Install

Reverse proxies🔗

You need to make sure the reverse proxy forwards all the headers to the FileRun server. In other words, your reverse proxy must be fully transparent.

Here is an Nginx configuration example:

 1proxy_set_header Host $host;
 2proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
 3proxy_set_header X-Forwarded-Proto $scheme;
 4proxy_set_header X-Forwarded-Protocol $scheme;
 5proxy_set_header X-Forwarded-Port $server_port;

If the custom port number is not being forwarded, you might want to try to change the last line like this:

 1proxy_set_header X-Forwarded-Port $port;

Trusted proxies🔗

Configuring this is highly recommended. Every request now reaches FileRun from the proxy, so until you do, FileRun records the proxy's own IP address as the IP address of every user.

Open System → Settings in the control panel and fill in Trusted proxies with the IP address of each reverse proxy placed in front of this server. An entry can be a single IP address or a range, in CIDR, wildcard or start-end format.

FileRun then takes the client IP address from the X-Forwarded-For header, but only for requests that arrived through one of the IP addresses you listed. A request that reaches the server directly keeps the IP address it came from, so nobody can claim another IP address by sending the header themselves.

What depends on knowing the real client IP address:

• the IP address recorded on every entry of the activity log,
• the IP address shown in a user's Sessions list, and beside each set of Connect app credentials,
• the identity check that protects account changes, which is tied to the IP address it was made from,
• the per-account IP restriction, and the IP address limitation of the authentication plugins. While every user arrives with the IP address of the proxy, these let either everybody in or nobody.

If your proxy sends the client IP address under a different header name, X-Real-IP or CF-Connecting-IP for instance, name it in customizables/config.php:

 1$config['system']['forwarded_for_header'] = 'CF-Connecting-IP';

Locking the URL🔗

Also a good idea. FileRun remembers the URL it is served from. By default, a request arriving on a different URL makes FileRun store that new URL instead.

Behind a proxy, the server itself is often still reachable by its IP address, or by another host name pointing at the same machine. One request on any of those replaces the stored URL. That URL is what the scheduled tasks use to build links, so the e-mail notifications would start pointing somewhere your users cannot open.

Turn Lock the URL on, under System → Settings. FileRun then refuses every request that does not arrive on the stored URL. The protocol and the port number are part of it, not only the host name.

Important

Open FileRun on the correct URL before turning the lock on: it locks the URL that is stored at that moment.

Warning

If the URL has to change later, turn the lock off first. With the lock on and the URL already changed, both the sign-in page and the control panel refuse the request, and the setting can then only be changed directly in the database.

Enabling resumable uploads🔗

Being able to resume uploads at the exact byte a transfer was interrupted can save a lot of time. To enable it, add the following line to the reverse proxy configuration:

 1proxy_request_buffering off;

When using NPM (Nginx Proxy Manager), add this line under the Advanced configuration section (the cog icon). It is the same place where you have configured the forwarding of the HTTP headers. See the Adding SSL guide for details.

After making this change you will notice that you can cancel an upload at any moment, and all the transferred bytes will be found on the server.