HTTPS Configuration

Run Rapid BI Catalog over HTTPS — terminate TLS in the app, or behind a reverse proxy.

HTTPSTLSReverse proxySecurity

HTTPS is required — Rapid BI Catalog will not start without it. Choose one of two modes: the app terminates TLS itself (Direct HTTPS), or a reverse proxy terminates TLS in front of it (TLS-offload).

A domain with HTTPS must be ready first
A domain served over HTTPS — terminated directly by the app or by a load balancer / reverse proxy — is a prerequisite before you complete setup.

Direct HTTPS

The application terminates TLS itself. Before starting the service, place your certificate and private key (in PEM format) on the server at these paths, then set their permissions to 0600:

Terminal
# place your PEM certificate and private key:
#   ~/.bicatalog/ssl-cert.crt   (certificate)
#   ~/.bicatalog/ssl-key.key    (private key)
chmod 600 ~/.bicatalog/ssl-cert.crt ~/.bicatalog/ssl-key.key

Then start (or restart) the service to enable HTTPS on port 3333:

Terminal
sudo systemctl start bicatalogui.service
The service will not start without TLS
Until the certificate and key are in place (or TLS-offload is enabled below), the service does not start. The installer prints these same paths at the end of installation.

TLS-Offload (Reverse Proxy)

A reverse proxy (nginx, AWS ALB, HAProxy, or Cloudflare) terminates TLS in front of the app. Set the following in ~/.bicatalog/bicatalog.env:

Terminal
BICATALOG_TLS_OFFLOAD=1

Then restart the service to apply the change:

Terminal
sudo systemctl restart bicatalogui.service

The app then serves plain HTTP bound to loopback only (127.0.0.1) and still treats the deployment as HTTPS for all client-facing decisions (Secure cookies, HSTS, and HTTPS CORS origin).

Port 3333 must be reachable only via the proxy
Because the app serves plain HTTP on loopback, you must ensure port 3333 is reachable only through your TLS-terminating proxy.

Accessing Rapid BI Catalog Over HTTPS

Once configured and restarted, users reach Rapid BI Catalog at your HTTPS domain (or, for direct HTTPS):

Terminal
https://<server-host>:3333

Next Steps