🛰️ Deploy Flask API on Local Server with Public DNS and TLS

[rhythmatician]

Priority: High (needed for Excel Power Query + Entra auth integration)
Goal: Make https://api.jgiquality.com publicly accessible and route traffic to our local Flask API.

---

🧩 Background

We're building a Flask API (core-api) that will be accessed from Excel via Power Query using organizational Microsoft (Entra ID) authentication. Entra requires a publicly accessible and TLS-secured URL that matches the Application ID URI:

api://jgiquality.com/core-api

---

✅ Tasks

• Set up port forwarding from our router:

  • External port 443 → internal server running Flask

• In Wix DNS manager, add an A record:

  Type: A
  Host: api
  Points to: [our public IP]
  

• Use Let’s Encrypt (e.g., win-acme on Windows) to generate a TLS cert for api.jgiquality.com

• Set up reverse proxy (Nginx or IIS):

  • Accepts HTTPS on port 443
  • Forwards requests to Flask at localhost:5000

• Ensure the URL https://api.jgiquality.com/whoami routes to the Flask test route successfully

• Bonus: Set up auto-renewal for the TLS cert

---

🛠️ Notes

• The Flask app will enforce Entra ID token validation.
• Excel users will access the API using "Organizational Account" auth.
• TLS is mandatory for Entra auth and Power Query compatibility.

---

Let me know once the reverse proxy is live — I’ll test it using a Power Query connection.

[rhythmatician]

We used NGINX as a secure reverse proxy and are hosting the Flask API on the QualerCalSync VM within JGI-HV-11 (our internal server). NGINX listens on port 443 and forwards requests from https://api.jgiquality.com to the Flask application running on localhost:5000.

We configured Task Scheduler to automatically launch the Flask API service on system boot via a script (run_api.bat) located at:

C:\Users\Jeff\Desktop\core-api\run_api.bat

NGINX terminates TLS using a Let's Encrypt certificate for api.jgiquality.com, and all traffic is routed securely over HTTPS. This setup allows Entra ID (Microsoft 365) authentication to succeed when accessing the API from Excel via Power Query.