Setting up your server behind AegisX

What to change on your server after connecting, so the site sees real visitors and payments and integrations keep working.

For any site

Visitor IP

AegisX sends it in the X-Real-IP and X-Forwarded-For headers. Without the setup below your server logs AegisX addresses instead of visitors.

HTTPS

Visitors always arrive over HTTPS. If the server is connected over http://, AegisX adds X-Forwarded-Proto: https so the site knows the connection is secure. Connecting the server over https:// is safer.

Close the server

While the server answers everyone, it can be attacked around the protection. The dashboard has a script for nftables, iptables or ufw: Sites → your site → Server protection. It keeps the AegisX address list up to date by itself.

AegisX certificate

The same tab has the AegisX root certificate. With it your server accepts HTTPS connections only from AegisX and only for its own site.

The AegisX addresses are always at: my.aegisx.network/api/public/edge-ips

The addresses change when we add servers. Refresh the file once a day, for example with cron.

nginx

The real visitor IP in $remote_addr, the logs and your app. The realip module is usually built into nginx.

curl -fsS https://my.aegisx.network/api/public/edge-ips | sed 's/.*/set_real_ip_from &;/' > /tmp/aegisx-realip.conf \
  && echo 'real_ip_header X-Real-IP;' >> /tmp/aegisx-realip.conf \
  && sudo mv /tmp/aegisx-realip.conf /etc/nginx/conf.d/aegisx-realip.conf \
  && sudo nginx -t && sudo systemctl reload nginx

Accept only AegisX connections to this site (in the server block with listen 443):

ssl_client_certificate /etc/nginx/aegisx-origin-pull-ca.pem;
ssl_verify_client on;
if ($ssl_client_s_dn !~ "CN=example.com(,|$)") { return 403; }

Apache

The remoteip module puts the real visitor IP in place. Use %a instead of %h in your log format.

sudo a2enmod remoteip
{ echo 'RemoteIPHeader X-Real-IP'; curl -fsS https://my.aegisx.network/api/public/edge-ips | sed 's/^/RemoteIPTrustedProxy /'; } > /tmp/aegisx-remoteip.conf \
  && sudo mv /tmp/aegisx-remoteip.conf /etc/apache2/conf-available/aegisx-remoteip.conf \
  && sudo a2enconf aegisx-remoteip && sudo apachectl configtest && sudo systemctl reload apache2

Accept only AegisX connections to this site (in the VirtualHost on port 443):

SSLCACertificateFile /etc/ssl/aegisx-origin-pull-ca.pem
SSLVerifyClient require
SSLVerifyDepth 1
<If "%{SSL_CLIENT_S_DN_CN} != 'example.com'">
    Require all denied
</If>

WordPress

Real IP

Set up nginx or Apache as above. Security plugins and comments need no changes.

HTTPS without a redirect loop

If the server is connected over http://, add the lines below to wp-config.php above the “That’s all, stop editing” line.

WP-Cron and Site Health

WordPress calls its own site from your server. Add the server address to the allowed ones: Rules → IP access.

WooCommerce payments

Stripe, LiqPay and YooKassa are ready exemptions on the Bots tab. For other payment plugins add their notification path, usually /wc-api/.

Login and xmlrpc.php

Give /wp-login.php its own limit, for example 5 POST requests a minute: your site → Settings → Path rules. If you do not use the WordPress app or Jetpack, close /xmlrpc.php: Rules → Path filters.

REST API

Keep /wp-json/ out of the browser check only if outside apps call it.

wp-config.php

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

1C-Bitrix

Real IP

In BitrixVM nginx sits in front of Apache: set it up as above. Apache gets the address from nginx.

HTTPS

If the server is connected over http://, add the lines below to /bitrix/php_interface/dbconn.php.

Payments

Payment systems send notifications to /bitrix/tools/sale_ps_result.php. Add this path to the exemptions on the Bots tab.

1C exchange

1C connects to /bitrix/admin/1c_exchange.php. Add the address of the computer or server running 1C to the allowed ones: Rules → IP access.

Admin section

If you close /bitrix/admin/ to other addresses, remember the 1C address: the exchange goes through the same section.

/bitrix/php_interface/dbconn.php

if (isset($_SERVER['HTTP_X_FORWARDED_PROTO']) && $_SERVER['HTTP_X_FORWARDED_PROTO'] === 'https') {
    $_SERVER['HTTPS'] = 'on';
}

Laravel

Trusted proxies

Laravel takes the visitor IP and HTTPS from headers only from trusted proxies. List the AegisX addresses as below.

Webhooks

Add your webhook routes (for example /webhooks/) to the exemptions on the Bots tab: payment systems and services cannot pass a browser check.

API for apps

Keep /api/ out of the browser check too, and set limits and token checks on the API tab.

Laravel 11 and later, bootstrap/app.php:

->withMiddleware(function (Middleware $middleware) {
    $middleware->trustProxies(at: [
        '203.0.113.10',
        '198.51.100.20',
    ]);
})

Laravel 10, app/Http/Middleware/TrustProxies.php:

protected $proxies = [
    '203.0.113.10',
    '198.51.100.20',
];

If the server is closed to everyone but AegisX by the script, you can put '*' instead of the list: then it never needs updating.

How to check

Open the site and find your request in the server log: it should show your address, not an AegisX one.
On the Server protection tab in the dashboard, run the check: it shows whether your server address is visible in public records.
Try opening the site directly by the server address: after the script the connection should not open.

Your platform is not here?

Tell us what the site runs on and we will suggest the settings.

Write to support@aegisx.network