Skip to main content

Put Erde behind a reverse proxy for HTTPS

When you host Erde as a Windows Service, Kestrel serves the app over plain HTTP, so you put a reverse proxy (such as IIS with Application Request Routing (ARR), Caddy, or nginx) in front of it to terminate TLS. For that to work correctly, Erde needs two settings so it trusts the proxy and generates correct links. (Under the IIS hosting shape, IIS terminates TLS and forwards in-process, so this page does not apply.)

Before you start
  • Role required: server administrator access to the Erde host and the proxy.
  • Prerequisites: Erde is installed and running as a Windows Service. You have a TLS certificate on the proxy.

Why two settings matter​

Both values are collected by the first-run setup wizard and stored in appsettings.Production.json:

SettingWhat it doesIf it is wrong
Application:PublicBaseUrlThe public HTTPS address users reach Erde at. Erde uses it for host filtering and for links in emails (password reset, account setup).Host filtering rejects requests, and password-reset and setup links point to the wrong address.
Application:ReverseProxy:ProxyIPsThe IP addresses Erde trusts as proxies. Erde honors the X-Forwarded-For and X-Forwarded-Proto headers only from these addresses.Erde ignores the forwarded scheme, treats requests as plain HTTP, and redirects and generated URLs break.

Steps​

  1. Configure your reverse proxy to terminate TLS and forward to the Kestrel HTTP port (the HTTP Port chosen at install, default 5000), passing the X-Forwarded-For and X-Forwarded-Proto headers.
  2. Set Application:PublicBaseUrl to the public HTTPS URL — for example https://erde.example.com.
  3. Set Application:ReverseProxy:ProxyIPs to the proxy's address(es). In the setup wizard, the proxy-IP field appears only when you choose the Behind IIS (out-of-process) or another reverse proxy deployment mode, where at least one trusted proxy IP is required — meaning a separate IIS or proxy sits in front of the Windows Service shape, distinct from the in-process IIS hosting shape where IIS hosts the app itself. The wizard drops any proxy IPs for the other modes. Alternatively, edit appsettings.Production.json and restart the service.
  4. Restart the Erde service and confirm you can sign in over HTTPS and that a password-reset email link uses the public URL.