Network & HTTPS

ScanPick’s API listens on the address specified by ASPNETCORE_URLS (default: http://+:5000). For production, run behind a reverse proxy for TLS termination, rate limiting, and request logging.

Default Ports

Service	Port	Protocol
API	5000	HTTP/REST + SignalR WS
Web Dashboard	5000	Served embedded in the API
PostgreSQL	5432	TCP

Reverse Proxy

nginx

server {
    listen 443 ssl;
    server_name scanpick.example.com;

    ssl_certificate /etc/ssl/certs/scanpick.crt;
    ssl_certificate_key /etc/ssl/private/scanpick.key;

    location / {
        proxy_pass http://127.0.0.1:5000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # SignalR WebSocket support
        proxy_read_timeout 86400;
    }
}

Caddy

scanpick.example.com {
    reverse_proxy 127.0.0.1:5000
}

Caddy handles TLS automatically via Let’s Encrypt.

Traefik

labels:
  - "traefik.enable=true"
  - "traefik.http.routers.scanpick.rule=Host(`scanpick.example.com`)"
  - "traefik.http.services.scanpick.loadbalancer.server.port=5000"

WebSocket (SignalR)

SignalR requires WebSocket support for real-time updates:

• nginx: the Upgrade and Connection headers must be passed through (see the nginx config above)
• Caddy: WebSocket support is automatic
• Load balancers: ensure sticky sessions or enable WebSocket passthrough

Network Security

• Run the API and database on the same private network when possible
• Do not expose PostgreSQL to the public internet
• Use a firewall to restrict API access to warehouse network IPs
• Consider a VPN for remote management access
• Mobile devices connect via warehouse WiFi — keep the API on the LAN

Docker Networking

In the Docker Compose setup, services communicate over an internal bridge network. Only the API (via nginx) is exposed on port 80.