Domains, HTTPS and apps behind a proxy

Why ports are not published, how to give a service an HTTPS domain, and which proxy headers your app must trust.

Ports and domains

ports: are not published on the server. Services are reachable only through domains: open the project → Domains, choose the service and its internal port, and get an HTTPS address. Inside the project, services talk to each other by service name (http://backend:8080).

Applications behind a proxy

Requests reach your app through an HTTPS proxy. The app must trust the X-Forwarded-Proto and X-Forwarded-Host headers, otherwise redirects go to http:// and CORS checks fail with 403.

• Spring Boot: server.forward-headers-strategy: framework;
• Express: app.set('trust proxy', true);
• other frameworks: enable "trust proxy" / forwarded headers.