Configure a reverse proxy

Put nginx or Caddy in front of Supermetry and preserve trusted client addresses.

Expose a localhost Supermetry listener through nginx or Caddy with HTTPS.

Keep Supermetry on localhost and trust the same-host proxy.
Terminal window
```
sudoedit /etc/supermetry/supermetry.env
```
Set these values, then restart:
```
SUPERMETRY_LISTEN=127.0.0.1:8787
SUPERMETRY_BASE_URL=https://analytics.example.com
SUPERMETRY_TRUSTED_PROXIES=127.0.0.1
```
Terminal window
```
sudo systemctl restart supermetry
```
For a proxy in another container or host, replace 127.0.0.1 with its source IP or CIDR prefix. Trust only proxies that overwrite forwarded-address headers.

For nginx, write the same configuration shape used by the installer.

sudo tee /etc/nginx/conf.d/supermetry.conf >/dev/null <<'NGINX'
server {
    listen 80;
    server_name analytics.example.com;

    client_max_body_size 10m;

    location / {
        proxy_pass http://127.0.0.1:8787;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Real-IP $remote_addr;
    }
}
NGINX
sudo nginx -t
sudo systemctl reload nginx
sudo certbot --nginx -d analytics.example.com

For Caddy instead, write a site block. Caddy manages HTTPS automatically.

sudo tee /etc/caddy/Caddyfile >/dev/null <<'CADDY'
analytics.example.com {
    reverse_proxy 127.0.0.1:8787
}
CADDY
sudo caddy validate --config /etc/caddy/Caddyfile
sudo systemctl reload caddy

Check the public readiness endpoint.
Terminal window
```
curl -fsS https://analytics.example.com/readyz
```

What you should see: {"status":"ok"} is returned over HTTPS.

Configure a reverse proxy

Related