# Sourcegraph HTTP and HTTPS/SSL configuration

Overview:

-   [Sourcegraph Cluster (Kubernetes): NGINX](#sourcegraph-cluster-kubernetes-nginx)
-   [Docker Compose: Caddy 2](#sourcegraph-via-docker-compose-caddy-2)

## Sourcegraph Cluster (Kubernetes): NGINX

We use the [ingress-nginx](https://kubernetes.github.io/ingress-nginx/) for Sourcegraph Cluster running on Kubernetes. Refer to the [deploy-sourcegraph Configuration](/self-hosted/deploy/kubernetes/configure#network-access) documentation for more information.

## Sourcegraph via Docker Compose: Caddy 2

Sourcegraph's [Docker Compose deployment](/self-hosted/deploy/docker-compose/) uses [Caddy 2](https://caddyserver.com/) as its reverse proxy. The Docker Compose deployment ships with a few builtin templates that cover common scenarios for exposing Sourcegraph:

-   plain HTTP
-   HTTPS with automatically provisioned Let's Encrypt certificates
-   HTTPS with custom certificates that you provide

Usage instructions are provided via [the `caddy` service's inline comments inside the `docker-compose.yaml` definition](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/3.14/docker-compose/docker-compose.yaml#L3:L58). Detailed steps are found below.

**Important:** When setting up caddy's automatic Lets Encrypt TLS certification for HTTPS we strongly recommended to test with the staging configuration first. However, the TLS certs provided by Lets Encrypt staging will not be verifiable, and will display an `unknown certificate` error. Once you are done testing, you will need to comment out the staging env variable and uncomment the production env variable for fully functional HTTPS.

### HTTPS with Custom Certificates in Docker Compose

**Important:** [https.custom-cert.Caddyfile](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/master/caddy/builtins/https.custom-cert.Caddyfile) should not require any updates and should remain untouched. Updates should be made in the [docker-compose.yaml](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/master/docker-compose/docker-compose.yaml) file only and as described below.

In your [docker-compose.yaml](https://github.com/sourcegraph/deploy-sourcegraph-docker/blob/master/docker-compose/docker-compose.yaml) within the caddy section:

1. In the Environment section of the compose file uncomment & update this line with your Sourcegraph Site Address:

    ```
    - 'SRC_SITE_ADDRESS=sourcegraph.example.com'
    ```

1. In Volumes section of the compose file comment out the following line

    ```
    - '//builtins/http.Caddyfile:/etc/caddy/Caddyfile'
    ```

1. In Volumes section of the compose file uncomment the following line:

    ```
    - '//builtins/https.custom-cert.Caddyfile:/etc/caddy/Caddyfile'
    ```

1. In Volumes section of the compose file uncomment and update the following line with your custom cert path:

    ```
    - '/LOCAL/CERT/PATH.pem:/sourcegraph.pem'
    ```

1. In Volumes section of the compose file uncomment and update the following line with your custom cert path:

    ```
    - '/LOCAL/KEY/PATH.key:/sourcegraph.key'
    ```

    **NOTE**: When adding your certs to your instance, make sure they are in the `deploy-sourcegraph-docker` folder, not outside of it. They will not be recognized otherwise.

## Next steps

You should configure Sourcegraph's `externalURL` in the [advanced configuration](/admin/config/site-config) (and restart the frontend instances) so that Sourcegraph knows its URL.