Reverse Proxy

When deploying Ideon in production, it is highly recommended to use a reverse proxy like Nginx or Apache. This allows you to handle SSL termination, load balancing, and more.

Nginx Configuration

Ideon relies heavily on WebSockets for real-time collaboration via Yjs. Your reverse proxy must be configured to support WebSocket upgrades.

Example Configuration

Here is a recommended Nginx configuration for Ideon:

server {
    listen 80;
    server_name ideon.example.com;

    # Redirect all HTTP requests to HTTPS
    location / {
        return 301 https://$host$request_uri;
    }
}

server {
    listen 443 ssl;
    server_name ideon.example.com;

    ssl_certificate /etc/nginx/ssl/ideon.crt;
    ssl_certificate_key /etc/nginx/ssl/ideon.key;

    # Security headers
    add_header Strict-Transport-Security "max-age=31536000; includeSubDomains" always;
    add_header X-Frame-Options "SAMEORIGIN" always;
    add_header X-XSS-Protection "1; mode=block" always;
    add_header X-Content-Type-Options "nosniff" always;

    location / {
        proxy_pass http://localhost:3000; # Point to your Ideon container/port

        proxy_http_version 1.1;

        # Critical for WebSockets
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        # Standard headers
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Disable buffering for real-time responsiveness
        proxy_buffering off;

        # Timeouts
        proxy_connect_timeout 90;
        proxy_send_timeout 90;
        proxy_read_timeout 90;
    }
}

Common Issues

WebSocket Connection Refused

If you see NS_ERROR_WEBSOCKET_CONNECTION_REFUSED in your browser console and the sync indicator shows a connection error, verify that the following lines are present in your Nginx configuration:

proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";

Without these headers, Nginx will not upgrade the HTTP connection to a WebSocket connection, and synchronization will fail.