Invite linke includes alias port and so isn't valid.

[mattague]

I fel like I am missing something. I have succesfully gotten meshcentral running behind a reverse proxy, and I set the alias port so remote agents could connect back. My only issue is that when I change invite codes the link that it generates includes the alias port, so it is broken. The link it generates it https://mesh.mydomain.com:447/invite but if I manually go to https://mesh.mydomain.com/invite, i get to the right page and it works. Below is my config.json

{
  "$schema": "http://info.meshcentral.com/downloads/meshcentral-config-schema.json",
  "__comment1__": "This is a simple configuration file, all values and sections that start with underscore (_) are >  "__comment2__": "See node_modules/meshcentral/sample-config-advanced.json for a more advanced example.",
  "settings": {
    "cert": "mesh.mydomain.com",
    "_WANonly": true,
    "_LANonly": true,
    "_sessionKey": "MyReallySecretPassword1",
    "port": 443,
    "aliasPort": 447,
    "_redirPort": 80,
    "_redirAliasPort": 80
  },
  "domains": {
    "": {
      "title": "Mattague's",
      "title2": "Remote access",
      "agentInviteCodes": true,
      "_minify": true,
      "_newAccounts": true,
      "_userNameIsEmail": true
    }

[Ylianst]

Well, so the alias port is the actual port that MeshCentral will be seen as externally. So, normally, if you set the alias port, that will be used for anything URL presented externally. So, this is expected behavior. Let me know why you think this is not right?

[mattague]

I thought the alias port was meant to be what the agents use to get back to the server, and the regualr "port" is where the website is served. do I have this backwards? The problem is that when you make a link with a port in it, it no longer goes over https, so it is not secured and can't be visited. however if i manually type the url without the port number, it works.

How is my config.json supposed to be laid out so that normal traffic get's reverse proxied to port 443 on my server, and agents get port forwarded on 447 back to my server from outside, and still have the generated invite links work?

[Ylianst]

I must be missing something. "port" is the actual port the MeshCentral will be listening on, and "aliasport" is the port that will be exposed externally. Indeed, your config.json seems to have it backwards. Typically you would have MeshCentral listen on a random port, say "447" and then have your reverse proxy listen on 443 and forward MeshCentral traffic to 447. In that case, you would have:

    "port": 447,
    "aliasPort": 443

If you reverse proxy is doing TLS and forwarding TCP connections to MeshCentral, do this:

    "port": 447,
    "aliasPort": 443,
    "tlsOffLoad": "1.2.3.4"

Where "1.2.3.4" is the internal IP address of your reverse proxy. In that case, MeshCentral will listen on port 447 but will not be doing TLS.

I have a video on MeshCentral and NGINX here, the video applies to any reverse proxy.