Server Deployment

This section describes how to deploy the Parsec Server on Linux.

Before you begin, take a look at the Application architecture section for an overview of software systems and interactions involved with the Parsec Server.

The steps and requirements described in this section may vary based on your specific needs. It is recommended to deploy and observe performance on a pilot project prior to using in production.

Note

Some setup and administrative operations must be performed with Parsec CLI on Linux. Please refer to the Install Parsec CLI on Linux section.

Deployment options

Parsec offers the following deployment options:

TL;DR - Quick deploy with Docker

We provide a detailed explanation of the required configuration below. But if you just want to deploy a Parsec server locally you can do it with the following commands:

git clone --depth 1 https://github.com/Scille/parsec-cloud.git
cd parsec-cloud/docs/hosting/deployment
bash setup-tls.sh
bash gen-secrets.sh
docker compose --file parsec-server.docker.yaml up

Prerequisites

The Parsec Server depends on the following components:

Optionally, the following components can be used to support additional features:

Important

For security reasons, installation and configuration of these components are not covered in this guide. Please refer to their corresponding official documentation for instructions on how to do it.

This guide provides instructions for quickly settings up mock-ups or basic installs of those components. Keep in mind that these instructions are provided for convenience and should not be used in production.

Important

It is not recommended to deploy both Parsec Server and PostgreSQL database on a single system for production use, but it is a good option for testing purposes.

System Requirements

The following panel describes the minimum software and hardware requirements.

Minimum system requirements

  • Hardware: 1 vCPU/core with 1GB RAM

  • Database: PostgreSQL v16+, 20GB for metadata storage

  • S3 Object Storage: 2TB for encrypted data storage (around x100 metadata size)

Preparation

TLS certificates

This section describe how to generate the required TLS certificates with a custom Certificate Authority (CA) created for this purpose.

Important

For a production environment, you should always use certificates issued from a trusted CA.

The setup-tls.sh script below will allow you to generate everything you need:

  1. Generate the CA key & self-signed certificate (tls/ca{-key}.pem).

  2. For parsec-s3 and parsec-server services:

    1. Generate the service key & Certificate Signing Request (CSR) tls/$service{-key,}.pem.

    2. Generate the certificate using the CSR and the CA.

setup-tls.sh 
 1# shellcheck disable=SC2148
 2# cspell:words cfssl gencert initca cfssljson tonumber
 3set -e
 4
 5if ! command -v cfssl; then
 6    echo "Command 'cfssl' not found, you need to install it to use this script" >&2
 7    exit 1
 8fi
 9
10mkdir -p tls
11
12if [ ! -f tls/ca-key.pem ] || [ ca-csr.json -nt tls/ca-key.pem ]; then
13    cfssl gencert -initca ca-csr.json | cfssljson -bare tls/ca
14fi
15
16# Number of days the certificates are valid according to the config file.
17# NOTE: this parsing only support `expiry` specified in hours (e.g. "360h").
18SERVER_CERT_LIFESPAN=$(jq '.signing.profiles.server.expiry | scan("[0-9]+") | tonumber | . / 24' ./ca-config.json)
19
20echo "Removing expired certificates:"
21find tls -type f -not \( -name 'ca*' -or -name '*-key.pem' -or -name '*.csr' \) -mtime "+$SERVER_CERT_LIFESPAN" -print -delete
22
23for service in parsec s3 proxy; do
24    if [ ! -f "tls/${service}.csr" ] || [ "${service}-csr.json" -nt "tls/${service}.csr" ]; then
25        cfssl genkey \
26            -config=ca-config.json -profile=server "${service}-csr.json" | cfssljson -bare "tls/${service}"
27    fi
28
29    if [ ! -f "tls/${service}.pem" ] || [ "tls/${service}.csr" -nt "tls/${service}.pem" ] || [ tls/ca-key.pem -nt "tls/${service}.pem" ]; then
30        cfssl sign \
31            -ca=tls/ca.pem -ca-key=tls/ca-key.pem \
32            -config=ca-config.json -profile=server "tls/${service}.csr" | cfssljson -bare "tls/${service}"
33    fi
34done

Set up the env files

The easiest way to configure the Parsec Sever is by using environment variables. These variables can be stored in a file and sourced before running the server.

In this guide, the environment variables are stored into multiple files in order to better describe how to configure each component.

Creating the secrets

Deploying the services requires certain secret values:

  • An administration token for admin operations on the server.

