Running LiveConfig behind a proxy

Category: LiveConfig
Created: 2019-10-25
Updated: 2026-01-09

If you run LiveConfig behind a proxy (i.e. you use a proxy to access LiveConfig), you will see that all log entries in LiveConfig show the IP address of your proxy server.

To log the IP address of the actual user, set the following options in /etc/liveconfig/liveconfig.conf:

http_proxy_ip_from = 127.0.0.1
http_proxy_url = https://your.proxy.server
# if you're using Apache as proxy web server:
http_proxy_ip_header = X-Forwarded-For
# if you're using NGINX as proxy web server:
http_proxy_ip_header = X-Real-IP

Replace XX.XX.XX.XX with the IP address of your proxy server (or 127.0.0.1 for a local proxy).

Finally restart LiveConfig to load the updated configuration.

Required adjustments for LiveConfig 3.x

If you are running LiveConfig 3.x behind a reverse proxy, then WebSocket connections must also be passed through.

For Apache httpd (version ≥2.4.47), add the options upgrade=websocket nocanon after the ProxyPass statement, e.g.:
ProxyPass "/" "http://127.0.0.1:8080/" upgrade=websocket nocanon

Reverse proxy configurations generated by LiveConfig itself already contain these options.
With NGINX this is unfortunately more complicated due to its architecture — here, a separate configuration file with the necessary proxy settings must be created and integrated. In addition, LiveConfig version ≥3.2.0 is required.
1. Create a file named /var/www/<contract>/conf/<subdomain>.nginx.conf with the following content:
```
location /liveconfig/app/ws {
   proxy_pass      http://your.liveconfig.host:8080$request_uri;
   proxy_redirect  off;
   proxy_pass_header     Set-Cookie;
   client_max_body_size  64m;
   proxy_set_header      Host $host;
   proxy_set_header      X-Real-IP $remote_addr;
   proxy_set_header      X-Forwarded-For $proxy_add_x_forwarded_for;
   proxy_set_header      X-Forwarded-Proto $scheme;
   proxy_set_header      Upgrade $http_upgrade;
   proxy_set_header      Connection "upgrade";
   proxy_http_version    1.1;
   proxy_read_timeout    3600;
}
```
  Adjust the target in proxy_pass accordingly. The file must belong to the user root:root and have permission 0640.
2. Save the vHost configuration for this contract again in LiveConfig (e.g., edit and save any domain setting). This will include this file in the NGINX configuration via the Include statement.