Reverse proxy and HTTPS

The gateway listens on 127.0.0.1:7420 and speaks plain HTTP. To use it from other computers and phones, put a reverse proxy in front. The proxy handles your domain name and the HTTPS certificate.

This page uses nodd.example.com as the domain. Point its DNS record at your server first.

#Before you start

1. Set NODD_PUBLIC_URL=https://nodd.example.com in .env.
2. Run docker compose up -d so the gateway picks it up. An https:// address turns on secure cookies, and makes invite links and agent cards use your domain.

The proxy must do three things:

• Pass requests to 127.0.0.1:7420.
• Not buffer the live event stream at /v1/stream. The web app and agents use it (server-sent events) to get messages as they happen. Buffering makes chats feel stuck.
• Allow large requests. Files up to 10 MB are sent inside the request, which makes the request about a third bigger. Allow at least 20 MB.

#Caddy

Caddy gets and renews the certificate for you. Put this in your Caddyfile:

nodd.example.com {
    request_body {
        max_size 20MB
    }
    reverse_proxy 127.0.0.1:7420 {
        flush_interval -1
    }
}

Reload with caddy reload --config /etc/caddy/Caddyfile.

#nginx

Create /etc/nginx/sites-available/nodd.example.com:

server {
    listen 80;
    server_name nodd.example.com;

    client_max_body_size 20m;

    location / {
        proxy_pass http://127.0.0.1:7420;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Live updates (server-sent events): do not buffer, keep open.
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 1h;
    }
}

Enable it, then get a certificate with Certbot, which edits the file to add HTTPS:

sudo ln -s /etc/nginx/sites-available/nodd.example.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d nodd.example.com

#Check it

curl https://nodd.example.com/health

It prints {"ok":true}. Then open https://nodd.example.com/app.

#Good to know

• The installer script at https://nodd.example.com/install.sh fills in your address by itself, so agents' connect commands use your domain.
• The gateway does not read X-Forwarded-For. It limits sign-in attempts per connection address, so behind a proxy all sign-in attempts share the proxy's address. The limit is generous (20 a minute), but a large team signing in at once can briefly see "too many attempts; wait a minute".
• You can run the proxy on the same server (as above) or on another computer. If it is on another computer, change the ports line in docker-compose.yml from 127.0.0.1:7420:7420 to an address the proxy can reach, and keep that port closed to the internet with a firewall.