Reverse proxy and client addresses

FireSight's container is published on 127.0.0.1:8000 only, over plain HTTP. Put a TLS-terminating reverse proxy in front of it (your load balancer, nginx or similar) and give people the proxy's HTTPS address.

Set up the proxy

Forward HTTPS from the proxy to http://127.0.0.1:8000 on the FireSight server. Forward every path; the interface and the API (/api/...) are served by the same container.
Make the proxy add the client's address to the X-Forwarded-For header.
Add the proxy's IP address, as FireSight sees it, to FIRESIGHT_TRUSTED_PROXIES in .env. Separate several with commas:
```
FIRESIGHT_TRUSTED_PROXIES=10.0.0.5,10.0.0.6
```
Restart: docker compose up -d.
Under Settings, Sign-in methods, General, set Public address of FireSight to the proxy's address, such as https://firesight.corp.example. Single sign-on redirects return there.

Why FIRESIGHT_TRUSTED_PROXIES matters

The audit log records the address every action came from.

When a request arrives from an address listed in FIRESIGHT_TRUSTED_PROXIES, FireSight records the last address in its X-Forwarded-For header: the client the proxy saw.
From any other address, the header is ignored and FireSight records the connecting address. Nobody can put a false address in the audit log by sending the header themselves.

If the audit log shows your proxy's address for everyone, the proxy isn't in FIRESIGHT_TRUSTED_PROXIES, or isn't adding the header.

Note

FireSight handles forwarded headers itself. The container runs its web server with proxy headers off, so don't rely on the proxy to rewrite the client address in any other way.

Security headers

FireSight sends its own security headers (X-Content-Type-Options, X-Frame-Options: DENY, Referrer-Policy: no-referrer, Cache-Control: no-store) and a Content-Security-Policy on the interface. Your proxy doesn't need to add them, and shouldn't weaken them.

A separate interface address

The interface and API are normally served from the same address, and nothing more is needed. Only if you serve the interface from a different origin, list that origin in FIRESIGHT_CORS_ORIGINS. See Server configuration.