# Securing VitoDeploy

:::info
This guide is only for VitoDeploy instances installed on a Virtual Private Server.
:::

## Install SSL on Vito instance

If you've installed VitoDeploy on a VPS, By default your Vito instance will be accessible via your server's IP address which is not secure.

To secure it you need to attach a domain to it and get an SSL certificate for it.

### Attach a domain

Create an A record on your domain's DNS manager and point it to your Vito server's IP address.

:::warning
If you are using Cloudflare make sure you have the cloud proxy off at this stage!
:::

Open `/etc/nginx/sites-available/vito` with an editor on your terminal like `nano`:

```sh
sudo nano /etc/nginx/sites-available/vito
```

Edit it like the following and add your domain to it:

```nginx
server {
    ...
    server_name _ YOUR_DOMAIN_GOES_HERE;
    ...
}
```

Now run the following command to restart the webserver:

```sh
sudo service nginx restart
```

Make sure your webserver is not broken:

```sh
sudo service nginx status
```

It should have something like this:

```text
● nginx.service - A high performance web server and a reverse proxy server
     Loaded: loaded (/lib/systemd/system/nginx.service; enabled; vendor preset: enabled)
     Active: active (running) since Wed 2024-04-10 11:11:32 UTC; 3 days ago
       Docs: man:nginx(8)
   Main PID: 172473 (nginx)
...
```

Now open your domain to make sure it is ok and can be opened.

### Get SSL

Now you need to run the following command to generate the SSL

```sh
sudo certbot --force-renewal --nginx --noninteractive --agree-tos --cert-name YOUR_DOMAIN -m YOUR_EMAIL -d YOUR_DOMAIN --verbose
```

Make sure to replace the placeholders:

YOUR_DOMAIN: Your domain address like example.com

YOUR_EMAIL: Your email address to be provided to letsencrypt

:::info
If you are using Cloudflare, Now you can enable the cloud proxy if you want. Keep in mind that you might need to enable Full SSL encryption option on Cloudflare
:::

### Vito behind proxy

You can put vito behind a reverse proxy like Nginx. In order to do so, you will need to add the following configuration to your reverse proxy as well:

```nginx
proxy_buffer_size   128k;
proxy_buffers   4 256k;
proxy_busy_buffers_size   256k;
```

In v4.x Vito uses a WebSocket server for its live console and realtime updates. When Vito is behind a
reverse proxy, you must also forward the `/ws/` path to the WebSocket server with the upgrade headers,
otherwise the live console and live updates will not work:

```nginx
location /ws/ {
    proxy_pass http://127.0.0.1:8085;
    proxy_http_version 1.1;
    proxy_set_header Upgrade $http_upgrade;
    proxy_set_header Connection "upgrade";
    proxy_set_header Host $host;
    proxy_set_header X-Real-IP $remote_addr;
    proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
    proxy_read_timeout 86400;
}
```

:::info
The WebSocket server listens on `127.0.0.1:8085` by default (configurable via `WS_HOST` and
`WS_PORT`). Make sure `APP_URL` is set to the domain you access Vito on, as `WS_ALLOWED_ORIGINS`
defaults to it. See [Configuration](./configuration#realtime-websocket) for the related environment
variables.
:::

### Update environment variables

Now you need add/update the following variables in the `.env` file if you are using VPS installation or docker's environment variables if you are using docker:

```sh
APP_URL=https://YOUR_DOMAIN
ASSET_URL=https://YOUR_DOMAIN
```