Deployment
HTTPS, a service, a public URL.

01Where these run

On the Linux server. Windows: connect with ssh from PowerShell, or use WSL / Git Bash; a Windows desktop behind a home router has no public https address and cannot receive the tool calls.

02HTTPS with Caddy (simplest)

answerbell.your-agency.com {
    reverse_proxy 127.0.0.1:8080
}

In .env set TRUST_PROXY=1, HOST=127.0.0.1 and PUBLIC_URL=https://answerbell.your-agency.com (or set the URL in the console under Voice agent).

TRUST_PROXY_HOPS is the number of proxies in front of Answerbell (1 for Caddy or nginx alone, 2 with Cloudflare in front of Caddy). A wrong value only weakens the per-address rate limits; it never opens access.

03nginx

server {
    server_name answerbell.your-agency.com;
    listen 443 ssl;   # certificates from certbot
    location / {
        proxy_pass http://127.0.0.1:8080;
        proxy_set_header Host $host;
        proxy_set_header X-Forwarded-For $proxy_add_x_forwarded_for;
        proxy_set_header X-Forwarded-Proto https;
    }
}

04Run as a service (systemd)

# /etc/systemd/system/answerbell.service
[Unit]
Description=Answerbell
After=network.target

[Service]
WorkingDirectory=/opt/answerbell
ExecStart=/usr/bin/node dist/src/index.js
Restart=always
User=answerbell
Environment=NODE_ENV=production

[Install]
WantedBy=multi-user.target

sudo useradd --system --home /opt/answerbell --shell /usr/sbin/nologin answerbell
sudo chown -R answerbell /opt/answerbell
sudo systemctl daemon-reload
sudo systemctl enable --now answerbell
journalctl -u answerbell -f      # the log, including the setup code on first start

Check the Node.js path with which node; if it is not /usr/bin/node, put the real path in ExecStart.

05Check it is reachable

curl https://answerbell.your-agency.com/healthz
# {"ok":true}
curl -X POST https://answerbell.your-agency.com/tools/x/business_info
# 404 JSON {"ok":false,"error":"not_found"}: the tools route answers

Then open Status in the console: Public URL is https must be green.