ReverseProxy

Behind a Reverse Proxy

Running Cloud Torrent-rs behind a reverse proxy is the recommended production setup — it lets you add TLS, a custom domain, and share a server with other apps.

Note: When using a reverse proxy for TLS, do not also enable --cert-path/--key-path on cloud-torrent itself. Run it in plain HTTP mode behind the proxy.

Cloud Torrent-rs uses two endpoints that require special proxy handling:

• /sync — Server-Sent Events (SSE), requires no-buffering and persistent connection
• /sync/ws — WebSocket, requires Upgrade header forwarding

---

Caddy

Simple reverse proxy

https://your.domain.tld {
  reverse_proxy * localhost:3000
}

Under a subdirectory

https://your.domain.tld {
  handle_path /torrents/* {
    reverse_proxy localhost:3000
  }
}

Via Unix socket

https://your.domain.tld {
  reverse_proxy * unix//run/cloud-torrent/ct.sock
}

---

Nginx

Dedicated domain

server {
    listen 443 ssl http2;
    listen [::]:443 ssl http2;
    server_name your.domain.tld;

    ssl_certificate     /etc/ssl/certs/your.crt;
    ssl_certificate_key /etc/ssl/private/your.key;

    # SSE and WebSocket endpoint
    location /sync {
        proxy_pass http://127.0.0.1:3000;
        # proxy_pass http://unix:/run/cloud-torrent/ct.sock;  # unix socket variant
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $http_connection;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_http_version 1.1;
    }

    location / {
        proxy_pass http://127.0.0.1:3000;
        # proxy_pass http://unix:/run/cloud-torrent/ct.sock;  # unix socket variant
        proxy_http_version 1.1;
        proxy_set_header Connection '';
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_buffering off;
        proxy_cache off;
    }
}

Shared domain, under /ctorrent/

location /ctorrent/ {
    proxy_pass http://127.0.0.1:3000/;
    proxy_http_version 1.1;
    proxy_set_header Connection '';
    proxy_buffering off;
    proxy_cache off;
}

location /ctorrent/sync {
    proxy_pass http://127.0.0.1:3000/sync;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_http_version 1.1;
}

---

Apache2

Enable required modules:

a2enmod rewrite proxy proxy_http proxy_wstunnel

<VirtualHost *:80>
  ServerName your.domain.tld

  RewriteEngine On
  RewriteCond %{HTTP:Upgrade} =websocket [NC]
  RewriteRule /(.*)  ws://127.0.0.1:3000/$1 [P,L]

  ProxyPreserveHost On
  ProxyPass / http://127.0.0.1:3000/
  ProxyPassReverse / http://127.0.0.1:3000/
</VirtualHost>