Skip to main content

Network access and HTTPS

Jiandu defaults to loopback HTTP. That is the right shape for one-machine evaluation, but other devices cannot connect.

For household access, put an HTTPS reverse proxy in front of a private Jiandu HTTP listener. Jiandu then verifies three things together: the public origin users open, the expected Host and Origin, and the direct network address of the trusted proxy.

Example boundary​

{
  "server": {
    "bind": "0.0.0.0:8077",
    "ingress": {
      "mode": "https_reverse_proxy",
      "public_origin": "https://docs.example.net",
      "trusted_proxy_cidrs": ["172.30.0.2/32"]
    }
  }
}

Replace both the hostname and proxy address with values from your own deployment. Prefer a single-host CIDR such as /32 (IPv4) or /128 (IPv6) when the proxy address is stable.

The equivalent environment boundary is:

export JIANDU_INGRESS_MODE=https_reverse_proxy
export JIANDU_PUBLIC_ORIGIN=https://docs.example.net
export JIANDU_INGRESS_TRUSTED_PROXY_CIDRS=172.30.0.2/32

Set the complete boundary through one configuration source. Partial or mixed-source boundaries fail closed.

Do not publish the backend port​

Only the reverse proxy's HTTPS port should be reachable by users. Keep port 8077 private to the host or container network. Direct non-loopback plaintext access is not supported.

Verify from a second device​

  1. Open the exact configured https:// origin.
  2. Confirm the certificate is trusted and issued for that name.
  3. Sign in and upload a small sample.
  4. Confirm a direct request to the backend port is blocked by the network.
  5. Review logs for rejected host, origin, or proxy checks.

The repository's Caddy Compose example provides a working topology. Reviewed Nginx and Traefik alternatives are adjacent to it.