HTTPS Reverse Proxy¶

Use an HTTPS reverse proxy when the C-Gate IoT Hub must be accessed through a customer-managed hostname and certificate. The proxy terminates TLS and forwards requests to the Hub on its internal HTTP port.

Required Settings¶

Set the Hub environment variable APP_EXTERNAL_URL to the public HTTPS URL, for example:

APP_EXTERNAL_URL=https://c-gate.my-company.com

The proxy should support WebSockets and forward the following headers:

X-Forwarded-For
X-Forwarded-Proto
X-Forwarded-Host
X-Forwarded-Port

Keep the Hub's internal port reachable only from the reverse proxy and other explicitly authorized systems. Do not expose the internal HTTP service directly to the public internet.

Nginx Example¶

server {
    listen 80;
    server_name c-gate.my-company.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name c-gate.my-company.com;

    ssl_certificate     /etc/nginx/certs/my-company.fullchain.pem;
    ssl_certificate_key /etc/nginx/certs/my-company.key.pem;

    client_max_body_size 0;

    location / {
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_set_header X-Forwarded-Port $server_port;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_pass http://localhost:8080;
    }
}

Use a certificate and private key managed according to the customer organization's certificate-management policy. For security considerations and the required headers, see Security Guidelines.