We're looking at deployment for a client who's sensitive to being hacked, so we want to put CiviCRM behind, say, nginx running mod_security2. Has anyone used a WAF with CiviCRM that can share recommendations?
we have a slightly different approach for an enhanced security architecture using a proxy-server plus vpn. If you are interested, please sind more information plus code on GitHub, there was also a session on last year's CiviCon.
Let me know if you have any questions regarding CiviProxy.
Kind Regards Fabian
I've configured CiviCRM behind both Pound and NginX. Both worked perfectly well, no complaints. If there were any special configurations required, they can't have been troublesome enough to remember :)
You will need to ensure CiviCRM is capable of "accessing itself", since some requests (eg dashboard contents) are made to the current CiviCRM website. This includes DNS / web access from the webserver CiviCRM is running on - see this answer.