.. meta::
   :description: Information about setting up a reverse proxy for
                 ThinLinc Web Access in a distributed cluster.

.. _reverse_proxy_distributed:

Distributed agents
~~~~~~~~~~~~~~~~~~

In complex or geographically distributed environments, you may not want
to proxy all agent connections through a single entry point. A more
scalable approach is to use a main proxy for the login page, which then
redirects clients to their specific agent connections.

.. code:: nginx

   location ~ /connect/tl.sweden.example.com/(.*) {
       return 307 https://tl.sweden.example.com/$1;
   }

The redirection sends the client to a new hostname. This can be the
agent server directly, if it is exposed on the network. Alternatively,
it can be a dedicated proxy server configured to forward
the traffic to the internal agent as below.

.. code:: nginx

   server {
       listen 443 ssl;
       server_name tl.sweden.example.com;

       # ... (SSL configuration) ...

       location / {
           proxy_pass https://tl.internal.sweden.example.com:300/;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $http_connection;
       }
   }

The following configuration brings together all the concepts discussed
in this guide for a more advanced example.

.. code:: nginx

   server {
       listen 443 ssl;
       server_name tl.example.com;

       # ... (SSL configuration) ...

       proxy_read_timeout 999h;

       location /subpath/ {
           proxy_pass https://tl.internal.example.com:300/;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $http_connection;
       }

       location /subpath/connect/tl.internal.example.com/ {
           proxy_pass https://tl.internal.example.com:300/;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $http_connection;
       }

       location ~ /subpath/connect/tl.sweden.example.com/(.*) {
           return 307 https://tl.sweden.example.com/$1;
       }
   }

   server {
       listen 443 ssl;
       server_name tl.sweden.example.com;

       # ... (SSL configuration) ...

       location / {
           proxy_pass https://tl.internal.sweden.example.com:300/;
           proxy_set_header Upgrade $http_upgrade;
           proxy_set_header Connection $http_connection;
       }
   }