← Google Interview Insights

Google·Software Engineer·Onsite - System Design / Architecture·Senior

Senior
May 2026

Summary

Google system design screen for a software engineer role. One question, but it had a lot of moving parts and I don't think I covered everything as cleanly as I should have.

Questions Asked (1)

Q1

You have a single Linux server with one public IPv4 address. Three different businesses each want their own website hosted on separate domains. How do you make that work, and walk through DNS setup, request routing, TLS certificates, and any operational or security concerns?

System DesignTechnical Trade-offs
Author's notes

The DNS part came out fine, I knew to point all three domains at the same IP with A records.

Create a free account to read the full note

AI HintsAI Generated

Suggested Approach

Start by clarifying requirements and constraints, then propose a reverse proxy (e.g., Nginx) to route traffic based on the Host header or SNI. Walk through DNS configuration, TLS certificate management (e.g., Let's Encrypt with SNI), and operational concerns like security, monitoring, and scalability.

Pro tip: Mention that using a reverse proxy with SNI allows multiple TLS certificates on a single IP, and highlight automation of certificate renewal to avoid downtime. Also, discuss security hardening like isolating each site's processes and using a Web Application Firewall (WAF).

1. Clarify Requirements and Constraints

Ask about expected traffic, budget, and whether the businesses need isolation. Confirm that all domains can point to the same IP and that the server can handle the load.

2. Design the Architecture

Propose a reverse proxy (e.g., Nginx) to listen on ports 80 and 443 and route requests to separate backend services or directories based on the Host header or SNI. Consider using containers or virtual hosts for isolation.

3. Configure DNS

For each domain, create an A record pointing to the server's public IP. Optionally, use CNAME records for subdomains. Ensure DNS propagation and TTL settings are appropriate.

4. Set Up TLS Certificates

Obtain individual TLS certificates for each domain using Let's Encrypt (e.g., via Certbot). Configure the reverse proxy to use SNI to present the correct certificate per domain. Automate renewal with cron jobs or systemd timers.

5. Address Operational and Security Concerns

Implement monitoring, logging, and backups. Harden security with firewalls, regular updates, and isolation between sites (e.g., separate user accounts or containers). Discuss scalability options like load balancing if needed.

Key Points to Mention

  • Reverse proxy configuration (Nginx/Apache) with virtual hosts and SNI
  • DNS A records for each domain pointing to the single IP
  • TLS certificate management with Let's Encrypt and automated renewal
  • Security measures: firewall, regular updates, isolation between sites
  • Operational considerations: monitoring, logging, backups, and scalability
  • Potential use of containers (Docker) for isolation and ease of management

AI-generated suggestions, not part of the candidate's original notes. May be inaccurate — verify before relying on them.