Reverse Proxy

For production, put TREK behind a reverse proxy with HTTPS.

Important: TREK uses WebSockets for real-time collaboration. Your reverse proxy must support WebSocket upgrades on the /ws path, or live sync will not work.

Nginx

server {
    listen 80;
    server_name trek.yourdomain.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl http2;
    server_name trek.yourdomain.com;

    ssl_certificate /etc/letsencrypt/live/trek.yourdomain.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/trek.yourdomain.com/privkey.pem;

    # WebSocket support (required for real-time sync)
    location /ws {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_read_timeout 86400;
    }

    # Everything else
    location / {
        proxy_pass http://localhost:3000;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
}

Then enable and get a certificate:

ln -sf /etc/nginx/sites-available/trek.yourdomain.com /etc/nginx/sites-enabled/
nginx -t && nginx -s reload
certbot --nginx -d trek.yourdomain.com

Caddy

Caddy handles WebSocket upgrades and HTTPS automatically:

trek.yourdomain.com {
    reverse_proxy localhost:3000
}

Traefik

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.trek.rule=Host(`trek.yourdomain.com`)"
  - "traefik.http.routers.trek.entrypoints=websecure"
  - "traefik.http.routers.trek.tls.certresolver=letsencrypt"
  - "traefik.http.services.trek.loadbalancer.server.port=3000"

Traefik handles WebSocket upgrades automatically.

Verifying WebSocket

Open your browser's developer console (F12) and check for:

• Working: WebSocket connection to 'wss://...' opened or no WebSocket errors
• Broken: WebSocket connection to 'wss://...' failed — check your /ws proxy config

CORS (optional)

If your proxy uses a different domain, set the ALLOWED_ORIGINS environment variable:

environment:
  - ALLOWED_ORIGINS=https://trek.yourdomain.com