Editing Rocket.Chat (section)

=== SSL termination and proxying ===
By design, Rocket.Chat is not designed to directly terminate SSL connections.  It can if needed, but the intended architecture is to have all the Rocket.Chat instances that form a cluster live behind a reverse proxy/load balancer, which does the termination of the SSL connection once for all the instances.  If security requires the communications between Load Balancer and RocketChat to be encrypted (or if you will only be using one instance of Rocket.Chat), that is when you will set up Rocket.Chat to use SSL.

The Load Balancer/Reverse Proxy doesn't have to be anything complicated -- they provide a simple config for HA-Proxy and NGINX that works very well.  If deploying in kubernetes, using the standard kubernetes service works well, but the standard Ingress doesn't handle the connection well due to the fact that Rocket.Chat requires the use of '''''websockets'''''.  Fortunately the documentation discussed this enough that I figured out what was needed (see below).