TLS termination & reverse proxy

Eddytor's binaries speak plaintext everywhere - the server↔engine hop is h2c (HTTP/2 cleartext), and the HTTP/gRPC listeners are unencrypted. TLS is terminated at the edge. Trust the local network; encrypt at the boundary. There is no internal self-signed cert mesh to manage.

Production setup

Put a TLS-terminating reverse proxy / load balancer in front of the server's plaintext :8080:

• Reverse proxies: Nginx, Envoy, Traefik, Caddy.
• Cloud LBs / ingress: ALB (EKS), GKE Ingress + managed cert, AKS app-routing / ingress-nginx + cert-manager.
• Service mesh (Kubernetes): Istio mTLS for the server↔engine hop.

Then set server.public_url to the HTTPS hostname the edge serves:

[server]
public_url = "https://app.example.com"

public_url must match the address users actually hit - see Reach the server for why, and for the two-step update on a raw cloud LoadBalancer.

Multi-host / separate engine

The server reaches the engine via engine.host:

• localhost for co-located dev,
• the service name (eddytor-engine) for Compose,
• DNS discovery in the Kubernetes edition.

All plaintext - secure the server↔engine hop with your network (mesh mTLS, private subnet, WireGuard) rather than in-process TLS.

The Web UI

The UI container also serves plaintext (:3000) and is a second public origin - terminate TLS for it at your edge exactly like the API. See Web UI.