External Hyperstream (HS) Launch — DNS, Certificates, Load Balancer, and FQDN Updates
External Hyperstream (HS) Launch — DNS, Certificates, Load Balancer, and FQDN Updates
This page is a child of the Deployment Guide and provides end‑to‑end steps to enable External HS‑Hyperstream launching. It complements the pages: Prerequisites, https://apportoteam.atlassian.net/wiki/spaces/PUB/pages/1368817686, and Running the on-prem cluster install wizard.
- 1 External Hyperstream (HS) Launch — DNS, Certificates, Load Balancer, and FQDN Updates
Overview
To allow external client endpoints to launch Hyperstream sessions through your network perimeter, you must configure public DNS, TLS certificates, a perimeter load balancer or gateway (and optional HA), and verify/update Hyperstream FQDNs post‑install.
Step 1 — Create External DNS A record
Step 2 — Obtain and prepare a third‑party wildcard certificate
Step 3 — Update the load balancer (NAT, SSL termination, backends, VIP/HA)
Step 4 — Update Hyperstream FQDN in Apporto (Resource Hub and HS node)
Step 1 — Create an External DNS A Record
Create a public DNS A record pointing to your external, internet‑reachable IP (often a NAT IP). Use your preferred DNS provider (e.g., Cloudflare, Route53, GoDaddy).
Choose the host name to match your external HS URL, for example:
hs.example.com.Map the A record to your external public IP (e.g.,
50.50.50.50).If using a provider with proxy/CDN features, ensure end‑to‑end TLS and WebSockets are supported for HS traffic (disable proxy if it interferes with WebSockets).
Step 2 — Obtain and Prepare a Third‑Party Wildcard Certificate
Acquire a trusted wildcard certificate that covers your HS hostname (e.g., *.example.com) from a public CA such as Sectigo or Let’s Encrypt. You will install this on your perimeter load balancer or gateway.
Certificate must include: server certificate, any intermediate CA certificates, and the private key.
Key size: 2048‑bit or stronger. Use modern TLS ciphers on the LB/gateway.
SAN should include the exact HS FQDN (most wildcard certs already match).
If using HAProxy, create a single PEM file containing the full chain and key in this order:
server.crt(leaf)intermediate.crt(one or more)server.key(private key)
https://apportoteam.atlassian.net/wiki/spaces/PUB/pages/1368817686
Step 3 — Update the Load Balancer
Terminate HTTPS on your perimeter device and forward HS traffic to the internal HS/gateway endpoints. Ensure WebSockets are supported end‑to‑end.
3.1 Public NAT and Port Mapping
Create a DNAT rule mapping external 443 to your internal LB/gateway VIP or node.
Example mapping:
50.50.50.50:443 → 10.200.0.70:443.Allow inbound TCP/443 from the internet and health probes from your monitoring sources.
3.2 HAProxy reference configuration
The following is a minimal pattern. Adjust IPs, health checks, ciphers, and timeouts per your standards.
global
log /dev/log local0
maxconn 5000
tune.ssl.default-dh-param 2048
defaults
log global
mode tcp
option tcplog
timeout connect 10s
timeout client 90s
timeout server 90s
# HTTPS listener (terminate TLS and forward to HS/gateway over TLS or TCP)
frontend fe_https_hs
bind *:443 ssl crt /etc/haproxy/certs/hs-example-com.pem alpn h2,http/1.1
mode http
option forwardfor
http-response set-header Strict-Transport-Security "max-age=15552000; includeSubDomains"
default_backend be_hs_nodes
backend be_hs_nodes
mode http
option httpchk GET /health
http-check expect status 200
balance roundrobin
server hs-node-1 10.200.0.101:30443 check ssl verify none
server hs-node-2 10.200.0.102:30443 check ssl verify none
# If you use the Apporto Secure Gateway, point to gateway nodes on 443 instead of 30443If your internal HS/gateway expects TLS, use ssl verify none during initial setup only. Replace with CA verification in production.
3.3 High availability (keepalived VIP)
For active/standby HAProxy VMs, configure a VRRP virtual IP (VIP) so the internal target is stable. Health checks should trigger failover.
vrrp_instance VI_1 {
state MASTER
interface ens160
virtual_router_id 51
priority 150
advert_int 1
authentication {
auth_type PASS
auth_pass change_me
}
virtual_ipaddress {
10.200.0.70/24 dev ens160
}
}Step 4 — Update Hyperstream FQDN in Apporto
After completing the On‑Prem OVA cluster installation, verify and, if needed, update the external FQDN to match the DNS record created in Step 1.
Open Apporto Admin Portal → Resource Hub.
Locate the Hyperstream component and the Secure Gateway (if used).
Set the Hyperstream External URL/FQDN to your public hostname (e.g.,
https://hs.example.com).If using an Apporto Secure Gateway, set its public FQDN similarly and ensure the LB routes are correct.
Save changes and validate connectivity.
Do not modify the “Secret” value shown for Hyperstream or related resources unless explicitly instructed by Apporto.
Validation
Launch a Hyperstream session from an external client and confirm the browser URL is your external FQDN.
Verify TLS padlock is valid (issued by your chosen CA, matches hostname, full chain).
Confirm session stability (WebSocket upgrades succeed; no mixed‑content or certificate warnings).
Troubleshooting
Change Log
Initial publication: May 21, 2026