Deployment guide

Generated from saved settings. Save the form to include changes. This guide does not verify that services, DNS or public access are working.

1. What does the domain serve?

The main domain opens the administrator login when remote administration is enabled. Caddy sends the main UI and its API requests to the administration port, and MCP/OAuth routes to the separate gateway port. Both listeners stay on loopback. Remote administration works even while MCP is disabled.

2. How is access protected?

Use the MCP login username and password from each bank profile. MCP clients use the app's OAuth login and consent flow; a generated profile API key is an alternative for clients that support bearer keys. These are separate from your bank login and administrator login.

The Caddy example uses the profile MCP login for MCP routes. If remote administration is enabled, Public HTTPS login lets clients from any address open the administrator login through Caddy. Restricted access optionally limits clients to the configured IPs/networks, enforced by both Caddy and the app. Remote administrator cookies require HTTPS. Initial setup stays local. The administration allowlist does not limit MCP clients. Do not add a second Basic Auth prompt over MCP: it can conflict with bearer authorization. Public HTTPS login needs no office IP, DDNS or VPN. Configure Allowed administration IPs / networks only when selecting Restricted access. If you also restrict MCP clients in Caddy or your perimeter firewall, include every client source; cloud MCP clients may use different addresses.

Trusted reverse proxy IPs identify the proxy server, not allowed visitors. When Caddy uses loopback on this computer, leave that field blank. For this example, bind the gateway to 127.0.0.1, enable it, set your HTTPS public origin, and leave both gateway TLS file fields blank. Caddy obtains and renews the public HTTPS certificate.

3. DNS, ports and startup

1. Point the domain's DNS A record to the Windows server's public IPv4 address. Use an AAAA record only if IPv6 reaches the same proxy.
2. Normally allow inbound TCP 80 and 443 through Windows, the provider firewall and any router forwarding. Keep the gateway and profile backend ports private.
3. Install Caddy as a Windows service with automatic start and persistent, writable certificate storage. Save the example as Caddyfile and run caddy validate --config Caddyfile --adapter caddyfile before starting or reloading it. DNS and certificate issuance must also succeed.
4. Use the installed Repair/restart shortcut after changing listener ports, the bind address, gateway enablement or gateway TLS files. The managed services and profile schedules are installed by the app installer.

Internet-facing file-sharing rules are unrelated to MCP. This guide does not approve or change them. The server administrator should review the exact rules and VPN file-sharing access separately.

Public HTTPS and PostgreSQL TLS protect different connections. If the external database is reached over the internet, configure its TLS separately.

4. Profile endpoints

5. Caddyfile for this computer

Preserves MCP/OAuth paths and disables Caddy response buffering. When remote administration is enabled, the main UI and its API routes use the saved Public or Restricted access choice; administrator login is required in both modes. Other public paths return 404. MCP uses the built-in profile login. The optional IP allowlist applies to administration, not MCP.

Copy Caddyfile

6. Verify the deployment

After restart, check both Banco General services and Caddy. If remote administration is enabled, open the public domain and sign in with your existing administrator account. Public HTTPS login works without a VPN or static office IP. If Restricted access was selected, also check that other addresses are denied. Open an enabled profile's discovery URL from an external MCP client. Discovery should return JSON with your HTTPS domain. A request to the MCP endpoint without credentials should return 401; that is expected. Connect your MCP client, complete the profile login, then test a read-only query. Test notification delivery and external outage monitoring separately.

Copyable server setup handoff

Includes saved domain, ports, access choice, profile endpoints, Caddy configuration, startup and verification instructions in one message. Passwords, bot tokens and API keys are excluded. Copy this into your server setup AI chat.

Copy setup handoff

Reference: Caddy HTTPS · Reverse proxy · IP and path matchers