Reverse proxy / load balancing

Collaboration Server On-Premises can be served by a reverse proxy or a load balancer of your choice. It is required for securing communication to the server by the TLS protocol and for handling the environment at scale. Also, it is a good practice to use a reverse proxy to handle the traffic to the application server. Besides distributing load between the multiple instances of an application, it can be used to secure the connection with WAF or prevent DDOS attacks.

# Requirements

The WebSocket protocol handles most of the communication between users and Collaboration Server On-Premises. The chosen reverse proxy or load balancer must support the WebSocket protocol.

The X-Forwarded-Proto and Host headers need to be passed from the reverse proxy to the Collaboration Server On-Premises. These headers are required to handle the generation of uploaded image URLs and to ensure that the Management Panel works correctly.

# NGINX

# Basic configuration

server {
    listen 80;
    server_name your.domain.name;

    location / {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;

        proxy_pass http://127.0.0.1:8000;
    }
}

# Handling multiple instances

upstream ckeditor-cs {
    server ckeditor-cs-1.example.com:8000 weight=1;
    server ckeditor-cs-2.example.com:8000 weight=1;
    server ckeditor-cs-3.example.com:8000 weight=1;
}

server {
    listen 80;
    server_name your.domain.name;

    location / {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;

        proxy_pass http://ckeditor-cs;
    }
}

# Encrypting connection with TLS

server {
    server_name your.domain.name;

    listen 80;

    return 301 https://$host$request_uri;
}

server {
    server_name your.domain.name;

    listen 443;
    ssl on;
    ssl_certificate /etc/ssl/your_cert.crt;
    ssl_certificate_key /etc/ssl/your_cert_key.key;

    location / {
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "Upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_http_version 1.1;

        proxy_pass http://127.0.0.1:8000;
    }
}

# HAProxy

# Basic configuration

global
    daemon

defaults
    mode http
    timeout connect 5s
    timeout client 120s
    timeout server 120s

frontend http-in
    bind *:80
    http-request set-header X-Forwarded-Proto http

    default_backend servers

backend servers
    server server1 127.0.0.1:8000 check

# Handling multiple instances

global
    daemon

defaults
    mode http
    timeout connect 5s
    timeout client 120s
    timeout server 120s

frontend http-in
    bind *:80
    http-request set-header X-Forwarded-Proto http

    default_backend servers

backend servers
    option httpchk

    server server1 ckeditor-cs-1.example.com:8000 check
    server server2 ckeditor-cs-2.example.com:8000 check
    server server3 ckeditor-cs-3.example.com:8000 check

# Encrypting connection with TLS

global
    daemon
    tune.ssl.default-dh-param 2048

defaults
    mode http
    timeout connect 5s
    timeout client 120s
    timeout server 120s

frontend http-in
    bind *:80
    bind *:443 ssl crt /etc/ssl/your_certificate.pem
    http-request set-header X-Forwarded-Proto https if { ssl_fc }
    http-request set-header X-Forwarded-Proto http if !{ ssl_fc }
    redirect scheme https if !{ ssl_fc }

    default_backend servers

backend servers
    server server1 127.0.0.1:8000

# Caddy

Caddy handles automatic TLS certificates and certificates renewal. Also, it requires no additional configuration for WebSocket connections and passes all required headers automatically.

# One liner

$ caddy reverse-proxy --from your.domain.name --to 127.0.0.1:8000

# Basic configuration

your.domain.com {
    reverse_proxy 127.0.0.1:8000
}

# Handling multiple instances

your.domain.com {
    reverse_proxy ckeditor-cs-1.example.com:8000 ckeditor-cs-3.example.com:8000 ckeditor-cs-3.example.com:8000
}