Networking

Sim has three traffic patterns that trip up default proxy configurations: long-lived websockets, server-sent event streams, and large uploads. Most "it works locally but not in production" reports come from one of the three.

Topology

Two services need to be reachable. You can put them on one hostname or two.

sim.yourdomain.com/           → app:3000
sim.yourdomain.com/socket.io  → realtime:3002

sim.yourdomain.com     → app:3000
sim-ws.yourdomain.com  → realtime:3002

app:
  env:
    NEXT_PUBLIC_APP_URL: "https://sim.yourdomain.com"
    BETTER_AUTH_URL: "https://sim.yourdomain.com"
    NEXT_PUBLIC_SOCKET_URL: "https://sim-ws.yourdomain.com"

realtime:
  env:
    ALLOWED_ORIGINS: "https://sim.yourdomain.com"

Second ingress and copilot routing

The chart renders a second, independent Ingress from ingressInternal — its own class, hosts, TLS secret, and rules. Use it to publish the same Deployments on an internal-only hostname alongside the public one.

ingressInternal:
  enabled: true
  className: nginx-internal
  app:
    host: sim.internal.example.com
    paths:
      - path: /
        pathType: Prefix
  realtime:
    host: sim.internal.example.com
    paths:
      - path: /socket.io
        pathType: Prefix
  tls:
    enabled: true
    secretName: sim-internal-tls

When realtime.host equals app.host, the realtime paths are folded into the app host's rule ahead of the catch-all — which is why /socket.io must come first. Give realtime a different host and it gets a rule of its own.

Both ingress and ingressInternal accept an optional copilot block, commented out in values.yaml because the copilot service is off by default. It follows the same host-sharing rule:

# The route renders only when the service itself is enabled.
copilot:
  enabled: true

ingress:
  copilot:
    host: sim.yourdomain.com
    paths:
      - path: /copilot
        pathType: Prefix

Reverse proxy configuration

sim.yourdomain.com {
    request_body {
        max_size 250MB
    }

    handle /socket.io/* {
        reverse_proxy localhost:3002
    }

    reverse_proxy localhost:3000 {
        flush_interval -1
    }
}

server {
    listen 443 ssl http2;
    server_name sim.yourdomain.com;

    # Large file uploads (chat attachments can reach ~220 MB)
    client_max_body_size 250M;

    location / {
        proxy_pass http://127.0.0.1:3000;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection 'upgrade';
        proxy_set_header Host $host;
        proxy_set_header X-Real-IP $remote_addr;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        # Streamed responses must not be buffered
        proxy_buffering off;
        proxy_cache off;

        # Long-running workflow executions
        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }

    location /socket.io/ {
        proxy_pass http://127.0.0.1:3002;
        proxy_http_version 1.1;
        proxy_set_header Upgrade $http_upgrade;
        proxy_set_header Connection "upgrade";
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto $scheme;

        proxy_read_timeout 3600s;
        proxy_send_timeout 3600s;
    }
}

ingress:
  annotations:
    nginx.ingress.kubernetes.io/proxy-body-size: "250m"
    nginx.ingress.kubernetes.io/proxy-read-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-send-timeout: "3600"
    nginx.ingress.kubernetes.io/proxy-buffering: "off"

ingress:
  className: traefik
  annotations:
    traefik.ingress.kubernetes.io/router.entrypoints: websecure
    traefik.ingress.kubernetes.io/router.tls: "true"

entryPoints:
  websecure:
    address: ":443"
    transport:
      respondingTimeouts:
        readTimeout: 3600s
        idleTimeout: 3600s

Cloud load balancers

GKE (GCE ingress)

apiVersion: cloud.google.com/v1
kind: BackendConfig
metadata:
  name: sim-realtime-backendconfig
  namespace: simstudio
spec:
  timeoutSec: 3600
  connectionDraining:
    drainingTimeoutSec: 60

Then annotate the realtime Service so the load balancer picks it up. The chart renders no annotations on any Service, and realtime.service accepts only type, port, and targetPort — an annotations key there is silently dropped. Annotate the Service directly:

kubectl annotate service -n <namespace> \
  -l app.kubernetes.io/instance=<release>,app.kubernetes.io/component=realtime \
  cloud.google.com/backend-config='{"default": "sim-realtime-backendconfig"}'

Re-apply it after any helm upgrade that recreates the Service, or manage the annotation with a kustomize patch so it survives.

