Organization — Reverse Proxy

The Organization must sit behind a TLS-aware reverse proxy that routes two distinct kinds of traffic differently:

• Application traffic for the szID hostname, passed through untouched.
• Web traffic for the Organization's web FQDN, terminated and routed by path.

Info

For the reference installation, this is configured automatically by nginx-setup.sh (see Installation — step 6). Use this page if you're bringing your own reverse proxy, or configuring nginx by hand. Configuration Examples shows a complete nginx config that satisfies these requirements.

Components

graph LR
  nginx(("nginx:443"))

  subgraph containers
    main["main:38443"]
    web["web:8082"]
    bff["bff:8081"]
    api["api:8080"]
    scim["scim:8083"]

    bff --> main
    api --> main
    scim --> api
  end

  style containers fill:none,stroke:#999

  nginx -->|"szex4mpl318d4f4c9ba2e37f5c1b9d3e6a.world.example.com"| main
  nginx -->|"/"| web
  nginx -->|"/api"| api
  nginx -->|"/scim"| scim
  nginx -->|"/bff/api"| bff

Listeners

Port	Protocol	Required	Purpose
80	HTTP	Always	Redirects to 443; otherwise unused
443	TLS	Always	Entry point for all Organization traffic

Example

server {
    listen 80;
    return 301 https://$host$request_uri;
}

stream {
    server {
        listen 443;
    }
}

Routing by SNI

Inspect the TLS SNI hostname on port 443 and route to one of two destinations. Do not terminate TLS for the szID destination — pass the connection through unmodified.

SNI hostname	Destination	TLS Handling
SynkzoneWebAddress	The web-facing endpoint	Terminated
The szID hostname	The main component's TLSPort	Pass-through

Example

stream {
    map $ssl_preread_server_name $backend {
        default                                              "";
        synkzone.example.com                                 https_web;
        szex4mpl318d4f4c9ba2e37f5c1b9d3e6a.world.example.com sz_service;
    }

    upstream https_web  { server 127.0.0.1:8443; }
    upstream sz_service { server 127.0.0.1:38443; }

    server {
        listen 443;
        ssl_preread on;
        proxy_pass $backend;
    }
}

Routing by Path

For requests to the web-facing hostname, after TLS termination, route by URL path to each deployed component.

Path prefix	Destination	Required
/	web:8082	If Web is deployed
/api/	api:8080	If API is deployed
/scim/	scim:8083	If SCIM is deployed
/bff/api/	web:8081/api/	If Web is deployed

Example

server {
    listen 8443 ssl;
    server_name synkzone.example.com;

    location /         { proxy_pass http://127.0.0.1:8082; }
    location /api/     { proxy_pass http://127.0.0.1:8080; }
    location /scim/    { proxy_pass http://127.0.0.1:8083; }
    location /bff/api/ { proxy_pass http://127.0.0.1:8081/api/; }
}

Required Headers

For the terminated (path-routed) branch, set:

Header	Value
Host	The original request's Host header
X-Forwarded-Proto	https
X-Forwarded-For	The client IP, appended to any existing value
X-Real-IP	The client IP

Example

server {
    listen 8443 ssl;
    server_name synkzone.example.com;

    location / {
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Required Parameters

For the terminated (path-routed) branch, set:

Parameter	Value
Maximum request body size	Large enough for the largest expected upload

Example

server {
    listen 8443 ssl;
    server_name synkzone.example.com;

    client_max_body_size 1000M;
}

Note

Set to accommodate the largest file your users need to upload; some reverse proxies default to a low limit (for example, nginx's default is 1 MB) that is too small for typical file-sharing use.