---
title: "Configuring a proxy"
source: https://dev.pageseeder.com/guide/installation/configuring_a_proxy.html
description: "Guide to configuring NGINX as a reverse proxy for PageSeeder on Linux, including installation steps, non-SSL and SSL configurations, maintenance page setup, and SELinux troubleshooting."
last_updated: 2026-08-11T16:10:50+10:00
tokens: ~1442
---

# Configuring a proxy (NGINX)

When configuring PageSeeder on Linux, if a website port less than 1024 (e.g. 80 or 443 for SSL) is chosen, then a reverse proxy from this port to the API port (e.g. 8282) needs to be configured. This is because the PageSeeder service is not running as the root user so doesn’t have permission to use these lower port numbers.

We recommend using NGINX as a reverse proxy as it is open source and straightforward to configure. Following are instructions on how to do this.

## Install NGINX

Try **entering:**

```shell
# yum install nginx
```

If this doesn't work add the nginx yum repository as follows: **create** a file named `/etc/yum.repos.d/nginx.repo` and paste the following configuration for CentOS or something similar for the operating system.

CentOS:

```properties
[nginx]
name=nginx repo
baseurl=http://nginx.org/packages/centos/$releasever/$basearch/
gpgcheck=0
enabled=1
```

Then **enter**:

```shell
# yum install nginx
```

## Configure NGINX

**Backup** the original `nginx.config`:

```shell
$ mv /etc/nginx/nginx.conf /etc/nginx/nginx.conf.orig
```

**Create** a new file `/etc/nginx/nginx.conf` and paste the following configuration for non-SSL or SSL into it. **Substitute** your domain name for `myserver.mycompany.com`, your website port for `80` and your API port for `8282`. If using SSL, see [Configuring SSL](/guide/installation/configuring_ssl.md). To bind PageSeeder to a single IP address, substitute `80 or 443` with `[your ip]:80` or `[your ip]:443`.  
**Non-SSL:**

```nginx
user nginx;

events {
    worker_connections  1024;
}

http {
  include       /etc/nginx/mime.types;
  server {
    listen               80;
    server_name          myserver.mycompany.com;    
    client_max_body_size 1000m;
    location / {
      proxy_pass                         http://localhost:8282;
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Host  $host:$server_port;
      proxy_set_header Upgrade           $http_upgrade;
      proxy_set_header Connection        $http_connection;
      proxy_http_version 1.1;
      proxy_read_timeout                 300s;
    }
    error_page 502 =503  /ps/maintenance/maintenance.html;
    location /ps/maintenance/ {
      root               /var/www;
    }
  }
}
```

**SSL:**

```nginx
user nginx;

events {
  worker_connections  1024;
}

http {
  include       /etc/nginx/mime.types;
  server {
    listen               443 ssl;
    server_name          myserver.mycompany.com;
    client_max_body_size 1000m;
    ssl_certificate      /etc/nginx/ssl/pageseeder/mydomain.crt;
    ssl_certificate_key  /etc/nginx/ssl/pageseeder/mydomain.key;
    ssl_session_cache    shared:SSL:10m;
    ssl_session_timeout  10m;
    ssl_protocols        TLSv1.2 TLSv1.3;
    location / {
      proxy_pass                         http://localhost:8282;
      proxy_set_header Host              $host;
      proxy_set_header X-Real-IP         $remote_addr;
      proxy_set_header X-Forwarded-Proto $scheme;
      proxy_set_header X-Forwarded-Host  $host:$server_port;
      proxy_set_header Upgrade           $http_upgrade;
      proxy_set_header Connection        $http_connection;
      proxy_http_version 1.1; 
      proxy_cookie_path /ps              "/ps; Secure";
      proxy_read_timeout                 300s;
    }
    error_page 502 =503  /ps/maintenance/maintenance.html;
    location /ps/maintenance/ {
      root               /var/www;
    }
  }
  server {
    listen                80;
    return 301            https://$host$request_uri;
  }
}
```

**Copy** the PageSeeder maintenance page to NGINX as follows:

```shell
$ mkdir -p /var/www/ps
$ cp -r /opt/pageseeder/webapp/maintenance /var/www/ps/
```

**Start** NGINX and make it start automatically at reboot.  
On CentOS 6:

```shell
$ service nginx start
$ chkconfig --add nginx
```

On CentOS 7:

```properties
$ systemctl start nginx
$ systemctl enable nginx
```

> **Note:** The `worker_connections 1024` includes both client and proxy connections, so this setting would only allow `512` concurrent client connections. Increasing this value may require the number of file descriptors allowed for `nginx` in Linux to be modified.

## Troubleshooting

### SELinux

To see if SELinux is enabled, enter the following:

```shell
$ sestatus
```

If `Current mode: enforcing` is displayed and NGINX returns a `403 Forbidden`error you might need to allow port `8282` and directory `/var/www/ps` in SELinux by entering:

```shell
$ setsebool -P httpd_can_network_relay on
$ semanage port -a -t http_port_t -p tcp 8282
$ semanage fcontext -a -t httpd_sys_content_t '/var/www/ps(/.*)?'
$ restorecon -Rv /var/www/ps
```

If the `semanage` command is not found it can be installed by entering:

```shell
$ yum install -y policycoreutils-python-utils
```

If this doesn’t fix the problem you can temporarily change SELinux to be more permissive by entering:

```shell
$ setenforce permissive
```

 But after finding the correct SELinux settings you should set the mode to enforce by entering:

```properties
$ setenforce enforcing
```

Permanent changes to the mode can be made by editing `/etc/selinux/config` but this is not recommended.

> **Note:** Confirm with your system administrator that this setting complies with your organization’s security policies.

## Timeout errors or many WebSocket requests

If **504 Gateway timeout** errors are received from NGINX or there are WebSocket requests every 60 seconds, ensure that the time for PageSeeder responses is at least 5 minutes by having the following in the `nginx.conf` under `server {`:

```nginx
proxy_read_timeout  300s;
```