Docs Self-hosting Reverse proxy & TLS

Reverse proxy & TLS

The daemon serves plain HTTP on localhost. One line of Caddy, or a small nginx block, puts a certificate in front of it.

Caddy

/etc/caddy/Caddyfile:

alerts.example.com {
    reverse_proxy 127.0.0.1:8391
}

Caddy issues and renews the certificate itself. Nothing else is needed.

nginx

server {
    listen 443 ssl http2;
    server_name alerts.example.com;
    ssl_certificate     /etc/letsencrypt/live/alerts.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/alerts.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8391;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
        proxy_read_timeout 60s;
    }
}

Long-poll needs a patient proxyGET /v1/pull?wait=25 holds the connection open for up to 25 seconds. A proxy read timeout under 30 seconds turns every quiet poll into a 504. Caddy’s default is fine; nginx’s default of 60 seconds is fine; a stricter default in front of either is not.

Behind Cloudflare

Works as-is. Set SSL mode to Full (strict) and give the origin a Cloudflare origin certificate, which is how api.pingtower.com itself runs. Keep the proxy’s real-IP handling on if you rate-limit by address.

Check it

curl -s https://alerts.example.com/healthz
# {"version":"…","tenants":1}