You can publish a manually installed MDriven Server and MDriven Turnkey instance through Nginx on standard HTTP and HTTPS ports; this guide is for administrators who completed the local Ubuntu installation.

What this configuration does

Nginx is a reverse proxy: it accepts requests from users on ports 80 and 443, then forwards each request to an application running locally on the same server.

This guide uses one hostname for each service:

Public URL	Local upstream service	Nginx site file
http://server.example.com	MDriven Server at http://127.0.0.1:5010	/etc/nginx/sites-available/mdrivenserver
http://turnkey.example.com	MDriven Turnkey at http://127.0.0.1:5011	/etc/nginx/sites-available/mdriventurnkey

For example, a user opening https://turnkey.example.com connects to Nginx. Nginx forwards the request locally to Turnkey at 127.0.0.1:5011; the user does not need direct access to port 5011.

This is the manual-installation configuration. If you deploy MDriven in containers, use Documentation:Deploying MDriven to Production with Nginx instead. That deployment has its own supplied Nginx and port configuration.

Before you start

Complete HowTos:Local Installation and confirm all of the following:

• Nginx is installed.
• MDriven Server listens on 127.0.0.1:5010.
• MDriven Turnkey listens on 127.0.0.1:5011.
• Each planned hostname has a DNS record pointing to this server's public IP address. In this guide, those names are server.example.com and turnkey.example.com.
• You can use sudo on the server.

Check the services and test the local upstreams:

sudo systemctl status nginx
sudo systemctl status mdrivenserver.service
sudo systemctl status mdriventurnkey.service

curl http://127.0.0.1:5010
curl http://127.0.0.1:5011

The service status should show active (running). The curl commands must receive a response before you configure Nginx. If either local request fails, troubleshoot the MDriven service first; Nginx cannot proxy to an unavailable upstream.

Create the Nginx site configurations

Nginx virtual-host configuration files are stored in /etc/nginx/sites-available. A symbolic link in /etc/nginx/sites-enabled enables each site.

A default site can remain unless it conflicts with these hostnames. To disable the default enabled site, remove its enabled link:

sudo rm /etc/nginx/sites-enabled/default

Configure MDriven Server

1. Create and open the site file.

sudo nano /etc/nginx/sites-available/mdrivenserver

1. Paste the following configuration. Replace server.example.com with the actual hostname for MDriven Server.

server {
    listen 80;
    server_name server.example.com;

    location / {
        proxy_pass http://127.0.0.1:5010;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_read_timeout 300;
        proxy_connect_timeout 300;
        proxy_send_timeout 300;

        proxy_redirect off;
    }

    error_log /var/log/nginx/mdriven_server_error.log;
    access_log /var/log/nginx/mdriven_server_access.log;
}

1. In Nano, press Ctrl+O, press Enter to save, then press Ctrl+X to exit.

Configure MDriven Turnkey

1. Create and open the site file.

sudo nano /etc/nginx/sites-available/mdriventurnkey

1. Paste the following configuration. Replace turnkey.example.com with the actual hostname for MDriven Turnkey.

server {
    listen 80;
    server_name turnkey.example.com;

    location / {
        proxy_pass http://127.0.0.1:5011;
        proxy_http_version 1.1;

        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";

        proxy_read_timeout 300;
        proxy_connect_timeout 300;
        proxy_send_timeout 300;

        proxy_redirect off;
    }

    error_log /var/log/nginx/mdriven_turnkey_error.log;
    access_log /var/log/nginx/mdriven_turnkey_access.log;
}

The Host and X-Forwarded-* headers preserve the hostname, client address, and original protocol for the upstream application. The Upgrade and Connection headers allow upgrade requests through the proxy, which is important for persistent application communication such as WebSocket connections.

