.. meta::
   :description: Learn how to use ThinLinc Web Access behind a reverse
                 proxy.

.. _reverse_proxy:

Reverse proxy
-------------

Running :ref:`ThinLinc Web Access <tlwebaccess>` behind a reverse proxy
is a way to integrate ThinLinc into existing infrastructure or meet
organizational requirements. This chapter explains the requirements
ThinLinc Web Access places on a reverse proxy to function correctly.

In a ThinLinc cluster, users start at the ThinLinc master server, but their
actual sessions run on individual agents to which ThinLinc Web Access
automatically redirects traffic. If a reverse proxy is used, it must be
configured to handle this routing and forward the connection to the correct
internal agent.

To support a proxy environment, specific ThinLinc parameters should
be updated. This involves enabling the :file:`X-Forwarded-For` header to
identify client IPs (see :ref:`forwarding_client_ip`) and updating
:servconf:`/webaccess/login_page` to match the public URL for the login
page.

Please note that this is a conceptual guide intended to illustrate the
routing logic. You must adapt the configuration to match your environment.

.. toctree::
   :hidden:

   reverse_proxy_tl_specifics
   reverse_proxy_basic_setup
   reverse_proxy_custom_path
   reverse_proxy_distributed
   forwarding_client_ip
