Deployment

HTTPS reverse proxy

Configure Portivo to recognize HTTPS terminated by a trusted proxy.

v2.0.0Source-backed

Application setting

PUBLIC_URL_SCHEME=https

With this setting Portivo marks session cookies Secure and emits HSTS. The Portivo listener itself remains HTTP. The reverse proxy is responsible for the certificate and TLS session shown to users.

Forwarded client addresses

Portivo does not trust X-Forwarded-For by default. If login throttling must use the original client address behind the proxy, enable proxy headers only for explicitly trusted direct proxy addresses.

TRUST_PROXY_HEADERS=true
TRUSTED_PROXY_IPS=127.0.0.1,::1

Do not enable proxy-header trust when untrusted clients can connect directly to the Portivo listener. Otherwise forwarded source headers can be spoofed.

WebSockets

Your reverse proxy must forward WebSocket upgrade requests for /ws/devices/<device_id>/terminal. 2.0.0 validates the WebSocket Origin before accepting the terminal connection.

← Network & security Architecture →