> ## Documentation Index
> Fetch the complete documentation index at: https://siderolabs-fe86397c-1-11-reference.mintlify.site/llms.txt
> Use this file to discover all available pages before exploring further.

# How to expose Omni with Nginx (HTTPS)

### Omni deployment configuration

You need to deploy an omni instance the [how to deploy omni on prem guide](./deploy-omni-on-prem), with the following flags set:

```bash
--name=$OMNI_NAME
--private-key-source=file:///omni.asc
--bind-addr=127.0.0.1:8080
--advertised-api-url=https://$OMNI_DOMAIN/
--siderolink-api-bind-addr=127.0.0.1:8090
--siderolink-api-advertised-url=https://api.$OMNI_DOMAIN:443
--k8s-proxy-bind-addr=127.0.0.1:8100
--advertised-kubernetes-proxy-url=https://kube.$OMNI_DOMAIN/
--account-id=$OMNI_UUID
## Also add the authentication flags according to your setup
```

### Certificates

You can use acme or certbot to generate certificates for your domain. In the following nginx config, the are stored in `/var/lib/acme/omni/` and `/var/lib/acme/omni_api/` and `/var/lib/acme/omni_kube/`. Make sure to change the paths to your own or to output the certificates to those paths.

### Nginx configuration

Use the following configuration to expose omni with nginx. Make sure to change the domain name (`$OMNI_DOMAIN`) to your own domain and to update the certificate paths if applicable.

```nginx
http {
	proxy_redirect off;
	proxy_http_version 1.1;

	proxy_connect_timeout 60s;

	# Omni needs long timeouts for the long-lived connections
	proxy_send_timeout 1h;
	proxy_read_timeout 1h;

	# $connection_upgrade is used for websocket proxying
	map $http_upgrade $connection_upgrade {
		default upgrade;
		'' close;
	}

	# Omni HTTPS redirection
	server {
		listen 0.0.0.0:80;
		listen [::0]:80;
		server_name $OMNI_DOMAIN;
		location / {
			return 301 https://$host$request_uri;
		}
	}

	map $http_content_type $is_grpc {
		default 0;
		"application/grpc" 1;
	}

	# Omni main API
	server {
		listen 0.0.0.0:443 http2 ssl;
		listen [::0]:443 http2 ssl;
		server_name $OMNI_DOMAIN;
		ssl_certificate /var/lib/acme/omni/fullchain.pem;
		ssl_certificate_key /var/lib/acme/omni/key.pem;
		ssl_trusted_certificate /var/lib/acme/omni/chain.pem;
		location / {
			error_page 418 = @grpc;
			error_page 419 = @http;

			if ($is_grpc) {
				return 418;
			}

			return 419;
		}

		# Omni main GRPC API
		location @grpc {
			# Omni needs long timeouts for the long-lived GRPC stream connections
			grpc_read_timeout 1h;
			grpc_send_timeout 1h;
			grpc_pass grpc://127.0.0.1:8080;
		}

		# Omni main HTTP API
		location @http {
			proxy_pass http://127.0.0.1:8080;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
		}
	}

	# Omni SideroLink (a.k.a. Machine) API
	server {
		listen 0.0.0.0:443 http2 ssl;
		listen [::0]:443 http2 ssl;
		server_name api.$OMNI_DOMAIN;
		ssl_certificate /var/lib/acme/omni_api/fullchain.pem;
		ssl_certificate_key /var/lib/acme/omni_api/key.pem;
		ssl_trusted_certificate /var/lib/acme/omni_api/chain.pem;
		location / {
			# Omni needs long timeouts for the long-lived GRPC stream connections
			grpc_read_timeout 1h;
			grpc_send_timeout 1h;
			grpc_pass grpc://127.0.0.1:8090;
		}
	}

	# Omni Kube API
	server {
		listen 0.0.0.0:443 http2 ssl;
		listen [::0]:443 http2 ssl;
		server_name kube.$OMNI_DOMAIN;
		ssl_certificate /var/lib/acme/omni_kube/fullchain.pem;
		ssl_certificate_key /var/lib/acme/omni_kube/key.pem;
		ssl_trusted_certificate /var/lib/acme/omni_kube/chain.pem;
		location / {
			proxy_pass http://127.0.0.1:8100;
			proxy_set_header Upgrade $http_upgrade;
			proxy_set_header Connection $connection_upgrade;
		}
	}
}
```

## How to use

The omni instance will be available at `https://$OMNI_DOMAIN/`, the API at `https://api.$OMNI_DOMAIN/` and the kubernetes proxy at `https://kube.$OMNI_DOMAIN/`.