  • A random seed for parsec-account (this is an unfinished feature, the seed is not being used but it is still required by the server)

  • Access credential for rustfs, which is the object-storage service used in the docker-compose stack.

For that, we provide a simple script that generate these secrets and save them locally:

gen-secrets.sh 
 1# shellcheck disable=SC2148
 2set -euo pipefail
 3
 4SECRETS_FOLDER=secrets
 5
 6mkdir -p $SECRETS_FOLDER
 7
 8PARSEC_ADMIN_ENV_FILE=$SECRETS_FOLDER/parsec-admin-token.env
 9if [ ! -f $PARSEC_ADMIN_ENV_FILE ]; then
10    (
11        echo "PARSEC_ADMINISTRATION_TOKEN=$(openssl rand -hex 32)"
12        echo "PARSEC_FAKE_ACCOUNT_PASSWORD_ALGORITHM_SEED=$(openssl rand -hex 32)"
13    ) | tee $PARSEC_ADMIN_ENV_FILE
14else
15    cat $PARSEC_ADMIN_ENV_FILE
16fi
17
18RUSTFS_ENV_FILE=$SECRETS_FOLDER/rustfs.env
19if [ ! -f $RUSTFS_ENV_FILE ]; then
20    (
21        echo "RUSTFS_ACCESS_KEY=$(openssl rand -hex 16)"
22        echo "RUSTFS_SECRET_KEY=$(openssl rand -base64 32)"
23    ) | tee $RUSTFS_ENV_FILE
24else
25    cat $RUSTFS_ENV_FILE
26fi

Database env file

Create the file parsec-db.env and specify the following content to configure the access to the PostgreSQL database:

parsec-db.env 
1# The PostgreSQL database URL
2PARSEC_DB=postgresql://DB_USER:DB_PASS@parsec-postgres:5432/parsec
3
4# The minimum number of connections to the database
5PARSEC_DB_MIN_CONNECTIONS=5
6
7# The maximum number of connections to the database
8PARSEC_DB_MAX_CONNECTIONS=7

SMTP env file

Create the file parsec-smtp.env to configure the access to the SMTP server (mailhog in this case).

We need to set the connection information, the sender information, the default language the emails are sent in:

parsec-smtp.env 
 1# The SMTP host to use for sending email
 2PARSEC_EMAIL_HOST=parsec-smtp
 3
 4# The SMTP server port
 5PARSEC_EMAIL_PORT=1025
 6
 7# The SMTP server username
 8PARSEC_EMAIL_HOST_USER=SMTP_USER
 9
10# The SMTP password
11PARSEC_EMAIL_HOST_PASSWORD=SMTP_PASS
12
13# The SMTP sender's email address
14PARSEC_EMAIL_SENDER=parsec@test.xyz
15
16# Enable to use TLS (secure) connection to connect to the SMTP server
17# PARSEC_EMAIL_USE_SSL
18
19# Enable to use implicit TLS (secure) connection to connect to the SMTP server
20# PARSEC_EMAIL_USE_TLS

S3 env file

Create the file parsec-s3.env with the following content to set the URL for the S3-like service:

parsec-s3.env 
 1# The blockstore configuration
 2#
 3# The syntax should be one of the following:
 4#
 5# - s3:[<endpoint_url>]:<region>:<bucket>:<key>:<secret>
 6# - swift:<auth_url>:<tenant>:<container>:<user>:<password>
 7# - POSTGRESQL
 8# - MOCKED
 9#
10# For S3/Swift, <endpoint_url> & <auth_url> are considered as HTTPS by default
11# (e.g."s3:foo.com:[...]" -> https://foo.com).
12#
13#   Note that escaping must be used in URLs in order to provide:
14#   - a custom scheme (e.g. "s3:http\\://foo.com:[...]"")
15#   - a port (e.g. "s3:parsec-s3\:9000:[...]")
16#
17# No extra parameter is needed for MOCKED (will use in-memory store) and
18# POSTGRESQL (will use the same database specified in PARSEC_DB).
19#
20# Multiple blockstore can be provided to form a RAID0/1/5 cluster.
21# In this case, each configuration must be provided with the following syntax:
22# - <raid_type>:<node>:<config>
23#  where <raid_type> is RAID0/RAID1/RAID5, <node> is an integer and
24# `<config>` is one of the previous s3/swift/POSTGRESQL/MOCKED configuration.
25
26PARSEC_BLOCKSTORE=s3:$RUSTFS_ESCAPED_ADDRESS:$RUSTFS_REGION:$BUCKET_NAME:$RUSTFS_ACCESS_KEY:$RUSTFS_SECRET_KEY

