Skip to main content

Configuring Multiple Access Addresses for the HDP System

Background description​

In a real application, you may need to access the same system through multiple domain names or addresses (such as example.example.com and new.example.com).

However, due to the routing and security mechanisms within the system, directly reverse proxying the new access address to the main address will cause problems such as session verification failure and page resource loading exceptions.

This document will guide you on how to achieve safe and stable access to the system from multiple addresses through correct configuration.

Core principles​

For the system to correctly handle requests from multiple source addresses, the key is to enable the backend service to identify the "true source" of each request. This requires three configurations working together:

  1. Unified proxy goal: All requests for extended addresses should be forwarded to a dedicated port 18880 inside the container through a reverse proxy (such as Nginx).

  2. Declaration source address (pdaddr): In the reverse proxy configuration, an HTTP request header named pdaddr must be added. Its value is the full address actually requested by the client, used to explicitly inform the backend.

  3. Address Whitelist: All extended access addresses must be added to a whitelist environment variable ENV_ADDRESS_ALLOWLIST so that the system can verify their legitimacy.

Through the above configuration, the system can correctly identify and process requests from different addresses, dynamically generate the correct resource URL, and ensure normal functions.

Configuration steps​

  1. Add port mapping under app service ports in docker-compose.yaml, and map the 18880 port in the container.

    - 18880:18880

  2. Add an environment variable under the app service environment. The value of the environment variable is your extended access address. Please separate multiple addresses with commas.

    ENV_ADDRESS_ALLOWLIST: "https://example2.domain.com"

  3. Restart the service in the installation manager directory to take effect.

    bash ./service.sh restartall

  4. Configure the nginx file to reverse proxy the new access address to the 18880 port of the microservice

    nginx reverse proxy configuration file reference:

  5. Add proxy_set_header pdaddr under the nginx configuration file localtion to specify the access system access address

    Such as:

    location / {
        set $real_ip '';
        if ($http_x_real_ip) {
            set $real_ip $http_x_real_ip;
        }
        if ($http_x_real_ip = '') {
            set $real_ip $remote_addr;
        }
        proxy_set_header X-Real-IP $real_ip;
        proxy_set_header Host $http_host;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_pass http://hdp;
        proxy_set_header pdaddr https://example2.domain.com; #Added, please change it to your actual extended access address.
    }

    location ~ /mds2 {
        proxy_set_header Host $http_host;
        proxy_hide_header X-Powered-By;
        proxy_set_header X-NginX-Proxy true;
        proxy_pass http://hdp;
        proxy_redirect off;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection upgrade;
        proxy_set_header pdaddr https://example2.domain.com; #Added, please change it to your actual extended access address.
    }

    location ~ ^/(agent|api/workflow/api/sse/chat) {
        set $md_real_ip '';
        if ($http_x_real_ip) {
            set $md_real_ip $http_x_real_ip;
        }
        if ($http_x_real_ip = '') {
            set $md_real_ip $remote_addr;
        }

        proxy_buffering off;
        proxy_read_timeout 30m;
        proxy_send_timeout 30m;
        client_max_body_size 16m;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $md_real_ip;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-HTTP-Method-Override "";
        proxy_set_header pdaddr https://example2.domain.com; #Added, please change it to your actual extended access address.
        proxy_pass http://hdp;
        proxy_redirect default;
    }

  6. After reloading nginx, you can use the system normally through the new access address.