Corestone

Panel over HTTPS

The panel speaks plain HTTP on its own port. To use it from outside your machine, put a reverse proxy with HTTPS in front of it and let only the proxy reach the panel port.

1. Point the panel at the proxy

In config.yml:

web:
  host: 127.0.0.1        # only the proxy on this machine can reach the panel
  port: 8080
  public-url: "https://panel.example.com"

Once nothing else on that host runs on plain http (a map plugin on another port), you can also set hsts: true: browsers then never try plain http there again for a year.

Restart the server: web.* changes need a restart. public-url is used for the links the plugin prints (setup, invites, reset links, report buttons in game). It is the address only, scheme and host (and a port if needed), without a path and without a trailing /.

2. Caddy

Caddy gets and renews the certificate on its own.

panel.example.com {
	reverse_proxy 127.0.0.1:8080
}

3. Nginx

server {
    listen 443 ssl;
    server_name panel.example.com;
    # ssl_certificate and ssl_certificate_key from your certificate (e.g. certbot)

    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-Host $host;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
    }
}

The Upgrade lines keep the live parts of the panel (dashboard, chat, console) working.

4. Trust the proxy

In the panel, Settings → Server → Security → Trusted proxies, add the proxy address (for a proxy on the same machine: 127.0.0.1/32). Only then does the panel believe the X-Forwarded-* headers the proxy sends. Without it:

  • every visitor looks like the proxy: the sessions list, the audit log and the IP whitelist all see the proxy's address, so a whitelist cannot tell visitors apart;
  • the panel does not know the visitor came over HTTPS, so its cookies are not marked Secure and links it builds start with http://;
  • the live parts of the panel (dashboard, chat, console) may refuse to connect, because the browser's address does not match what the panel sees.

Sign-in limits are counted per account, so trusting the proxy does not change them.

5. Optional: IP whitelist

Settings → Server → Security → IP whitelist lets only listed addresses or ranges (203.0.113.0/24) open the panel. The panel refuses a list that would lock you out unless you confirm it. If you lock yourself out anyway, run /ac whitelist off in the server console.

Under a path

To serve the panel under a path of a shared domain (https://example.com/panel/):

web:
  base-path: /panel
  public-url: "https://example.com"   # the address only; the path comes from base-path

Proxy that path to the panel port with the path kept: the panel expects requests to start with /panel. In Caddy use handle, not handle_path (which strips the path):

example.com {
	handle /panel* {
		reverse_proxy 127.0.0.1:8080
	}
}

In Nginx, location /panel/ { proxy_pass http://127.0.0.1:8080; ... } with no path after the port keeps it.