Reverse Proxy & TLS

Most production deployments place Fluxomni Studio behind a reverse proxy to terminate TLS, serve the UI on port 443, and optionally restrict access.

Overview

Fluxomni Studio exposes an HTTP surface (UI + API) and several media-plane ports. A reverse proxy sits in front of the HTTP surface while media ports (RTMP, SRT, HLS, WHIP signaling, and RTC media) are typically passed through directly.

Internet
  |
  +---> :443 (TLS) ---> reverse proxy ---> frontend :80  (HTTP)
  +---> :1935 -----------------------------------------> media-node   (RTMP)
  +---> :10080/udp ------------------------------------> media-node   (SRT)
  +---> :8000/tcp -------------------------------------> media-node   (HLS)
  +---> :8003/tcp -------------------------------------> media-node   (WHIP signaling)
  +---> :8000/udp -------------------------------------> media-node   (RTC media)

Caddy (recommended)

Caddy handles TLS certificates automatically via Let’s Encrypt.

Install Caddy on the same host or a gateway host, then create /etc/caddy/Caddyfile:

stream.example.com {
    reverse_proxy localhost:80
}

Reload Caddy:

sudo systemctl reload caddy

Caddy provisions a certificate automatically. Set your .env values to match:

FLUXOMNI_PUBLIC_HOST=stream.example.com
FLUXOMNI_MEDIA_NODE_PUBLIC_HOST=stream.example.com
FLUXOMNI_PUBLIC_URL=https://stream.example.com

FLUXOMNI_PUBLIC_URL tells the control plane the full public URL including scheme. Without it, artifact fetch URLs default to http:// which causes TLS handshake failures when media nodes download files through the HTTPS proxy.

Apply changes through Capacity Ledger Upgrades. Disable and drain routes before recreating existing control-plane or media-node containers, then restore the recorded enabled routes after verification.

WebSocket support

The Control Surface uses WebSocket connections for real-time updates. Caddy proxies WebSocket by default with no extra configuration.

nginx

Install nginx and create /etc/nginx/sites-available/fluxomni:

server {
    listen 443 ssl http2;
    server_name stream.example.com;

    ssl_certificate     /etc/letsencrypt/live/stream.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/stream.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:80;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # WebSocket support
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

server {
    listen 80;
    server_name stream.example.com;
    return 301 https://$host$request_uri;
}

Enable the site and reload:

sudo ln -s /etc/nginx/sites-available/fluxomni /etc/nginx/sites-enabled/
sudo nginx -t && sudo systemctl reload nginx

Obtain a certificate with Certbot:

sudo certbot --nginx -d stream.example.com

Media ports

RTMP (TCP 1935), SRT (UDP 10080), and RTC media (UDP 8000) must have reachable transport paths. HLS uses TCP 8000; WHIP signaling uses TCP 8003. Keep these ports published directly unless you deliberately proxy HLS or WHIP over HTTP. Proxying WHIP signaling does not proxy RTC UDP media. For custom ports, use the values from .env.

If you need TLS on RTMP, some CDN endpoints accept RTMPS. Fluxomni Studio outputs support rtmps:// destination URLs natively.

Firewall considerations

When using a reverse proxy, you can restrict the frontend HTTP port to localhost so it is only reachable through the proxy:

# In .env
FLUXOMNI_FRONTEND_HTTP_PORT=127.0.0.1:80

This binds port 80 to the loopback interface only. The reverse proxy on the same host can still reach it, but external clients cannot bypass TLS.

Media ports must remain publicly accessible for publishers and viewers.

Keyboard shortcuts