Langkau ke kandungan dokumentasi
Aqiled LogoDokumentasi

Terjemahan Sedang Dijalankan

Dokumen ini disediakan dalam bahasa Inggeris buat sementara waktu sementara terjemahan Bahasa Melayu disiapkan.

Reverse Proxy, SSL & WebSockets

Aqiled relies on a reverse proxy (such as Nginx or Caddy) to terminate HTTPS, serve compiled front-end static assets, forward /api requests, and maintain persistent WebSocket connections for real-time notifications (/hubs/notifications).

Tersedia sekarang. Semakan terakhir: 26 October 2026.

Install Nginx and Certbot:

sudo apt-get install -y nginx certbot python3-certbot-nginx

Obtain an SSL certificate:

sudo certbot --nginx -d school.example.com

Create /etc/nginx/sites-available/aqiled:

server {
    listen 80;
    server_name school.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name school.example.com;

    # SSL Certificates
    ssl_certificate /etc/letsencrypt/live/school.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/school.example.com/privkey.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    # Static Front-End (Compiled dedicated build)
    root /opt/school/web/current;
    index index.html;

    # Upload file size limit (documents and student photos)
    client_max_body_size 25M;

    # Security Headers
    add_header X-Content-Type-Options "nosniff" always;
    add_header X-Frame-Options "DENY" always;
    add_header Referrer-Policy "strict-origin-when-cross-origin" always;

    # Front-end client-side routing
    location / {
        try_files $uri $uri/ /index.html;
    }

    # API Proxy
    location /api/ {
        proxy_pass http://127.0.0.1:5216;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 60s;
    }

    # SignalR WebSocket Hubs
    location /hubs/ {
        proxy_pass http://127.0.0.1:5216;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_cache_bypass $http_upgrade;
        proxy_read_timeout 300s;
        proxy_send_timeout 300s;
    }

    # Health Check endpoint
    location /health/ {
        proxy_pass http://127.0.0.1:5216;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
    }
}

Enable the site and test Nginx:

sudo ln -s /etc/nginx/sites-available/aqiled /etc/nginx/sites-enabled/
sudo nginx -t
sudo systemctl reload nginx

Option B: Caddy Configuration (Ideal for Small Schools & LANs)

Caddy automatically obtains and renews Let's Encrypt certificates, or provisions internal self-signed TLS certificates for local school LAN networks (.local or .lan domains).

Create /etc/caddy/Caddyfile:

school.example.com {
    root * /opt/school/web/current
    file_server

    # Forward API requests
    handle /api/* {
        reverse_proxy 127.0.0.1:5216
    }

    # Forward SignalR WebSockets (Caddy upgrades automatically)
    handle /hubs/* {
        reverse_proxy 127.0.0.1:5216
    }

    # Health check
    handle /health/* {
        reverse_proxy 127.0.0.1:5216
    }

    # Fallback to Single Page App index.html
    handle {
        try_files {path} {path}/ /index.html
    }
}

Reload Caddy:

sudo systemctl reload caddy

Cloudflare Proxy Considerations

If routing through Cloudflare:

  1. Navigate to Network settings in your Cloudflare dashboard and ensure WebSockets is toggled ON.
  2. Set SSL/TLS encryption mode to Full (strict).
  3. If using Cloudflare Turnstile bot protection for authentication, configure your domain's Turnstile site key and secret key in /etc/school/api.env.
← Gambaran Keseluruhan Pengehosan Sendiri & Pelancaran