TLS on GKE typically uses a ManagedCertificate, which the chart references by annotation but does not create — create it yourself before the first deploy:

apiVersion: networking.gke.io/v1
kind: ManagedCertificate
metadata:
  name: simstudio-ssl-cert
  namespace: simstudio
spec:
  domains:
    - sim.yourdomain.com
    - sim-ws.yourdomain.com

ingress:
  className: gce
  annotations:
    kubernetes.io/ingress.global-static-ip-name: "sim-ip"
    networking.gke.io/managed-certificates: "simstudio-ssl-cert"
    kubernetes.io/ingress.allow-http: "false"
  # TLS comes from the ManagedCertificate — leaving the chart's secret-based
  # TLS on makes the ingress reference a Secret that does not exist.
  tls:
    enabled: false

The certificate provisions once DNS resolves, typically 15–30 minutes after the first deploy.

AWS (ALB ingress)

ingress:
  className: alb
  annotations:
    alb.ingress.kubernetes.io/scheme: internet-facing
    alb.ingress.kubernetes.io/target-type: ip
    alb.ingress.kubernetes.io/listen-ports: '[{"HTTPS":443}]'
    alb.ingress.kubernetes.io/certificate-arn: "arn:aws:acm:..."
    alb.ingress.kubernetes.io/load-balancer-attributes: idle_timeout.timeout_seconds=3600

The ALB's default 60-second idle timeout also closes websockets. Raise it as shown.

Azure (Application Gateway / NGINX)

Application Gateway's default request timeout is 30 seconds; raise it in the backend HTTP setting. Many AKS deployments use ingress-nginx instead — see the Nginx tab above.

Request size limits

Sim enforces its own limits in addition to whatever your proxy allows. The proxy limit must be at least as large as the app limit, or the proxy rejects the request before Sim ever sees it.

A proxy body limit of 250 MB accommodates all three defaults. If you lower the app limits, you can lower the proxy limit to match.

Outbound connectivity

The app makes outbound calls to model providers, integration APIs, your email provider, object storage, and your telemetry backend. Whether HTTP_PROXY / HTTPS_PROXY apply depends on which of those paths a call takes — there is no single answer, and no global setting that covers all of them.

The server runs on Bun, and Bun's native fetch honors $HTTP_PROXY, $HTTPS_PROXY, and $NO_PROXY. Sim installs no global dispatcher, so every call that goes through the default fetch is proxied. The rest either build their own HTTP agent or speak a non-HTTP protocol.

The practical consequence: a mandatory-egress-proxy environment can route most LLM traffic, Resend mail, and Azure/GCS storage through the proxy, but guarded integration calls, S3, Bedrock, SMTP, telemetry, and datastore traffic still need a transparent proxy or NAT-based egress.

# Helm — for a release named `acme`
app:
  env:
    NO_PROXY: "localhost,127.0.0.1,.svc,.svc.cluster.local,acme-sim-app,acme-sim-realtime,acme-sim-pii,acme-sim-ollama"

# Docker Compose
services:
  simstudio:
    environment:
      # Add any internal model service you run: ollama, litellm, vllm.
      - NO_PROXY=localhost,127.0.0.1,simstudio,realtime,ollama

The per-request escape hatch

The HTTP block's proxyUrl is honored per request by the SSRF guard, which builds a proxy agent for that call instead of pinning the target IP. It applies only to that path — connectors, content fetches, and MCP calls take a different guarded transport with no per-request proxy option.