Nginx and HTTPS

This example uses Nginx installed on the same host as the Docker Compose deployment. The Kaneo container is available only at 127.0.0.1:5173. You need a domain pointing at the server and a valid TLS certificate. The paths below assume a certificate for kaneo.example.com already exists. Obtain one with your certificate manager before enabling the HTTPS server block.

Configure one public origin

Set this in Kaneo’s .env:

KANEO_CLIENT_URL=https://kaneo.example.com

Leave KANEO_API_URL unset for the bundled image. It serves the web app and /api through the same public origin.

docker compose up -d --force-recreate kaneo

Trust the proxy chain

Configure TRUSTED_PROXIES for this host-Nginx setup before serving traffic. Requests pass through host Nginx, Docker’s published port, and the bundled Nginx before reaching the API. The API trusts loopback by default, but the bundled Nginx also appends its Docker-side peer address. Without trusting that hop, visitors can share the gateway address in session records and IP-based rate limits. Find the gateway for the Kaneo container’s network:

docker inspect "$(docker compose ps -q kaneo)" --format '{{range $name, $network := .NetworkSettings.Networks}}{{$name}} gateway={{$network.Gateway}}{{println}}{{end}}'

On a standard Linux Docker bridge, the host proxy reaches the container through that gateway. If the output shows 172.19.0.1, add this to .env, replacing the example address with your actual gateway:

TRUSTED_PROXIES=127.0.0.0/8,::1/128,172.19.0.1/32

Keep loopback in the list because the bundled Nginx connects to the API locally. Trust only the gateway or proxy addresses you control, not every private network. If Docker uses a different network mode or forwarding layer, confirm the peer address in the bundled Nginx access logs and trust that specific hop instead. Recheck this setting if you recreate the Docker network. Apply the setting:

docker compose up -d --force-recreate kaneo

Configure Nginx

Save this in your Nginx site’s configuration. The map belongs in the http context, outside the server blocks; on a standard Debian or Ubuntu installation, sites-enabled is included there.

map $http_upgrade $kaneo_connection_upgrade {
    default upgrade;
    '' close;
}

server {
    listen 80;
    server_name kaneo.example.com;
    return 301 https://$host$request_uri;
}

server {
    listen 443 ssl;
    server_name kaneo.example.com;
    ssl_certificate /etc/letsencrypt/live/kaneo.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/kaneo.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:5173;
        proxy_http_version 1.1;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection $kaneo_connection_upgrade;
        proxy_read_timeout 300s;
        proxy_buffering off;
    }
}

The upgrade headers follow Nginx’s WebSocket guidance. They allow live task updates through the proxy. Disabling response buffering also lets streaming MCP responses arrive promptly. Enable the site using your distribution’s normal procedure, then validate and reload:

sudo nginx -t
sudo systemctl reload nginx

Check the public URL

curl --fail https://kaneo.example.com/api/health

Sign in and open a project in two browser sessions. Change a task in one and confirm the other receives the update without a refresh.

Other network layouts

If Nginx runs in another container, 127.0.0.1 refers to that proxy container. Put it on the same Docker network as Kaneo and use http://kaneo:5173 as the upstream. Configure TRUSTED_PROXIES for this different proxy chain so client addresses remain correct. Trust only the proxy addresses or a dedicated proxy subnet. If you deliberately host the API and web app separately, set their public URLs explicitly and configure allowed origins. The one-domain setup above does not require exposing port 1337. For uploads, give Silo its own HTTPS hostname pointing to its S3 API.

Install

Configure

Sign-in providers

Keep it running

Migrate a deployment

Nginx and HTTPS

Configure one public origin

Trust the proxy chain

Configure Nginx

Check the public URL

Other network layouts

​Configure one public origin

​Trust the proxy chain

​Configure Nginx

​Check the public URL

​Other network layouts

Configure one public origin

Trust the proxy chain

Configure Nginx

Check the public URL

Other network layouts