Configure HTTPS
Configure HTTPS for encrypted remote access and passkey sign-in. You need a domain pointing to the server, a certificate, and a reverse proxy such as Nginx.
- Prepare a stable hostname and trusted TLS certificate.
- Restrict the Panel management port to localhost or the trusted proxy; use local access or SSH forwarding during setup.
- Configure the proxy to redirect HTTP to HTTPS, forward client and protocol headers, and support WebSockets for nodes and terminals.
- Allow at least 50 MiB per proxy request for file chunks and multipart overhead, and set timeouts for the complete transfer. The system file limit applies to the complete upload or import.
- Check the settings below during setup or in System Settings.
- Verify login, terminals, and node connectivity before allowing public access.
| Setting | Requirement |
|---|---|
APP_DOMAIN | Final HTTPS address, including the scheme and any required port |
APP_CORS_ORIGINS, APP_CSP_RESOURCE_ORIGINS | Explicit trusted origins, including the final Panel origin |
AUTH_COOKIE_SECURE | Use auto with correctly forwarded HTTPS, or true; verify the browser receives Secure cookies |
SERVER_TRUST_PROXY | Enable only when the proxy controls forwarded headers and clients cannot bypass it |
If a node's connection address changes, update panel_url in its configuration file, restart Daemon, and check that it comes online. Containerized nodes use /data/config.yaml; see Daemon CLI for other installation paths.
Configure game server ports separately in the workspace.