Skip to Content
InstallationNetwork access

Network access

By default, only the computer that runs NovusLens can open its web interface. To let people on your network sign in, put an HTTPSHTTPSHTTP carried over an encrypted connection, so the contents are protected while travelling between the caller and the server. proxyProxyA service that receives a request and forwards it to another service. The NovusLens web proxy adds the signed-in identity and service token. in front of it and tell setup. Then let only the proxy reach the web port, so no passphrase crosses your network over plain HTTPHTTPHypertext Transfer Protocol: the rules a browser or program uses to send a request to a web service and receive its response..

Choose who opens the web interface

./lens setup asks this question after the web port:

AnswerWho can open itWhat setup saves
this-host (default)This computer only, at http://localhost:<port>Nothing extra. The web port listens on 127.0.0.1.
proxyPeople on your network, through your HTTPS proxyNOVUSLENS_TLS_PROXY=1, and NOVUSLENS_UI_BIND when the address is not 127.0.0.1

The proxy answer asks one more question: the address the web port listens on.

  • Your proxy runs on this computer: keep 127.0.0.1.
  • Your proxy runs on another computer: give this computer’s network address, such as 192.168.1.20.

./lens setup --defaults asks nothing. It keeps the saved answer, or this-host on a first setup. To change your answer later, run ./lens setup --interview.

Set up the proxy

Your proxy receives HTTPS requests from people’s browsers and passes them to NovusLens over plain HTTP.

  1. Point the proxy at the address the deployment screen shows as Proxy target, such as http://192.168.1.20:3111.
  2. When the proxy runs on another computer, use your firewall to let only that computer reach the web port.
  3. Set the X-Forwarded-Proto: https header on every request it passes on.
  4. Set the X-Forwarded-For header to the browser’s address, and replace any value the browser sent. NovusLens limits failed sign-ins per address. A missing or invalid address refuses sign-in.
  5. Open NovusLens at the proxy’s HTTPS address and sign in.

Once a proxy is declared, sign-in needs X-Forwarded-Proto: https, on this computer too. Without it, the login page shows Sign-in requires HTTPS before offering the account and passphrase fields. The sign-in action checks the protocol again before looking up credentials. Keep the web port restricted to the proxy: the server trusts the protocol and client address headers it supplies. The session cookieCookieA small value a browser keeps and sends back to a website. NovusLens uses a signed cookie to remember the signed-in account. is sent over encrypted connections only.

When setup refuses an address

Setup and ./lens check the saved settings before each deployment.

Message starts withCauseFix
NOVUSLENS_UI_BIND <address> would serve sign-in over plain HTTP on the networkA network address is saved without a declared proxy.Run ./lens setup --interview. It shows the problem, then answer proxy, or answer this-host.
NOVUSLENS_UI_BIND '<value>' needs an IPv4 addressThe address is a host name or an IPv6 address.Run ./lens setup --interview and give an IPv4 address, such as 127.0.0.1.

Advanced settings

After the demo and model questions, setup asks whether to review the advanced settings. The default is no, which keeps each saved or default value. Setup settings lists them.

The MCPMCPModel Context Protocol: a standard way for an AI application to discover and call named tools supplied by another program. tools setting reaches only MCP clients on the installation’s own Docker network. It publishes no port on this computer.

Next steps

Last updated
Setup settingsTutorials