12 Glossary

Glossary

Domain

Main address like example.com.

Subdomain

Child address like app.example.com.

Upstream

Internal target service that DomNexDomain proxies to.

HA (High Availability)

Multiple target servers for one service.

• failover: backup server on failure
• round_robin: load distribution

ACME / Let's Encrypt

Automated TLS certificate issuance.

GeoIP Policy

Rule that allows or blocks access based on country code derived from client IP.

RBAC

Role-based access control for users.

Scope

Fine-grained API permission assigned to tokens.

Edge

Public ingress layer of DomNexDomain handling routing, policy gates, and forwarding.

Control Plane

Admin API and Web UI used to configure domains, subdomains, users, and security policies.

Deterministic Decision Chain

Fixed, short-circuit request evaluation order where first terminal decision (drop/deny/error) ends processing.

Threat Intel

Behavior + feed + signature driven risk engine used to classify and enforce against abusive sources.

Signature

Pattern-based detection rule (signature.*) matching suspicious paths, hosts, or user agents.

Watch State

Elevated monitoring state for a source IP, typically used as a controlled pre-block stage.

Soft Block

Temporary block window (ban_until) where requests are denied for a limited time.

Hard Block

Highest enforcement level; source is added to block path and requests are dropped.

Rehabilitation / Decay

Gradual XP/level reduction over inactivity, with eventual cleanup for cooled-down sources.

XP / Level / Tier

Threat scoring model:

• XP: accumulated threat points
• Level: escalation stage
• Tier: UI label derived from level

Feed Hit

Source IP appears in an enabled Threat Intel feed and is matched on live incoming traffic.

Allowlist (Threat Intel)

Explicit IP exception list that prevents normal threat enforcement for trusted sources.

WAF Unknown-Host Baseline

Built-in temporary protection against high-rate requests to non-configured hostnames.

Smart Error Page

Branded edge response page with trace correlation while minimizing sensitive details.

Trace ID

Correlation identifier for linking edge responses with Strategic Intel investigations and related audit entries.

Trace Timeline

Chronological reconstruction of one request or security flow across flow, evidence, and action entries.

Flow Event

Trace event generated directly by DomNexDomain runtime logic, starting at first contact on the edge and ending at request completion or terminal deny/drop/error.

Evidence Event

Trace event generated when Threat Intel records a classification input or decision-carrying signal.

Action Event

Trace event derived from retained audit actions that carry the same trace ID.

Investigations

Strategic Intel tab used to pivot by trace ID, IP, host, or related evidence and reconstruct the exact decision path.

Source Scope

Request origin class (for example internal/LAN vs external/internet) used in policy context.

SSH Bastion

Dedicated SSH gateway listener (:2222) that authorizes key-based forwarding to allowed targets.

Direct-TCPIP

SSH channel type used by bastion forwarding (-J/ProxyJump style flows).

OS Firewall Enforcer (nftables)

Optional kernel-level block synchronization from Threat Intel blocked sources to nft sets/rules.

Trusted Proxies

Configured proxy CIDRs whose forwarded headers are trusted for source IP/country resolution.

OTS (One-Time Setup Code)

Single-use setup unlock code required during initial installation before first admin setup.

Break-Glass MFA Reset

Local CLI recovery action (domnexdomain mfa-reset <username>) to recover admin access if MFA is misconfigured.