83 lines
2.0 KiB
Markdown
83 lines
2.0 KiB
Markdown
# Reverse Proxy
|
|
|
|
The web UI and HTTP API work through a standard HTTP reverse proxy. The application uses same-origin requests and an `HttpOnly` signed session cookie.
|
|
|
|
For NPMplus, use the dedicated [npmplus.md](npmplus.md) guide. The included Caddy overlay is only an optional standalone alternative.
|
|
|
|
## What The Proxy Handles
|
|
|
|
- Web UI.
|
|
- Operator login/logout.
|
|
- Operator HTTP API.
|
|
- Agent enrollment, heartbeat, command polling, and command results.
|
|
|
|
## What The Proxy Does Not Handle
|
|
|
|
An ordinary HTTP reverse proxy does not proxy SSH:
|
|
|
|
- `2222/tcp` must remain reachable by managed routers, or be handled by a TCP proxy.
|
|
- `22000-22099/tcp` must remain reachable by trusted operators, or be handled by a TCP proxy/VPN.
|
|
|
|
## Included Caddy Configuration
|
|
|
|
Set a public DNS name in `.env`:
|
|
|
|
```env
|
|
RMM_DOMAIN=rmm.example.com
|
|
RMM_COOKIE_SECURE=true
|
|
RMM_HTTP_BIND_IP=127.0.0.1
|
|
```
|
|
|
|
Start the base stack with the proxy overlay:
|
|
|
|
```sh
|
|
docker compose -f compose.yaml -f compose.proxy.yaml up -d --build
|
|
```
|
|
|
|
Caddy automatically obtains and renews a TLS certificate when:
|
|
|
|
- the domain resolves to the server;
|
|
- ports `80` and `443` are reachable from the internet.
|
|
|
|
Open:
|
|
|
|
```text
|
|
https://rmm.example.com
|
|
```
|
|
|
|
## Existing Reverse Proxy
|
|
|
|
Proxy HTTP traffic to:
|
|
|
|
```text
|
|
http://rmm-server:8080
|
|
```
|
|
|
|
When the browser uses HTTPS, set:
|
|
|
|
```env
|
|
RMM_COOKIE_SECURE=true
|
|
```
|
|
|
|
Preserve the original `Host` header and forward client/protocol headers. Example Nginx location:
|
|
|
|
```nginx
|
|
location / {
|
|
proxy_pass http://127.0.0.1:18080;
|
|
proxy_http_version 1.1;
|
|
proxy_set_header Host $host;
|
|
proxy_set_header X-Real-IP $remote_addr;
|
|
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
|
|
proxy_set_header X-Forwarded-Proto $scheme;
|
|
}
|
|
```
|
|
|
|
No WebSocket settings are currently required.
|
|
|
|
## Recommended Network Policy
|
|
|
|
- Public or VPN operator access: `443/tcp`.
|
|
- Router tunnel access: `2222/tcp`.
|
|
- Trusted operator/VPN access only: `22000-22099/tcp`.
|
|
- Do not expose the direct application port `18080` publicly when using a reverse proxy.
|