Reverse Proxy Configuration

Running through a reverse proxy means the Kitto^x application is not exposed directly to users. Instead, a web server (Apache, nginx, IIS) accepts external requests and forwards them to the Kitto^x Indy server running on localhost.

Why use a proxy

• HTTPS: the proxy terminates SSL/TLS; the application communicates over plain HTTP internally
• Security: battle-tested web servers shield you from vulnerabilities in the embedded server
• Multiple apps: host several Kitto^x applications on the same port (80/443) under different paths
• Independent restarts: each application runs as a separate process (or Windows Service) — restart one without affecting others
• Static file caching: the proxy can cache static resources
• Load balancing: distribute requests across multiple instances (Apache, nginx)

Note on sessions

Kitto^x stores sessions in memory (stateful). Load balancing requires sticky sessions (session affinity) so that all requests from the same client go to the same instance.

Proxy modes

Full proxy mode (recommended)

All requests (static and dynamic) are forwarded to the Kitto^x application. This is the simplest configuration and works out of the box because Kitto^x serves its own static resources internally via TKMultipleStaticWebRoute.

Mixed proxy mode (optional optimization)

Only dynamic requests (/kx/) are forwarded; static resources (/res/) are served directly by the proxy from the filesystem. This is faster for high-traffic deployments but requires additional configuration.

To enable mixed mode, set Application/HandleResources: False in Config.yaml and configure the proxy to serve static files:

Application:
  HandleResources: False

Home directory consolidation

In mixed mode, the proxy serves static files from a single directory. You need to merge the framework Home/Resources/ and the application Home/Resources/ into one folder (application files overwrite framework files with the same name).

nginx

Full proxy

server {
    listen 80;
    server_name localhost;

    location /hellokittox/ {
        proxy_pass http://127.0.0.1:3621/hellokittox/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location = /hellokittox {
        return 301 /hellokittox/;
    }
}

The location = /hellokittox block handles the trailing-slash redirect, essential for correct relative URL resolution in the browser.

Mixed proxy

server {
    listen 80;
    server_name localhost;

    # Static resources served directly by nginx
    location /hellokittox/res/ {
        alias C:/MyApp/Home/Resources/;
    }

    # Dynamic requests forwarded to KittoX
    location /hellokittox/ {
        proxy_pass http://127.0.0.1:3621/hellokittox/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location = /hellokittox {
        return 301 /hellokittox/;
    }
}

HTTPS

server {
    listen 443 ssl;
    server_name myserver.example.com;

    ssl_certificate      conf/ssl/server.crt;
    ssl_certificate_key  conf/ssl/server.key;

    location /hellokittox/ {
        proxy_pass http://127.0.0.1:3621/hellokittox/;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
    }
    location = /hellokittox {
        return 301 /hellokittox/;
    }
}

Apache

Enable the proxy modules:

LoadModule proxy_module modules/mod_proxy.so
LoadModule proxy_http_module modules/mod_proxy_http.so

Full proxy

<IfModule proxy_http_module>
    ProxyPass "/hellokittox" "http://localhost:3621/hellokittox"
    ProxyPassReverse "/hellokittox" "http://localhost:3621/hellokittox"
</IfModule>

• hellokittox must match AppPath in Config.yaml
• localhost is the machine where the Kitto^x service is running
• 3621 is the Server/Port in Config.yaml

Mixed proxy

<IfModule proxy_http_module>
    ProxyPass "/hellokittox/res" "!"
    ProxyPass "/hellokittox" "http://localhost:3621/hellokittox"
    ProxyPassReverse "/hellokittox" "http://localhost:3621/hellokittox"
</IfModule>

<IfModule alias_module>
    Alias /hellokittox/res/ "C:/MyApp/Home/Resources/"
</IfModule>

<Directory "C:/MyApp/Home/Resources/">
    Require all granted
</Directory>

The ProxyPass "/hellokittox/res" "!" line excludes /res/ from proxying; Apache serves those files directly via the Alias.

HTTPS

Add the same ProxyPass directives inside the <VirtualHost *:443> block.

IIS (Application Request Routing)

1. Install Application Request Routing (ARR) and URL Rewrite from the IIS downloads page
2. Open IIS Manager > server node > Application Request Routing Cache > Server Proxy Settings
3. Check Enable proxy and click Apply
4. Create a URL Rewrite inbound rule:
   • Pattern: ^hellokittox/(.*)
   • Action type: Rewrite
   • Rewrite URL: http://localhost:3621/hellokittox/{R:1}

Repeat for each application with the corresponding port.

Multiple applications

Each Kitto^x application runs on its own port. Add a proxy block for each:

Application	AppPath	Port
HelloKittoX	/hellokittox	3621
TaskittoX	/taskittox	3622
KEmployeeX	/kemployeex	3623

nginx example:

location /hellokittox/ { proxy_pass http://127.0.0.1:3621/hellokittox/; ... }
location /taskittox/   { proxy_pass http://127.0.0.1:3622/taskittox/;   ... }
location /kemployeex/  { proxy_pass http://127.0.0.1:3623/kemployeex/;  ... }

Apache example:

ProxyPass "/hellokittox" "http://localhost:3621/hellokittox"
ProxyPass "/taskittox"   "http://localhost:3622/taskittox"
ProxyPass "/kemployeex"  "http://localhost:3623/kemployeex"
ProxyPassReverse "/hellokittox" "http://localhost:3621/hellokittox"
ProxyPassReverse "/taskittox"   "http://localhost:3622/taskittox"
ProxyPassReverse "/kemployeex"  "http://localhost:3623/kemployeex"

See also

• Windows Service Deployment — run as a service with install/uninstall batch scripts
• Standalone Deployment — desktop GUI mode
• Apache Module Deployment — native Apache module (no proxy needed)
• ISAPI Deployment (IIS) — native IIS module (no proxy needed)
• Deployment Overview — all deployment modes