{"result":{"depiction_url":null,"edges":{"hasreference":{"objects":[{"created":"2026-10-07T11:13:45Z","object_id":{"id":3066,"is_a":["text","documentation","adminguide"],"name":"admin_hostnames_https","title":{"_type":"trans","tr":{"en":"Configure hostnames and HTTPS"}},"uri":"https:\/\/zotonic.com\/id\/3066"},"seq":1},{"created":"2026-10-07T11:13:45Z","object_id":{"id":1789,"is_a":["text","documentation","developerguide"],"name":"doc_developerguide_deployment_privilegedports","title":{"_type":"trans","tr":{"en":"Serve HTTPS on a privileged port"}},"uri":"https:\/\/zotonic.com\/id\/1789"},"seq":2}],"predicate":{"id":2774,"is_a":["meta","predicate"],"name":"hasreference","title":{"_type":"trans","tr":{"en":"Documentation reference"}},"uri":"https:\/\/zotonic.com\/id\/hasreference"}},"subject":{"objects":[{"created":"2026-10-07T11:13:45Z","object_id":{"id":2554,"is_a":["categorization","keyword","keyword_information_type"],"name":"zotonic_topic_how_to_guide","title":"How-to guide","uri":"https:\/\/zotonic.com\/id\/2554"},"seq":1},{"created":"2026-10-07T11:13:45Z","object_id":{"id":2566,"is_a":["categorization","keyword","keyword_audience"],"name":"zotonic_topic_operator","title":"Operator","uri":"https:\/\/zotonic.com\/id\/2566"},"seq":2},{"created":"2026-10-07T11:13:45Z","object_id":{"id":2676,"is_a":["categorization","keyword","keyword_technology"],"name":"zotonic_topic_http","title":"HTTP","uri":"https:\/\/zotonic.com\/id\/2676"},"seq":3},{"created":"2026-10-07T11:13:45Z","object_id":{"id":2603,"is_a":["categorization","keyword","keyword_domain"],"name":"zotonic_topic_configuration","title":"Configuration","uri":"https:\/\/zotonic.com\/id\/2603"},"seq":4},{"created":"2026-10-07T11:13:45Z","object_id":{"id":2682,"is_a":["categorization","keyword","keyword_technology"],"name":"zotonic_topic_tls_and_certificates","title":"TLS and certificates","uri":"https:\/\/zotonic.com\/id\/2682"},"seq":5}],"predicate":{"id":308,"is_a":["meta","predicate"],"name":"subject","title":{"_type":"trans","tr":{"en":"Keyword"}},"uri":"http:\/\/purl.org\/dc\/elements\/1.1\/subject"}}},"id":1790,"is_a":["text","documentation","developerguide"],"links":[{"rel":"self","target":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/1790"},{"rel":"hub","target":"https:\/\/zotonic.com\/.zotonic\/websub"}],"medium":null,"medium_url":null,"name":"doc_developerguide_deployment_nginx","page_url":{"en":"https:\/\/zotonic.com\/docs\/1790\/put-zotonic-behind-nginx","x-default":"https:\/\/zotonic.com\/docs\/1790\/put-zotonic-behind-nginx"},"preview_url":null,"resource":{"body":{"_type":"trans","tr":{"en":"

Configure Zotonic's backend listener on a private interface, for example loopback port 8000. Set the site's public hostname and HTTPS port to the values visitors use, and set proxy_allowlist<\/code> to the actual proxy address(es). Consult zotonic.config.in<\/code> for listener versus advertised-port settings.<\/p>\n

In nginx's http<\/code> context, define:<\/p>\n

map $http_upgrade $connection_upgrade {\n    default upgrade;\n    '' close;\n}\n<\/code><\/pre>\n
Inside the site's existing TLS server<\/code> block, with its real certificate and key:<\/p>\n
location \/ {\n    proxy_pass http:\/\/127.0.0.1:8000;\n    proxy_http_version 1.1;\n    proxy_set_header Host $host;\n    proxy_set_header X-Forwarded-Proto $scheme;\n    proxy_set_header X-Forwarded-For $remote_addr;\n    proxy_set_header Upgrade $http_upgrade;\n    proxy_set_header Connection $connection_upgrade;\n    proxy_read_timeout 3600s;\n    client_max_body_size 100m;\n}\n<\/code><\/pre>\n
This example assumes nginx is the single public proxy; it replaces an untrusted inbound forwarded-address header. A CDN or extra proxy hop needs an explicit trusted-chain configuration. Set the upload limit to your site's policy, and use the current nginx TLS defaults and your deployment's certificate policy instead of an old copied cipher list.<\/p>\n
Run nginx -t<\/code> before reloading. Test public pages, redirects, login, uploads and a WebSocket connection lasting beyond the usual HTTP idle timeout. Check the client address and scheme seen by Zotonic. nginx's WebSocket documentation<\/a> explains the upgrade headers and idle timeout.<\/p>"}},"category_id":{"id":317,"is_a":["meta","category"],"name":"developerguide","title":"Developer guide","uri":"https:\/\/zotonic.com\/id\/developerguide"},"content_group_id":{"id":339,"is_a":["meta","content_group"],"name":"default_content_group","title":{"_type":"trans","tr":{"en":"Default Content Group"}},"uri":"https:\/\/zotonic.com\/id\/default_content_group"},"created":"2020-05-30T05:47:36Z","creator_id":{"id":336,"is_a":["person","robot"],"name":"gitbot","title":"Git","uri":"https:\/\/zotonic.com\/id\/336"},"doc_editorial_bundle":true,"doc_editorial_edges":{"hasreference":[1789,3066],"subject":[2554,2566,2603,2676,2682]},"github_url":"https:\/\/github.com\/zotonic\/zotonic\/tree\/master\/doc\/developer-guide\/deployment\/nginx.rst","is_authoritative":true,"is_dependent":false,"is_featured":false,"is_protected":false,"is_published":true,"is_unfindable":false,"language":["en"],"modified":"2026-10-07T11:13:57Z","modifier_id":{"id":1,"is_a":["person"],"name":"administrator","title":"Site Administrator","uri":"https:\/\/zotonic.com\/id\/1"},"name":"doc_developerguide_deployment_nginx","pivot_geocode":null,"pivot_location_lat":null,"pivot_location_lng":null,"privacy":0,"publication_end":"9999-06-01T00:00:00Z","publication_start":"2022-02-15T10:01:33Z","slug":"put-zotonic-behind-nginx","summary":{"_type":"trans","tr":{"en":"Forward HTTP and WebSocket traffic with a narrow trust boundary."}},"title":{"_type":"trans","tr":{"en":"Put Zotonic behind nginx"}},"title_slug":{"_type":"trans","tr":{"en":"put-zotonic-behind-nginx"}},"tz":"UTC","uri":null,"version":35,"visible_for":0},"uri":"https:\/\/zotonic.com\/id\/1790","uri_template":"https:\/\/zotonic.com\/id\/:id","websub":{"hub":"https:\/\/zotonic.com\/.zotonic\/websub","topic":"https:\/\/zotonic.com\/.zotonic\/websub\/topic\/1790"}},"status":"ok"}