starred/tacticalrmm

Fork 0

mirror of https://github.com/amidaware/tacticalrmm.git synced 2026-04-26 06:55:52 +03:00

[GH-ISSUE #315] Reverse proxy setup questions (Docker, Traefik) #2147

New issue

Closed

opened 2026-03-14 02:46:10 +03:00 by kerem · 8 comments

kerem commented

2026-03-14 02:46:10 +03:00

Owner

Originally created by @wtfpeter on GitHub (Mar 7, 2021).
Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/315

Hi guys, I would like to use Tactical RMM via Docker as it looks exactly like what I have been searching for. However I am struggling to fit it into my setup with an existing TraefikV2 reverse proxy already handling all other hosted services.
Can you give me insight into which URLs need to be routed to which tacticalrmm service without using the shipped nginx reverse proxy? I want to continue using Traefik as a reverse proxy.

This is what I have gathered from the docs so far:
APP_HOST:443 -> tactical-frontend:443
API_HOST:80 -> tactical-backend:80
API_HOST:4222 -> tactical-nats:4222
MESH_HOST:443 -> tactical-meshcentral:443

Are there any other URLs that I overlooked?
Are there URLs that need to be routed differently?

In other issues there I see that the nginx config could be used as a template for a non-standard reverse proxy setup, however I am not completely familiar with reading and understanding nginx configs.

Originally created by @wtfpeter on GitHub (Mar 7, 2021). Original GitHub issue: https://github.com/amidaware/tacticalrmm/issues/315 Hi guys, I would like to use Tactical RMM via Docker as it looks exactly like what I have been searching for. However I am struggling to fit it into my setup with an existing TraefikV2 reverse proxy already handling all other hosted services. Can you give me insight into which URLs need to be routed to which tacticalrmm service without using the shipped nginx reverse proxy? I want to continue using Traefik as a reverse proxy. This is what I have gathered from the docs so far: APP_HOST:443 -> tactical-frontend:443 API_HOST:80 -> tactical-backend:80 API_HOST:4222 -> tactical-nats:4222 MESH_HOST:443 -> tactical-meshcentral:443 Are there any other URLs that I overlooked? Are there URLs that need to be routed differently? In other issues there I see that the nginx config could be used as a template for a non-standard reverse proxy setup, however I am not completely familiar with reading and understanding nginx configs.

kerem closed this issue

2026-03-14 02:46:17 +03:00

kerem commented

2026-03-14 02:46:24 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 7, 2021):

Hello,

I will try and get the info for you.

APP uses ports 80 and 443
Mesh uses ports 80 and 4430>443
API uses ports 80 and 443

That should be all you need to proxy obviously nats as well needs the port forward done.

As long as you can get traefik (which I am not familiar with at all) to forward https on the 3 subdomains it should be fine and then nginx will look after the rest of it.

Nginx doesnt handle 4222 so if its port forwarded should be fine.

Let us know how you get on, you can always join the discussions on discord.

@dinger1986 commented on GitHub (Mar 7, 2021): Hello, I will try and get the info for you. APP uses ports 80 and 443 Mesh uses ports 80 and 4430>443 API uses ports 80 and 443 That should be all you need to proxy obviously nats as well needs the port forward done. As long as you can get traefik (which I am not familiar with at all) to forward https on the 3 subdomains it should be fine and then nginx will look after the rest of it. Nginx doesnt handle 4222 so if its port forwarded should be fine. Let us know how you get on, you can always join the discussions on discord.

kerem commented

2026-03-14 02:46:29 +03:00

Author

Owner

@wtfpeter commented on GitHub (Mar 8, 2021):

Thank you for the input, it's much appreciated. I now realize I should have been clearer in what I want to achieve.
I want to completely remove nginx from the stack and move whatever functionality it has to Traefik. I want this for two reasons:

Traefik is already handling certificates automatically
Adding nginx to the routing could introduce additional errors, for example when using custom host ports to avoid port conflicts with Traefik

For this reason I want to get info on which domains and URLs/paths should be forwarded to which container.

@wtfpeter commented on GitHub (Mar 8, 2021): Thank you for the input, it's much appreciated. I now realize I should have been clearer in what I want to achieve. I want to completely remove nginx from the stack and move whatever functionality it has to Traefik. I want this for two reasons: 1. Traefik is already handling certificates automatically 2. Adding nginx to the routing could introduce additional errors, for example when using custom host ports to avoid port conflicts with Traefik For this reason I want to get info on which domains and URLs/paths should be forwarded to which container.

kerem commented

2026-03-14 02:46:34 +03:00

Author

Owner

@bradhawkins85 commented on GitHub (Mar 8, 2021):

You will find you will have issues with the mesh agent not connecting if you mess with the SSL.
I used to have it working with HAProxy but now as soon as another certificate is put between mesh central and the mesh agent they stop communicating. That was with leaving nginx in the mix.
Traefik would need to pass through the mesh central server certificate or you need to update the client configs to match the Traefik SSL cert.