Note

The env file re-use environment variables defined in rustfs.env and secrets/rustfs.env (cf: Creating the secrets). Those variables are used to configured the rustfs service that provide the object-storage API when using the docker-compose approach.

rustfs.env 
1RUSTFS_TLS_PATH=/tls
2RUSTFS_ADDRESS=parsec-s3:9000
3# MUST be similar to RUSTFS_ADDRESS with the colon escaped,
4# Not used directly by `rustfs` but will be useful for build the blockstore URL for parsec
5RUSTFS_ESCAPED_ADDRESS=parsec-s3\:9000
6RUSTFS_REGION=region1
7BUCKET_NAME=parsec-testing-infra

Parsec env file

Create the file parsec.env with the following content to configure the parsec-server service:

parsec.env 
 1# Host & Port to listen to.
 2PARSEC_HOST=0.0.0.0
 3PARSEC_PORT=6777
 4
 5# The SSL key file.
 6PARSEC_SSL_KEYFILE=/run/secrets/parsec-pem-key
 7
 8# The SSL certificate file.
 9PARSEC_SSL_CERTFILE=/run/secrets/parsec-pem-crt
10
11# A comma-separated list of ciphers suites to use
12# This is the list of suites recommended by ANSSI
13# See: https://cyber.gouv.fr/guide-tls
14PARSEC_SSL_CIPHERS=
15PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}TLS_AES_256_GCM_SHA384,
16PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}TLS_AES_128_GCM_SHA256,
17PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}TLS_AES_128_CCM_SHA256,
18PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}TLS_CHACHA20_POLY1305_SHA256,
19PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-ECDSA-AES256-GCM-SHA384,
20PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-ECDSA-AES128-GCM-SHA256,
21PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-ECDSA-AES256-CCM,
22PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-ECDSA-AES128-CCM,
23PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-ECDSA-CHACHA20-POLY1305,
24PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-RSA-AES256-GCM-SHA384,
25PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-RSA-AES128-GCM-SHA256,
26PARSEC_SSL_CIPHERS=${PARSEC_SSL_CIPHERS}ECDHE-RSA-CHACHA20-POLY1305
27
28# The log file (defaults to stderr)
29# PARSEC_LOG_FILE=
30
31# The log level (DEBUG, INFO, WARNING, ERROR, CRITICAL)
32# Only log messages of the specified level (or above) will be displayed
33# (e.g. WARNING will output WARNING + ERROR + CRITICAL messages)
34PARSEC_LOG_LEVEL=WARNING
35
36# The log message format (CONSOLE, JSON)
37PARSEC_LOG_FORMAT=CONSOLE
38
39# List of proxy addresses to trust
40PARSEC_PROXY_TRUSTED_ADDRESS=parsec-proxy
41
42# The URL to reach Parsec server
43PARSEC_SERVER_ADDR=parsec3://app.parsec.localhost
44
45# Keep SSE connection open by sending keepalive messages to client in seconds.
46# Set to 0 to disable keepalive messages.
47PARSEC_SSE_KEEPALIVE=30
48
49# Sentry environment for telemetry report.
50PARSEC_SENTRY_ENVIRONMENT=production

Parsec Server can be further configured with other environment variables. To see the full list, run the following command and look for sections such as [env var: VARIABLE] next to each configuration option. For example:

$ python -m parsec run --help

[...]

--administration-token TOKEN    Secret token to access the Administration API
                                [env var: PARSEC_ADMINISTRATION_TOKEN; required]

Deploy with Docker

This section describes how to install Parsec Server with Docker on Linux.

This method is an alternative to the Direct installation on Linux server.

