diff options
Diffstat (limited to 'docs/operations.md')
| -rw-r--r-- | docs/operations.md | 22 |
1 files changed, 22 insertions, 0 deletions
diff --git a/docs/operations.md b/docs/operations.md index fe09537..be185f1 100644 --- a/docs/operations.md +++ b/docs/operations.md @@ -103,6 +103,28 @@ One node at a time, restarting each with its files. What to know: switching ([`remakes.md`](remakes.md), Limits). Don't remake while the swarm runs two versions. * **The dashboard** reloads by itself once its node serves another version of it. +## Behind a reverse proxy + +The HTTP API speaks plain HTTP on `127.0.0.1:3000`; a reverse proxy in front adds TLS, +and can authenticate users itself (single sign-on, client certificates, its own +password file). It then names the user in a header, which the node believes from the +proxy's address alone (`--user-header`, `--trusted-proxies`, by default this host's +loopback addresses); requests from elsewhere still need `--htpasswd`, which becomes +optional. The proxy must set or clear that header on every request, or a client could +set it itself. With nginx: + +```nginx +location / { + auth_basic "continuum"; + auth_basic_user_file /etc/nginx/continuum.htpasswd; + proxy_set_header X-Remote-User $remote_user; + proxy_pass http://127.0.0.1:3000; +} +``` + +and the node started with `--user-header X-Remote-User`. The names the proxy gives are +the users of `--protocol-writers` and of who wrote what ([`api.md`](api.md)). + ## What to alert on From the metrics (`GET /admin/stats` as Prometheus, [`measurements.md`](measurements.md)): |