Reverse Proxy, TLS & Control-Plane Isolation
Recommended Nginx and Caddy configurations to expose the data plane while keeping the Admin Console on a restricted subdomain or internal network.
Separating Data Plane and Control Plane Traffic
The Madar Server never serves an embedded web admin UI on /admin. Instead, the React/TypeScript Admin Console runs as an isolated BFF process (default port 3501) and should be exposed only on a dedicated administrative hostname (such as control.xpertsafe.com) or restricted to internal management VPN subnets.
Nginx Reverse Proxy Snippet for Workspace & WebSocket
location / {
proxy_pass http://127.0.0.1:5025;
proxy_http_version 1.1;
proxy_set_header Upgrade $http_upgrade;
proxy_set_header Connection "upgrade";
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
}