@bradhawkins85 commented on GitHub (Mar 8, 2021): You will find you will have issues with the mesh agent not connecting if you mess with the SSL. I used to have it working with HAProxy but now as soon as another certificate is put between mesh central and the mesh agent they stop communicating. That was with leaving nginx in the mix. Traefik would need to pass through the mesh central server certificate or you need to update the client configs to match the Traefik SSL cert.

kerem commented

2026-03-14 02:46:39 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 8, 2021):

ok in that case:
rmm.yourdomain uses ports 80 and 443
mesh.yourdomain uses ports 80 and 443>4430
api.yourdomain uses ports 80 and 443

thanks @bradhawkins85 yes that will be a problem as well.

@dinger1986 commented on GitHub (Mar 8, 2021): ok in that case: rmm.yourdomain uses ports 80 and 443 mesh.yourdomain uses ports 80 and 443>4430 api.yourdomain uses ports 80 and 443 thanks @bradhawkins85 yes that will be a problem as well.

kerem commented

2026-03-14 02:46:44 +03:00

Author

Owner

@sadnub commented on GitHub (Mar 8, 2021):

@wtfpeter Are you running traefik on the same docker host? If so, I'm not sure how that will work. You might be able to get the container on the same docker network segment as the tactical servers. See here: https://github.com/wh1te909/tacticalrmm/blob/develop/docker/docker-compose.yml

The docker proxy network is the one you need to allow access to the traefik container.

The containers actually offload all ssl to the reverse proxy. The containers themselves listen of these ports:
Api: 80
Mesh: 443 (http)
app: 80

If you can get the traefik container on the docker proxy network you should be good. Just forward your hostnames to the ports above.

You may run into issues because internally the nats container (responsible for agent communication), requires TLS always. Nats does communicate directly to the backend, so a valid certificate is required for that.

@sadnub commented on GitHub (Mar 8, 2021): @wtfpeter Are you running traefik on the same docker host? If so, I'm not sure how that will work. You might be able to get the container on the same docker network segment as the tactical servers. See here: https://github.com/wh1te909/tacticalrmm/blob/develop/docker/docker-compose.yml The docker proxy network is the one you need to allow access to the traefik container. The containers actually offload all ssl to the reverse proxy. The containers themselves listen of these ports: Api: 80 Mesh: 443 (http) app: 80 If you can get the traefik container on the docker proxy network you should be good. Just forward your hostnames to the ports above. You may run into issues because internally the nats container (responsible for agent communication), requires TLS always. Nats does communicate directly to the backend, so a valid certificate is required for that.

kerem commented

2026-03-14 02:46:49 +03:00

Author

Owner

@sadnub commented on GitHub (Mar 8, 2021):

You will find you will have issues with the mesh agent not connecting if you mess with the SSL.
I used to have it working with HAProxy but now as soon as another certificate is put between mesh central and the mesh agent they stop communicating. That was with leaving nginx in the mix.
Traefik would need to pass through the mesh central server certificate or you need to update the client configs to match the Traefik SSL cert.

This also. Forgot about that. Mesh needs the IP address of the reverse proxy to get the certificate.

There will be a problem with manually updating the mesh configs, because the configs will be rewritten everytime the mesh container restarts.

To get around that, you could fork the repo and modify the configurations to suit your needs and build the images yourself.

@sadnub commented on GitHub (Mar 8, 2021): > You will find you will have issues with the mesh agent not connecting if you mess with the SSL. > I used to have it working with HAProxy but now as soon as another certificate is put between mesh central and the mesh agent they stop communicating. That was with leaving nginx in the mix. > Traefik would need to pass through the mesh central server certificate or you need to update the client configs to match the Traefik SSL cert. This also. Forgot about that. Mesh needs the IP address of the reverse proxy to get the certificate. There will be a problem with manually updating the mesh configs, because the configs will be rewritten everytime the mesh container restarts. To get around that, you could fork the repo and modify the configurations to suit your needs and build the images yourself.

kerem commented

2026-03-14 02:46:54 +03:00

Author

Owner

@wtfpeter commented on GitHub (Mar 9, 2021):

Thanks a lot for all of your input.
@sadnub I am running traefik on a different host. All my hosts are behind a single NAT address with traefik being my reverse proxy for all applications. This means I can't go without traefik, for now.
To me it seems like it would be a better idea to use a dedicated host with a dedicated address for Tactical RMM

@wtfpeter commented on GitHub (Mar 9, 2021): Thanks a lot for all of your input. @sadnub I am running traefik on a different host. All my hosts are behind a single NAT address with traefik being my reverse proxy for all applications. This means I can't go without traefik, for now. To me it seems like it would be a better idea to use a dedicated host with a dedicated address for Tactical RMM

kerem commented

2026-03-14 02:46:59 +03:00

Author

Owner

@dinger1986 commented on GitHub (Mar 9, 2021):

you could host it on a VPS, most are fairly inexpensive.

@dinger1986 commented on GitHub (Mar 9, 2021): you could host it on a VPS, most are fairly inexpensive.

kerem referenced this issue

2026-03-14 07:01:30 +03:00

[GH-ISSUE #2147] Connected button missing on new installed devices #3274