Skip to content

AllTalk SSL Proxy System ‐ Technical Guide

Jump to bottom
erew123 edited this page Nov 27, 2024 · 2 revisions

⚠️ Important Notice

This is an advanced feature intended for users who need to expose AllTalk services to the internet with SSL/HTTPS capabilities. If you're running AllTalk locally or don't specifically need HTTPS support, you should use the standard Gradio interface (http://localhost:7852) and API port (7851).

This guide is specifically for:

  • System administrators
  • Users with networking/SSL certificate experience
  • Those requiring HTTPS for production deployments
  • Users needing secure external access to AllTalk services

Not recommended for:

  • Local installations
  • Testing environments
  • Users unfamiliar with SSL certificates & DNS
  • Those without specific HTTPS requirements

Table of Contents

Technical Overview

Implementation Guide

Technical Overview

The AllTalk Proxy System implements a reverse proxy using Twisted, providing SSL termination and port forwarding capabilities for both the Gradio interface and API endpoints. It sits between your AllTalk services and external networks, handling all incoming connections and routing them appropriately.

Architecture

External Request → Proxy (SSL Termination) → Internal Services
- Gradio UI: External Port → 7852
- API: External Port → 7851

Implementation Requirements

System Requirements

  • Understanding of SSL certificates and key management
  • Knowledge of networking and port forwarding
  • Properly configured DNS if using valid SSL certificates
  • Access to modify firewall rules
  • Understanding of HTTP/HTTPS protocols

SSL Certificate Options

Production Deployments

For production use, obtain certificates from trusted Certificate Authorities:

  1. Let's Encrypt (recommended for most users)

    • Free, automated certificates
    • 90-day validity with automatic renewal
    • Requires domain name and DNS configuration

  2. Cloudflare SSL

    • Free with Cloudflare CDN services
    • Includes proxy and DDoS protection
    • Requires domain name management through Cloudflare

  3. Commercial CAs

    • DigiCert, GlobalSign, etc.
    • Extended validation options
    • Wildcard certificate support

Certificate Requirements

  • Valid SSL certificate (.crt/.pem)
  • Private key (.key)
  • Must be from trusted CA for the Gradio interface to work
  • Minimum 2048-bit RSA or equivalent
  • Valid dates and proper CN/SAN fields

Technical Limitations

Gradio Interface

  • Requires valid SSL certificates from trusted CA
  • Self-signed certificates will not work & will cause errors for Gradio
  • No workaround for invalid certificates due to Gradio's security model

API Endpoint

  • Supports both valid and self-signed certificates
  • Can operate in HTTP mode if needed
  • More flexible security options

Advanced Configuration

The proxy system allows separate configuration for API and Gradio endpoints:

  • Independent port selection
  • Individual enable/disable controls

Security Considerations

  • SSL termination happens at proxy level
  • Internal traffic remains unencrypted
  • Certificate private keys must be properly secured
  • Regular certificate rotation recommended
  • Monitor logs for unauthorized access attempts
  • Consider implementing rate limiting
  • Keep system packages updated

Monitoring and Maintenance

  • Basic logging available in system/proxy_module/logs/
  • Debug mode available for troubleshooting
  • Certificate expiration monitoring
  • Connection tracking and metrics
  • Health checks for both endpoints

Additional Resources

Remember: This proxy system is a technical tool for specific use cases. If you're unsure whether you need it, you probably don't. Stick with the standard AllTalk interface for typical usage.

Proxy System Setup Guide

Prerequisites

  • Valid SSL certificates (if using HTTPS)
  • Knowledge of your desired external ports
  • Understanding of proxy/SSL concepts

Initial Setup

  1. Navigate to Global Settings tab in the AllTalk interface

  2. Configure Basic Settings:

    • Enable "Master switch/safety lockout for proxy functionality"
    • Select "Start Proxy Automatically on Startup" if desired
    • Set "External IP" (use 0.0.0.0 to bind to all interfaces)

  3. Configure API Endpoint:

    • Set "API (TTS Generation) Proxy" to "Enabled"
    • Set "API Port" (e.g., 1234)
    • Note: This port must be different from Gradio port

  4. Configure Gradio Endpoint:

    • Set "Gradio Interface Proxy" to "Enabled"
    • Set "Gradio Interface Port" (e.g., 5678)
    • Note: Must be different from API port

Certificate Setup (Optional but recommended)

For Production/Public Access:

  1. Obtain valid SSL certificates from a trusted CA
  2. In the Certificate Management section:
    • Upload your certificate file (.crt/.pem)
    • Upload your private key file (.key)
    • Enter a descriptive name (e.g., "production_cert")
    • Click "Upload Certificate"

Testing without SSL:

  • Skip certificate upload
  • System will operate in HTTP mode
  • Suitable for internal testing only

Starting the Service

  1. Click "Save Configuration" to apply settings

  2. Click "Start Service"

  3. Check "Status" output for:

    [AllTalk PRX] Gradio HTTP Proxy : From 0.0.0.0:444 -> 127.0.0.1:7852 is now active.
[AllTalk PRX] API HTTP Proxy    : From 0.0.0.0:443 -> 127.0.0.1:7851 is now active.

Verifying Operation

  1. Test API Endpoint:

    • Try accessing: http(s)://your-ip:api-port

  2. Test Gradio Interface:

    • Try accessing: http(s)://your-ip:gradio-port
    • Note: HTTPS requires valid CA certificates

Troubleshooting

If status shows errors:

  1. Click "Check Status" for detailed information
  2. Enable debug_proxy in settings
  3. Restart AllTalk to see detailed logs
  4. Check Status/Result box for error messages

Shutting Down

  1. Click "Stop Service"
  2. Wait up to 60 seconds for complete shutdown
  3. Status will show "Proxy Server: Stopped"

Maintenance

To remove certificates:

  1. Click "Delete All Certificates"
  2. System will revert to HTTP mode
  3. Restart proxy service

To update certificates:

  1. Upload new certificates
  2. Keep same certificate name
  3. Restart proxy service

Remember: For production use, always use valid SSL certificates from trusted CAs. Self-signed certificates will cause errors with the Gradio interface.

AllTalk Version 2 Index

Installation

System Requirements

Features
3rd Party Integrations
XTTS Finetuning Guides
API Documentation
Support & Help
Clone this wiki locally