In find myself in a situation where part of an application lives in DMZ for security compliance reasons and the other part lives on the LAN. The instances on the LAN do not use a lot of ressource and there is a lot of waste (cpu and memory). I would like to leverage our internal docker swarm to host them.
But, as it is an serveless architecture, the IPs can change and I cannot guarantee port numbers ; which doesn't play nice with the firewall whose rules are not recomputed in real time.
There is a Consul cluster that can help me identify the services and route TCP connection to them but not from within the DMZ so I was thinking of having some proxies on other servers and simply route the connections to the service. This would only consume a bit of bandwidth but I can live with that.
Does anyone have any experience of this kind of situation ? Is there a simpler solution ?
In the end, I am not even sure it is worth the trouble. Should I just continue to pack low consuming applications on the same server ?