HTTPS and a reverse proxy

Choose one:

Setup	When
Your certificate on the edge	Flowtrix has the server to itself
Behind a reverse proxy	Caddy or nginx on the server already serves other sites on 443, often behind Cloudflare

Your certificate on the edge

1. Put fullchain.pem (the certificate and its chain) and privkey.pem (its key) in a folder, as files, not links. certbot's live/ folder holds links: copy them into a folder of their own in a deploy hook.

2. Name the folder in /opt/flowtrix/.env:

   FLOWTRIX_TLS=/etc/flowtrix/tls

3. Restart the edge:

   cd /opt/flowtrix && sudo docker compose restart edge

Video then also plays on port 8443, and the interface opens on 9443. System › Settings shows the certificate's names and expiry, or what is wrong with it.

Some boxes do not speak today's TLS, so the plain ports stay open until you close them. Once boxes play over HTTPS:

FLOWTRIX_API_BIND=127.0.0.1     # the interface on HTTPS only
FLOWTRIX_HTTP_BIND=127.0.0.1    # video on HTTPS only

A renewed certificate: replace the files, then reload the edge:

cd /opt/flowtrix && sudo docker compose exec edge nginx -c /etc/nginx/flowtrix/nginx.conf -s reload

Behind a reverse proxy

Answer yes to the installer's reverse proxy question (FLOWTRIX_BEHIND_PROXY=yes). Flowtrix then:

• listens on 127.0.0.1 only, so nothing reaches it but the proxy;
• needs no certificate of its own;
• trusts the proxy's X-Forwarded-For (FLOWTRIX_PROXY=172.16.0.0/12, Docker's networks), so sign-in limits, viewers and token checks see each viewer's own address;
• plays at https://<domain>, and the installer prints the proxy's site block.

The interface and /v1 go to the agent (port 8090); everything else to the edge (8080). In Caddy, with Cloudflare's origin certificate:

https://tv.example.com {
	tls /certs/origin.pem /certs/origin.key
	@agent path / /index.html /favicon.svg /assets/* /v1/*
	handle @agent {
		reverse_proxy 127.0.0.1:8090 {
			header_up X-Forwarded-For {client_ip}
		}
	}
	handle {
		reverse_proxy 127.0.0.1:8080 {
			header_up X-Forwarded-For {client_ip}
		}
	}
}

In Caddy's global options, set trusted_proxies to Cloudflare's ranges and client_ip_headers CF-Connecting-IP, so {client_ip} is the visitor. Cloudflare's SSL mode: Full (strict).

Cloudflare's ports

Cloudflare proxies HTTPS only on 443, 2053, 2083, 2087, 2096 and 8443, so 8090 and 9443 cannot be reached through it directly: use the proxy.