The Reverse Proxy is the single front door of the stack. Every request from the outside world hits it first — it terminates TLS and forwards traffic to the right internal service over the private network.
Role in the stack
It routes HTTPS to Studio, proxies authentication to Keycloak, and upgrades WebSocket connections for the Yjs Realtime Server. Internal services never need to be exposed directly.
Upgrade/Connection
headers passed through correctly.| Incoming | Forwarded to | Notes |
|---|---|---|
https://<host>/ | Studio | Web UI + API |
https://<host>/auth | Keycloak | OIDC endpoints |
wss://<host>/collab | Yjs Realtime Server | WebSocket upgrade required |
On Kubernetes this is the Ingress controller (e.g. NGINX Ingress or Traefik),
not a pod you write yourself. You declare an Ingress and the controller
programs the edge:
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: iomodel
namespace: iomodel
annotations:
nginx.ingress.kubernetes.io/proxy-read-timeout: '3600'
nginx.ingress.kubernetes.io/proxy-send-timeout: '3600'
spec:
tls:
- hosts: ['iomodel.example.com']
secretName: iomodel-tls
rules:
- host: iomodel.example.com
http:
paths:
- path: /collab
pathType: Prefix
backend: { service: { name: yjs-server, port: { number: 3400 } } }
- path: /
pathType: Prefix
backend: { service: { name: studio, port: { number: 3200 } } }The long proxy timeouts matter for the /collab WebSocket route — without
them the Ingress will drop idle realtime connections.
Terminate TLS here, not in the app
Studio and the Yjs server expect to run behind this proxy. Keep TLS, HSTS, and certificate renewal at the edge so the internal services stay simple.
apiVersion: networking.k8s.io/v1
kind: Ingress
metadata:
name: iomodel
namespace: iomodel
annotations:
nginx.ingress.kubernetes.io/proxy-read-timeout: '3600'
nginx.ingress.kubernetes.io/proxy-send-timeout: '3600'
spec:
tls:
- hosts: ['iomodel.example.com']
secretName: iomodel-tls
rules:
- host: iomodel.example.com
http:
paths:
- path: /collab
pathType: Prefix
backend: { service: { name: yjs-server, port: { number: 3400 } } }
- path: /
pathType: Prefix
backend: { service: { name: studio, port: { number: 3200 } } }