Use TiDB Dashboard behind a Reverse Proxy

When you use HAProxy as the reverse proxy, take the following steps:

1. Use reverse proxy for TiDB Dashboard on the 8033 port (for example). In the HAProxy configuration file, add the following configuration:

   frontend tidb_dashboard_front
     bind *:8033
     use_backend tidb_dashboard_back if { path /dashboard } or { path_beg /dashboard/ }
   
   backend tidb_dashboard_back
     mode http
     server tidb_dashboard 192.168.0.123:2379
   

   Replace 192.168.0.123:2379 with IP and port of the actual address of the TiDB Dashboard obtained in Step 1.

   Warning

   You must retain the if part in the use_backend directive to ensure that services only in this path are behind reverse proxy; otherwise, security risks might be introduced. See Secure TiDB Dashboard.

2. Restart HAProxy for the configuration to take effect.

3. Test whether the reverse proxy is effective: access the /dashboard/ address on the 8033 port of the machine where HAProxy is located (such as http://example.com:8033/dashboard/) to access TiDB Dashboard.

When you use NGINX as the reverse proxy, take the following steps:

1. Use reverse proxy for TiDB Dashboard on the 8033 port (for example). In the NGINX configuration file, add the following configuration:

   server {
       listen 8033;
       location /dashboard/ {
       proxy_pass http://192.168.0.123:2379/dashboard/;
       }
   }
   

   Replace http://192.168.0.123:2379/dashboard/ with the actual address of the TiDB Dashboard obtained in Step 1.

   Warning

   You must keep the /dashboard/ path in the proxy_pass directive to ensure that only the services under this path are reverse proxied. Otherwise, security risks will be introduced. See Secure TiDB Dashboard.

2. Reload NGINX for the configuration to take effect.

   sudo nginx -s reload
   

3. Test whether the reverse proxy is effective: access the /dashboard/ address on the 8033 port of the machine where NGINX is located (such as http://example.com:8033/dashboard/) to access TiDB Dashboard.

If you are deploying a new cluster, you can add the configuration above to the topology.yaml TiUP topology file and deploy the cluster. For specific instruction, see TiUP deployment document.

For a deployed cluster:

1. Open the configuration file of the cluster in the edit mode (replace CLUSTER_NAME with the cluster name).

   tiup cluster edit-config CLUSTER_NAME
   

2. Modify or add configuration items under the pd configuration of server_configs. If no server_configs exists, add it at the top level:

   monitored:
     ...
   server_configs:
     tidb: ...
     tikv: ...
     pd:
       dashboard.public-path-prefix: /foo
     ...
   

   The configuration file after the modification is similar to the following file:

   server_configs:
     pd:
       dashboard.public-path-prefix: /foo
     global:
       user: tidb
       ...
   

   Or

   monitored:
     ...
   server_configs:
     tidb: ...
     tikv: ...
     pd:
       dashboard.public-path-prefix: /foo
   

3. Perform a rolling restart to all PD instances for the modified configuration to take effect (replace CLUSTER_NAME with your cluster name):

   tiup cluster reload CLUSTER_NAME -R pd
   

See Common TiUP Operations - Modify the configuration for details.

Taking http://example.com:8033/foo/ as an example, the corresponding HAProxy configuration is as follows:

frontend tidb_dashboard_front
  bind *:8033
  use_backend tidb_dashboard_back if { path /foo } or { path_beg /foo/ }

backend tidb_dashboard_back
  mode http
  http-request set-path %[path,regsub(^/foo/?,/dashboard/)]
  server tidb_dashboard 192.168.0.123:2379

Replace 192.168.0.123:2379 with IP and port of the actual address of the TiDB Dashboard obtained in Step 1.

If you want that the TiDB Dashboard service is run in the root path (such as http://example.com:8033/), use the following configuration:

frontend tidb_dashboard_front
  bind *:8033
  use_backend tidb_dashboard_back
backend tidb_dashboard_back
  mode http
  http-request set-path /dashboard%[path]
  server tidb_dashboard 192.168.0.123:2379

Modify the configuration and restart HAProxy for the modified configuration to take effect.

Taking http://example.com:8033/foo/ as an example, the corresponding NGINX configuration is as follows:

server {
  listen 8033;
  location /foo/ {
    proxy_pass http://192.168.0.123:2379/dashboard/;
  }
}

Replace http://192.168.0.123:2379/dashboard/ with the actual address of the TiDB Dashboard obtained in Step 1.

If you want that the TiDB Dashboard service is run in the root path (such as http://example.com:8033/), use the following configuration:

server {
  listen 8033;
  location / {
    proxy_pass http://192.168.0.123:2379/dashboard/;
  }
}

Modify the configuration and restart NGINX for the modified configuration to take effect.

sudo nginx -s reload