Reverse Proxy

On the node target a reverse proxy sits in front of your long-running apps, routes each request to the right port by host and path, terminates TLS, and forwards the client IP so the backend rate-limits correctly.

Ports

Routing rules

Stripping the /docs prefix

The docs app serves its pages at root - the public prefix comes from the proxy, not the app - so a proxy that forwards /docs intact 404s every page.

Keep config.docs.url (default /docs) pointed at the public docs URL so generated links resolve. Skip this entirely when config.docs.enabled is false - the docs app is not deployed.

TLS and client IP

• Terminate TLS at the proxy; the apps speak plain HTTP behind it.
• Forward X-Forwarded-For - the backend rate-limits by the client IP and stamps it on audit entries, and without it every request carries the proxy's own address.
• Leave TRUSTED_PROXY unset when the proxy reaches the app over loopback or a private network: the backend reads that as proof of one forwarded hop. Set TRUSTED_PROXY=1 when the proxy reaches it over a public address, and cf-connecting-ip when a CDN fronts the proxy. See Client IP.

Idle connections

Your proxy pools connections to the apps and reuses them. If an app closes one first, the next request the proxy sends over it is reset, and the visitor gets a 502 that appears in no app log - nothing arrived to be logged.

The shipped defaults clear the common proxies. Raise them if yours holds idle connections longer.

Example: Nginx

Routing all three apps and stripping the docs prefix:

server {
  listen 443 ssl;
  server_name yourdomain.com;

  # TLS termination
  ssl_certificate     /etc/ssl/certs/yourdomain.crt;
  ssl_certificate_key /etc/ssl/private/yourdomain.key;

  # Frontend (root)
  location / {
    proxy_pass http://127.0.0.1:3000;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
  }

  # Docs - trailing slashes strip the /docs prefix
  location /docs/ {
    proxy_pass http://127.0.0.1:3040/;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }

  # Backend (separate only) - no trailing slash keeps the /api prefix,
  # so set API_URL to https://yourdomain.com/api
  location /api/ {
    proxy_pass http://127.0.0.1:3010;
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
  }
}