HTTPS & Proxy Setup
For a production setup the Databus requires the use of a proxy with a TLS-encrypted connection (HTTPS). There are two options: activate the internal proxy with automatic HTTPS (certificate) provisioning or configure an external proxy of your choice.
Internal Proxy with Automatic HTTPS (certificate) provisioning
If no web server is running on the deployment machine, an integrated Caddy server can be activated by changing settings in the .env
and docker-compose.yml
files. The only requirement is that the deployment host machine has a DNS A/AAAA/CNAME DNS record for its FQDN.
In the .env
file the DATABUS_PROXY_SERVER_ENABLE
needs to be set to true
and DATABUS_PROXY_SERVER_HOSTNAME
must be set to the host's name (FQDN). As long as DATABUS_PROXY_SERVER_USE_ACME
is set to true
, which is the default, HTTP or TLS-ALPN ACME challenges can be used to request a free certificate. However, the compose setup must be accessible from the Internet on port 80 or 443 for this. In order to achieve this, the according lines in the docker-compose.yml
have to be uncommented
Custom Certificates
If an own certificate is to be used, the variable DATABUS_PROXY_SERVER_USE_ACME
hast to be set to false
. The file name (not path!) of the own certificate is then set by DATABUS_PROXY_SERVER_OWN_CERT
, as well as its key file name by DATABUS_PROXY_SERVER_OWN_CERT_KEY
. By default certificates are retrieved from ./data/tls/
, which is relative to the folder of the docker-compose.yml
file.
The path to the certificate directory can be customized. For security reasons, it the certificate folder is mounted as read-only into the docker, so the Databus container cannot modify or delete your own certificates.
When using custom certificates the HTTP and HTTPS port bindings can be freely adjusted. The HTTP port is not mandatory, since it will return a permanent redirect to HTTPS.
External Proxy Example
You can use an existing web server as a reverse proxy in front of the Databus container (by default port 3000). The reverse proxy must support HTTPS and it is recommended that HTTP requests are automatically redirected to HTTPS. In case Apache is used, the HTTPS configuration might look similar like this:
Last updated