VTunedocs

Operations

Reverse proxy and TLS#

Publish VTune through HTTPS while keeping the container and health endpoint on loopback. The release includes generic Nginx templates under deploy/nginx/.

Required behavior#

  • Redirect HTTP to the canonical HTTPS origin.
  • Proxy the dashboard and API to the loopback-bound application port.
  • Allow uploads up to the configured maximum plus protocol overhead.
  • Disable request buffering for upload routes.
  • Disable response buffering and use a long read timeout for /api/events server-sent events.
  • Never expose /healthz, /data, SQLite files, or stored media.
  • Reject iframe embedding and set a self-only Content Security Policy.

Deploy a rendered template#

After the container is healthy on loopback, an operator with Nginx, Certbot, and sudo can run:

VTUNE_APP_DOMAIN=music.example.com \
VTUNE_UPSTREAM_PORT=3000 \
./scripts/deploy-app-domain.sh

The script validates the hostname and port before rendering. Keep the real domain, checkout path, host credentials, and DNS access outside the repository.

Verify outside-in#

Check the final domain from another network, test OAuth callback completion, upload a small file, watch live queue updates, and inspect security headers. A loopback health response alone does not prove the public route works.