Spring Boot hybrid access with VPN and central firewall

Overview

This pattern is used when workloads on STACKIT must stay connected to central enterprise networks. It combines workload hosting with explicit network governance through VPN and centralized firewall controls.

Typical use case

• Hybrid dependency landscape: application integrations still depend on on-premises systems.
• Central inspection requirement: traffic must pass enterprise-approved firewall controls.
• Controlled project communication: east-west traffic between projects should be policy-driven.

Architecture diagram

Design best practices

• Route all hybrid traffic through one policy point: keep the central firewall as mandatory next hop.
• Keep routing ownership explicit: document who controls route tables and firewall rules per change window.
• Segment integration paths by criticality: separate business-critical from non-critical hybrid flows.
• Validate failover behavior: include VPN and firewall outage scenarios in architecture acceptance checks.

Related connectivity asset

• pfSense Firewall Connectivity Pattern

Repository usage and required settings

Workload provisioning in this pattern is covered by the VM Rehost repository:

Code & registry github.com STACKIT CMF Rehost Spring Boot repository Open the repository

Use these settings for the spoke workload VM:

create_project              = true
target_project_name         = "cmf-rehost-springboot"
target_project_owner_email  = "owner@sa.stackit.cloud"
parent_container_id         = "cmf-parent-container-id"
service_account_key_path    = "/path/to/stackit-sa-key.json"

enable_observability        = true
enable_node_exporter        = true
enable_local_postgresql     = false
enable_local_load_generator = false

Common CMF feature flags:

setup_project=true
setup_observability=true
setup_database=false
setup_workload=true
setup_loadgen=false
setup_dns=false

Scope note: VPN gateway, central firewall policies, and shared network area routes are design requirements in this asset and must be configured with the corresponding network/security setup in addition to the workload repository.