.. title:: Reverse Proxy

Reverse Proxy
=============


Overview
--------
Administrators may desire to run Kasm Server behind a reverse proxy such as `Nginx <https://nginx.org/>`_ or
`Caddy <https://caddyserver.com/docs/proxy>`_ . A handful of configurations are required for communication to properly
flow between the proxy and Kasm.

.. figure:: /images/reverse_proxy/reverse_proxy.png
  :width: 90%
  :align: center

  **Kasm Server Behind a Reverse Proxy**



Running Kasm Server on a Non-Standard Port
------------------------------------------

By default, Kasm Server will listen on port 443. Administrators may wish to run the application on another port so that
the revere proxy can run on port 443.

During the installation pass the **-L** flag to choose a different port.
e.g ``sudo bash kasm_release/install.sh -L 8443``


Users will now access Kasm Server via the defined port **https://kasm.server:8443**


Example Nginx Config
--------------------

Below is an example Nginx config with the appropriate settings for Kasm annotated. In this example, Nginx is listening
on port **443** and Kasm Server is listening on port **8443**


.. code-block:: Bash

    server {
        listen 443 ssl;
        ssl_certificate /etc/nginx/ssl/nginx.crt;
        ssl_certificate_key /etc/nginx/ssl/nginx.key;

        location / {
            # The following configurations must be configured when proxying to Kasm Server

            # WebSocket Support
            proxy_set_header        Upgrade $http_upgrade;
            proxy_set_header        Connection "upgrade";

            # Host and X headers
            proxy_set_header        Host $host;
            proxy_set_header        X-Real-IP $remote_addr;
            proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header        X-Forwarded-Proto $scheme;

            # Connectivity Options
            proxy_http_version      1.1;
            proxy_read_timeout      1800s;
            proxy_send_timeout      1800s;
            proxy_connect_timeout   1800s;
            proxy_buffering         off;

            # Allow large requests to support file uploads to Kasms
            client_max_body_size 10M;

            # Proxy to Kasm Server running locally on 8443 using ssl
            proxy_pass https://127.0.0.1:8443 ;
        }
    }



Example Caddy Config
--------------------
Below is an example Caddyfile with the appropriate settings for Kasm annotated. In this example Caddy is listening
on port **443** and Kasm Server is listening on port **8443**

.. code-block:: Bash

    192.168.117.130:443
    tls self_signed
    log stdout

    # Proxy to Kasm running locally on port 8443
    proxy / https://localhost:8443 {

            # By default Kasm Server installs with self-signed certificates. If these are not replaced
            # then Caddy must be instructed to skip verification of these certs.
            insecure_skip_verify

            # WebSocket Support
            header_upstream Connection {>Connection}
            header_upstream Upgrade {>Upgrade}


            # Host and X headers
            header_upstream Host {host}
            header_upstream X-Real-IP {remote}
            header_upstream X-Forwarded-For {remote}
            header_upstream X-Forwarded-Port {server_port}
            header_upstream X-Forwarded-Proto {scheme}
    }


Updating Kasm Settings
----------------------
In order for the system to properly make connections to the Kasms when they are provisioned, the ``proxy_port`` Setting
needs to be updated with the port the **Reverse Proxy** is listening on. For example, if the reverse proxy is listening
on **443** this setting must reflect that.


* Log into the Kasm Server UI as an administrator

  * Select Settings.
  * Update the **proxy_port** setting.

* Log into the Kasm Server Host

  * Restart the Kasm Services

    .. code-block:: Bash

      sudo /opt/kasm/bin/stop
      sudo /opt/kasm/bin/start