Network, Reverse Proxy & TLS
Production-style stack
deploy/docker-compose.https.yml exposes only the reverse proxy. PostgreSQL and the API are not published directly to the host.
Default production-oriented entry ports are 80 and 443. Local evaluation can use 18080 and 18443.
TLS
Generate local self-signed material with:
The generator writes:
Use a trusted certificate for real public deployment.
GDC_TRUST_PROXY_HEADERS controls whether forwarded headers are honored. The current production-style Compose stack enables proxy-header trust and sets trusted hosts to * because the API is intended to sit behind its bundled reverse proxy.
If you change the topology, restrict the trusted proxy boundary accordingly.
DNS
DataRelay Control does not require a product-specific DNS protocol. Point the desired hostname at the reverse proxy using normal DNS and TLS configuration.
Firewall
Expose only the browser/reverse-proxy ports you need. Do not expose PostgreSQL to the public Internet.Last modified on September 22, 2026
