A detailed case study on building a custom mTLS-based authentication and authorization system for NGINX web frontends. The author describes `ipng-nginx-auth`, a three-component system: `authd` (central control plane with private CA, SQLite store, and gRPC API), `authz` (per-NGINX sidecar enforcing ACLs via NGINX's auth_request module), and `authc` (operator CLI). Long-lived client certificates are issued via a private CA and installed in browsers as PKCS#12 or Apple mobileconfig bundles. Authorization uses an OpenBSD pf.conf-inspired ordered ACL language with regex matching on host, URI, user DN, certificate serial, and IP prefix. The sidecar achieves ~110k req/s at 70µs median latency with 10 ACL rules. The system supports staged ACL commits, real-time policy propagation via gRPC streaming, Prometheus metrics, and selective per-request debug logging.