Additional Requirements

In addition to the base requirements, you will need:

The Docker Compose file

You can use the following Docker Compose file to deploy Parsec Server for testing:

parsec-server.docker.yaml 
  1services:
  2  proxy:
  3    depends_on:
  4      parsec:
  5        condition: service_healthy
  6    image: nginx:1.27-alpine
  7    container_name: parsec-proxy
  8    ports:
  9      - 443:443
 10      - 80:80
 11    secrets:
 12      - proxy-pem-crt
 13      - proxy-pem-key
 14    volumes:
 15      - ./parsec-nginx.conf:/etc/nginx/nginx.conf:ro
 16
 17  postgres:
 18    image: postgres:16.10-alpine
 19    container_name: parsec-postgres
 20    healthcheck:
 21      # cspell: words pg_isready
 22      test: pg_isready -d $${POSTGRES_DB}
 23      start_period: 1s
 24      start_interval: 3s
 25    environment:
 26      POSTGRES_USER: DB_USER
 27      POSTGRES_PASSWORD: DB_PASS
 28      POSTGRES_DB: parsec
 29    ports:
 30      # Expose PostgreSQL to localhost
 31      - 127.0.0.1:5432:5432
 32    volumes:
 33      - parsec-db-data:/var/lib/postgresql/data
 34
 35  # Fix the volumes permissions so `s3` service have write access has the user 1000:100
 36  pre-s3:
 37    image: alpine:3.23
 38    command: chown 1000:100 /data /logs
 39    volumes:
 40      - s3-data:/data
 41      - s3-logs:/logs
 42
 43  s3:
 44    depends_on:
 45      pre-s3:
 46        condition: service_completed_successfully
 47    image: rustfs/rustfs:1.0.0-beta.10@sha256:60f4f2f41ce95216f8cac676e69f9d90c0bfec458a3bc7fd7fb9b7c2452ac57a
 48    container_name: parsec-s3
 49    security_opt:
 50      - no-new-privileges:true
 51    user: 1000:100
 52    healthcheck:
 53      test: >-
 54        curl -f --http1.1
 55        --cacert /run/secrets/ca-crt
 56        https://$${RUSTFS_ADDRESS}/health
 57      start_period: 1s
 58      start_interval: 3s
 59    env_file:
 60      - ./secrets/rustfs.env
 61      - ./rustfs.env
 62    ports:
 63      - 127.0.0.1:9000:9000 # S3 API
 64    volumes:
 65      - s3-data:/data
 66      - s3-logs:/logs
 67    secrets:
 68      - ca-crt
 69      - source: s3-pem-crt
 70        target: /tls/rustfs_cert.pem
 71      - source: s3-pem-key
 72        target: /tls/rustfs_key.pem
 73
 74  # Configure the object storage service (create bucket for the server)
 75  post-s3:
 76    depends_on:
 77      s3:
 78        condition: service_healthy
 79    image: amazon/aws-cli:2.36.2@sha256:964336bffb17b82d2e84a2526b0672e70a2c881544e1a281acaca1d9aa41b536
 80    entrypoint: sh
 81    command: /init-s3.sh
 82    env_file:
 83      - ./secrets/rustfs.env
 84      - ./rustfs.env
 85    environment:
 86      AWS_CA_BUNDLE: /run/secrets/ca-crt
 87    volumes:
 88      - ./init-s3.sh:/init-s3.sh:ro
 89    secrets:
 90      - ca-crt
 91
 92  smtp:
 93    image: mailhog/mailhog:v1.0.1
 94    container_name: parsec-smtp
 95    healthcheck:
 96      test: wget -O /dev/null http://localhost:8025
 97      start_period: 1s
 98      start_interval: 3s
 99    ports:
100      - 1025:1025
101      # Web interface exposed to http://127.0.0.1:8025
102      - 127.0.0.1:8025:8025
103
104  # Apply DB migrations before running the server.
105  # You may want to update that step to also perform database backup before applying the migrations.
106  pre-parsec:
107    depends_on:
108      postgres:
109        condition: service_healthy
110    image: ghcr.io/scille/parsec-cloud/parsec-server:3.9.4-a.0.dev.20722+b093e56
111    command: migrate
112    restart: on-failure
113    env_file:
114      - parsec-db.env
115
116  parsec:
117    depends_on:
118      smtp:
119        condition: service_healthy
120      post-s3:
121        condition: service_completed_successfully
122      postgres:
123        condition: service_healthy
124      pre-parsec:
125        condition: service_completed_successfully
126    image: ghcr.io/scille/parsec-cloud/parsec-server:3.9.4-a.0.dev.20722+b093e56
127    restart: on-failure
128    container_name: parsec-server
129    env_file:
130      - rustfs.env
131      - secrets/rustfs.env
132      - parsec-s3.env
133      - parsec.env
134      - parsec-db.env
135      - parsec-smtp.env
136      - secrets/parsec-admin-token.env
137    environment:
138      AWS_CA_BUNDLE: /run/secrets/ca-crt
139    user: "1000"
140    secrets:
141      - ca-crt
142      - parsec-pem-crt
143      - parsec-pem-key
144    ports:
145      - 127.0.0.1:6777:6777
146
147volumes:
148  parsec-db-data: {}
149  s3-data: {}
150  s3-logs: {}
151
152secrets:
153  parsec-pem-crt:
154    file: ./tls/parsec.pem
155  parsec-pem-key:
156    file: ./tls/parsec-key.pem
157  ca-crt:
158    file: ./tls/ca.pem
159  s3-pem-crt:
160    file: ./tls/s3.pem
161  s3-pem-key:
162    file: ./tls/s3-key.pem
163  proxy-pem-crt:
164    file: ./tls/proxy.pem
165  proxy-pem-key:
166    file: ./tls/proxy-key.pem

