Integrations
Reverse Proxies
Publish Kaya through HTTPS with correct host, protocol and client-IP handling.
Kaya can operate behind a conventional reverse proxy that preserves Host and supplies forwarding headers. The implementation is not tied to a particular proxy product.
Forward HTTP and WebSocket traffic for the main interface to port 8080. Publish Secure Send port 8999 separately if used. Preserve WebSocket upgrade headers for Remote Manager. Set the public Base URL, configure Allowed Hosts, and set FORWARDED_ALLOW_IPS to only the immediate proxy IP/CIDR.
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
Use HTTPS, adequate upload/time-out limits and WebSocket support. Enable HSTS only after every required route is reliably HTTPS.
To remove the proxy, first disable HSTS where appropriate, ensure a direct Allowed Host and port are available, change Base URL and trusted-proxy environment, recreate Kaya, then remove routing.
Related: Trusted Proxies, Reverse Proxy Problems.