Anubis Without TLS Termination?

[RezaOnGithub]

Problem: I want to serve a website locally over limited bandwidth, and still offer HTTPS end-to-end to the server box.

Current Solution: host Anubis locally alongside the backend. This is the least complicated way but is eating my bandwidth.

I've been researching how to host Anubis on a cloud VPS, have the VPS take the brunt of the bad requests and present the PoW challenge, and forward the legitimate traffic to the real backend. I've interrogated LLMs on this but none have come up with a solution. (One suggestion was to do my own traffic analysis on the VPS and forward raw encrypted packets- I may combine this with the current solution to reduce bad traffic that crosses the wire)

Edit: see a few crude diagrams

I am a programmer but I'm new to networking and backend development so please forgive me if it's a weird question/haven't searched hard enough.

[Xe]

Can you make a diagram of the flow you have in mind?

[RezaOnGithub]

Currently I have tested this set-up, where my server thinks it is a publicly-accessible host:

Current Set-Up Diagram

Outside World/Browser
↓
VPS:
        - WireGuard Port-Forwarding (443) and VPN  
↓
Box in My Closet:
        - Caddy
        ↓↓
        - Anubis
        ↓↓
        - Some FastAPI backend

Edit: Just to re-iterate, problem here is that I'm very bandwidth-limited so the current set-up is not sustainable anyway but I'm experimenting.

I don't want this:

Decrypt And Re-encrypt Diagram

Outside World/Browser
↓
VPS:
        - Caddy
        ↓↓
        - Anubis
        ↓↓
        - WireGuard Port-Forwarding (some private port that goes to host)
↓
Box in My Closet:
        - Some FastAPI backend

I want to have my cake and eat it too:

Anubis and HTTPS (Caddy on The Box) Diagram

Outside World/Browser
↓
VPS:
        - Anubis (somehow)
        ↓↓    
        - WireGuard Port-Forwarding (443) and VPN  
↓
Box in My Closet:
        - Caddy
        ↓↓
        - Some FastAPI backend

I'm open to alternative designs of course. The main thing is Caddy and how easy it is, and perhaps it's unnecessarily limiting my options.

[Xe]

Are you able to set up a point to point VPN like wireguard or tailscale between the two nodes?

[RezaOnGithub]

Yes, that's how the local server is connected at all. I have a WireGuard VPN set-up where all incoming connections are handled with port-forwarding to the local. Outgoing connections from local are also made over VPN out of the VPS. (I can post a complete sample in a few days if needed)

[fu-sen]

I believe Caddy issues TLS (SSL) certificates, but I don't understand why you dislike having them done on a VPS. Because that creation is the most ideal.

[zc-devs]

Anubis Without TLS Termination

No way. You must terminate SSL in order to look in the headers.
Terminate SSL before Anubis. Then make another SSL to the backend, if you want.
However, you have encrypted tunnel from VPS to Backend. So, it is unnecessary.
I have a similar setup in Kubernetes: SSL termination on VPS in Traefik -> WireGuard to other node with backend.
You must trust your VPS provider in this case.

---

Another option could be Anubis in ForwardAuth mode: Traefik is in your home, Anubis on VPS.
-- You receive all bots requests at home anyway
++ SSL termination at your home
++ Some saved traffic, that involved in challenges between Client and Anubis (probably, very small)