Basic proxy setup

This section describes the process of setting up a simple reverse proxy for Web Access. The requirements are slightly different for single server setups and cluster setups.

Single agent

Below is an example Nginx configuration for a setup with a single ThinLinc server running both the master and agent services. All requests to the root / are forwarded to the ThinLinc backend.

Pay special attention to the path handler /connect/tl.internal.example.com/.

server {
    listen 443 ssl;
    server_name tl.example.com;

    # ... (SSL configuration) ...

    proxy_read_timeout 999h;

    location / {
        proxy_pass https://tl.internal.example.com:300/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }

    location /connect/tl.internal.example.com/ {
        proxy_pass https://tl.internal.example.com:300/;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
    }
}

ThinLinc Web Access relies on WebSocket connections to establish and maintain user sessions. Therefore, your proxy must set the Upgrade and Connection headers again. If this is not configured correctly, users will be able to load the login page but unable to start a session.

Once the session is established, the proxy should allow the connection to remain open for long periods, even when the user is idle. Default proxy read timeouts are typically short and might abruptly disconnect inactive users. To avoid this, it is recommended to increase the proxy’s read timeout.

Note

Do not use the proxy timeout to enforce idle limits. If you wish to disconnect users after a specific period of inactivity, this should be configured within ThinLinc using the -MaxIdleTime parameter. For more information, see Limiting lifetime of ThinLinc sessions.

Multiple agents

In a ThinLinc cluster with more than one agent, follow the instructions in Single agent, but replicate the agent-specific path handler for every additional agent, as in the example below.

location /connect/agent1.internal.example.com/ {
    proxy_pass https://agent1.internal.example.com:300/;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection $http_connection;
}