Run it behind HTTPS

For real use, serve FusionTerm over HTTPS so passwords, terminal traffic and the sign-in cookie are encrypted. Single sign-on and installing the phone app also need HTTPS. Put a reverse proxy in front of FusionTerm; it handles the certificate.

Whichever proxy you use:

1. Remove FORCE_SECURE_COOKIE=false and TRUST_PROXY=false from FusionTerm's settings, so the sign-in cookie is only ever sent over HTTPS and FusionTerm takes the visitor's address from the proxy.
2. Make only the proxy reachable from the network (don't publish port 5577 to everyone).
3. The proxy must pass WebSockets through — terminals and remote desktops use them (/ws/terminal).
4. Tell FusionTerm its public address: Settings → Connect a phone → Public address. Single sign-on also has a Public URL field.

#The one-line way (installer)

Point a DNS name (for example ft.example.com) at the server, open ports 80 and 443, and run the installer with that name:

curl -fsSL https://fusionterm.com/install.sh | FUSIONTERM_DOMAIN=ft.example.com sh

It adds Caddy next to FusionTerm (docker-compose.override.yml and .env in the install folder), gets a Let's Encrypt certificate and renews it automatically, redirects http:// to https://, stops publishing port 5577, and does steps 1–3 above for you. Running it again on an existing install switches that install to HTTPS and keeps your data. Then do step 4.

#Caddy by hand (gets a free certificate automatically)

Instead of the installer you can save docker-compose.https.yml as docker-compose.override.yml next to your docker-compose.yml, put FUSIONTERM_DOMAIN=ft.example.com in .env, and run docker compose up -d. Or add the service yourself — to your docker-compose.yml (next to fusionterm and guacd):

  caddy:
    image: caddy:2
    ports: ["80:80", "443:443"]
    command: caddy reverse-proxy --from fusionterm.example.com --to fusionterm:5577
    volumes: [caddy-data:/data]
    restart: unless-stopped

…and caddy-data: under volumes:. Remove the ports: mapping from the fusionterm service. Point the DNS name at the server and run docker compose up -d. WebSockets work without extra settings.

#nginx

server {
  listen 443 ssl;
  server_name fusionterm.example.com;
  ssl_certificate     /etc/ssl/fusionterm.crt;
  ssl_certificate_key /etc/ssl/fusionterm.key;
  client_max_body_size 500m;            # file uploads up to 500 MB

  location / {
    proxy_pass http://127.0.0.1:5577;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;     # WebSockets (terminals, RDP)
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_set_header X-Forwarded-Proto $scheme;
    proxy_read_timeout 1d;                      # keep idle terminals open
  }
}

#Traefik and others

Any proxy works if it forwards WebSockets and sends X-Forwarded-Proto: https. FusionTerm trusts one proxy in front of it. With two (for example a load balancer and nginx), set TRUST_PROXY=2; to trust only specific proxy addresses, list them, for example TRUST_PROXY=10.0.0.5.