Quick Start
Guides
Rocket.Chat SaaS
Resources
Configuring SSL Reverse Proxy
Rocket.Chat is a middle tier application server, by itself it does not handle SSL. However, Rocket.Chat works well with several industrial grade, battle-tested reverse proxy servers (see nginx below, for example) that you can configure to handle SSL.
Note: You must use the outside https address for the value at
ROOT_URL in [[Section 3|Deploy-Rocket.Chat-without-docker#3-download-rocketchat]] above. This includes the https:// and leave off the port number. So instead of ROOT_URL=http://localhost:3000 use something like https://your_hostname.comNote: When setting up a reverse proxy in front of your Rocket.Chat server you need to configure Rocket.Chat to use the correct clientAddress. The rate limiter (and maybe other features) will not work properly if this is not done. Set
HTTP_FORWARDED_COUNT Environment variable to the correct number of proxies in front of Rocket.Chat. If you are using snap there's a documentation how to do it here​Running behind a nginx SSL Reverse Proxy
Note: These instructions were written for Ubuntu. For Amazon Linux, the conf file for the proxy goes in
/etc/nginx/conf.d/ and needs to have a discrete name ending in .conf and nginx is installed using yum -y install nginx.Run this as root:
1
apt-get install nginx
Copied!
Add your private key to
/etc/nginx/certificate.keyLock down permissions:
chmod 400 /etc/nginx/certificate.keyAdd your certificate to
/etc/nginx/certificate.crtEdit
/etc/nginx/sites-enabled/default or if you use nginx from docker /etc/nginx/conf.d/default.conf and be sure to use your actual hostname in lieu of the sample hostname "your_hostname.com" below.1
# Upstreams
2
upstream backend {
3
server 127.0.0.1:3000;
4
}
5
​
6
# HTTPS Server
7
server {
8
listen 443;
9
server_name your_hostname.com;
10
​
11
# You can increase the limit if your need to.
12
client_max_body_size 200M;
13
​
14
error_log /var/log/nginx/rocketchat.access.log;
15
​
16
ssl on;
17
ssl_certificate /etc/nginx/certificate.crt;
18
ssl_certificate_key /etc/nginx/certificate.key;
19
ssl_protocols TLSv1 TLSv1.1 TLSv1.2; # don’t use SSLv3 ref: POODLE
20
​
21
location / {
22
proxy_pass http://backend;
23
proxy_http_version 1.1;
24
proxy_set_header Upgrade $http_upgrade;
25
proxy_set_header Connection "upgrade";
26
proxy_set_header Host $http_host;
27
​
28
proxy_set_header X-Real-IP $remote_addr;
29
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
30
proxy_set_header X-Forwarded-Proto https;
31
proxy_set_header X-Nginx-Proxy true;
32
​
33
proxy_redirect off;
34
}
35
}
Copied!
Restart Nginx:
service nginx restartRunning under Plesk Onyx behind Nginx
Plesk Onyx has now a docker installation and Nginx proxy docker rule generator built in, that doesn't support adding custom directives. Disable it and add the rules manually in the additional Nginx directives space. A scheme follows (replace 30000 with your external docker mapped port).
1
#manual extension docker with socket upgrade begin
2
location ~ ^/.* {
3
proxy_pass http://0.0.0.0:3000;
4
proxy_set_header Host $host;
5
proxy_set_header X-Real-IP $remote_addr;
6
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
7
​
8
proxy_set_header Upgrade $http_upgrade;
9
proxy_set_header Connection "upgrade";
10
proxy_set_header X-Forwarded-Proto http;
11
proxy_set_header X-Nginx-Proxy true;
12
proxy_http_version 1.1;
13
​
14
proxy_redirect off;
15
}
16
​
17
#extension docker end
Copied!
Running behind an Apache SSL Reverse Proxy
Note: You must use the outside https address for the value at
ROOT_URL in [[Section 3|Deploy-Rocket.Chat-without-docker#3-download-rocketchat]] above. This includes the https:// and leave off the port number. So instead of ROOT_URL=http://localhost:3000 use something like https://your_hostname.comRun this as root:
1
apt-get update
2
apt-get install apache2
3
a2enmod proxy_http
4
a2enmod proxy
5
a2enmod ssl
6
a2enmod proxy_wstunnel
7
a2enmod rewrite
Copied!
Add your private key to
/etc/ssl/private/chat.domain.com.keyLock down permissions:
chmod 400 /etc/ssl/private/chat.domain.com.keyAdd your certificate to
/etc/ssl/certs/chat.domain.com.crtAdd your intermediate to
/etc/ssl/certs/intermediate.ca.pemEdit
/etc/apache2/sites-enabled/rocketchat.conf and be sure to use your actual hostname in lieu of the sample hostname "your_hostname.com" below.1
<VirtualHost *:443>
2
ServerAdmin [email protected]
3
ServerName chat.domain.com
4
​
5
LogLevel info
6
ErrorLog /var/log/chat.domain.com_error.log
7
TransferLog /var/log/chat.domain.com_access.log
8
​
9
SSLEngine On
10
SSLCertificateFile /etc/ssl/certs/chat.domain.com.crt
11
SSLCertificateKeyFile /etc/ssl/private/chat.domain.com.key
12
SSLCertificateChainFile /etc/ssl/certs/intermediate.ca.pem
13
​
14
<Location />
15
Require all granted
16
</Location>
17
​
18
RewriteEngine On
19
RewriteCond %{HTTP:CONNECTION} Upgrade [NC]
20
RewriteCond %{HTTP:Upgrade} =websocket [NC]
21
RewriteRule /(.*) ws://localhost:3000/$1 [P,L]
22
RewriteCond %{HTTP:Upgrade} !=websocket [NC]
23
RewriteRule /(.*) http://localhost:3000/$1 [P,L]
24
​
25
ProxyPassReverse / http://localhost:3000/
26
</VirtualHost>
Copied!
Restart Apache:
service apache2 restartRunning behind a Caddy Reverse Proxy with Free SSL
curl https://getcaddy.com | bashNow Caddy is installed, but you still need a service to run Caddy http server on the background.
You must have at least the port 443 opened so the Caddy server will request an SSL certificate from Let's Encrypt
You can also open the port 80 to redirect http requests to https.
Open
/etc/caddy/CaddyfileInsert
1
your_domain.com {
2
proxy / 127.0.0.1:3000 {
3
header_upstream X-Forwarded-Proto {scheme}
4
header_upstream X-Forwarded-For {host}
5
header_upstream Host {host}
6
websocket
7
}
8
}
Copied!
Multi Instance Nginx reverse proxy
Last modified 1mo ago