Reverse Proxy¶

Overview¶

Administrators may desire to run Kasm Server behind a reverse proxy such as Nginx or Caddy . A handful of configurations are required for communication to properly flow between the proxy and Kasm.

Kasm Server Behind a Reverse Proxy¶

Running Kasm Server on a Non-Standard Port¶

By default, Kasm Server will listen on port 443. Administrators may wish to run the application on another port so that the revere proxy can run on port 443.

During the installation pass the -L flag to choose a different port. e.g sudo bash kasm_release/install.sh -L 8443

Users will now access Kasm Server via the defined port https://kasm.server:8443

Example Nginx Config¶

Below is an example Nginx config with the appropriate settings for Kasm annotated. In this example, Nginx is listening on port 443 and Kasm Server is listening on port 8443

server {
    listen 443 ssl;
    ssl_certificate /etc/nginx/ssl/nginx.crt;
    ssl_certificate_key /etc/nginx/ssl/nginx.key;

    location / {
        # The following configurations must be configured when proxying to Kasm Server

        # WebSocket Support
        proxy_set_header        Upgrade $http_upgrade;
        proxy_set_header        Connection "upgrade";

        # Host and X headers
        proxy_set_header        Host $host;
        proxy_set_header        X-Real-IP $remote_addr;
        proxy_set_header        X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header        X-Forwarded-Proto $scheme;

        # Connectivity Options
        proxy_http_version      1.1;
        proxy_read_timeout      1800s;
        proxy_send_timeout      1800s;
        proxy_connect_timeout   1800s;
        proxy_buffering         off;

        # Allow large requests to support file uploads to Kasms
        client_max_body_size 10M;

        # Proxy to Kasm Server running locally on 8443 using ssl
        proxy_pass https://127.0.0.1:8443 ;
    }
}

Example Caddy Config¶

Below is an example Caddyfile with the appropriate settings for Kasm annotated. In this example Caddy is listening on port 443 and Kasm Server is listening on port 8443

192.168.117.130:443
tls self_signed
log stdout

# Proxy to Kasm running locally on port 8443
proxy / https://localhost:8443 {

        # By default Kasm Server installs with self-signed certificates. If these are not replaced
        # then Caddy must be instructed to skip verification of these certs.
        insecure_skip_verify

        # WebSocket Support
        header_upstream Connection {>Connection}
        header_upstream Upgrade {>Upgrade}


        # Host and X headers
        header_upstream Host {host}
        header_upstream X-Real-IP {remote}
        header_upstream X-Forwarded-For {remote}
        header_upstream X-Forwarded-Port {server_port}
        header_upstream X-Forwarded-Proto {scheme}
}

Updating Kasm Settings¶

In order for the system to properly make connections to the Kasms when they are provisioned, the proxy_port Setting needs to be updated with the port the Reverse Proxy is listening on. For example, if the reverse proxy is listening on 443 this setting must reflect that.

Log into the Kasm Server UI as an administrator
- Select Settings.
- Update the proxy_port setting.
Log into the Kasm Server Host
- Restart the Kasm Services
```
sudo /opt/kasm/bin/stop
sudo /opt/kasm/bin/start
```