Reverse Proxy

The service can run behind nginx, Traefik, IIS ARR, or another reverse proxy.

Recommended settings:

• Terminate TLS at the proxy or use native TLS mode
• Forward X-Request-ID when present
• Forward X-Forwarded-For / X-Real-IP carefully
• Keep PUBLIC_BASE_URL aligned with the externally reachable URL
• Set TLS_MODE=reverse_proxy when TLS is terminated upstream