add-proxy

Expose a deployed service publicly through the bastion's nginx reverse proxy: traffic to <service>.<domain> is forwarded to the service's private address <service>.rumi.local:<app-port>. If the bastion has HTTPS enabled, the service is reachable at https://<service>.<domain>.

Syntax

rumi cloud hetzner add-proxy \
  --api-key <token> \
  --network <network> \
  --key-pair <keypair> \
  --service <service> \
  --domain <domain> \
  --app-port <port> \
  [options]

Options

Option	Short	Description	Default
--api-key	-k	The Hetzner Cloud project API token (or set HCLOUD_TOKEN)	Required
--region	-r	The Hetzner location the network is in	fsn1
--network	-n	The name of the network	Required
--key-pair	-K	The SSH key pair to reach the bastion	Required
--service	-s	The service to expose	Required
--domain	-d	The base domain; the service is exposed at <service>.<domain>	Required
--app-port	-a	The service's app port to reverse-proxy to	Required

Example

rumi cloud hetzner add-proxy \
  --api-key $HCLOUD_TOKEN \
  --network my-cloud \
  --key-pair rumi \
  --service myapp \
  --domain example.com \
  --app-port 9000

Notes

• Public DNS is your responsibility, not Rumi's — point <service>.<domain> (or a wildcard *.<domain>) at the bastion's public IP in whatever DNS hosts the domain. Rumi only writes the bastion's nginx entry. The bastion's :80/:443 are already open to the world, so no whitelist step is needed.

• The service must be running and its app port opened (see launch-instance).

• With HTTPS enabled the proxy terminates TLS on :443; otherwise it serves plain HTTP on :80.

See Also

• enable-https

• launch-instance

• deploy