Reverse proxy and domains

The app serves plain HTTP on one port and expects a reverse proxy or CDN in front for TLS, compression, and your domain. Any proxy works; the examples here use Caddy for its two-line TLS and nginx for familiarity.

Caddy

docs.example.com {
    reverse_proxy localhost:4321
}

Caddy provisions and renews the certificate automatically. That is the entire configuration.

nginx

server {
    listen 443 ssl http2;
    server_name docs.example.com;

    location / {
        proxy_pass http://localhost:4321;
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
    }
}

Terminate TLS however you already do (certbot, your CDN); the app needs nothing special.

Passing the client IP

Rate limiting buckets by client IP. Behind a proxy, every request arrives from the proxy's address unless you forward the real one and tell Readsmith which header to trust:

1. Make the proxy set a header only it controls: X-Real-IP above, or your CDN's equivalent such as CF-Connecting-IP.
2. Set READSMITH_TRUSTED_IP_HEADER to that header's name.

Behind a CDN

A CDN in front works well: the pages are static and cache cleanly. Two notes:

• Let /llms.txt, /skill.md, and /.well-known/* through untouched; agents fetch them directly.
• Search and Ask AI are POST requests under /_readsmith/; exclude them from caching.

One host, several sites

Run one app container per site, each with its own content, stores, and port, and route by hostname at the proxy. Containers share nothing, which is exactly the property that keeps two sites from overwriting each other's artifacts.