Skip to content
Documentation
Run a server
TLS and reverse proxy

TLS and reverse proxy

lasboltd speaks plain HTTP. Browsers and the apps need HTTPS. Put a reverse proxy with a TLS certificate in front of lasboltd. The proxy and lasboltd run on the same host. lasboltd listens on the loopback address only.

    sequenceDiagram
  participant B as Browser
  participant P as Proxy (TLS)
  participant D as lasboltd 127.0.0.1:8080
  B->>P: HTTPS request
  P->>D: HTTP request + X-Forwarded-For: client address
  D->>D: Trusted proxy? Read the client address
  D-->>P: Response
  P-->>B: HTTPS response

Tell lasboltd which proxy to trust

The server records the client address in the audit log and uses it for the rate limits of logins. Behind a proxy, it must read the address from the X-Forwarded-For header. A client can write any value in that header. So lasboltd reads the header only when the request comes from a range that you name.

lasboltd --addr 127.0.0.1:8080 --trusted-proxy 127.0.0.1/32
FlagVariableMeaning
--trusted-proxy CIDRLASBOLT_TRUSTED_PROXYA CIDR range of a trusted proxy. Repeat the flag, or separate values with commas.
--addrLASBOLT_ADDRThe listen address. Use 127.0.0.1:8080.
--public-urlLASBOLT_PUBLIC_URLThe public origin, for example https://vault.example.org. lasboltctl uses it in invitation links.
Without --trusted-proxy, the audit log and the rate limits see the address of the proxy for every request. All users then share one limit. Do not trust a range that other hosts can use to reach lasboltd.

The server takes the rightmost address in X-Forwarded-For that is not a trusted proxy. If the request does not come from a trusted range, the server ignores the header. Set the header from the real peer address in your proxy, as the examples below do.

Caddy

Caddy gets and renews the certificate by itself. This is a Caddyfile:

vault.example.org {
	reverse_proxy 127.0.0.1:8080
}

Caddy sets X-Forwarded-For and streams the event connections without extra settings.

nginx

Put this in a server block with listen 443 ssl and your certificate settings:

client_max_body_size 20m;

proxy_http_version 1.1;
proxy_set_header Connection "";
proxy_set_header Host $host;
proxy_set_header X-Forwarded-For $remote_addr;
proxy_set_header X-Forwarded-Proto https;

location / {
	proxy_pass http://127.0.0.1:8080;
}

# The event streams (live sync) stay open for a long time.
location ~ ^/(api/v1/)?events$ {
	proxy_pass http://127.0.0.1:8080;
	proxy_buffering off;
	proxy_cache off;
	proxy_read_timeout 1h;
}
  • Use $remote_addr, not $proxy_add_x_forwarded_for. A client then cannot add addresses of its own.
  • The event streams need proxy_buffering off and a long proxy_read_timeout. The server also sends the header X-Accel-Buffering: no. The server sends a heartbeat each 25 seconds.
  • client_max_body_size must be bigger than the largest request. The web import accepts up to 8 MiB.

What the server sets

The server sets these headers on its pages: Strict-Transport-Security, Content-Security-Policy, X-Frame-Options: DENY, X-Content-Type-Options: nosniff and Referrer-Policy: no-referrer. Do not remove them in the proxy.

Check it

  1. Open https://vault.example.org in a browser. The login page must load with a valid certificate.
  2. Run lasbolt login https://vault.example.org on a computer.

The UDP port of peer sync

lasboltd also opens a UDP port for peer sync. The default is 7849 on all addresses (--peer-udp). The proxy does not carry this port. A device uses it to learn its public address. Open the port in the firewall for peer sync to work, or turn it off with --peer-udp off. To turn peer sync off for the whole server, use --peer-sync off.

Last updated on
InstallConfiguration