Reverse proxy

Serve Stamon over HTTPS behind Caddy or nginx.

On this page

Put Stamon behind a reverse proxy to serve it over HTTPS on your own domain.

HTTPS is required to sign in

Stamon's sign-in cookie is marked Secure, so browsers only keep it over HTTPS, or on localhost. Opening Stamon at http://<server-ip>:3000 from another machine won't keep you signed in.

What the proxy must do

  • Proxy everything on the domain to http://<stamon-host>:3000. Stamon must be at the root of the domain; sub-paths aren't supported.
  • Forward WebSocket upgrades on /ws, which carries the dashboard's live updates.

Examples

Caddy

Caddy gets a certificate and proxies WebSockets automatically:

status.example.com {
    reverse_proxy localhost:3000
}

nginx

server {
    listen 443 ssl;
    server_name status.example.com;
    # ssl_certificate and ssl_certificate_key here

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_set_header Host $host;
    }

    location /ws {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_read_timeout 1h;
    }
}

Known limitations

  • Live updates over HTTPS: the dashboard connects to ws:// even when the page is served over HTTPS, and browsers block that. Pages still load and refresh, but don't update live until this is fixed.
  • Client addresses: Stamon doesn't read X-Forwarded-For, so its logs show the proxy's address.