Table of contents

Configuration

Configuring reverse proxy and TLS.

Deployment methodThe commands on this page apply to the Docker Compose delivery. Open the matching Kubernetes and Helm procedure.

Reverse proxy and TLS

Create a public DNS domain pointing to the server's external IP and configure HTTPS on port 443 with a valid TLS certificate. The reverse proxy is the single entry point for platform users: it accepts traffic on the standard port 443 and forwards it to internal services, hiding their ports from direct internet access and terminating TLS centrally. HTTPS is required: all traffic between the browser and the platform is encrypted, and without a valid certificate browsers block access or mark the connection as insecure. API requests to the platform (the web panel and the public API) pass through the reverse proxy to port 10001 (gateway); web panel pages are served on port 10011.

Nginx configuration

Create the configuration file /etc/nginx/sites-available/massaccess.conf. Replace ms.company.ru with your domain and point to the actual TLS certificate paths. This assumes nginx installed from the OS repository (Debian/Ubuntu).

nginx

# /etc/nginx/sites-available/massaccess.conf

server {
    listen 443 ssl http2;
    server_name ms.company.ru;

    ssl_certificate /etc/letsencrypt/live/ms.company.ru/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/ms.company.ru/privkey.pem;

    client_max_body_size 10M;

    # Web panel API
    location /web/api/ {
        proxy_pass http://127.0.0.1:10001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Web panel WebSocket
    location /web/api/ws/ {
        proxy_pass http://127.0.0.1:10001;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Public API
    location /api/ {
        proxy_pass http://127.0.0.1:10001;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }

    # Web panel
    location / {
        proxy_pass http://127.0.0.1:10011;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

# HTTP -> HTTPS redirect
server {
    listen 80;
    server_name ms.company.ru;
    return 301 https://$host$request_uri;
}

InformationIf nginx runs on a separate host, replace 127.0.0.1 with the platform server's IP address and open ports 10001 and 10011 in the firewall. Web panel WebSocket connections use the /web/api/ws/ path.

Enable the configuration with a symlink, verify it and reload nginx:

bash

ln -s /etc/nginx/sites-available/massaccess.conf /etc/nginx/sites-enabled/
nginx -t
systemctl reload nginx

If nginx runs in Docker, place the massaccess.conf file in the directory mounted into the container as /etc/nginx/conf.d/ — nginx automatically includes all *.conf files from that directory. For example, in docker compose add the volume ./nginx/conf.d:/etc/nginx/conf.d to the nginx service. Then apply the changes:

bash

docker exec nginx nginx -t && docker exec nginx nginx -s reload