TLS and reverse proxy
HTTP TLS (control plane / runtime)
If VION_ALLOW_INSECURE_HTTP is off, both processes require VION_TLS_CERT and VION_TLS_KEY. Do not commit those files.
gRPC TLS / mTLS
| Side | Variables |
|---|---|
| Runtime server TLS | VION_GRPC_TLS_CERT + VION_GRPC_TLS_KEY |
| Runtime mTLS (require client) | + VION_GRPC_TLS_CLIENT_CA |
| Control plane client TLS | VION_RUNTIME_GRPC_TLS_CA |
| Control plane mTLS client cert | VION_RUNTIME_GRPC_TLS_CERT + VION_RUNTIME_GRPC_TLS_KEY |
| App token | same VION_RUNTIME_APP_TOKEN on both → metadata x-vion-app-token |
| Keepalive | VION_GRPC_KEEPALIVE_SECS (>0) |
Local development may leave TLS/token unset (plaintext).
Reverse proxy
Set VION_TRUST_PROXY=true only behind a proxy you control: lastLoginIp uses the first X-Forwarded-For entry. Otherwise the socket peer is used.
VION_CORS_ORIGIN restricts the browser origin (default http://127.0.0.1:5173).
WARNING
Runtime gRPC (50051) may be unauthenticated in Phase 1. Do not publish that port beyond the machine; use app token + TLS in production.