Behind a proxy

Let the proxy handle HTTPS and pass requests to Nifty on 127.0.0.1:4000, which is Nifty's default address. Add these two settings to /etc/nifty.env.

NIFTY_ORIGIN=https://notes.example.com
NIFTY_TRUSTED_PROXIES=127.0.0.1

• NIFTY_ORIGIN is the address you open Nifty at. Always set it. Nifty answers only to that name, and without it a new server's setup trusts requests from this computer.
• NIFTY_TRUSTED_PROXIES names the proxy, so that Nifty sees each visitor's address. Without it, every visitor counts as the proxy, so one visitor who hits a rate limit, such as too many sign-in attempts, blocks everyone. It takes addresses or CIDRs, separated by commas.

Then run sudo systemctl restart nifty. install.sh --origin https://notes.example.com writes both settings for you.

Caddy

Caddy gets its own certificate and redirects http://.

notes.example.com {
	reverse_proxy 127.0.0.1:4000
}

nginx

server {
    listen 443 ssl;
    server_name notes.example.com;
    # ssl_certificate and ssl_certificate_key here

    client_max_body_size 51m;
    proxy_read_timeout 120s;

    location / {
        proxy_pass http://127.0.0.1:4000;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    }
}

• client_max_body_size allows large uploads. Documents can be 50 MB, and nginx refuses anything over 1 MB by default.
• proxy_read_timeout allows slow replies. An AI reply can take up to 90 seconds.
• Redirect http:// to HTTPS in a second server block.

A proxy on another machine

Set NIFTY_LISTEN to an address the proxy can reach, such as 10.0.0.5:4000. Name the proxy in NIFTY_TRUSTED_PROXIES, and pass the original Host header through. Keep that port closed to everything else, because traffic between the proxy and Nifty is plain HTTP.