adding proxy configuration #20231107 #20230503 in 4314 issue

_search-plugins/cross-cluster-search.md

@@ -267,7 +267,7 @@ It is sufficient to point to only one of the node IPs on the remote cluster beca
 
 You can now run queries across both clusters:
 
-```bash
+```json
 curl -XGET -k -u 'admin:<custom-admin-password>' 'https://opensearch-domain-1:9200/opensearch-ccs-cluster2:books/_search?pretty'
 {
   ...
@@ -297,3 +297,56 @@ curl -k -XPUT -H 'Content-Type: application/json' -u 'admin:<custom-admin-passwo
   }
 }'
 ```
+
+## OpenSearch behind a proxy
+You can configure cross-cluster search on a cluster running behind a proxy. There are many ways to configure a reverse proxy and various proxies to chose from. The following example demonstrates the basic NGINX reverse proxy configuration without TLS termination. OpenSearch is expected to be running with both transport and HTTP TLS encryption enabled. For more information about configuring TLS encryption, see [Configuring TLS certificates]({{site.url}}{{site.baseurl}}/security/configuration/tls/).
+
+### Proxy configuration
+The basic NGINX configuration for HTTP and transport communication follows:
+
+```
+stream {
+    upstream opensearch-transport {
+        server <opensearch>:9300;
+    }
+    upstream opensearch-http {
+        server <opensearch>:9200;
+    }
+    server {
+        listen 8300;
+        ssl_certificate /.../opensearch-2.12.0/config/esnode.pem;
+        ssl_certificate_key /.../opensearch-2.12.0/config/esnode-key.pem;
+        ssl_trusted_certificate /.../opensearch-2.12.0/config/root-ca.pem;
+        proxy_pass opensearch-transport;
+        ssl_preread on;
+    }
+    server {
+        listen 443;
+        listen [::]:443;
+        ssl_certificate /.../opensearch-2.12.0/config/esnode.pem;
+        ssl_certificate_key /.../opensearch-2.12.0/config/esnode-key.pem;
+        ssl_trusted_certificate /.../opensearch-2.12.0/config/root-ca.pem;
+        proxy_pass opensearch-http;
+        ssl_preread on;
+    }
+}
+```
+The listening ports for HTTP and transport communication are set to `443` and `8300` respectively. 
+
+### OpenSearch configuration
+The remote cluster can be configured to point to the `proxy` using the following command:
+
+```bash
+curl -k -XPUT -H 'Content-Type: application/json' -u 'admin:<custom-admin-password>' 'https://opensearch:9200/_cluster/settings' -d '
+{
+  "persistent": {
+    "cluster.remote": {
+      "opensearch-remote-cluster": {
+        "mode": "proxy",
+        "proxy_address": "<remote-cluster-proxy>:8300"
+      }
+    }
+  }
+}'
+```
+Note the previously defined port `8300` configured in the [Proxy configuration]({{site.url}}{{site.baseurl}}/search-plugins/cross-cluster-search/#proxy-configuration) section.