Normally TLS for HTTP requests is terminated on built in reverse proxy, but if application needs to be scaled over multiple hosts, this can be changed. 

To use external proxy and balance requests between nodes, issue the following commands. 

For Authentication Server service (NtkAS):

$ ntk cfg setc nas.external_proxy on 
$ ntk redis start
$ ntk cfg set :nas.redis_url redis://
$ ntk as restart

Replace the ip address with your node address that will be running Redis accelerator. It is recommended to use VRRP service to configure Redis accelerator service high availability.  See this tech note.

For SSO service (NtkSSO): 

$ ntk cfg setc sso.external_proxy on 
$ ntk sso restart

Commands need to be executed on every node that will take part in external load balancer backend pool.

Services expect that the real remote IP address will be provided in X-Real-IP HTTP header. This is relevant if you are using different security policies depending on user location in network. 

After reconfiguration NtkAS service will be exposed on tcp/5000 on node, service NtkSSO will be on 

tcp/7000. These endpoints have to be added to external load balancer pool. Use "ntk net eth0 address" to discover the internal node IP address. 

If management port setting is non-default and dual instance mode is active (:nas.dual_instance_mode = on), management interface will also be exposed on tcp/6000, but additional protection should be used to protect this service, if exposing administrative interface publicly. Otherwise you can use built-in proxy service to access management directly on internal node IP address. You can configure VRRP service to use single internal IP address for all nodes. See documentation for more details. 

See below for configuration examples of common load balancing solutions. 

HAProxy configuration for a NtkAS service

backend notakey-backend
        mode http
        balance roundrobin
        option forwardfor
        option httpchk
        http-request set-header X-Forwarded-Port %[dst_port]
        http-request set-header X-Real-IP %[src_addr]
        http-request add-header X-Forwarded-Proto https if { ssl_fc }
        server node01 check
        server node02 check
        server node03 check

Nginx configuration for a NtkAS service

http {
    include    conf/mime.types;
    index    index.html index.htm index.php;
    access_log   logs/access.log  main;
    sendfile     on;
    tcp_nopush   on;
    server_names_hash_bucket_size 128; # this seems to be required for some vhosts

    upstream ntkservers { 
        # Nginx open source monitors backends by analyzing requests
        # If request times out, backend is marked as unavailable
        # This may lead to unintended failures during appliance updates 

    ; Nginx Plus config
    match server_ok {
        status 200;

    server {
        listen 443 ssl http2;
        root /app/public;

        ssl_certificate /etc/nginx/ssl/ntkchain.pem;
        ssl_certificate_key /etc/nginx/ssl/ntk.key;
        ssl_session_timeout 1d;
        ssl_session_cache shared:MySSL:10m;
        ssl_session_tickets off;
        ssl_protocols TLSv1.3;
        ssl_prefer_server_ciphers off;

        location / {
            proxy_set_header Host $host;
            proxy_set_header X-Real-IP $remote_addr;
            proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
            proxy_set_header X-Forwarded-Proto https;
            proxy_set_header X-Forwarded-Port $server_port;

            client_max_body_size    10m;
            client_body_buffer_size 128k;

            proxy_connect_timeout   10;
            proxy_send_timeout      90;
            proxy_read_timeout      90;
            proxy_buffers           32 4k;

            proxy_redirect off;
            proxy_pass http://ntkservers;
            # Nginx Plus config
            health_check interval=10 uri=/api/health match=server_ok;