Reverse Proxy

For Linux installations, you can use NGINX as reverse proxy to provide HTTPS access and better security for Broadcast Suite.

NGINX Installation & Configuration

Install NGINX

Install NGINX with the following command:

sudo dnf install nginx -y

Configure NGINX

Edit the file /etc/nginx/nginx.conf and replace the whole file with the following configuration:

nginx.conf

user nginx;
worker_processes auto;
error_log /var/log/nginx/error.log;
pid /run/nginx.pid;
 
include /usr/share/nginx/modules/*.conf;
 
events {
    worker_connections 1024;
}
 
http {
    log_format  main  '$remote_addr - $remote_user [$time_local] "$request" '
                      '$status $body_bytes_sent "$http_referer" '
                      '"$http_user_agent" "$http_x_forwarded_for"';
 
    access_log  /var/log/nginx/access.log  main;
 
    sendfile            on;
    tcp_nopush          on;
    tcp_nodelay         on;
    keepalive_timeout   65;
    types_hash_max_size 2048;
 
    # .NET specific settings
    proxy_buffer_size           128k;
    proxy_buffers               4 256k;
    proxy_busy_buffers_size     256k;
    large_client_header_buffers 4 32k;
 
    include             /etc/nginx/mime.types;
    default_type        application/octet-stream;
 
    include /etc/nginx/conf.d/*.conf;
}

note

This configuration includes .NET-specific settings for proxy buffers to handle larger requests.

SSL Certificate

If you don't have an existing certificate, you can create a self-signed certificate:

sudo mkdir -p /etc/ssl/private
sudo openssl req -x509 -nodes -days 365 -newkey rsa:2048 \
  -keyout /etc/ssl/private/nginx-selfsigned.key \
  -out /etc/ssl/certs/nginx-selfsigned.crt

This will create a certificate which is valid for 365 days.

tip

For production environments, use a proper SSL certificate from a trusted Certificate Authority (CA) such as Let's Encrypt.

Broadcast Suite NGINX Configuration

Create a new configuration file for Broadcast Suite at /etc/nginx/conf.d/broadcastsuite.conf:

warning

Make sure to update the server_name directive if you want to use a specific domain name instead of the default configuration. Also verify that the SSL certificate paths match your certificate location.

broadcastsuite.conf

upstream grpc_core {
    server 127.0.0.1:8086;
}

upstream grpc_api {
    server 127.0.0.1:8092;
}

server {
    server_name broadcastsuite.internal;

    add_header Strict-Transport-Security max-age=31536000;

    proxy_http_version      1.1;
    proxy_read_timeout      1d;
    proxy_connect_timeout   4;
    proxy_send_timeout      1d;

    proxy_set_header Upgrade         $http_upgrade;
    proxy_set_header Connection      $http_connection;
    proxy_set_header Host            $http_host;
    proxy_set_header X-Real-IP       $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;

    location /RemoteCoreService {
        grpc_pass grpc://grpc_core;
    }
    
    location /AgentService {
        grpc_pass grpc://grpc_core;
    }

    location /ApiService {
        grpc_pass grpc://grpc_api;
    }

    location / {
        proxy_pass http://127.0.0.1:5000;
    }

    location /swagger/v1/swagger.json {
        return 301 /swagger/swagger/v1/swagger.json;
    }

    location /swagger/ {
        rewrite /swagger/(.*) /$1 break;
        proxy_pass http://127.0.0.1:8091;
    }

    location /api/ {
        proxy_pass http://127.0.0.1:8091;
    }

    listen 443 ssl http2;
    ssl_certificate /etc/ssl/certs/nginx-selfsigned.crt;
    ssl_certificate_key /etc/ssl/private/nginx-selfsigned.key;
}

server {
    return 301 https://$host$request_uri;
}

Enable and Restart NGINX

Enable NGINX to start on boot and restart it to apply the changes:

sudo systemctl enable nginx --now
sudo systemctl restart nginx

Verify that NGINX is running correctly:

sudo systemctl status nginx

Firewall Configuration

Open the necessary firewall ports for HTTP and HTTPS:

sudo firewall-cmd --permanent --add-service=http
sudo firewall-cmd --permanent --add-service=https
sudo firewall-cmd --reload