Reverse Proxy and HTTPS

View as Markdown

Why use a Reverse Proxy?

While you can access TailStatic directly on its internal port, using a reverse proxy is the standard way to deploy it for production. A reverse proxy like Nginx or Caddy handles security, SSL certificates, and allows you to host multiple sites on the same server.

Configuring Forwarded Headers

TailStatic needs to know the original details of the visitor's request. You must configure your reverse proxy to send "Forwarded" headers. Without these, features like site routing and HTTPS detection may not work correctly.

Ensure your proxy is sending the following:

  • X-Forwarded-For: The IP address of the user.
  • X-Forwarded-Proto: Set this to https so TailStatic knows the connection is secure.
  • X-Forwarded-Host: The domain name the user requested.

Nginx Configuration

Here is a basic snippet for an Nginx server block:

server {
    server_name dashboard.yourdomain.com;    
    location / {
        proxy_pass http://127.0.0.1:5000;

        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection keep-alive;

        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_buffering off;
        proxy_request_buffering off;
    }

    listen 443 ssl; # managed by Certbot
    ssl_certificate /etc/letsencrypt/live/dashboard.yourdomain.com/fullchain.pem; # managed by Certbot
    ssl_certificate_key /etc/letsencrypt/live/dashboard.yourdomain.com/privkey.pem; # managed by Certbot
    include /etc/letsencrypt/options-ssl-nginx.conf; # managed by Certbot
    ssl_dhparam /etc/letsencrypt/ssl-dhparams.pem; # managed by Certbot

}
server {
    if ($host = dashboard.yourdomain.com) {
        return 301 https://dashboard.yourdomain.com$request_uri;
    }


    listen 80;
    server_name dashboard.yourdomain.com;
    return 404; # managed by Certbot
}

For each domain that you wish to add in TailStatic, you will need to create nginx configuration file just like above.

Caddy Configuration

If you prefer Caddy, it can automatically obtain and renew certificates for you. This makes it a simple option for HTTPS-enabled deployments.

{
    email [email protected]
}

dashboard.yourdomain.com {
    reverse_proxy 127.0.0.1:5000 {
        header_up Host {host}
        header_up X-Real-IP {remote_host}
        header_up X-Forwarded-For {remote_host}
        header_up X-Forwarded-Proto {scheme}
        header_up X-Forwarded-Host {host}
    }
}

If you are serving multiple TailStatic sites, add one site block per domain or subdomain and point each one at the correct upstream.

Enabling SSL with Certbot

If you are using Nginx, Certbot can request and install a trusted SSL certificate from Let's Encrypt and update your server block automatically.

  1. Install Certbot and the Nginx plugin on your server.
  2. Make sure DNS for your dashboard domain points to the server's public IP.
  3. Run Certbot for your domain, for example:
sudo certbot --nginx -d dashboard.yourdomain.com
  1. Follow the prompts to choose the domain and redirect HTTP traffic to HTTPS.
  2. Certbot will update Nginx with the certificate paths and create the HTTP-to-HTTPS redirect.

After setup, verify the certificate renewal timer is active:

sudo certbot renew --dry-run

If you prefer to manage TLS manually, you can still use Certbot to obtain certificates and then reference the generated files in your Nginx configuration.

Dashboard vs. Site Domains

When configuring your proxy, remember that you need to handle two types of traffic:

  1. Dashboard Traffic: Traffic intended for managing TailStatic. This should go to your dashboard domain (e.g., tailstatic.example.com).
  2. Site Traffic: Traffic for the websites you have created. These can be various domains or subdomains.

TailStatic is smart enough to distinguish between these based on the Host header, as long as your reverse proxy passes it through correctly.

Enabling HTTPS

We recommend using HTTPS for all connections. Most modern reverse proxies can automatically manage SSL certificates using Let's Encrypt, Certbot, or built-in ACME support like Caddy. Once HTTPS is enabled, ensure your X-Forwarded-Proto header is correctly set to https.

Next Steps

This was the last part of configuration. If you are done with this, you can proceed to install TailStatic.