Enable and validate the sites

1. Enable both configurations by creating symbolic links.

sudo ln -s /etc/nginx/sites-available/mdrivenserver /etc/nginx/sites-enabled/
sudo ln -s /etc/nginx/sites-available/mdriventurnkey /etc/nginx/sites-enabled/

1. Test the complete Nginx configuration before reloading it.

sudo nginx -t

1. Continue only when the output includes syntax is ok and test is successful.
2. Restart Nginx and verify that it is running.

sudo systemctl restart nginx
sudo systemctl status nginx

Configure firewall access

Allow public HTTP and HTTPS traffic to Nginx:

sudo ufw allow 'Nginx Full'
sudo ufw status

When Nginx is the public entry point, ports 5010 and 5011 do not normally need public firewall access because Nginx reaches them through the local loopback addresses. After you confirm that both hostnames work through Nginx, remove any public rules previously created for those ports:

sudo ufw delete allow 5010/tcp
sudo ufw delete allow 5011/tcp

Do not remove these rules until proxy access has been verified.

Verify HTTP access

Open the configured hostnames in a browser:

• http://server.example.com for MDriven Server.
• http://turnkey.example.com for MDriven Turnkey.

If a hostname does not reach the intended service, first confirm that its DNS record points to the server and that the matching server_name value is correct.

Enable HTTPS with Certbot

Use HTTPS for a public installation. The following steps use Certbot with the Nginx plugin to obtain and install Let's Encrypt certificates.

Install Certbot

sudo apt update
sudo apt install certbot python3-certbot-nginx
sudo systemctl start nginx

Request certificates

Before requesting certificates, verify that:

• Both hostnames resolve publicly to this server.
• Port 80 is open and both sites are accessible over HTTP.
• Port 443 is open for HTTPS access.
• sudo nginx -t succeeds.

Request certificates for both hostnames:

sudo certbot --nginx -d server.example.com -d turnkey.example.com

Replace both example names with your own names. Follow the Certbot prompts and choose the redirect option when offered, so HTTP requests are redirected to HTTPS.

Let's Encrypt requires publicly valid domain names. It cannot normally issue a public certificate for a private address such as 10.0.2.15.

Verify HTTPS and renewal

1. Test and restart the Nginx configuration updated by Certbot.

sudo nginx -t
sudo systemctl restart nginx

1. Open both URLs and confirm that the browser uses HTTPS:

• https://server.example.com
• https://turnkey.example.com

Let's Encrypt certificates are valid for 90 days. Check the Certbot timer and test a renewal without changing certificates:

sudo systemctl status certbot.timer
sudo certbot renew --dry-run

Troubleshoot the request path

Check the request path in order: MDriven service, local upstream response, Nginx syntax and service, then public DNS and firewall access.

Symptom	Check	Command
Nginx does not start or reload	Find configuration errors before making further changes.	sudo nginx -t
MDriven Server does not respond through Nginx	Confirm that the service is running and answers locally on port 5010.	sudo systemctl status mdrivenserver.service curl http://127.0.0.1:5010
Turnkey does not respond through Nginx	Confirm that the service is running and answers locally on port 5011.	sudo systemctl status mdriventurnkey.service curl http://127.0.0.1:5011
Nginx returns an error while the local upstream works	Inspect the Nginx service journal and the site-specific error log.	sudo journalctl -u nginx -n 100 --no-pager sudo tail -f /var/log/nginx/mdriven_server_error.log sudo tail -f /var/log/nginx/mdriven_turnkey_error.log
A hostname cannot be reached from outside the server	Confirm DNS, ports 80/443, and firewall rules.	sudo ufw status

If you need to restart every component after correcting a service issue, run:

sudo systemctl restart mdrivenserver.service
sudo systemctl restart mdriventurnkey.service
sudo systemctl restart nginx

For MDriven application logs created by the local installation, see Local Installation.

See also

• HowTos:Local Installation
• Documentation:Deploying MDriven to Production with Nginx
• Documentation:Deployment
• Documentation:Advanced Docker Compose Configuration for MDriven
• Documentation:Serving MDriven using Apache Webserver