ConsoleConfigure your HTTPS address
Use a stable hostname and valid TLS certificate on your existing reverse proxy. Set ALLOWED_ORIGINS to the exact HTTPS origin used by browsers, with no path, query or fragment. Self-hosted Console Hub does not obtain certificates or bundle an edge proxy.
Restrict access to the application port
When the proxy runs on the same host, bind the application to loopback. When it runs elsewhere, bind to a private address and restrict the port to the proxy's source. Keep WebSocket upgrade support and suitable long-lived connection timeouts enabled.
Configure trusted proxies
Configure TRUSTED_PROXY to the proxy address or supported trusted range for your topology; do not blindly trust forwarded headers from every source. Ensure the proxy forwards the public host and scheme consistently.
Test access through HTTPS
Check sign-in, secure cookies, a long-lived terminal and the graphical protocols you use through the public origin. Passkeys require a secure browser context such as HTTPS or localhost. Keep guacd and any Docker Engine endpoint private.