# Production gateway

Serve your production domains through Ceryx with HTTPS everywhere and redirects.

This guide covers the settings most production setups want, once Ceryx is [deployed](/docs/deploy) and serving your domains.

## Enforce HTTPS everywhere

Make every new route redirect plain HTTP to HTTPS by setting this environment variable when running `docker compose up -d`:

```bash
CERYX_ROUTE_SETTINGS_DEFAULT_ENFORCE_HTTPS=true
```

The default applies when a route is created and is stored with it. Update routes that already exist with their `enforce_https` [setting](/docs/route-settings).

## Redirect www to your main domain

A route in `redirect` mode sends visitors to its target with a permanent (`301`) redirect, keeping the path and query string:

```bash
docker compose -p ceryx exec ceryx curl -X POST localhost:8080/api/routes \
  -H 'Content-Type: application/json' \
  -d '{
    "source": "www.example.com",
    "target": "https://example.com",
    "settings": {"mode": "redirect", "enforce_https": true}
  }'
```

Now `https://www.example.com/pricing?plan=team` redirects to `https://example.com/pricing?plan=team`. The same pattern moves an old domain to a new one.

## HTTP/2 and WebSockets

Both work without any settings. Ceryx serves HTTPS over HTTP/2 when clients support it, and passes WebSocket upgrades through to your services.

## Headers your services receive

Ceryx forwards the original `Host` header, and adds:

| Header | Value |
| --- | --- |
| `X-Forwarded-For` | The client's address, appended to any value the client sent. |
| `X-Real-IP` | The address of the client connecting to Ceryx. |
| `X-Forwarded-Proto` | `http` or `https`, as the client connected. |

Only trust these headers from Ceryx: keep your services off public ports, so every request reaches them through Ceryx.

## Large uploads

Ceryx accepts request bodies of up to 100 MB and answers `413` above that. Raise or lower the limit with `CERYX_MAX_REQUEST_BODY_SIZE`, for example `CERYX_MAX_REQUEST_BODY_SIZE=1g`.

## Before you go live

- Keep the API private. See [Exposing the API safely](/docs/api#exposing-the-api-safely).
- Test new domains against the Let's Encrypt staging environment first, to avoid hitting rate limits. See [How certificates work](/docs/concepts/certificates#lets-encrypt).