Self Hosted instance behind a reverse proxy like nginx

[ghanjiboy]

Is there some guidance around how to expose anytype self hosted instance to the internet with a reverse proxy?

Thanks!

[fb929]

you can use any TCP/UDP load balancer, such as Nginx Stream.
after configuring the load balancer, you need to add the corresponding addresses to the static configuration for new clients - heart.yml (or client.yml if you are using our any-sync-dockercompose) as well as to the "network configuration" in Mongo.

[TAT-Hins]

Thanks for your help.

as well as to the "network configuration" in Mongo.

I would like to know how to apply these changes in Mongo, since I modified the original docker-compose configurations and connected any-sync services to my own independent Mongo docker container.

[fb929]

In any-sync-dockercompose, changes are automatically applied upon restart (see the service any-sync-coordinator_bootstrap in docker-compose.yml).
You can also perform this step manually.
Ensure that the necessary changes are present in the file /etc/any-sync-coordinator/network.yml.
You can check the config in Mongo like this: https://github.com/anyproto/puppet-anysync?tab=readme-ov-file#ahow-current-config-in-mongo.

[ghanjiboy]

Thank you - what nodes needs to be exposed outside of the load balancer - all of them or only certain nodes?

[fb929]

Thank you - what nodes needs to be exposed outside of the load balancer - all of them or only certain nodes?

You need to ensure access to all services described in the client config file ./etc/client.yml.

[neoromantique]

Is there a way to make sure it is a private network if I expose it online through a subdomain? I.e I don't want to have somebody else uploading data to my instance (even if it is encrypted data)

or would id/networkId act as a secret in that case and prevent it?

[fb929]

at the moment, it is only possible to restrict access at the network level (firewall, private local network, etc...)
access cannot be restricted at the daemon configuration level.

[phxyz12]

Hi,

To my knowledge, anyone who knows your external IP and the ports can create workspaces. I only access my Anytype backend from the Internet via a Wireguard VPN tunnel. This works reliably also on mobile devices. I created a tunnel which only routes traffic to my Anytype backend IP through it. I always have this tunnel running on my phone, it always works and doesn't interfere with anything else. If you have also other services you want to access from the Internet, you could also expose those only via Wireguard through the same tunnel. This adds a lot security to the whole story.

[tribals]

In my deployment, all the "any-" services are behind reverse proxy. They all configured to listen on localhost (yamux/quic listenAddrs binds only to localhost). How do I configure network.yml given to clients properly? If I fill it with localhost:5430 etc then a remote client will not be able to connect, obviously. On the other hand, if I fill network.yml with public domain name, then "any-" services will not be able to find each other.

I've though that I can fill configuration files for each "any-" service with localhost address, and network.yml with public address but seems like this is not the case - after any-sync-confapply -n network.yml -e, services starts trying to connect using public address. On the other hand, as I said before. filling network.yml with localhost doesn't make any sense for remote client.

I've tried to comment out network key in "any-" services configuration files, but they fail to start in this case.

What is the reason of having network in config files? What is the reason of storing db.coordinator.nodeConf in mongo? What is the reason of having nodes other than coordinator in network.yml given to client, if it asks coordinator for all other nodes anyway?

@fb929

[fb929]

in network.yml, you need to specify both the external addresses that clients will use to connect to the server and the internal addresses that servers will use to communicate with each other.

after making changes, you need to synchronize the configuration to MongoDB using the following command:
any-sync-confapply -c /etc/any-sync-coordinator/config.yml -n /etc/any-sync-coordinator/network.yml -e

the static configuration in client.yml is required only for the client’s cold start, when it does not yet have any configuration.
after that, the client connects to any-sync-coordinator and downloads the current configuration from MongoDB.

in theory, the client.yml file distributed to clients only needs to contain the coordinator addresses.
however, we have encountered some bugs with this approach, so I recommend keeping client.yml identical to the network configuration stored in MongoDB.

[grishy]

@ghanjiboy you may check the proxy example configuration here from any-sync-bundle:
https://github.com/grishy/any-sync-bundle/blob/main/compose.traefik.yml