CCortex

DOCS · DEPLOYMENT

Serve Cortex over HTTPS with Caddy

Cortex has access to development workspaces and can execute commands as the account running it. If you expose Cortex across an untrusted network, put HTTPS in front of it. Caddy is the recommended simple reverse proxy because it can obtain, renew and serve TLS certificates automatically.

Public domain

Point a DNS A or AAAA record such as cortex.example.com at the machine running Cortex. Make sure ports 80 and 443 reach Caddy, then keep Cortex itself on the loopback interface.

cortex
caddy reverse-proxy --from cortex.example.com --to 127.0.0.1:7331

When Caddy knows the public hostname, it can obtain a publicly trusted certificate, renew it automatically and redirect HTTP traffic to HTTPS. Cortex remains behind the proxy rather than being exposed directly on its application port. Caddy sets the standard X-Forwarded-* headers automatically. Cortex uses them only because proxy trust was explicitly enabled, only from its direct loopback peer, and pins secure cookies, Google OAuth callbacks, Host and origin checks to the configured public origin.

Caddyfile

For a long-running deployment, a small Caddyfile is easier to keep under service management:

cortex.example.com {
    reverse_proxy 127.0.0.1:7331
}

Run Cortex and Caddy as persistent services appropriate to your operating system. Caddy needs persistent writable storage for its certificate state.

Requirements

  • The domain's DNS records must point to the Cortex host.
  • Ports 80 and 443 must be reachable by Caddy for the normal automatic certificate flow.
  • Caddy must be able to bind to those ports.
  • Do not prefix the Caddy site address with http:// if you want automatic HTTPS.

Local HTTPS

Caddy can also provide HTTPS for local names and addresses using its own local certificate authority. Other client devices must trust that CA before their browsers will accept those certificates, so public-domain HTTPS is generally simpler for a remotely hosted Cortex instance.

Authentication does not replace transport security.Cortex password, TOTP and Google authentication protect access to the application. HTTPS protects credentials, session cookies and application traffic while they cross the network. Use both for remotely exposed Cortex.

Already use nginx?

See Serve Cortex over HTTPS with nginx for an nginx configuration including forwarded headers, streaming-friendly settings and WebSocket proxying.

More about Caddy

See Caddy's reverse proxy quick-start and Automatic HTTPS documentation for installation, service management and advanced TLS configuration.