Securing the JAMS Web Client Installation
The JAMS Web Client is a multi-service application consisting of six ASP.NET Core services. The Gateway, Identity, API, UI, JAMS MCP, and JAX are installed together on a single Windows machine and communicate with each other internally. In a production environment, these services must be secured prior to deployment to production so that browsers, API clients, and AI agents can reach them securely.
Recommended Deployment Models
Direct exposure of the JAMS Gateway to the internet without a front-end layer is not recommended.
The front-end layer is responsible for:
- Public TLS termination - serving a publicly CA-trusted certificate to browsers and API clients so connections are secure and warning-free.
- Forwarding traffic to the JAMS Gateway - all six JAMS services are accessed through the Gateway; the front-end layer only needs one backend target.
- Health monitoring - the front-end layer probes /api/system/health to detect and route around unhealthy instances.
The choice of front-end layer depends on your infrastructure. Common configurations include:
- AWS - Application Load Balancer (ALB) in front of an EC2 instance.
- Azure - Application Gateway in front of an Azure VM.
- On-premises or any cloud - nginx, IIS, Apache, HAProxy, or any other reverse proxy in front of the Windows host.
The configuration steps for JAMS are the same regardless of which front-end layer is used, and only the infrastructure setup differs.