It will setup 4 services:

Service name

Description

postgres

The PostgreSQL database

s3

The Object Storage service

smtp

A mock SMTP server

parsec

The Parsec Server

proxy

A Nginx proxy server, used as an example to configure a reverse proxy.

Learn more about using Parsec behind a reverse proxy

Starting the services

The docker containers can be started as follows:

docker compose -f parsec-server.docker.yaml up

Initial configuration

When starting the docker-compose stack, it will also start some short-lived containers used to configure the different services (those short lived containers use the prefix pre-/post- in the configuration).

Setup S3 service

One such service called post-s3, execute the following script that automatically create a bucket for the server using the aws s3api CLI:

init-s3.sh 
 1#!/bin/bash
 2set -eu
 3
 4AWS_ACCESS_KEY_ID="${RUSTFS_ACCESS_KEY}"
 5AWS_SECRET_ACCESS_KEY="${RUSTFS_SECRET_KEY}"
 6
 7export AWS_ACCESS_KEY_ID AWS_SECRET_ACCESS_KEY
 8
 9AWS_CLI_SHARED_OPTS=(
10    --bucket "$BUCKET_NAME"
11    --region "$RUSTFS_REGION"
12    --endpoint-url "https://$RUSTFS_ADDRESS"
13    --no-cli-pager
14    --no-cli-auto-prompt
15)
16
17set -x
18
19aws s3api create-bucket \
20    "${AWS_CLI_SHARED_OPTS[@]}"
21
22aws s3api put-bucket-versioning \
23    "${AWS_CLI_SHARED_OPTS[@]}" \
24    --versioning-configuration Status=Enabled
25
26aws s3api list-buckets \
27    "${AWS_CLI_SHARED_OPTS[@]}"

Deploy with Linux

This section describes how to install Parsec Server directly on Linux.

This method is an alternative to the Container-Based deployment.

Additional Requirements

In addition to the base requirements, you will need:

  • Python v3.14 with pip and venv modules

  • Parsec Server (Python package), available at https://pypi.org/project/parsec-cloud/

    • It can be installed with pip (see Installation step below).

    • To perform an offline install, you will need to download the package and all its dependencies. You can do this with pip download.

Set up

Configure the env files as described in Set up the env files.

Installation

  1. Set up a virtual env:

    python -m venv venv

  2. Activate the virtual env in your current shell:

    source venv/bin/activate

  3. Install Parsec Server:

    python -m pip install 'parsec-cloud==3.9.4-a.0.dev.20722+b093e56'

  4. Apply database migrations:

    $ set -a
$ source parsec-db.env
$ python -m parsec migrate

Start the server

  1. Create a wrapper script run-parsec-server with the following content:

    run-parsec-server 
    # Load the virtual env
source venv/bin/activate

# Load the env files into the environment table
set -a
source secrets/parsec-admin-token.env
source parsec-db.env
source parsec-smtp.env
source parsec-s3.env
source parsec.env
set +a

# Start Parsec Server
python -m parsec run

  2. Make the script executable

    chmod +x run-parsec-server

  3. Start Parsec Server with the wrapper:

    ./run-parsec-server

Running behind a reverse proxy

To run Parsec behind a reverse proxy you will need to add the option --proxy-trusted-address or set the environment variable PARSEC_PROXY_TRUSTED_ADDRESS to the address of the reverse proxy (e.g.: localhost).

If this option is not set, the gunicorn/uvicorn FORWARDED_ALLOW_IPS environment variable is used, defaulting to trusting only localhost if absent.

