| 1 | # Running Netdata behind lighttpd v1.4.x |
| 2 | |
| 3 | Here is a config for accessing Netdata in a suburl via lighttpd 1.4.46 and newer: |
| 4 | |
| 5 | ```text |
| 6 | $HTTP["url"] =~ "^/netdata/" { |
| 7 | proxy.server = ( "" => ("netdata" => ( "host" => "127.0.0.1", "port" => 19999 ))) |
| 8 | proxy.header = ( "map-urlpath" => ( "/netdata/" => "/") ) |
| 9 | } |
| 10 | ``` |
| 11 | |
| 12 | If you have older lighttpd, you have to use a chain (such as below), as explained [at this Stack Overflow answer](http://stackoverflow.com/questions/14536554/lighttpd-configuration-to-proxy-rewrite-from-one-domain-to-another). |
| 13 | |
| 14 | ```text |
| 15 | $HTTP["url"] =~ "^/netdata/" { |
| 16 | proxy.server = ( "" => ("" => ( "host" => "127.0.0.1", "port" => 19998 ))) |
| 17 | } |
| 18 | |
| 19 | $SERVER["socket"] == ":19998" { |
| 20 | url.rewrite-once = ( "^/netdata(.*)$" => "/$1" ) |
| 21 | proxy.server = ( "" => ( "" => ( "host" => "127.0.0.1", "port" => 19999 ))) |
| 22 | } |
| 23 | ``` |
| 24 | |
| 25 | If the only thing the server is exposing via the web is Netdata (and thus no suburl rewriting required), |
| 26 | then you can get away with just |
| 27 | |
| 28 | ```text |
| 29 | proxy.server = ( "" => ( ( "host" => "127.0.0.1", "port" => 19999 ))) |
| 30 | ``` |
| 31 | |
| 32 | Though if it's public facing, you might then want to put some authentication on it. |
| 33 | |
| 34 | :::tip Simpler Alternative |
| 35 | |
| 36 | If you use Netdata Cloud, [Bearer Token Protection](/docs/netdata-agent/configuration/secure-your-netdata-agent-with-bearer-token.md) provides authentication with a single setting - no htdigest files or lighttpd auth configuration needed. |
| 37 | |
| 38 | ::: |
| 39 | |
| 40 | `htdigest` support looks like: |
| 41 | |
| 42 | ```text |
| 43 | auth.backend = "htdigest" |
| 44 | auth.backend.htdigest.userfile = "/etc/lighttpd/lighttpd.htdigest" |
| 45 | auth.require = ( "" => ( "method" => "digest", |
| 46 | "realm" => "netdata", |
| 47 | "require" => "valid-user" |
| 48 | ) |
| 49 | ) |
| 50 | ``` |
| 51 | |
| 52 | other auth methods, and more info on htdigest, can be found in lighttpd's [mod_auth docs](http://redmine.lighttpd.net/projects/lighttpd/wiki/Docs_ModAuth). |
| 53 | |
| 54 | It seems that lighttpd (or some versions of it), fail to proxy compressed web responses. |
| 55 | To solve this issue, disable web response compression in Netdata. |
| 56 | |
| 57 | Open `/etc/netdata/netdata.conf` and set in `[global]`: |
| 58 | |
| 59 | ```text |
| 60 | enable web responses gzip compression = no |
| 61 | ``` |
| 62 | |
| 63 | ## limit direct access to Netdata |
| 64 | |
| 65 | You would also need to instruct Netdata to listen only to `127.0.0.1` or `::1`. |
| 66 | |
| 67 | To limit access to Netdata only from localhost, set `bind socket to IP = 127.0.0.1` or `bind socket to IP = ::1` in `/etc/netdata/netdata.conf`. |