only creates one.
   1. Choose Instances -> Launch Instance
      
      
   2. Type a suitable Name
   3. Choose an instance type. We selected Ubuntu Server 22.04 LTS
   4. Choose a suitable Instance size - for our testing we selected a t2.micro
      
      
10. At this point, we need to create an SSH key for administering our instances. Click Create new key pair
    
11. In Create key pair
    1. Type a suitable Key pair name
    2. Choose whether you want RSA or ED22519 Encryption
    3. Choose your key format. We are using Linux/Mac so we chose a .pem format
    4. Click Create key pair
    5. Download the key
       
12. Back on the Launch an instance screen
    1. Choose the key pair you just created
    2. Choose to Create security group
    3. Check Allow SSH traffic from -> My IP
    4. Click Launch Instance
13. Once the instance has finished booting up
    1. Click on it and in the description tab, locate the Public DNS value and copy it to your clipboard
       
       
14. On your local machine (assuming Linux/macOS)
    1. Change the permissions for the downloaded key
    2. Check you can SSH into your host
       
15. Now we have an Ubuntu instance created, we can finally finish that Target Group we started to create earlier.
    1. Under EC2 -> Target Groups
    2. Click your Target Group
    3. Click Actions -> Register and deregister instance / ip targets 
       
16. In the Register and deregister targets window
    1. Select your instance
    2. Click Add to registered
    3. Click Save
       
17. Back in EC2 -> Instances
    1. Select our instance and once again view the description tab
    2. Click on the Security Group that was created. We need to open some ports
       
18. Select the Security Group
    1. Click Actions -> Edit inbound rules
       
19. Add HTTP from anywhere and click save
    
20. At this point we have set up:
    1. An SSH key for authenticating with our EC2 instances
    2. A Security group allowing port SSH connections and port 80 to our instances
    3. A Ubuntu VM
    4. An AWS SSL certificate for signing 443 requests 
    5. A Network load balancer
       1. Listening on port 80 and forwarding to our target group on port 80
       2. Listening and Terminating any 443 requests with our SSL certificate and then forwarding to the target group on port 80
21. Next, we need to configure our Ubuntu VM to proxy these port 80 requests to your managed domain. For this, we will use NGINX. This part of the guide was heavily influenced by this great guide: How To Install Nginx on Ubuntu 20.04 | DigitalOcean
    1. First SSH back into the Instance
    2. Run: 

       # Install nginx
       sudo apt update
       sudo apt install nginx -y
       
       # enable Nginx to start on boot
       sudo systemctl enable nginx
       
       # create a folder for our configuration
       sudo mkdir -p /var/www/reverse_proxy/html
       
       # Set the correct permissions
       sudo chown -R $USER:$USER /var/www/reverse_proxy/html
       sudo chmod -R 755 /var/www/reverse_proxy

    3. Next, create and open the following file by typing:

       sudo nano /etc/nginx/sites-available/reverse_proxy

    4. paste the following into that file

       server {
         listen 80;
         # catch all
         location / {
           # Update the domain below with your complimentary managed domain in your account
           proxy_pass https://www.example.com;
           proxy_set_header Host www.example.com;
           proxy_set_header X-Forwarded-Host $host;
           proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
           proxy_ssl_server_name on;    
         }
       }

    5. Type the following to save and exit the nano editor:

       ctrl+x Y Enter

    6. Create a symbolic link to this newly created nginx config file:

       sudo ln -s /etc/nginx/sites-available/reverse_proxy /etc/nginx/sites-enabled/

    7. Remove the default server configuration symbolic link

       sudo rm /etc/nginx/sites-enabled/default

    8. restart nginx to apply the changes

       sudo systemctl restart nginx

22. The final step is to add ANAME or A records from your DNS provider to point to the public IP address(es) of your Network LB
    1. If your DNS provider supports ANAME records you can simply create one that points to the public DNS of your LB
       1. First, find the public DNS of your LB by Navigating to EC2 -> Load Balancers -> and finding the DNS name
       2. Next, create ANAME records for the root and www subdomain that points to that DNS. Example shown is Constellix
          
    2. If you cannot create an ANAME record then you will have to create A records for the IP address your Network Load Balancer has.
       1. To find these IP addresses go to Network Interfaces 
       2. Find those that have a description matching your Network Load Balancer and find their Public IPv4 Address 
          
23. If you have followed all the steps above correctly, you should be able to visit www.your-self-hosted-domain.com and it should proxy to your configured managed domain

If you have any further questions, please contact: support@optizmo.com