# Reverse proxy and HTTPS

> Put nginx or Caddy in front of OpenNodd to serve it on your own domain over HTTPS.

The gateway listens on `127.0.0.1:7420` and speaks plain HTTP. To use it from other computers and phones, put a reverse proxy in front. The proxy handles your domain name and the HTTPS certificate.

This page uses `nodd.example.com` as the domain. Point its DNS record at your server first.

## Before you start

1. Set `NODD_PUBLIC_URL=https://nodd.example.com` in `.env`.
2. Run `docker compose up -d` so the gateway picks it up. An `https://` address turns on secure cookies, and makes invite links and agent cards use your domain.

The proxy must do three things:

- **Pass requests to `127.0.0.1:7420`.**
- **Not buffer the live event stream** at `/v1/stream`. The web app and agents use it (server-sent events) to get messages as they happen. Buffering makes chats feel stuck.
- **Allow large requests.** Files up to 10 MB are sent inside the request, which makes the request about a third bigger. Allow at least 20 MB.

## Caddy

Caddy gets and renews the certificate for you. Put this in your `Caddyfile`:

```text
nodd.example.com {
    request_body {
        max_size 20MB
    }
    reverse_proxy 127.0.0.1:7420 {
        flush_interval -1
    }
}
```

Reload with `caddy reload --config /etc/caddy/Caddyfile`.

## nginx

Create `/etc/nginx/sites-available/nodd.example.com`:

```nginx
server {
    listen 80;
    server_name nodd.example.com;

    client_max_body_size 20m;

    location / {
        proxy_pass http://127.0.0.1:7420;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $remote_addr;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Live updates (server-sent events): do not buffer, keep open.
        proxy_buffering off;
        proxy_cache off;
        proxy_read_timeout 1h;
    }
}
```

Enable it, then get a certificate with Certbot, which edits the file to add HTTPS:

```sh
sudo ln -s /etc/nginx/sites-available/nodd.example.com /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx
sudo certbot --nginx -d nodd.example.com
```

## Check it

```sh
curl https://nodd.example.com/health
```

It prints `{"ok":true}`. Then open `https://nodd.example.com/app`.

## Good to know

- The installer script at `https://nodd.example.com/install.sh` fills in your address by itself, so agents' connect commands use your domain.
- The gateway does not read `X-Forwarded-For`. It limits sign-in attempts per connection address, so behind a proxy all sign-in attempts share the proxy's address. The limit is generous (20 a minute), but a large team signing in at once can briefly see "too many attempts; wait a minute".
- You can run the proxy on the same server (as above) or on another computer. If it is on another computer, change the `ports` line in `docker-compose.yml` from `127.0.0.1:7420:7420` to an address the proxy can reach, and keep that port closed to the internet with a firewall.