Web Proxy with SSL

Simple, Secure Exposure of an Internal Service to the Internet

This template provides a lightweight way for clients to expose an internal service (HTTP or WebSocket) to the public internet through the Trooper.AI router system. It automatically creates a secure HTTPS endpoint with a free SSL certificate, while forwarding traffic to any internal port on the client’s machine.

The goal is simplicity: install a small proxy, specify the internal port, and instantly get a secure, externally reachable URL.

All traffic from the Webproxy’s SSL Endpoint to your machine’s public port is routed in our internal network, completely bypassing the internet. This is a significant security advantage of Trooper.AI.

Key Features

1. Public HTTPS Endpoint

Your internal service becomes available under a *.secure.trooper.ai subdomain, routed through the Trooper.AI infrastructure with automatic SSL certificates.

2. Full WebSocket Support

The template forwards both standard HTTP traffic and WebSocket connections without additional configuration.

3. Optional Password Protection

If a username and password are provided, the endpoint is secured with Basic Auth. Leaving both values empty disables authentication.

4. Clean and Minimal Setup

Each installed instance of SSL Web Proxy creates a dedicated proxy endpoint, listens on an automatically assigned external port, and forwards traffic to the configured internal service.

How It Works

Inputs

You only set template configuration before installation.

The external port will be assigned automatically and displayed next to the template name, just like with other templates.

🚨 Do not use port 443 and don’t provide a self sign certificate on your port!

Internal Flow

1. Nginx is installed (including htpasswd support).
2. If authentication is enabled, a password file is created.
3. A proxy configuration is placed under /etc/nginx/sites-available/trooperai-webproxy-<external_port>
4. The config forwards all incoming traffic to http://127.0.0.1:<internal_port>.
5. WebSocket upgrade headers are automatically passed through.
6. Nginx is reloaded and the endpoint becomes active.

Timeout classes

The proxy also upgrades timeouts dynamically on the response (e.g., if your server sends 206 or Content-Disposition: attachment, it bumps to the DOWNLOAD timeout even if the request wasn’t classified as a download initially).

⚠️ The long timeout on streaming only works if your service streams the response! Slow or non-streaming requests can still be dropped at 60s. So also make sure TTFT is below 60s and data keeps flowing.!

Example Result

Given a Trooper.AI-assigned domain such as:

myapp123-husky-delta.secure.trooper.ai

and an automatically assigned external proxy port (e.g., 12345), with an internal service listening on port 8080,

the connection flow will be: https://myapp123-husky-delta.secure.trooper.ai -> 12345 -> 8080.

This securely forwards traffic from the public HTTPS endpoint to your internal service.

Troubleshooting

We have compiled answers to common questions regarding the webproxy feature. For individual assistance, please contact our support team: Support Contacts.

Where to find my HTTPS domain?

Ensure your internal service is running on the desired port, then install or update the corresponding Web Proxy SSL instance. Its assigned domain and SSL activation status (indicated by a lock icon) will then be displayed.

Does the WebProxy support UDP and WebSockets?

WebSocket is simply an HTTP(S) upgrade — fully supported by the WebProxy, enabling seamless integration with widely used AI applications featuring web interfaces.

UDP is a stateless protocol requiring no certificates; you communicate directly via hostname:port instead. Encryption is managed at the application level (e.g., LiveKit using DTLS). Since the WebProxy is HTTP-based and HTTP runs over TCP, it cannot forward UDP — but you don’t need a proxy for UDP anyway. Simply open the required UDP ports in your firewall.

Can I restricting Access to Specific IP Addresses?

Our SSL WebProxy integrates seamlessly with Trooper.AI’s built-in firewall rules. To restrict access to designated IP addresses or ranges for enhanced security, configure the respective firewall policies in the Management Dashboard.

For detailed guidance on implementing IP restrictions, refer to our documentation:🛡️ Trooper.AI customizable Network-Level Firewall

Is my internal service HTTP or HTTPS?

That’s a valid question. Internally, your service operates as a standard HTTP service on a configurable port, such as 8080. This port remains internal to your server instance. The web proxy service installed via this template handles SSL encryption, automatically provisioning and managing the SSL certificate for secure external access. Essentially, this template establishes a secure HTTPS connection between your internal port and the public internet.

Existing Nginx Configurations

This template installs and configures Nginx to route internal traffic on your GPU server. While it will not override existing configurations, managing Nginx directly on your GPU server is generally not recommended due to potential complexity. Consider whether direct Nginx management is necessary for your workflow.

Multiple Web Proxy SSL instances can run in parallel. Each instance creates its own Nginx configuration based on its assigned external port, so the individual proxy configurations remain separated.

Handling Blocked Requests and Brute-Force Protection

Our Secure SSL Proxy includes infrastructure-level protection to keep the routing layer stable and shield your service from abusive traffic. It continuously monitors connection health and traffic patterns, and temporarily throttles sources that cause repeated failures. So the proxy can tell a genuine outage from normal operation, your service should signal real problems clearly — by rejecting or closing the connection, or returning a 5xx server error when it is genuinely unavailable.

Application-level authentication (e.g. login or API-key checks returning 401/403) is handled by your own service. The proxy intentionally does not block on these, so normal auth flows are never disrupted.

Error Codes (E-Codes)

If you encounter an error page while accessing your endpoint, it will display a unique error code (e.g. e-code: TP3) in its headline. Please include this code when contacting support — it helps us pinpoint the cause immediately.

💡 Avoid aggressive automatic retries when you see an error page. Repeated failing requests can lead to a temporary block (TP4).