Web Hosting HTTPS

Web Hosting and HTTPS

Direct HTTP

For a private LAN or testing setup, the default listener is:

http://SERVER:8899/api

A standalone page, when enabled, is:

http://SERVER:8899/chat

HTTPS is recommended for public servers

Password login, cookies, uploads, and browser push features should be exposed through HTTPS. A typical production layout is:

Browser
  -> HTTPS reverse proxy (Caddy/Nginx)
      -> BlueMap internal HTTP
      -> BlueMapWebChat 127.0.0.1:8899

Use:

http:
  host: "127.0.0.1"
  port: 8899
  path-prefix: "/api"
  cors-origin: "https://map.example.com"

web-addon:
  api-base-url: "/bmwc/api"

Public URL rules

In reverse-proxy mode, web-addon.api-base-url should be the public API path or URL seen by browsers, not the internal 127.0.0.1:8899 address.

standalone-web.api-base-url, upload.public-base-url, and emoji.public-base-url can normally stay empty so they follow the configured public API base automatically.

CORS

When authenticated browser requests use cookies through HTTPS, prefer the exact public origin instead of *:

http:
  cors-origin: "https://map.example.com"

Real client IPs behind a proxy

Only trust forwarding headers from known proxies:

http:
  trusted-proxies:
    - "127.0.0.1"

Do not trust arbitrary Internet sources for X-Forwarded-For.

WebSocket requirement

BlueMapWebChat does not require a permanent WebSocket relay. Public chat updates use its normal web transport, and server-to-server relay uses signed HTTP requests. Proxy the full configured API path, including POST endpoints.

See Caddy Example and Nginx Example.