Skip to main content

TLS & certificates

Operator

The frontend Nginx terminates TLS. Local deployments use a self-signed certificate by default; production should use a real certificate.

Where certificates live​

Certificates are mounted into the frontend container from the certs/ directory, referenced by the frontend Nginx configuration. The certs/ directory is gitignored — never commit private keys.

Local / self-signed (default)​

Out of the box, local deployments generate a self-signed cert for localhost, which is why browsers show a warning at https://localhost. This is fine for development.

Production certificate​

  1. Obtain a certificate and private key for your domain (from a public CA, or your internal CA for air-gapped environments).
  2. Place them in certs/ with the filenames the frontend Nginx config expects (e.g. fullchain.pem and privkey.pem — confirm against your nginx.conf).
  3. Restart the frontend container: 
    docker compose restart frontend
  4. Verify: 
    curl -v https://<your-domain>/api/v1/health

What's already enforced​

  • HTTP → HTTPS redirect (port 80 → 443).
  • HSTS with a one-year max-age and includeSubDomains.
  • A strong Content-Security-Policy and other security headers (see the Hardening guide).
Behind another proxy?

If you front Ticketra with an additional reverse proxy or load balancer, make sure the trust proxy hop count matches your real chain — otherwise per-IP rate limiting and audit IPs can be spoofed. This is on the hardening checklist.

Air-gapped environments​

Use your organization's internal CA. Distribute the CA certificate to client trust stores so browsers don't warn. No public CA or internet validation is required.