Address

This step fixes the one address the whole product uses. Sign-in, the Power BI connection and every agent send people back to it, and the cookies that keep people signed in travel over https only.

Before you start

The stack runs (see the quickstart).
You have a name for it, such as metrics.example.com, and a way to serve it over https. The Deploy part has one guide per target.

Steps

Decide the address people will type, with https:// and no path. In this guide it is https://metrics.example.com.
Set it in the deployment’s .env. pbmb init --public-base-url wrote it the first time; edit the line if it is wrong:
```
PUBLIC_BASE_URL=https://metrics.example.com
```
Put a reverse proxy in front of the api that ends https. The stack publishes the api on 127.0.0.1 only (port 3000, or PBMB_PORT). The proxy must:
- pass the Host header unchanged, so the host the api sees is the host in PUBLIC_BASE_URL;
- add the client’s address in X-Forwarded-For;
- be named in TRUSTED_PROXY in .env (its address, or a range holding it), or every sign-in attempt counts against the proxy’s own address.
With Caddy the whole proxy is:
```
metrics.example.com {
    reverse_proxy 127.0.0.1:3000
}
```
Source: Caddy’s reverse_proxy directive, which sets X-Forwarded-For and leaves the Host header as the client sent it when the upstream is plain http.
Restart the stack so the api reads .env:
Terminal window
```
docker compose up -d
```
Print a setup link and open it. It works once, for 24 hours, and printing a new one ends every earlier link and any open setup session:
Terminal window
```
docker compose exec api server setup-link
```
On Dokploy, Coolify, Railway or Azure Container Apps, run server setup-link in the api service with that platform’s shell. Each deploy guide shows where.
Step 1 shows This page’s address. Check that it is the address in step 2, then press Check the address.

Plain http works only in development and test. In production the check fails, because the cookies are always Secure.

Check

Press Check the address. It passes when the api is served over https and the page was opened at the host in PUBLIC_BASE_URL. You can run the same check later:

pbmb admin check address

If it fails, find the sentence on When a check fails and make the one change it names.

Next: The app registration.