HTTPS

Tip

Due to the architectural features of the HAP system, when the system access address changes due to proxy configuration, the docker-compose.yaml file must be updated accordingly.

As shown in the illustration below, modify the value of the ENV_ADDRESS_MAIN environment variable to match the actual access address of the HAP service. After completing the modification, restart the HAP service to apply the changes.

For earlier versions:
If your environment configuration has not yet defined ENV_ADDRESS_MAIN, please modify the parameters ENV_MINGDAO_PROTO, ENV_MINGDAO_HOST, and ENV_MINGDAO_PORT instead. The configuration logic remains consistent.

Nginx Configuration Example

If you need to configure HTTPS protocol-based proxy access to the HAP service, ensure you have prepared the SSL certificate in advance and use Nginx to proxy requests to the backend HAP service's internal network address.

Below is an example configuration for HTTPS reverse proxy setup with Nginx:

upstream hap {
    server SERVER_IP:8880; # Replace with your HAP internal network IP and port
}

server {
    listen 80;
    server_name _;
    rewrite ^(.*)$ https://$host$1 permanent;
}

server {
    listen 443 ssl;
    server_name _;
    access_log /data/logs/weblogs/hap.log main; # Customize the log path as needed
    error_log /data/logs/weblogs/hap.error.log; # Customize the log path as needed

    ssl_certificate         /etc/cert/fullchain.pem; # Replace with the path to your SSL certificate file
    ssl_certificate_key     /etc/cert/privkey.pem;   # Replace with the path to your SSL private key file

    underscores_in_headers on;
    client_max_body_size    2048m;
    gzip  on;
    gzip_proxied any;
    gzip_disable "msie6";
    gzip_vary on;
    gzip_min_length 512;
    gzip_comp_level 6;
    gzip_buffers 16 8k;
    gzip_types text/plain text/css application/json application/x-javascript application/javascript application/octet-stream text/xml application/xml application/xml+rss text/javascript image/jpeg image/gif image/png;

    location / {
        set $real_ip '';
        if ($http_x_real_ip) {
            set $real_ip $http_x_real_ip;
        }
        if ($http_x_real_ip = '') {
            set $real_ip $remote_addr;
        }
        proxy_set_header X-Real-IP $real_ip;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://hap;
    }

    # Required for IM
    location ~ /mds2 {
        proxy_set_header Host $http_host;
        proxy_hide_header X-Powered-By;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://hap;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
    }
}

If you wish to retain the original access method while setting up a new access address, please refer to Multiple Access Address Configuration.