Serve the Mifos Web App, securely proxy Apache Fineract, connect production domains and enable HTTPS using Nginx and Let's Encrypt certificates.
| Hostname | Type | Value | Purpose |
|---|---|---|---|
| mifos.example.com | A | YOUR_SERVER_IPV4 | Mifos Web App frontend |
| api-mifos.example.com | A | YOUR_SERVER_IPV4 | Apache Fineract API |
Install Nginx from the Ubuntu package repository and enable it during server startup.
sudo apt update
sudo apt install -y nginx
sudo systemctl enable --now nginx
sudo systemctl status nginx --no-pagerBoth the frontend and API domains must resolve to the intended server before requesting certificates.
getent hosts mifos.example.com
getent hosts api-mifos.example.com
dig +short mifos.example.com
dig +short api-mifos.example.comVerify that the compiled frontend exists in the configured Nginx document root.
sudo find /var/www/mifos-web-app -maxdepth 2 -type f | sed -n '1,80p'
sudo test -f /var/www/mifos-web-app/index.html && echo "index.html found"Test the backend directly on the server before placing Nginx in front of it.
curl -k \
https://127.0.0.1:8443/fineract-provider/actuator/healthServe the compiled Angular application and provide fallback routing to index.html.
sudo nano /etc/nginx/sites-available/mifos-web-appProxy the public API domain to Apache Fineract on its private local port.
sudo nano /etc/nginx/sites-available/mifos-apiCreate symbolic links in sites-enabled and remove the default site when it is no longer needed.
sudo ln -sfn \
/etc/nginx/sites-available/mifos-web-app \
/etc/nginx/sites-enabled/mifos-web-app
sudo ln -sfn \
/etc/nginx/sites-available/mifos-api \
/etc/nginx/sites-enabled/mifos-api
sudo rm -f /etc/nginx/sites-enabled/defaultAlways test the configuration before reloading the service.
sudo nginx -t
sudo systemctl reload nginxInstall Certbot and its Nginx integration package.
sudo apt update
sudo apt install -y certbot python3-certbot-nginx
certbot --versionRequest certificates only after both domains resolve correctly and respond through Nginx.
sudo certbot --nginx \
-d mifos.example.com \
-d api-mifos.example.comPerform a dry run to confirm that future certificate renewal can succeed.
sudo certbot renew --dry-run
systemctl list-timers | grep -i certbot || trueTest the frontend, backend and certificate responses after the configuration is complete.
curl -I https://mifos.example.com/
curl -I \
https://api-mifos.example.com/fineract-provider/actuator/health
openssl s_client \
-connect mifos.example.com:443 \
-servername mifos.example.com \
</dev/null 2>/dev/null | \
openssl x509 -noout -subject -issuer -datesserver {
listen 80;
listen [::]:80;
server_name mifos.example.com;
root /var/www/mifos-web-app;
index index.html;
location / {
try_files $uri $uri/ /index.html;
}
location ~* \.(js|css|png|jpg|jpeg|gif|svg|ico|woff|woff2)$ {
expires 7d;
add_header Cache-Control "public";
try_files $uri =404;
}
access_log /var/log/nginx/mifos-web-app.access.log;
error_log /var/log/nginx/mifos-web-app.error.log;
}server {
listen 80;
listen [::]:80;
server_name api-mifos.example.com;
location / {
proxy_pass https://127.0.0.1:8443;
proxy_http_version 1.1;
proxy_set_header Host $host;
proxy_set_header X-Real-IP $remote_addr;
proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
proxy_set_header X-Forwarded-Proto $scheme;
proxy_connect_timeout 60s;
proxy_send_timeout 120s;
proxy_read_timeout 120s;
proxy_ssl_verify off;
}
access_log /var/log/nginx/mifos-api.access.log;
error_log /var/log/nginx/mifos-api.error.log;
}proxy_ssl_verify off only because a locally running Fineract container may use a development certificate. Review and strengthen upstream certificate validation for your production architecture.Confirm Apache Fineract is running, verify the proxy_pass address and review Nginx and Fineract logs.
Check DNS, firewall rules, port 80, proxy services and whether the domain points to another server.
Ensure the frontend location block uses try_files with index.html as the fallback.
Configure the frontend to use the HTTPS Apache Fineract API URL.
Confirm the frontend and API domains, reverse-proxy headers and backend cross-origin configuration.
Inspect the certificate names and rerun Certbot with every required hostname.
MifosX deployment services
MifosX provides Mifos and Apache Fineract domain setup, Nginx configuration, SSL, security hardening, monitoring, backups and production deployment support.