Any reverse proxy

Every proxy works the same way. Terminate TLS wherever you like, proxy to the board's loopback port, and give Ntwine the public origin.

  press R, choose Something else

  Origin  https://whatever-that-proxy-serves

Ntwine checks that a request's Host matches the origin you gave it, so the value has to be the exact origin a browser sees: scheme included, no trailing slash.

CaddyCopy Anchor Link

Caddy needs a two-line Caddyfile and gets its own certificate:

board.example.com {
  reverse_proxy 127.0.0.1:9393
}

What the proxy has to carryCopy Anchor Link

• WebSocket upgrades. The board's terminals are WebSockets. A proxy that doesn't forward Upgrade serves the page and then goes silent.
• Server-sent events, unbuffered. The board's live feed is a stream that never ends, so behind a proxy that buffers responses, the board never updates. In nginx, that's proxy_buffering off.
• The original Host. Ntwine judges the origin from it. A proxy that rewrites it to 127.0.0.1 makes every request look local and skips the access gate.