.. meta::
   :description: Guide for setting up a simple reverse proxy for
                 ThinLinc Web Access. Includes instructions for both
                 single server setups and cluster setups.

.. _reverse_proxy_basic_setup:

Basic proxy setup
~~~~~~~~~~~~~~~~~

This section describes the process of setting up a simple reverse proxy
for Web Access. The requirements are slightly different for single
server setups and cluster setups.

.. _reverse_proxy_single_agent:

Single agent
^^^^^^^^^^^^

Below is an example Nginx configuration for a setup with a single
ThinLinc server running both the master and agent services. All requests
to the root :file:`/` are forwarded to the ThinLinc backend.

Pay special attention to the path handler :file:`/connect/tl.internal.example.com/`.

.. code:: nginx

   server {
       listen 443 ssl;
       server_name tl.example.com;

       # ... (SSL configuration) ...

       proxy_read_timeout 999h;

       location / {
           proxy_pass https://tl.internal.example.com:300/;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $http_connection;
       }

       location /connect/tl.internal.example.com/ {
           proxy_pass https://tl.internal.example.com:300/;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $http_connection;
       }
   }

ThinLinc Web Access relies on WebSocket connections to establish and
maintain user sessions. Therefore, your proxy must set the Upgrade and
Connection headers again. If this is not configured correctly, users
will be able to load the login page but unable to start a session.

Once the session is established, the proxy should allow the connection
to remain open for long periods, even when the user is idle. Default
proxy read timeouts are typically short and might abruptly disconnect
inactive users. To avoid this, it is recommended to increase the proxy's
read timeout.

.. note::

   Do not use the proxy timeout to enforce idle limits. If you wish to
   disconnect users after a specific period of inactivity, this should
   be configured within ThinLinc using the :option:`-MaxIdleTime`
   parameter. For more information, see
   :ref:`configuration_limiting_lifetime`.

.. _reverse_proxy_multiple_agents:

Multiple agents
^^^^^^^^^^^^^^^

In a ThinLinc cluster with more than one agent, follow the instructions
in :ref:`reverse_proxy_single_agent`, but replicate the agent-specific
path handler for every additional agent, as in the example below.

.. code:: nginx

    location /connect/agent1.internal.example.com/ {
        proxy_pass https://agent1.internal.example.com:300/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }
