DBTrail Documentation

Put the DBTrail console on console.example.com with TLS, covering DNS, certificate, and the Host header rule that returns 403 until you set it.

A browser or MCP client reaches port 443, TLS is terminated by nginx or by the console itself, and the console checks the Host header: localhost, an IP literal or a name in --allowed-hosts passes, anything else gets HTTP 403. Port 8090 stays closed to the network, and a non-loopback console needs a password or --token.

DNS: an A or AAAA record to the host.
Firewall: open 443; keep 8090 closed.
TLS: one of the two shapes below.
Allow the hostname, or every request answers 403.

A credential comes first

A console on a non-loopback address refuses to start without a console password or --token.

TLS

The console terminates TLS

bintrail-console serve --index-dsn '<dsn>' \
  --listen 0.0.0.0:8090 \
  --tls-cert /etc/ssl/console.crt \
  --tls-key  /etc/ssl/console.key \
  --allowed-hosts console.example.com

On watch: --console-tls-cert, --console-tls-key.

A reverse proxy terminates TLS

Console stays on loopback; certificate renewal comes with the proxy.

server {
    listen 443 ssl;
    server_name console.example.com;

    ssl_certificate     /etc/letsencrypt/live/console.example.com/fullchain.pem;
    ssl_certificate_key /etc/letsencrypt/live/console.example.com/privkey.pem;

    location / {
        proxy_pass http://127.0.0.1:8090;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-Proto $scheme;
        # backup and .sql downloads stream as they are built
        proxy_buffering off;
    }
}

The header rule

HTTP 403
{"error": "forbidden: host not allowed"}

A defence, not a misconfiguration: without a Host check, a web page resolving a hostname to 127.0.0.1 could drive your console (DNS rebinding). Allow the name:

--allowed-hosts console.example.com          # serve
--console-allowed-hosts console.example.com  # watch
BINTRAIL_CONSOLE_ALLOWED_HOSTS=console.example.com

Dropping proxy_set_header Host also "works": nginx then sends 127.0.0.1:8090, an IP literal, always allowed. But the real hostname never reaches the console or its logs. Pass Host and list it.

Same flags on bintrail-console and dbtrail-console-ee; no license needed. The MCP endpoint rides the same rule: https://console.example.com/mcp, behind the console credential.

Console on a Hostname

TLS

The console terminates TLS

A reverse proxy terminates TLS

The header rule

On this page