Tip

You can provide multiple addresses by separating them with a comma. For example: --proxy-trusted-address '::1,10.0.0.42' will trust the addresses ::1 and 10.0.0.42

An example of a reverse proxy configuration for nginx can be found in the Docker Compose file:

parsec-server.docker.yaml 
 2  proxy:
 3    depends_on:
 4      parsec:
 5        condition: service_healthy
 6    image: nginx:1.27-alpine
 7    container_name: parsec-proxy
 8    ports:
 9      - 443:443
10      - 80:80
11    secrets:
12      - proxy-pem-crt
13      - proxy-pem-key
14    volumes:
15      - ./parsec-nginx.conf:/etc/nginx/nginx.conf:ro

Use the following Nginx configuration file to serve the domain app.parsec.localhost by listening on port 80 and 443, and proxy the requests to the Parsec Server.

parsec-nginx.conf 
 1events {
 2    worker_connections 128;
 3}
 4
 5
 6http {
 7    server {
 8        listen 80;
 9        listen 443 ssl;
10        server_name app.parsec.localhost;
11        http2 on;
12        # Hide version number
13        server_tokens off;
14
15        # Only provide tlsv1.3
16        ssl_protocols       TLSv1.3;
17        ssl_certificate     /run/secrets/proxy-pem-crt;
18        ssl_certificate_key /run/secrets/proxy-pem-key;
19
20        location ~ ^/authenticated/.*/events$ {
21            proxy_pass https://parsec-server:6777;
22
23            # Specific configuration for SSE:
24            # Disable buffering, cache & chunking
25            proxy_buffering             off;
26            proxy_cache                 off;
27            chunked_transfer_encoding   off;
28            proxy_read_timeout          24h;
29
30            # Add X-Forwarded headers to the proxied request
31            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
32            proxy_set_header X-Forwarded-Proto $scheme;
33            proxy_set_header X-Forwarded-Host $host;
34            proxy_set_header X-Forwarded-Port $server_port;
35
36            # Remove the Forwarded header
37            proxy_set_header Forwarded "";
38
39            # Overwrite the Host header
40            proxy_set_header Host app.parsec.localhost;
41        }
42
43        location / {
44            proxy_pass https://parsec-server:6777;
45
46            # Add X-Forwarded headers to the proxied request
47            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
48            proxy_set_header X-Forwarded-Proto $scheme;
49            proxy_set_header X-Forwarded-Host $host;
50            proxy_set_header X-Forwarded-Port $server_port;
51
52            # Remove the Forwarded header
53            proxy_set_header Forwarded "";
54
55            # Overwrite the Host header
56            proxy_set_header Host app.parsec.localhost;
57        }
58    }
59}

The important takeaways are:

  • Set the X-Forwarded-For, X-Forwarded-Proto, X-Forwarded-Host and X-Forwarded-Port headers.

    • Currently, Parsec only uses the X-Forwarded-For and X-Forwarded-Proto headers, but it is better to set all of them to avoid any issue.

  • Remove the Forwarded header.

    • The Forwarded header (RFC-7239) is not used by Parsec, but it may be in the future.

  • Set the header host to the accessible address. Here we force the value to be app.parsec.localhost, but you can set it to $host like for X-Forwarded-Host.

TLS Recommendation

We recommend that connections to the service are made using a TLS layer. If you are using a reverse proxy refer to it’s documentation on how to configure TLS:

Or if you do not use a reverse proxy, see how to configure TLS on the server.

TLS Server configuration

We recommend that when user directly connects to the server (i.e. without using a reverse proxy) to configure the TLS settings on the server.

We provide 3 options to configure the TLS connection:

  • --ssl-keyfile (PARSEC_SSL_KEYFILE): The TLS key file

  • --ssl-certfile (PARSEC_SSL_CERTFILE): The TLS certificate file

  • --ssl-ciphers (PARSEC_SSL_CIPHERS): A list of ciphers that can be used when the client & server negotiate which algorithm to use when doing the TLS handcheck

    Note

    You are not required to provide the ciphers list as we use a default list that was recommended by the French Cybersecurity Agency (ANSSI) in Recommandations de sΓ©curitΓ© relatives Γ  TLS

If you followed the installation described in Deploy with Docker, you should only have to replace the file s tls/parsec.pem and tls/parsec-key.pem that where generated on section TLS certificates. The env variables PARSEC_SSL_KEYFILE and PARSEC_SSL_CERTFILE are already configured in parsec.env (see Parsec env file).