TLS termination & reverse proxy
Eddytor speaks plaintext internally - terminate TLS at the edge.
Eddytor's binaries speak plaintext everywhere - the server↔engine hop is h2c (HTTP/2 cleartext), and the HTTP/gRPC listeners are unencrypted. TLS is terminated at the edge. Trust the local network; encrypt at the boundary. There is no internal self-signed cert mesh to manage.
Production setup
Put a TLS-terminating reverse proxy / load balancer in front of the server's
plaintext :8080:
- Reverse proxies: Nginx, Envoy, Traefik, Caddy.
- Cloud LBs / ingress: ALB (EKS), GKE Ingress + managed cert, AKS app-routing / ingress-nginx + cert-manager.
- Service mesh (Kubernetes): Istio mTLS for the server↔engine hop.
Then set server.public_url to the HTTPS hostname the edge serves:
[server]
public_url = "https://app.example.com"Heads up
public_url drives cookies, OAuth redirects, and JWKS, so
it must match the address users actually hit. A mismatch breaks sign-in. On a
raw cloud LoadBalancer the IP isn't known until provisioned - install with a
placeholder, then reconcile (--reuse-values --set config.publicUrl=…); see the
Kubernetes install.Multi-host / separate engine
The server reaches the engine via engine.host:
localhostfor co-located dev,- the service name (
eddytor-engine) for Compose, - DNS discovery in the Kubernetes edition.
All plaintext - secure the server↔engine hop with your network (mesh mTLS, private subnet, WireGuard) rather than in-process TLS.
The Web UI
The UI container also serves plaintext (:3000) and is a second public origin -
terminate TLS for it at your edge exactly like the API. See
Web UI.