Security Configuration Guide

May 31, 2026 · View on GitHub

Overview

This guide covers the security features and best practices for deploying serveMyAPI.

Authentication

Setting up API Authentication

The HTTP/SSE server requires Bearer token authentication. Set the authentication key:

export SERVEAPI_AUTH_KEY="your-secure-api-key-here"

Generate a secure key:

openssl rand -base64 32

Using Authentication

Include the Bearer token in all API requests:

Authorization: Bearer your-secure-api-key-here

HTTPS/TLS Configuration

Using a Reverse Proxy (Recommended)

The recommended approach is to run serveMyAPI behind a reverse proxy like nginx or Caddy that handles TLS termination.

Nginx Configuration

server {
    listen 443 ssl http2;
    server_name api.yourdomain.com;

    ssl_certificate /path/to/cert.pem;
    ssl_certificate_key /path/to/key.pem;
    ssl_protocols TLSv1.2 TLSv1.3;
    ssl_ciphers HIGH:!aNULL:!MD5;

    location / {
        proxy_pass http://localhost:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;
        proxy_cache_bypass $http_upgrade;
    }
}

Caddy Configuration

api.yourdomain.com {
    reverse_proxy localhost:3000
}

Direct TLS Support (Alternative)

For direct TLS support, create a wrapper script:

// https-server.js
import https from 'https';
import fs from 'fs';
import app from './dist/server.js';

const options = {
  key: fs.readFileSync('private-key.pem'),
  cert: fs.readFileSync('certificate.pem')
};

https.createServer(options, app).listen(443, () => {
  console.log('HTTPS Server running on port 443');
});

Docker Security

Environment Variables

When running in Docker, set these required environment variables:

# Required for encryption
ENCRYPTION_KEY="your-encryption-key-here"

# Required for authentication
SERVEAPI_AUTH_KEY="your-api-key-here"

# Optional: Allowed CORS origins
ALLOWED_ORIGINS="https://app1.com,https://app2.com"

Docker Run Example

docker run -d \
  --name servemyapi \
  -p 3000:3000 \
  -e ENCRYPTION_KEY="$(openssl rand -base64 32)" \
  -e SERVEAPI_AUTH_KEY="$(openssl rand -base64 32)" \
  -e NODE_ENV=production \
  -v servemyapi-data:/app/data \
  --user apiuser \
  servemyapi:latest

Docker Compose Example

version: '3.8'
services:
  servemyapi:
    image: servemyapi:latest
    environment:
      - ENCRYPTION_KEY=${ENCRYPTION_KEY}
      - SERVEAPI_AUTH_KEY=${SERVEAPI_AUTH_KEY}
      - NODE_ENV=production
      - ALLOWED_ORIGINS=https://myapp.com
    volumes:
      - servemyapi-data:/app/data
    ports:
      - "3000:3000"
    user: apiuser
    restart: unless-stopped

volumes:
  servemyapi-data: